joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d3570
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push 0xffffffffffffffff
push 0x66be70
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x70903c]
xor eax, esp
mov dword [esp + 0x5c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x70903c]
xor eax, esp
push eax
lea eax, [esp + 0x74]
mov dword fs:[0], eax
mov edx, dword [esp + 0x84]
mov eax, dword [edx]
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x14], edx
mov ebp, 4
jle 0x5d374b
mov dword [esp + 0x18], eax
jmp 0x5d35d8
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
mov eax, dword [edx + ebp]
add ebp, 4
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], ebp
cmp dword [ecx + 0x3c74], ebx
je 0x5d3612
mov eax, dword [ecx + 0x3c7c]
mov dword [esp + 0x20], eax
cmp eax, ebx
je 0x5d3608
mov ecx, dword [eax]
mov dword [esp + 0x24], ecx
lea eax, [esp + 0x20]
jmp 0x5d361e
mov dword [esp + 0x24], ebx
lea eax, [esp + 0x20]
jmp 0x5d361e
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
lea eax, [esp + 0x30]
mov esi, dword [eax + 4]
mov edi, dword [eax]
cmp esi, ebx
je 0x5d3740
jmp 0x5d3630
push 0xffffffffffffffff
lea eax, [esi + 4]
push ebx
push eax
lea ecx, [esp + 0x44]
mov dword [esp + 0x5c], 0xf
mov dword [esp + 0x58], ebx
mov byte [esp + 0x48], bl
call fcn.00417560
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x58]
push eax
mov dword [esp + 0x84], ebx
call fcn.004f9580
add esp, 8
cmp dword [esp + 0x50], 0x10
mov byte [esp + 0x7c], 2
jb 0x5d3682
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.00613a18
add esp, 4
cmp dword [esp + 0x6c], 0x10
mov eax, dword [esp + 0x58]
mov dword [esp + 0x50], 0xf
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
jae 0x5d36a1
lea eax, [esp + 0x58]
mov edx, dword [esp + 0x68]
add edx, eax
xor ecx, ecx
cmp eax, edx
jae 0x5d36c4
lea ecx, [ecx]
movzx ebp, byte [eax]
imul ecx, ecx, 0x1000193
inc eax
xor ecx, ebp
cmp eax, edx
jb 0x5d36b0
mov ebp, dword [esp + 0x2c]
cmp dword [esp + 0x1c], ecx
je 0x5d370c
cmp dword [esp + 0x6c], 0x10
mov dword [esp + 0x7c], 0xffffffff
jb 0x5d36e6
mov eax, dword [esp + 0x58]
push eax
call fcn.00613a18
add esp, 4
mov eax, dword [esi]
cmp eax, ebx
jne 0x5d36fa
lea esp, [esp]
mov eax, dword [edi + 4]
add edi, 4
cmp eax, ebx
je 0x5d36f0
mov esi, edi
sub esi, eax
neg esi
sbb esi, esi
and esi, eax
jne 0x5d3630
jmp 0x5d3740
mov ecx, dword [esi + 0x20]
call fcn.005d4620
mov ecx, dword [esp + 0x14]
add ecx, ebp
push ecx
mov ecx, eax
call fcn.005daa70
add ebp, eax
cmp dword [esp + 0x6c], 0x10
mov dword [esp + 0x7c], 0xffffffff
jb 0x5d3740
mov edx, dword [esp + 0x58]
push edx
call fcn.00613a18
add esp, 4
sub dword [esp + 0x18], 1
jne 0x5d35d0
mov ecx, dword [esp + 0x74]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.00613e6e
add esp, 0x6c
ret 4
Function at 0x5d3b40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, ecx
mov ecx, dword [ebx + 4]
add ecx, 4
cmp dword [ecx + 0x18], 0x10
push edi
jb 0x5d3b5a
mov eax, dword [ecx + 4]
jmp 0x5d3b5d
lea eax, [ecx + 4]
mov ecx, dword [ecx + 0x14]
add ecx, eax
xor edi, edi
cmp eax, ecx
jae 0x5d3b80
jmp 0x5d3b70
movzx edx, byte [eax]
imul edi, edi, 0x1000193
inc eax
xor edi, edx
cmp eax, ecx
jb 0x5d3b70
cmp dword [esi], 0
je 0x5d3b93
mov eax, dword [esp + 0x18]
push eax
mov ecx, esi
call fcn.005d3af0
jmp 0x5d3bc3
mov ecx, dword [esp + 0x18]
push ecx
mov ecx, esi
call fcn.005d2b60
cmp dword [esi + 4], eax
lea ecx, [esi + 4]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
jb 0x5d3bb1
mov eax, ecx
mov edx, dword [eax]
mov dword [ecx], edx
mov ecx, esi
call fcn.005d55f0
mov ecx, esi
call fcn.005d2a20
mov eax, edi
xor edx, edx
div dword [esi + 4]
mov eax, dword [esi]
pop edi
lea ecx, [eax + edx*4]
mov edx, dword [ebx + 4]
mov dword [ebx + 4], 0
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [esp + 0xc]
mov dword [ecx], edx
inc dword [esi + 0x10]
mov dword [esi + 0x18], ecx
pop esi
mov dword [eax], ecx
mov dword [eax + 4], edx
pop ebx
ret 0xc

Function at 0x5d3c00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push 0xffffffffffffffff
push 0x66bed8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x70903c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [esp + 0x34]
cmp dword [ebx + 0x18], 0x10
jb 0x5d3c38
mov eax, dword [ebx + 4]
jmp 0x5d3c3b
lea eax, [ebx + 4]
mov ecx, dword [ebx + 0x14]
add ecx, eax
xor ebp, ebp
cmp eax, ecx
jae 0x5d3c56
movzx edx, byte [eax]
imul ebp, ebp, 0x1000193
inc eax
xor ebp, edx
cmp eax, ecx
jb 0x5d3c46
xor edx, edx
mov eax, ebp
div dword [esi + 4]
mov eax, dword [esi]
push ebx
mov ecx, esi
lea edi, [eax + edx*4]
push edi
call fcn.005d2c50
mov ecx, eax
xor eax, eax
cmp ecx, eax
je 0x5d3c80
mov eax, dword [esp + 0x30]
mov dword [eax + 4], ecx
mov byte [eax + 8], 0
jmp 0x5d3cf3
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], 0
mov byte [esp + 0x1d], 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], eax
call fcn.005d2df0
mov ecx, dword [esp + 0x38]
mov ebx, dword [esp + 0x18]
push ecx
lea edx, [ebx + 4]
push edx
push 0
call fcn.005d2e60
mov eax, dword [esi + 0x10]
add esp, 0xc
inc eax
push eax
mov ecx, esi
mov byte [esp + 0x21], 1
call fcn.005d3af0
test al, al
je 0x5d3cd7
mov eax, ebp
xor edx, edx
div dword [esi + 4]
mov ecx, dword [esi]
lea edi, [ecx + edx*4]
mov edx, dword [edi]
mov dword [ebx], edx
mov dword [edi], ebx
inc dword [esi + 0x10]
cmp edi, dword [esi + 0x18]
jae 0x5d3ce8
mov dword [esi + 0x18], edi
mov eax, dword [esp + 0x30]
mov dword [eax + 4], ebx
mov byte [eax + 8], 1
mov dword [eax], edi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0xc
Function at 0x5d4560
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x255]
push 0x68df14
push esi
call fcn.00616a76
add esp, 8
test eax, eax
je 0x5d458a
push eax
call fcn.0061705d
add esp, 4
pop edi
mov al, 1
pop esi
ret
cmp byte [edi + 0x364], 0
je 0x5d4598
pop edi
xor al, al
pop esi
ret
push 0x6916a4
push esi
call fcn.00616a76
mov esi, eax
add esp, 8
test esi, esi
je 0x5d4593
push esi
push 1
push 4
push str.EPKD
call fcn.00618dcc
push esi
push 1
push 4
push 0x695454
call fcn.00618dcc
push esi
push 1
push 4
add edi, 0x150
push edi
call fcn.00618dcc
push esi
call fcn.0061705d
add esp, 0x34
pop edi
mov al, 1
pop esi
ret

Function at 0x5d50e0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [ecx + 0x3c14], 0x20
je 0x5d50ee
xor al, al
ret 4
cmp byte [ecx + 0x365], 0
jne 0x5d5136
cmp dword [ecx + 0x3c18], 0x10
push esi
push edi
jb 0x5d510a
mov esi, dword [ecx + 0x3c04]
jmp 0x5d5110
lea esi, [ecx + 0x3c04]
mov edx, dword [esp + 0xc]
xor eax, eax
xor dword [esi + eax*4], edx
mov edi, dword [ecx + 0x3c14]
inc eax
shr edi, 2
add edx, 0x1000193
cmp eax, edi
jne 0x5d5116
pop edi
mov byte [ecx + 0x365], 1
pop esi
mov al, 1
ret 4
Function at 0x5d9c80
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x66c700
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x70903c]
xor eax, esp
mov dword [esp + 0x4c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x70903c]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
mov eax, dword [esp + 0x74]
mov edi, dword [esp + 0x7c]
mov ebp, dword [esp + 0x80]
mov esi, ecx
mov ecx, dword [esp + 0x78]
xor ebx, ebx
push 0xffffffffffffffff
push ebx
mov dword [esp + 0x1c], ecx
push eax
lea ecx, [esp + 0x50]
mov dword [esp + 0x68], 0xf
mov dword [esp + 0x64], ebx
mov byte [esp + 0x54], bl
call fcn.00417560
lea edx, [esp + 0x44]
push edx
mov dword [esp + 0x70], ebx
call fcn.005899a0
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x30]
push ecx
call fcn.005d9c50
add esp, 0xc
cmp dword [esp + 0x40], 0x10
mov eax, dword [esp + 0x2c]
mov byte [esp + 0x6c], 1
jae 0x5d9d1e
lea eax, [esp + 0x2c]
mov edx, dword [esp + 0x3c]
add edx, eax
xor ecx, ecx
cmp eax, edx
jae 0x5d9d42
lea ebx, [ebx]
movzx ebx, byte [eax]
imul ecx, ecx, 0x1000193
inc eax
xor ecx, ebx
cmp eax, edx
jb 0x5d9d30
xor ebx, ebx
mov dword [esp + 0x18], ecx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
push ecx
mov ecx, esi
call fcn.005d9810
mov esi, dword [eax + 4]
mov edx, dword [eax]
mov dword [esp + 0x18], edx
cmp esi, ebx
jne 0x5d9da6
mov esi, 0x10
cmp dword [esp + 0x40], esi
jb 0x5d9d7c
mov eax, dword [esp + 0x2c]
push eax
call fcn.00613a18
add esp, 4
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
cmp dword [esp + 0x5c], esi
jb 0x5d9d9f
mov ecx, dword [esp + 0x48]
push ecx
call fcn.00613a18
add esp, 4
xor al, al
jmp 0x5d9e67
cmp dword [esp + 0x5c], 0x10
mov eax, dword [esp + 0x48]
jae 0x5d9db5
lea eax, [esp + 0x48]
mov edx, dword [esp + 0x58]
push edx
push eax
call fcn.0058c410
mov ecx, eax
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
lea eax, [edx + edx*2]
mov edx, ecx
sub edx, eax
mov eax, dword [esp + 0x1c]
mov dword [eax], edx
mov edx, dword [esi + 8]
mov dword [edi], edx
mov eax, dword [esi + 0xc]
mov dword [edi + 4], eax
mov edx, dword [esi + 0x10]
mov dword [edi + 8], edx
mov eax, dword [esi + 0x14]
mov dword [edi + 0xc], eax
mov edx, dword [esi + 0x18]
mov dword [ebp], edx
mov eax, dword [esi + 0x1c]
mov dword [ebp + 4], eax
mov edx, dword [esi + 0x20]
mov dword [ebp + 8], edx
mov eax, dword [esi + 0x24]
add esp, 8
mov dword [ebp + 0xc], eax
xor eax, eax
lea esp, [esp]
xor dword [edi + eax*4], ecx
inc eax
cmp eax, 4
jb 0x5d9e10
xor eax, eax
jmp 0x5d9e20
xor dword [ebp + eax*4], ecx
inc eax
cmp eax, 4
jb 0x5d9e20
mov esi, 0x10
cmp dword [esp + 0x40], esi
jb 0x5d9e42
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.00613a18
add esp, 4
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
cmp dword [esp + 0x5c], esi
jb 0x5d9e65
mov edx, dword [esp + 0x48]
push edx
call fcn.00613a18
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.00613e6e
add esp, 0x5c
ret 0x10
Function at 0x5d9e90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push 0xffffffffffffffff
push 0x66c738
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x70903c]
xor eax, esp
mov dword [esp + 0x30], eax
push ebp
push esi
push edi
mov eax, dword [0x70903c]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov eax, dword [esp + 0x54]
mov ebp, dword [esp + 0x58]
mov esi, ecx
mov ecx, dword [esp + 0x5c]
push 0xffffffffffffffff
push 0
mov dword [esp + 0x20], ecx
push eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x48], 0xf
mov dword [esp + 0x44], 0
mov byte [esp + 0x34], 0
call fcn.00417560
lea edx, [esp + 0x24]
push edx
mov dword [esp + 0x50], 0
call fcn.005899a0
mov edi, dword [esp + 0x40]
mov eax, dword [esp + 0x2c]
add esp, 4
cmp edi, 0x10
jae 0x5d9f20
lea eax, [esp + 0x28]
mov ecx, dword [esp + 0x38]
lea edx, [ecx + eax]
xor ecx, ecx
cmp eax, edx
jae 0x5d9f44
lea ecx, [ecx]
movzx ebp, byte [eax]
imul ecx, ecx, 0x1000193
inc eax
xor ecx, ebp
cmp eax, edx
jb 0x5d9f30
mov ebp, dword [esp + 0x10]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x20]
mov dword [esp + 0x14], ecx
push eax
lea ecx, [esi + 0x20]
call fcn.005d9810
mov esi, dword [eax + 4]
mov ecx, dword [eax]
mov dword [esp + 0x10], ecx
test esi, esi
je 0x5d9f7e
mov eax, dword [esi + 0x34]
sub eax, dword [esi + 0x30]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
test eax, eax
jg 0x5d9f94
mov dword [ebp], 0
cmp edi, 0x10
jb 0x5d9f90
mov edx, dword [esp + 0x28]
push edx
call fcn.00613a18
add esp, 4
xor al, al
jmp 0x5d9fbf
mov eax, dword [esi + 0x34]
sub eax, dword [esi + 0x30]
jne 0x5d9fa5
call fcn.00615e0c
mov edi, dword [esp + 0x3c]
mov ecx, dword [esi + 0x30]
mov dword [ebp], ecx
cmp edi, 0x10
jb 0x5d9fbd
mov edx, dword [esp + 0x28]
push edx
call fcn.00613a18
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00613e6e
add esp, 0x40
ret 0xc
Function at 0x5dfe76
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [eax], 0x20000000
mov dword [ebp - 4], edi
jne 0x5dffbd
push ebx
push esi
push 4
pop esi
add eax, esi
mov ecx, dword [eax]
cmp ecx, 0x40020000
jne 0x5dff1c
add eax, esi
mov ecx, dword [eax]
xor edx, edx
cmp ecx, 0x40000001
je 0x5dfec6
cmp ecx, 0x40010001
je 0x5dfec6
cmp ecx, 0x40020001
je 0x5dfec6
cmp ecx, 0x40030001
jne 0x5dfed1
shr ecx, 0x10
and ecx, 0xf
inc ecx
mov edx, ecx
add eax, esi
cmp dword [eax], 0x40050002
jne 0x5dfee3
inc edx
mov dword [ebp - 4], 0x1000
add eax, esi
mov ecx, edx
sub ecx, edi
je 0x5dff16
dec ecx
je 0x5dff10
dec ecx
je 0x5dff0a
dec ecx
je 0x5dff04
dec ecx
je 0x5dfefe
dec ecx
jne 0x5dff29
or dword [ebp - 4], 0xe
jmp 0x5dff29
or dword [ebp - 4], 0xc
jmp 0x5dff29
or dword [ebp - 4], 0xa
jmp 0x5dff29
or dword [ebp - 4], 8
jmp 0x5dff29
or dword [ebp - 4], 6
jmp 0x5dff29
or dword [ebp - 4], 2
jmp 0x5dff29
cmp ecx, 0x40030000
jne 0x5dff29
mov dword [ebp - 4], esi
add eax, esi
cmp dword [eax], 0x40020003
push 0x10
pop ecx
jne 0x5dff39
or dword [ebp - 4], ecx
add eax, esi
cmp dword [eax], 0x40000004
jne 0x5dff47
or dword [ebp - 4], 0x20
add eax, esi
cmp dword [eax], 0x40040005
jne 0x5dff55
or dword [ebp - 4], 0x40
add eax, esi
cmp dword [eax], 0x40040006
jne 0x5dff63
or byte [ebp - 4], 0x80
add eax, esi
push 7
pop esi
mov edx, dword [eax]
mov ebx, esi
or ebx, 0x40000000
cmp ebx, edx
jne 0x5dff78
push 3
jmp 0x5dffa3
mov ebx, esi
or ebx, 0x40010000
cmp ebx, edx
je 0x5dffa9
mov ebx, esi
or ebx, 0x40020000
cmp ebx, edx
jne 0x5dff95
xor edx, edx
inc edx
jmp 0x5dffa4
mov ebx, esi
or ebx, 0x40030000
cmp ebx, edx
jne 0x5dffb5
push 2
pop edx
shl edx, cl
or dword [ebp - 4], edx
add eax, 4
inc edi
inc ecx
inc ecx
inc esi
cmp ecx, 0x20
jb 0x5dff66
shl edi, 8
or dword [ebp - 4], edi
pop esi
pop ebx
cmp dword [eax], 0xffffffff
pop edi
je 0x5dffca
mov eax, 0x8876086c
jmp 0x5dffd4
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
xor eax, eax
leave
ret 8

Function at 0x5ea6c5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x6968d0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x5ea71d
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x5ea71d
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x5ea71d
xor eax, eax
inc eax
leave
ret
xor eax, eax
leave
ret
Function at 0x5ea746
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
lea eax, [ebp - 4]
push eax
push 0x6968d0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x5ea7b4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push str.DisableMMX
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5ea7ab
cmp dword [ebp - 0xc], 4
jne 0x5ea7ab
cmp dword [ebp - 0x10], edi
je 0x5ea7ab
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x705014], edi
xor eax, eax
jmp 0x5ea7dc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x705014], edi
jge 0x5ea7d7
mov dword [0x705014], edi
call fcn.005ea721
test eax, eax
je 0x5ea7d7
emms
mov dword [0x705014], 1
mov eax, dword [0x705014]
pop edi
leave
ret

Function at 0x5ea8bc
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x98
push ebx
push edi
push 0x25
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
xor bl, bl
and byte [ebp + 0x73], bl
push eax
mov dword [ebp - 0x24], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x5ea8f3
inc bl
mov byte [ebp + 0x73], 1
cmp dword [ebp - 0x14], 1
jne 0x5ea915
cmp dword [ebp - 0x20], 4
ja 0x5ea91f
jne 0x5ea90f
cmp dword [ebp - 0x1c], 0xa
jb 0x5ea90f
cmp word [ebp - 0x18], 0x55d
jae 0x5ea91f
mov byte [ebp + 0x73], 1
jmp 0x5ea91f
cmp dword [ebp - 0x14], 2
jne 0x5ea935
test bl, bl
je 0x5ea950
mov eax, dword [ebp + 0x7c]
sub eax, 6
je 0x5ea940
dec eax
je 0x5ea939
sub eax, 3
jne 0x5ea935
cmp byte [ebp + 0x73], 0
je 0x5ea961
xor eax, eax
jmp 0x5ea969
call fcn.005ea7df
jmp 0x5ea969
cmp byte [ebp + 0x73], 0
jne 0x5ea935
call fcn.005ea817
and eax, 4
jmp 0x5ea969
cmp dword [ebp + 0x7c], 0xa
je 0x5ea961
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
jmp 0x5ea969
call fcn.005ea817
and eax, 8
pop edi
pop ebx
add ebp, 0x74
leave
ret
Function at 0x5ed1b9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, edx
cmp edx, eax
mov dword [ebp - 0x18], eax
jae 0x5ed2da
mov eax, dword [ebp + 0x10]
lea eax, [edx + eax*4]
push ebx
push esi
mov dword [ebp + 0x14], eax
mov esi, 0xffc03fc0
mov eax, 0xff00ff
cmp edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
jae 0x5ed2be
mov ebx, dword [ebp + 0x14]
sub ebx, edx
dec ebx
shr ebx, 3
lea ecx, [edx + 4]
inc ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ebx
mov edx, dword [ecx + edi]
mov edi, dword [edi + ecx - 4]
mov dword [ebp - 0xc], edi
shr edi, 2
and edi, esi
mov dword [ebp - 4], edx
mov edx, dword [ecx]
mov ecx, dword [ecx - 4]
mov ebx, ecx
shr ebx, 2
and ebx, esi
add ebx, edi
mov edi, dword [ebp - 4]
shr edi, 2
and edi, esi
add ebx, edi
mov edi, edx
shr edi, 2
and edi, esi
lea ebx, [ebx + edi - 0x7fff80]
mov edi, dword [ebp - 0xc]
and edi, eax
mov esi, ecx
and esi, eax
add esi, edi
mov edi, dword [ebp - 4]
and edi, eax
add esi, edi
mov edi, edx
and edi, eax
lea esi, [esi + edi + 0x20002]
mov edi, dword [ebp - 0xc]
shr ecx, 2
shr esi, 2
xor ebx, esi
shr edi, 2
mov esi, 0x3fc03fc0
and ecx, esi
and edi, esi
add ecx, edi
mov edi, dword [ebp - 4]
shr edi, 2
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x18]
shr edx, 2
and edx, esi
lea ecx, [ecx + edx + 0x800080]
and ebx, eax
xor ebx, ecx
mov ecx, dword [ebp - 8]
add dword [ebp - 8], 4
mov dword [ecx], ebx
mov ecx, dword [ebp - 0x10]
add ecx, 8
dec dword [ebp - 0x14]
mov dword [ebp - 0x10], ecx
mov esi, 0xffc03fc0
jne 0x5ed210
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add dword [ebp + 8], ecx
lea ecx, [edi + edi]
add dword [ebp + 0x14], ecx
add edx, ecx
cmp edx, dword [ebp - 0x18]
mov dword [ebp + 0xc], edx
jb 0x5ed1ee
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret
Function at 0x5ed5a6
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
push esi
mov esi, dword [ecx]
mov ebp, dword [esi + 0x105c]
push edi
mov edi, dword [esi + 0x1050]
imul ebp, edi
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x18]
add ebp, eax
cmp eax, ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], ebp
jae 0x5ed6ed
mov edx, 0xf81f
push ebx
mov ebx, dword [esp + 0x14]
mov esi, dword [esi + 0x1058]
lea esi, [eax + esi*2]
mov dword [esp + 0x10], ebx
add edi, eax
cmp eax, esi
mov ebx, eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], esi
jae 0x5ed6c8
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx eax, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
mov ebx, eax
and bx, dx
and bp, dx
mov dword [esp + 0x24], ecx
and ecx, 0xffff07e0
add ebx, ebp
mov ebp, edi
and bp, dx
add ebx, ebp
mov ebp, esi
and bp, dx
lea ebx, [ebx + ebp + 0x1002]
mov ebp, eax
and ebp, 0xffff07e0
add ebp, ecx
mov ecx, edi
and ecx, 0xffff07e0
add ebp, ecx
mov ecx, esi
and ecx, 0xffff07e0
shr ebx, 2
lea ecx, [ecx + ebp + 0x40]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and eax, edx
and ecx, edx
add eax, ecx
and edi, edx
add eax, edi
mov edi, dword [esp + 0x1c]
and esi, edx
and ebx, 0xffff07e0
lea eax, [eax + esi + 0x1002]
shr eax, 2
xor ebx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [eax], bx
mov ebx, dword [esp + 0x18]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
jb 0x5ed60f
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov esi, dword [ecx + 4]
mov esi, dword [esi + 0x1050]
add dword [esp + 0x14], esi
mov esi, dword [ecx]
mov edi, dword [esi + 0x1050]
lea eax, [eax + edi*2]
cmp eax, ebp
mov dword [esp + 0x20], eax
jb 0x5ed5e6
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x5ed81a
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
push esi
mov esi, dword [ecx]
mov ebp, dword [esi + 0x105c]
mov edx, dword [esi + 0x18]
push edi
mov edi, dword [esi + 0x1050]
imul ebp, edi
add ebp, edx
cmp edx, ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x2c], ebp
jae 0x5ed960
mov eax, 0x83e0
push ebx
mov ebx, dword [esp + 0x14]
mov esi, dword [esi + 0x1058]
lea esi, [edx + esi*2]
mov dword [esp + 0x10], ebx
add edi, edx
cmp edx, esi
mov ebx, edx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], esi
jae 0x5ed93b
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx edx, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
and ebp, eax
mov ebx, edx
and ebx, eax
add ebx, ebp
mov ebp, edi
and ebp, eax
add ebx, ebp
mov dword [esp + 0x24], ecx
and ecx, 0x7c1f
mov ebp, esi
and ebp, eax
lea ebx, [ebx + ebp + 0x10040]
mov ebp, edx
and ebp, 0x7c1f
add ebp, ecx
mov ecx, edi
and ecx, 0x7c1f
add ebp, ecx
mov ecx, esi
and ecx, 0x7c1f
lea ecx, [ecx + ebp + 0x802]
shr ecx, 2
shr ebx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and ecx, eax
and edx, eax
add edx, ecx
and edi, eax
add edx, edi
mov edi, dword [esp + 0x1c]
and esi, eax
and ebx, 0xffff7c1f
lea ecx, [edx + esi + 0x10040]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [ecx], bx
mov ebx, dword [esp + 0x18]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
jb 0x5ed883
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov esi, dword [ecx + 4]
mov esi, dword [esi + 0x1050]
add dword [esp + 0x14], esi
mov esi, dword [ecx]
mov edi, dword [esi + 0x1050]
lea edx, [edx + edi*2]
cmp edx, ebp
mov dword [esp + 0x20], edx
jb 0x5ed85a
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret