joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5901a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
cmp dword [esp + 0x1c], 0
jle 0x590293
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
push edi
mov ecx, dword [eax + 8]
mov ebx, ecx
add ebx, dword [eax]
mov edx, dword [eax + 0xc]
mov esi, edx
mov edi, dword [eax + 4]
adc edi, edx
mov dword [esp + 0x18], ebx
shld edx, ecx, 0xd
shr esi, 0x13
xor ebp, ebp
shl ecx, 0xd
or ebp, edx
mov edx, dword [eax + 0x1c]
or esi, ecx
mov ecx, dword [eax + 0x18]
xor esi, ebx
xor ebp, edi
mov dword [esp + 0x14], esi
mov esi, ecx
mov dword [esp + 0x20], ebp
add esi, dword [eax + 0x10]
mov ebp, edx
mov ebx, edx
mov dword [esp + 0x10], edi
adc ebp, dword [eax + 0x14]
xor edi, edi
shld edx, ecx, 0x10
shr ebx, 0x10
shl ecx, 0x10
or edi, edx
or ebx, ecx
mov dword [esp + 0x1c], esi
mov ecx, dword [esp + 0x10]
xor ebx, esi
xor edi, ebp
xor esi, esi
or esi, dword [esp + 0x18]
mov edx, edi
add ecx, ebx
mov dword [esp + 0x10], ecx
adc esi, edi
mov dword [eax], ecx
shld edi, ebx, 0x15
xor ecx, ecx
shr edx, 0xb
or ecx, edi
shl ebx, 0x15
mov edi, dword [esp + 0x14]
or edx, ebx
xor edx, dword [esp + 0x10]
xor ecx, esi
add edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
mov dword [eax + 4], esi
mov esi, ebx
adc esi, ebp
mov dword [eax + 0x18], edx
mov ebp, dword [esp + 0x14]
mov edx, ebx
mov dword [eax + 0x1c], ecx
xor ecx, ecx
shld ebx, ebp, 0x11
shr edx, 0xf
or ecx, ebx
shl ebp, 0x11
xor ecx, esi
mov dword [eax + 0x10], esi
mov dword [eax + 0xc], ecx
or edx, ebp
xor ecx, ecx
xor edx, edi
or ecx, edi
mov dword [eax + 8], edx
sub dword [esp + 0x2c], 1
mov dword [eax + 0x14], ecx
jne 0x5901b6
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x590410
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
sub esp, 8
push edi
mov edi, dword [esp + 0x10]
cmp dword [edi + 0x1ec], 0
jne 0x5904ac
push esi
xor esi, esi
nop dword [eax + eax]
push 4
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x590476
mov edx, dword [esp + 0x14]
xor ecx, ecx
nop
cmp esi, 4
jae 0x59046b
mov eax, edx
shr eax, cl
add ecx, 8
mov byte [esp + esi + 8], al
inc esi
cmp ecx, 0x20
jb 0x590450
cmp esi, 4
jb 0x590430
push dword [esp + 8]
push str.rand_s
jmp 0x59049d
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov esi, dword [esp + 8]
xor esi, dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor eax, esi
imul eax, eax, 0x7fffffff
push eax
push str.fallback_4_
call fcn.005879f0
add esp, 8
mov dword [edi + 0x1ec], eax
pop esi
cmp byte [edi + 0xe8], 0
je 0x5904c8
push str.xmlhttp:__www.w3.org_XML_1998_namespace
push edi
call fcn.0058fa40
add esp, 8
pop edi
add esp, 8
ret
mov al, 1
pop edi
add esp, 8
ret
Function at 0x5a3790
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x5a3915
cmp dword [esi + 0x20], 0
je 0x5a3915
cmp dword [esi + 0x24], 0
je 0x5a3915
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x5a3915
cmp dword [eax], esi
jne 0x5a3915
mov eax, dword [eax + 4]
cmp eax, 0x2a
je 0x5a37f5
cmp eax, 0x39
je 0x5a37f5
cmp eax, 0x45
je 0x5a37f5
cmp eax, 0x49
je 0x5a37f5
cmp eax, 0x5b
je 0x5a37f5
cmp eax, 0x67
je 0x5a37f5
cmp eax, 0x71
je 0x5a37f5
cmp eax, 0x29a
jne 0x5a3915
push edi
mov edi, dword [esi + 0x1c]
mov dword [esi + 0x14], 0
mov dword [esi + 8], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x2c], 2
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 8]
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], eax
test ecx, ecx
jns 0x5a382e
neg ecx
mov dword [edi + 0x18], ecx
cmp ecx, 2
mov eax, 0x2a
push 0
mov edx, 0x39
cmove eax, edx
push 0
mov dword [edi + 4], eax
push 0
jne 0x5a3850
call fcn.005a0990
jmp 0x5a3855
call fcn.005a0f20
add esp, 0xc
mov dword [esi + 0x30], eax
mov dword [edi + 0x28], 0xfffffffe
push edi
call fcn.005a4980
mov esi, dword [esi + 0x1c]
xor edx, edx
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x4c]
add eax, eax
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2 - 2], dx
mov eax, dword [esi + 0x4c]
lea eax, [eax*2 - 2]
push eax
push edx
push dword [esi + 0x44]
call fcn.00541810
mov eax, dword [esi + 0x84]
add esp, 0x10
lea ecx, [eax + eax*2]
movzx eax, word [ecx*4 + 0x6960e2]
mov dword [esi + 0x80], eax
movzx eax, word [ecx*4 + 0x6960e0]
mov dword [esi + 0x8c], eax
movzx eax, word [ecx*4 + 0x6960e4]
mov dword [esi + 0x90], eax
xor eax, eax
movzx ecx, word [ecx*4 + 0x6960e6]
pop edi
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x6c], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x16b4], 0
mov dword [esi + 0x78], 2
mov dword [esi + 0x60], 2
mov dword [esi + 0x68], 0
mov dword [esi + 0x48], 0
pop esi
ret
mov eax, 0xfffffffe
pop esi
ret

Function at 0x5a8ae0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x1c]
cmp dword [esp + 0x14], esi
cmovb esi, dword [esp + 0x14]
test esi, esi
je 0x5a8b84
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x18]
sub ebp, ebx
mov dword [esp + 0x10], esi
nop dword [eax]
mov eax, dword [edi + 8]
mov dl, byte [ebx + ebp]
or eax, 2
mov ecx, eax
mov byte [esp + 0x28], dl
xor ecx, 1
imul ecx, eax
lea eax, [esp + 0x28]
push 1
push eax
shr ecx, 8
xor cl, dl
mov byte [ebx], cl
mov eax, dword [edi]
not eax
push eax
call fcn.005a0990
not eax
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul eax, eax, 0x8088405
push 1
inc eax
mov dword [edi + 4], eax
shr eax, 0x18
mov byte [esp + 0x30], al
lea eax, [esp + 0x30]
push eax
mov eax, dword [edi + 8]
not eax
push eax
call fcn.005a0990
add esp, 0x18
lea ebx, [ebx + 1]
not eax
mov dword [edi + 8], eax
sub esi, 1
jne 0x5a8b10
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
pop ecx
ret
xor eax, eax
pop esi
pop ecx
ret
Function at 0x5aa850
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, dword [esp + 0x24]
push ebp
mov eax, dword [ebx + 0x440]
mov ebp, dword [eax]
cmp byte [ebp + 0x1e40], 0
je 0x5aa872
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret
mov eax, dword [ebp + 0x44]
test byte [eax + 0x66], 8
jne 0x5aa8a9
mov ecx, dword [ebp + 0x4c]
mov eax, dword [ebp + 0x48]
test ecx, ecx
jg 0x5aa8a9
jl 0x5aa88c
cmp eax, 0xc
jae 0x5aa8a9
push ecx
push eax
push str.Truncated_Zip_encrypted_body:_only__jd_bytes_available
push 0x2a
push ebx
call fcn.005b3f50
add esp, 0x14
mov eax, 0xffffffe2
pop ebp
pop ebx
add esp, 0x1c
ret
push 0
push 0xc
push ebx
call fcn.005b1660
add esp, 0xc
mov dword [esp + 0x14], eax
test eax, eax
jne 0x5aa8d9
push str.Truncated_ZIP_file_data
push 0x2a
push ebx
call fcn.005b3f50
add esp, 0xc
mov eax, 0xffffffe2
pop ebp
pop ebx
add esp, 0x1c
ret
push esi
push edi
xor esi, esi
push ebx
mov dword [esp + 0x1c], esi
call fcn.005bd290
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x5aa9c1
lea edi, [ebp + 0x1e34]
nop word [eax + eax]
mov esi, ebx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x5aa905
mov dword [edi], 0x12345678
mov dword [edi + 4], 0x23456789
mov dword [edi + 8], 0x34567890
sub esi, ecx
je 0x5aa978
mov al, byte [ebx]
mov byte [esp + 0x10], al
lea eax, [esp + 0x10]
push 1
push eax
mov eax, dword [edi]
not eax
push eax
call fcn.005a0990
not eax
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul eax, eax, 0x8088405
push 1
inc eax
mov dword [edi + 4], eax
shr eax, 0x18
mov byte [esp + 0x27], al
lea eax, [esp + 0x27]
push eax
mov eax, dword [edi + 8]
not eax
push eax
call fcn.005a0990
add esp, 0x18
lea ebx, [ebx + 1]
not eax
mov dword [edi + 8], eax
sub esi, 1
jne 0x5aa924
push 0xc
lea eax, [esp + 0x24]
push eax
push 0xc
push dword [esp + 0x28]
push edi
call fcn.005ac050
mov ecx, dword [ebp + 0x44]
add esp, 0x14
mov al, byte [esp + 0x2b]
cmp al, byte [ecx + 0x6b]
je 0x5aa9f3
mov esi, dword [esp + 0x18]
cmp esi, 0x2710
jg 0x5aa9ec
push dword [esp + 0x30]
inc esi
mov dword [esp + 0x1c], esi
call fcn.005bd290
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x5aa900
test esi, esi
mov eax, str.Incorrect_passphrase
mov ecx, str.Passphrase_required_for_this_entry
cmovle eax, ecx
push eax
push 0xffffffffffffffff
push dword [esp + 0x38]
call fcn.005b3f50
add esp, 0xc
mov eax, 0xffffffe7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
push str.Too_many_incorrect_passphrases
jmp 0x5aa9d1
mov ebx, dword [esp + 0x30]
push 0
push 0xc
push ebx
call fcn.005b1680
mov eax, dword [ebp + 0x44]
add esp, 0xc
mov byte [ebp + 0x1e40], 1
test byte [eax + 0x66], 8
jne 0x5aaa1c
add dword [ebp + 0x48], 0xfffffff4
adc dword [ebp + 0x4c], 0xffffffff
add dword [ebp + 0x50], 0xc
push ebx
adc dword [ebp + 0x54], 0
mov dword [ebp + 0x1e2c], 0
call fcn.005ac1f0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x5ac050
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push esi
mov esi, dword [esp + 0x18]
cmp dword [esp + 0x10], esi
cmovb esi, dword [esp + 0x10]
test esi, esi
je 0x5ac0de
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x14]
sub ebp, ebx
mov eax, dword [edi + 8]
or eax, 2
mov ecx, eax
xor ecx, 1
imul ecx, eax
lea eax, [esp + 0x24]
push 1
push eax
shr ecx, 8
xor cl, byte [ebx + ebp]
mov byte [ebx], cl
mov eax, dword [edi]
not eax
mov byte [esp + 0x2c], cl
push eax
call fcn.005a0990
not eax
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul eax, eax, 0x8088405
push 1
inc eax
mov dword [edi + 4], eax
shr eax, 0x18
mov byte [esp + 0x2c], al
lea eax, [esp + 0x2c]
push eax
mov eax, dword [edi + 8]
not eax
push eax
call fcn.005a0990
add esp, 0x18
lea ebx, [ebx + 1]
not eax
mov dword [edi + 8], eax
sub esi, 1
jne 0x5ac073
pop edi
pop ebp
pop ebx
pop esi
ret
Function at 0x5b4170
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
lea eax, [esp + 4]
push 0xf0000000
push 1
push 0
push 0
push eax
call esi
test eax, eax
jne 0x5b41b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x5b41ae
push 8
push 1
push 0
push 0
lea eax, [esp + 0x14]
push eax
call esi
test eax, eax
jne 0x5b41b6
mov eax, 0xffffffe7
pop esi
pop ecx
ret
push dword [esp + 0xc]
push dword [esp + 0x14]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [esp + 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor ecx, ecx
mov eax, 0xffffffe7
test esi, esi
pop esi
cmovne eax, ecx
pop ecx
ret
Function at 0x5b9bd0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push ebp
mov ebp, dword [esp + 0x10]
push esi
xor esi, esi
push edi
mov edi, dword [esp + 0x14]
test ebp, 0xffff7fff
jne 0x5b9cab
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x5b9c4a
call ebx
cmp eax, 3
jne 0x5b9c31
push edi
call fcn.005b9fd0
mov esi, eax
add esp, 4
test esi, esi
jne 0x5b9c25
call fcn.00532619
pop edi
pop esi
pop ebp
mov dword [eax], 0x16
or eax, 0xffffffff
pop ebx
ret
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x5b9c4a
call ebx
push eax
call fcn.005b9b10
push esi
call fcn.0063c69f
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
ret
test al, 0x10
je 0x5b9ca3
push 0
push 0x2000001
push 3
push 0
push 0
push 0
test esi, esi
je 0x5b9c6a
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x5b9c71
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
mov edi, eax
call fcn.0063c69f
add esp, 4
cmp edi, 0xffffffff
jne 0x5b9c93
call ebx
push eax
call fcn.005b9b10
add esp, 4
or eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
push 0
push edi
call fcn.00533057
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
ret
test esi, esi
jne 0x5b9d3f
push dword [esp + 0x1c]
push ebp
push edi
call fcn.00660c75
mov esi, eax
add esp, 0xc
test esi, esi
jns 0x5b9dc6
call fcn.00532619
cmp dword [eax], 0xd
jne 0x5b9d1e
test ebp, 0x100
je 0x5b9d1e
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x5b9cf4
call ebx
push eax
call fcn.005b9b10
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
ret
test al, 0x10
je 0x5b9d0b
call fcn.00532619
pop edi
pop esi
pop ebp
mov dword [eax], 0x15
or eax, 0xffffffff
pop ebx
ret
call fcn.00532619
pop edi
pop esi
pop ebp
mov dword [eax], 0xd
or eax, 0xffffffff
pop ebx
ret
call fcn.00532619
cmp dword [eax], 2
jne 0x5b9dc6
push edi
call fcn.005b9fd0
mov esi, eax
add esp, 4
test esi, esi
je 0x5b9c12
push dword [esp + 0x1c]
push ebp
push esi
call fcn.00660d1b
mov edi, eax
add esp, 0xc
test edi, edi
jns 0x5b9db6
call fcn.00532619
cmp dword [eax], 0xd
jne 0x5b9db6
test ebp, 0x100
je 0x5b9db6
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x5b9d8c
call ebx
push eax
call fcn.005b9b10
add esp, 4
push esi
call fcn.0063c69f
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
test al, 0x10
je 0x5b9dab
call fcn.00532619
push esi
mov dword [eax], 0x15
call fcn.0063c69f
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
call fcn.00532619
mov dword [eax], 0xd
push esi
call fcn.0063c69f
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x5b9dd0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jns 0x5b9de7
call fcn.00532619
mov dword [eax], 9
or eax, 0xffffffff
ret
cmp dword [esp + 0xc], 0
je 0x5b9e58
push eax
call fcn.00532fed
add esp, 4
lea ecx, [esp + 4]
push 0
push ecx
push dword [esp + 0x14]
push dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x5b9e53
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe8
jne 0x5b9e2d
call fcn.00532619
mov dword [eax], 0xb
or eax, 0xffffffff
ret
cmp eax, 0x6d
je 0x5b9e58
cmp eax, 5
jne 0x5b9e46
call fcn.00532619
mov dword [eax], 9
or eax, 0xffffffff
ret
push eax
call fcn.005b9b10
add esp, 4
or eax, 0xffffffff
ret
mov eax, dword [esp + 4]
ret
xor eax, eax
ret

Function at 0x5ba1e0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jns 0x5ba1f7
call fcn.00532619
mov dword [eax], 9
or eax, 0xffffffff
ret
push 0
lea ecx, [esp + 8]
push ecx
push dword [esp + 0x14]
push dword [esp + 0x14]
push eax
call fcn.00532fed
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x5ba241
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x5ba234
call fcn.00532619
mov dword [eax], 9
or eax, 0xffffffff
ret
push eax
call fcn.005b9b10
add esp, 4
or eax, 0xffffffff
ret
mov eax, dword [esp + 4]
ret

Function at 0x5e6610
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp byte [0x6fc0d0], 0
push esi
push edi
jne 0x5e66cc
mov byte [0x6fc0d0], 1
xor esi, esi
mov ecx, esi
mov eax, esi
shr ecx, 1
mov edx, ecx
xor edx, 0xedb88320
test al, 1
cmove edx, ecx
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, 0xedb88320
test dl, 1
cmove eax, ecx
mov dword [esi*4 + 0x6fcfc0], eax
inc esi
cmp esi, 0x100
jb 0x5e6628
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
not eax
test edi, edi
je 0x5e66fa
mov esi, dword [esp + 0xc]
nop
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x6fcfc0]
sub edi, 1
jne 0x5e66e0
pop edi
not eax
pop esi
ret
Function at 0x5e7c00
Capabilities:
Encode data using xor

Disassembly:
cmp byte [0x6fc8d8], 0
push ebx
push esi
push edi
jne 0x5e7d17
mov byte [0x6fc8d8], 1
xor esi, esi
nop dword [eax]
xor eax, eax
mov edx, esi
shrd edx, eax, 1
mov ecx, esi
and ecx, 1
shr eax, 1
or ecx, 0
je 0x5e7c3f
xor edx, 0xd7870f42
xor eax, 0xc96c5795
mov ecx, edx
and edx, 1
shrd ecx, eax, 1
shr eax, 1
or edx, 0
je 0x5e7c5a
xor ecx, 0xd7870f42
xor eax, 0xc96c5795
mov edx, ecx
and ecx, 1
shrd edx, eax, 1
shr eax, 1
or ecx, 0
je 0x5e7c75
xor edx, 0xd7870f42
xor eax, 0xc96c5795
mov ecx, edx
and edx, 1
shrd ecx, eax, 1
shr eax, 1
or edx, 0
je 0x5e7c90
xor ecx, 0xd7870f42
xor eax, 0xc96c5795
mov edx, ecx
and ecx, 1
shrd edx, eax, 1
shr eax, 1
or ecx, 0
je 0x5e7cab
xor edx, 0xd7870f42
xor eax, 0xc96c5795
mov ecx, edx
and edx, 1
shrd ecx, eax, 1
shr eax, 1
or edx, 0
je 0x5e7cc6
xor ecx, 0xd7870f42
xor eax, 0xc96c5795
mov edx, ecx
and ecx, 1
shrd edx, eax, 1
shr eax, 1
or ecx, 0
je 0x5e7ce1
xor edx, 0xd7870f42
xor eax, 0xc96c5795
mov ecx, edx
and edx, 1
shrd ecx, eax, 1
shr eax, 1
or edx, 0
je 0x5e7cfc
xor ecx, 0xd7870f42
xor eax, 0xc96c5795
mov dword [esi*8 + 0x6fc0d8], ecx
mov dword [esi*8 + 0x6fc0dc], eax
inc esi
cmp esi, 0x100
jb 0x5e7c20
mov ebx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
not ebx
mov edi, dword [esp + 0x14]
not edx
test edi, edi
je 0x5e7d55
mov esi, dword [esp + 0x10]
nop
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, bl
shrd ebx, edx, 8
xor ecx, eax
shr edx, 8
xor ebx, dword [ecx*8 + 0x6fc0d8]
xor edx, dword [ecx*8 + 0x6fc0dc]
sub edi, 1
jne 0x5e7d30
pop edi
not ebx
not edx
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x603c90
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x18]
test esi, esi
je 0x603d48
lea eax, [esp + 0x18]
push eax
push esi
push 2
call fcn.00623860
add esp, 0xc
test eax, eax
jne 0x603d48
lea eax, [esp + 4]
push eax
push esi
push 0x17
call fcn.00623860
add esp, 0xc
test eax, eax
jne 0x603d48
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x603cd5
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.006243f0
add esp, 0xc
test eax, eax
je 0x603d09
sub eax, esi
push eax
push 0x2e
push esi
call fcn.006243f0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x603d0b
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
mov ebx, 0x1505
add edi, esi
cmp esi, edi
jae 0x603d3e
nop dword [eax]
mov al, byte [esi]
push eax
call fcn.0060fa50
movsx ecx, al
inc esi
mov eax, ebx
add esp, 4
shl eax, 5
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp esi, edi
jb 0x603d20
pop edi
movzx eax, bl
pop ebx
pop esi
add esp, 0x10
ret
xor eax, eax
pop esi
add esp, 0x10
ret
Function at 0x6072c0
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push edi
push str.kernel32
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x6072da
pop edi
pop ebx
pop ecx
ret
push ebp
push esi
push str.LoadLibraryExA
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [esp + 0x18]
mov ebp, eax
push 0x6a42fc
push esi
call fcn.0053bab0
add esp, 8
test eax, eax
je 0x607322
test ebp, ebp
je 0x607313
push 8
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
test ebp, ebp
je 0x607348
push str.AddDllDirectory
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x607348
push 0x800
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x6073ff
mov ecx, esi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x607365
sub ecx, ebx
lea eax, [ecx + 1]
add eax, edx
push eax
call dword [0x6f7ec8]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x6073f5
push dword [esp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x6073f5
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x607397
sub ecx, edx
mov eax, 0x5c
mov word [ecx + ebx], ax
mov ecx, ebx
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x6073b0
sub ecx, edx
sub ecx, esi
add ecx, ebx
nop dword [eax]
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x6073c0
test ebp, ebp
je 0x6073ec
push 8
push 0
push ebx
call ebp
push ebx
mov edi, eax
call dword [0x6f7ecc]
add esp, 4
mov eax, edi
pop esi
pop ebp
pop edi
pop ebx
pop ecx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push ebx
call dword [0x6f7ecc]
add esp, 4
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
pop ecx
ret
Function at 0x607580
Capabilities:
Get common file path
Initialize winsock library

Disassembly:
sub esp, 0x190
test byte [esp + 0x194], 2
je 0x6075c3
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x6075b7
mov eax, dword [esp]
cmp al, 2
jne 0x6075b1
shr eax, 8
cmp al, 2
je 0x6075c3
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
add esp, 0x190
ret
call fcn.006284b0
test eax, eax
jne 0x6077c5
push esi
push edi
push str.kernel32
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
test edi, edi
jne 0x6075f0
mov dword [0x6fc9c0], esi
jmp 0x607728
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.LoadLibraryExA
push edi
call ebp
push 0x6a42fc
push str.iphlpapi.dll
mov ebx, eax
call fcn.0053bab0
add esp, 8
test eax, eax
je 0x607640
test ebx, ebx
je 0x60762e
push 8
push 0
push str.iphlpapi.dll
call ebx
mov esi, eax
jmp 0x607703
push str.iphlpapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
jmp 0x607703
test ebx, ebx
je 0x607665
push str.AddDllDirectory
push edi
call ebp
test eax, eax
je 0x607665
push 0x800
push 0
push str.iphlpapi.dll
call ebx
mov esi, eax
jmp 0x607703
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ebp, eax
test ebp, ebp
je 0x6076fd
lea ecx, [ebp + 0xd]
push ecx
call dword [0x6f7ec8]
mov edi, eax
add esp, 4
test edi, edi
je 0x6076f3
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x6076f3
mov ecx, edi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x6076a0
sub ecx, edx
mov eax, 0x5c
mov word [ecx + edi], ax
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x6076b7
sub ecx, edx
mov edx, str.iphlpapi.dll
sub ecx, edx
add ecx, edi
nop dword [eax]
mov al, byte [edx]
lea edx, [edx + 1]
mov byte [ecx + edx - 1], al
test al, al
jne 0x6076d0
test ebx, ebx
je 0x6076ea
push 8
push 0
push edi
call ebx
jmp 0x6076f1
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
push edi
call dword [0x6f7ecc]
add esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x6fc9c0], esi
test esi, esi
je 0x607726
push str.if_nametoindex
push esi
call ebp
mov ecx, dword [0x6fc9bc]
test eax, eax
cmovne ecx, eax
mov dword [0x6fc9bc], ecx
pop ebp
pop ebx
push 0x9c
lea eax, [esp + 0xc]
push 0
push eax
call fcn.00541810
mov esi, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
add esp, 0xc
mov dword [esp + 8], 0x9c
mov dword [esp + 0xc], 6
mov dword [esp + 0x10], 0
push 3
push 2
push 0
push 0
mov dword [esp + 0x28], 2
call esi
push 3
push 1
push edx
push eax
call esi
push 3
push 0x20
push edx
push eax
call esi
push 3
push 0x10
push edx
push eax
call esi
push 1
push 8
push edx
push eax
call esi
push edx
push eax
push 0x33
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
pop edi
pop esi
test eax, eax
je 0x6077bc
push 0x6fd3c0
mov byte [0x6fd3c8], 1
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor eax, eax
add esp, 0x190
ret
mov byte [0x6fd3c8], 0
xor eax, eax
add esp, 0x190
ret