joyce8/EMBER2024-capa huggingface dataset:
Function at 0x453378
Capabilities:
Contain obfuscated stackstrings

Disassembly:
je 0x44a50c
invalid
invalid
push edx
wait
fnstcw word [esp]
je 0x4533cb
mov eax, dword [esp + 0xc]
cmp word [esp], 0x27f
je 0x453391
fldcw word [0x45f918]
test eax, 0x7ff00000
je 0x4533f6
test eax, 0x80000000
jne 0x4533e0
fldlg2
fxch st(1)
fyl2x
cmp dword [0x4768ec], 0
jne 0x44a4fe
lea ecx, [0x466080]
mov edx, 0x1b
jmp 0x44a50b
test eax, 0x80000000
jne 0x4533e0
jmp 0x45339f
test eax, 0xfffff
jne 0x4533ef
cmp dword [esp + 8], 0
jne 0x4533ef
and eax, 0x80000000
je 0x4533a5
fstp st(0)
fld xword [0x45f8d0]
mov eax, 1
jmp 0x453411
call fcn.0044a48c
jmp 0x453411
test eax, 0xfffff
jne 0x4533c2
cmp dword [esp + 8], 0
jne 0x4533c2
fstp st(0)
fld xword [0x45f87a]
mov eax, 2
cmp dword [0x4768ec], 0
jne 0x44a4fe
lea ecx, [0x466080]
mov edx, 0x1b
call fcn.0044a417
pop edx
ret
Function at 0x40180f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x406004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x18]
push ebx
push esi
mov esi, dword [ebp + 0x1c]
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
push eax
push ecx
push dword [ebp + 0xc]
lea eax, [ebp - 0x804]
mov dword [ebp - 0x818], edx
push 0x400
push eax
call fcn.00401a0e
add esp, 0x14
test eax, eax
js 0x4018e1
lea eax, [ebp - 0x808]
mov dword [ebp - 0x808], ebx
push eax
push 1
push ebx
lea eax, [ebp - 0x804]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4018e1
push 4
pop edi
lea eax, [ebp - 0x814]
mov dword [ebp - 0x80c], ebx
push eax
lea eax, [ebp - 0x810]
mov dword [ebp - 0x810], ebx
push eax
lea eax, [ebp - 0x80c]
mov dword [ebp - 0x814], edi
push eax
push ebx
push dword [ebp - 0x818]
push dword [ebp - 0x808]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4018d5
cmp dword [ebp - 0x80c], edi
jne 0x4018d5
cmp dword [ebp - 0x810], eax
mov bl, 1
setne al
mov dword [esi], eax
push dword [ebp - 0x808]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040272d
leave
ret

Function at 0x401e5b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x20019
push esi
push str.SoftwarePoliciesAdobeAcrobat_ReaderDCFeatureLockDown
push 0x80000002
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401ec7
lea eax, [ebp - 0x10]
mov dword [ebp - 8], esi
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0x10], 4
push eax
push esi
push str.bEnableATL7Compat
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401ebe
cmp dword [ebp - 8], 4
jne 0x401ebe
inc eax
cmp dword [ebp - 0xc], eax
cmove esi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret

Function at 0x401ecc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 8]
push esi
push edi
push eax
push 0x20019
xor edi, edi
xor esi, esi
push edi
push str.SoftwareAdobeAdobe_AcrobatDCSecurity
push 0x80000002
inc esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401f32
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], edi
push eax
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 4
push eax
push edi
push 0x4043c8
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401f29
cmp dword [ebp - 4], eax
cmove esi, eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x401f30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x14]
sub esp, 0x14
xor ecx, ecx
test edx, edx
je 0x402037
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
cmp edx, 0x40
jb 0x402015
lea eax, [edx - 1]
add eax, ebx
cmp esi, eax
ja 0x401f6e
lea eax, [edx - 1]
add eax, esi
cmp eax, ebx
jae 0x402015
lea eax, [edx - 1]
add eax, edi
cmp esi, eax
ja 0x401f84
lea eax, [edx - 1]
add eax, esi
cmp eax, edi
jae 0x402015
mov eax, edx
mov edx, edi
sub edx, ebx
and eax, 0xffffffc0
mov dword [ebp - 4], edx
mov edx, esi
sub edx, ebx
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], edx
mov eax, ebx
mov ebx, dword [ebp - 4]
mov edx, edi
sub edx, esi
mov dword [ebp - 0xc], edx
lea edx, [edi + 0x30]
mov edi, dword [ebp - 8]
mov dword [ebp - 0x10], edx
lea edx, [esi + 0x10]
movups xmm0, xmmword [eax]
mov esi, dword [ebp - 0xc]
lea eax, [eax + 0x40]
movups xmm1, xmmword [ebx + eax - 0x40]
lea edx, [edx + 0x40]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x30]
movups xmmword [edi + eax - 0x40], xmm1
movups xmm1, xmmword [esi + edx - 0x40]
mov esi, dword [ebp - 0x10]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x20]
movups xmmword [edx - 0x40], xmm1
movups xmm1, xmmword [esi + ecx - 0x10]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x10]
movups xmmword [edx - 0x30], xmm1
movups xmm1, xmmword [esi + ecx]
mov esi, dword [ebp + 0x10]
add ecx, 0x40
pxor xmm1, xmm0
movups xmmword [edx - 0x20], xmm1
cmp ecx, dword [ebp - 0x14]
jb 0x401fb2
mov edx, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
cmp ecx, edx
jae 0x402034
sub edi, ebx
lea eax, [ecx + ebx]
sub esi, ebx
sub edx, ecx
mov cl, byte [eax + edi]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
mov byte [eax + esi - 1], cl
sub edx, 1
jne 0x402022
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x56fcc0
Capabilities:
Hash data with md5

Disassembly:
mov dword [ecx + 0x14], 0
mov eax, ecx
mov dword [ecx + 0x10], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x5d2f00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xfb5f80
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x100c068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], 0xfd4ea4
call fcn.00f499a4
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.00f4862c
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5d6240
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100c068]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push esi
push edi
push 0x11
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], ecx
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
call ebx
movzx esi, ax
shr esi, 7
push 0x12
and esi, 1
call ebx
mov edi, esi
or edi, 2
and al, 0x80
push 0x10
cmove edi, esi
call ebx
mov esi, edi
or esi, 4
and al, 0x80
push 0x5b
cmove esi, edi
call ebx
mov edi, esi
or edi, 8
and al, 0x80
push 0x5c
cmove edi, esi
call ebx
mov ebx, dword [ebp + 0xc]
mov esi, edi
or esi, 8
and al, 0x80
mov eax, dword [ebp - 0x1c]
cmove esi, edi
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], esi
test ebx, 0x1000000
je 0x5d62de
cmp eax, 0xd
jne 0x5d62fa
mov dword [ebp - 0x14], 0x23
jmp 0x5d63c2
xor ecx, ecx
mov edx, 0x24
cmp edx, eax
je 0x5d63b8
mov edx, dword [ecx*8 + 0xfd4488]
inc ecx
cmp edx, 0x2c
jne 0x5d62e5
xor ecx, ecx
mov edx, 0x1b
cmp edx, eax
je 0x5d63af
mov edx, dword [ecx*8 + 0xfd44e8]
inc ecx
cmp edx, 0x2c
jne 0x5d6301
xor ecx, ecx
mov edx, 0x11
nop dword [eax]
cmp edx, eax
je 0x5d639c
mov edx, dword [ecx*8 + 0xfd4428]
inc ecx
cmp edx, 0x2c
jne 0x5d6320
sar ebx, 0x10
mov ecx, 2
movzx edx, bl
xor eax, eax
nop
cmp ecx, edx
je 0x5d6390
mov ecx, dword [eax*8 + 0xfd3da8]
inc eax
cmp ecx, 0xffff
jne 0x5d6340
xor eax, eax
mov ecx, 0x47
nop dword [eax + eax]
cmp ecx, edx
je 0x5d6387
mov ecx, dword [eax*8 + str.H_I_K]
inc eax
cmp ecx, 0xffff
jne 0x5d6360
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00f49793
mov esp, ebp
pop ebp
ret
mov eax, dword [eax*8 + 0xfd3f44]
jmp 0x5d63bf
mov al, byte [eax*8 + 0xfd3da4]
mov byte [ebp - 0x18], al
jmp 0x5d63c2
mov eax, dword [ecx*8 + 0xfd4424]
mov dword [ebp - 0x10], eax
not eax
and esi, eax
mov dword [ebp - 0xc], esi
jmp 0x5d63c2
mov eax, dword [ecx*8 + 0xfd44e4]
jmp 0x5d63bf
mov eax, dword [ecx*8 + 0xfd4484]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x20]
lea edx, [ebp - 0x18]
push edx
push ecx
mov eax, dword [ecx + 0x64]
push eax
mov eax, dword [eax + 0x10]
call eax
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00f49793
mov esp, ebp
pop ebp
ret
Function at 0x5da690
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100c068]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
push edi
mov dword [ebp - 0x24], ecx
mov ecx, eax
push ebx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x14], eax
call fcn.005da650
add esp, 4
lea esi, [eax + 1]
push 0xc
call fcn.00f499a4
lea ecx, [ebp - 9]
mov byte [ebp - 9], 0
push ecx
xorps xmm0, xmm0
mov ecx, eax
movq qword [eax], xmm0
push esi
mov dword [eax + 8], 0
call fcn.005d0450
mov dword [ebp - 8], eax
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
call fcn.005d03d0
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
lea eax, [ebp - 8]
push eax
call fcn.005d02a0
push ebx
push 0
push dword [ebp - 0x14]
mov dword [eax], str.char__
mov eax, dword [ebp - 8]
push esi
mov edi, dword [eax]
push edi
call fcn.005cef60
add esp, 0x14
push edi
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push str._libui___hs:_hs:_hs____hs_hs_n
call fcn.005e0100
add esp, 0x18
mov ecx, edi
mov esi, eax
call fcn.005d0120
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, esi
call fcn.005d0120
call dword [sym.imp.KERNEL32.dll_DebugBreak]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00f49793
mov esp, ebp
pop ebp
ret
Function at 0x63ea50
Capabilities:
Hash data with md5

Disassembly:
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0xe58f90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xfb6f8f
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x100c068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov dword [ebp - 0x10], ecx
push 1
call fcn.00f499a4
mov edi, eax
push 0x68
mov byte [edi], 0
call fcn.00f499a4
mov esi, eax
mov dword [ebp - 0x14], esi
push 0x68
push 0
push esi
mov dword [ebp - 4], 0
call fcn.00f8fdb0
add esp, 0x14
mov ecx, esi
push ebx
push edi
push dword [ebp - 0x10]
call fcn.00406890
push 0
push 0
push eax
push 0xe59020
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xe592a0
Capabilities:
Access peb ldr_data
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xfb6ffb
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x100c068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x14]
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
mov dword [ebp - 4], 0
push 0
push 0xfd48d4
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
call fcn.0044c750
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0xf52b5d
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0xf52bc4
push esi
call fcn.00f60bd5
pop ecx
test al, al
jne 0xf52bc4
push ebx
push edi
lea eax, [ebp + 8]
push eax
push esi
call fcn.00f52ddd
pop ecx
mov esi, eax
mov ebx, 0x1505
pop ecx
mov ecx, dword [ebp + 8]
xor eax, eax
and dword [ebp + 8], 0
add ecx, esi
mov edi, ecx
sub edi, esi
cmp esi, ecx
cmova edi, eax
test edi, edi
je 0xf52bbd
mov al, byte [esi]
push eax
call fcn.00f5ffe7
imul ebx, ebx, 0x21
pop ecx
movsx ecx, al
mov eax, dword [ebp + 8]
xor ebx, ecx
inc esi
inc eax
mov dword [ebp + 8], eax
cmp eax, edi
jb 0xf52ba0
pop edi
movzx eax, bl
pop ebx
jmp 0xf52bc6
xor eax, eax
pop esi
pop ebp
ret
Function at 0xf56c68
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push edi
push ebx
mov eax, dword [ebx + 8]
mov dword [ebp - 4], eax
call fcn.00f56912
cmp dword [ebx], 0x100c0e4
mov edi, dword [ebp + 0xc]
pop ecx
mov ecx, 0x434
mov dword [ebp - 0xc], eax
lea eax, [ecx - 0x68]
cmovne ecx, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
add ecx, edi
je 0xf56ddc
cmp byte [ecx + 0x3c], 0
je 0xf56ddc
cmp dword [edi + 0x8d0], 0
je 0xf56ddc
mov eax, dword [edi + 0x78]
test eax, eax
je 0xf56ccf
test byte [eax + 4], 0x10
lea ebx, [eax + 0x78]
jne 0xf56cd5
lea ebx, [edi + 0x8d4]
and dword [ebp - 8], 0
cmp dword [edi + 0x4a4], 0
push esi
jbe 0xf56db7
and dword [ebp + 0xc], 0
mov eax, dword [ebp + 0xc]
mov esi, dword [edi + 0x8d0]
add esi, eax
cmp dword [esi + 0xc], 0
je 0xf56d9e
mov eax, dword [ebp - 4]
push dword [esi]
push dword [eax + 8]
call fcn.00f60126
pop ecx
pop ecx
test eax, eax
je 0xf56d9b
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov eax, dword [esi + 4]
cmp byte [ecx + 0x1c9], 0
jne 0xf56d2f
test eax, eax
je 0xf56d42
jmp 0xf56d9b
test eax, eax
je 0xf56d9b
push eax
push dword [ecx + 0x64]
call fcn.00f60126
pop ecx
pop ecx
test eax, eax
je 0xf56d9b
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov eax, dword [esi + 0x1c]
cmp byte [ecx + 0x1ca], 0
jne 0xf56d5b
cmp eax, 0xffffffff
je 0xf56d68
jmp 0xf56d9b
cmp eax, 0xffffffff
je 0xf56d9b
cmp dword [ecx + 0x440], eax
jne 0xf56d9b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
cmp eax, dword [esi + 0x18]
jne 0xf56d9b
mov eax, dword [ecx + 0x1e0]
push dword [esi + 8]
push dword [eax]
call fcn.00f60126
pop ecx
pop ecx
test eax, eax
je 0xf56d9b
lea eax, [esi + 0x20]
push eax
push dword [ebp - 0xc]
call fcn.00f56a5b
pop ecx
pop ecx
test al, al
jne 0xf56dbd
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp - 8]
add eax, 0x60
inc esi
mov dword [ebp + 0xc], eax
mov dword [ebp - 8], esi
cmp esi, dword [edi + 0x4a4]
jb 0xf56cee
xor eax, eax
inc eax
pop esi
jmp 0xf56dde
inc dword [ebx]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebx]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0xc]
mov dword [ecx], eax
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0xf56dd8
mov eax, dword [esi + 0x10]
mov dword [ecx], eax
xor al, al
jmp 0xf56dba
mov al, 1
pop edi
pop ebx
leave
ret

Function at 0xf5ba8e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 0x6cb], 0
je 0xf5bb12
cmp dword [esi + 0x1a4], 0
je 0xf5badc
push esi
call fcn.00f4ea76
push 1
push esi
mov byte [ebp + 8], al
call fcn.00f4ec9d
push dword [esi + 0x154]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [esi + 0x1a4]
push dword [ebp + 8]
push esi
call fcn.00f4ec9d
add esp, 0x28
jmp 0xf5bb12
mov eax, dword [ebp + 0xc]
cmp eax, 2
ja 0xf5bb12
push dword [esi + 0x150]
imul eax, eax, 3
push 1
push 2
add eax, 0xfbf9d4
push eax
call fcn.00fa040f
push dword [esi + 0x150]
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.00fa040f
add esp, 0x20
pop esi
pop ebp
ret
Function at 0xf5d2bc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00faecf3

Function at 0xf5d4d2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0xfbfbd8
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 4], eax
test eax, eax
je 0xf5d5d5
push ebx
push edi
push 0xfbfbec
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [ebp + 8]
mov ebx, eax
push 0xfbfbfc
push edi
call fcn.00fa1703
pop ecx
pop ecx
test eax, eax
je 0xf5d524
test ebx, ebx
je 0xf5d51b
push 8
jmp 0xf5d53f
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0xf5d543
test ebx, ebx
je 0xf5d54a
push str.AddDllDirectory
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0xf5d54a
push 0x800
push esi
push edi
call ebx
mov esi, eax
jmp 0xf5d5d1
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [ebp - 4], eax
test eax, eax
je 0xf5d5d1
push edi
call fcn.00fa0467
mov ecx, dword [ebp - 4]
add ecx, eax
lea ecx, [ecx*2 + 2]
push ecx
call dword [0x100c090]
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0xf5d5c9
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0xf5d5c9
push 0xfd490c
push edi
call fcn.00fa0467
pop ecx
lea eax, [edi + eax*2]
push eax
call fcn.00fa16e1
pop ecx
pop ecx
push dword [ebp + 8]
push edi
call fcn.00fa0467
pop ecx
lea eax, [edi + eax*2]
push eax
call fcn.00fa16e1
pop ecx
pop ecx
test ebx, ebx
je 0xf5d5c0
push 8
push esi
push edi
call ebx
jmp 0xf5d5c7
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
push edi
call dword [0x100c094]
pop ecx
pop edi
mov eax, esi
pop ebx
pop esi
leave
ret

Function at 0xf60bf1
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0xf60c0f
cmp dword [esi + 0x78], 0
je 0xf60c0f
push 2
push 3
push esi
call fcn.00f60592
add esp, 0xc
push dword [ebp + 0xc]
call fcn.00f607f4
pop ecx
test esi, esi
je 0xf60c2c
cmp dword [esi + 0x78], 0
je 0xf60c2c
push 3
push esi
call fcn.00f605cb
pop ecx
pop ecx
pop esi
pop ebp
ret
Function at 0xf6ab72
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
lea eax, [ebp - 0x24]
push edi
push eax
call fcn.00f530e4
push dword [ebp + 8]
mov esi, eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00f6a1ad
push dword [ebp + 0xc]
mov esi, eax
mov dword [ebp - 4], esi
call fcn.00f6a1ad
add esp, 0xc
mov ebx, eax
jmp 0xf6abe9
lea eax, [ebp - 0x24]
push eax
call fcn.00f530e4
sub esp, 0xc
lea esi, [ebp - 0x14]
mov edi, esp
sub esp, 0x10
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, eax
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00f53174
add esp, 0x20
test edx, edx
ja 0xf6ac14
jb 0xf6abde
cmp eax, 0x3e8
ja 0xf6ac14
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [ebp - 4]
push 1
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0xf6aba9
test esi, esi
je 0xf6ac02
push esi
call fcn.00f9304c
pop ecx
test ebx, ebx
je 0xf6ac0d
push ebx
call fcn.00f9304c
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [ebp - 4]
test eax, eax
je 0xf6ac22
push eax
call fcn.00f9304c
pop ecx
test ebx, ebx
je 0xf6ac2d
push ebx
call fcn.00f9304c
pop ecx
xor eax, eax
inc eax
jmp 0xf6ac0f

Function at 0xf6b3f4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push eax
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
push eax
call fcn.00fa5149
add esp, 0x18
test eax, eax
je 0xf6b414
cmp eax, 0xffffffff
jne 0xf6b416
xor eax, eax
pop ebp
ret

Function at 0xf6b52b
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.00f8fdb0
add esp, 0xc
push 2
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb eax, eax
and eax, 2
pop ebp
ret
Function at 0xf6cff1
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 0x14]
xor ebx, ebx
push edi
push 4
pop edi
push esi
push ebx
push dword [ebp + 0x10]
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], edi
mov dword [ebp + 0x14], esi
call fcn.00f8fdb0
add esp, 0xc
lea eax, [ebp - 8]
push 0xf0000040
push dword [ebp + 0x18]
push ebx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0xf6d0aa
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push dword [ebp + 0x1c]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0xf6d08d
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0xf6d08d
push ebx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp - 4]
mov edi, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
call edi
test eax, eax
je 0xf6d08d
cmp esi, dword [ebp - 0xc]
jb 0xf6d08d
push ebx
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
push 2
push dword [ebp - 4]
call edi
cmp dword [ebp - 4], ebx
je 0xf6d09b
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp dword [ebp - 8], ebx
je 0xf6d0aa
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
pop esi
pop ebx
leave
ret

Function at 0xf7abfc
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ecx - 0xc8]
xor edi, edi
mov ebx, dword [esi + 0xc]
cmp eax, 0x64
jb 0xf7ac2a
push str.Couldnt_set_desired_mode
push esi
call fcn.00f5bb15
pop ecx
pop ecx
push 0x11
pop eax
jmp 0xf7ac7c
cmp ecx, 0xc8
je 0xf7ac41
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200
push esi
call fcn.00f5bbc5
add esp, 0xc
mov al, byte [ebp + 0x10]
cmp al, 0x13
jne 0xf7ac53
push ebx
push esi
call fcn.00f7a93c
pop ecx
pop ecx
jmp 0xf7ac78
cmp al, 0x14
jne 0xf7ac5f
push esi
call fcn.00f79ac3
jmp 0xf7ac50
cmp al, 0x15
jne 0xf7ac67
push 0xd
jmp 0xf7ac6d
cmp al, 0x16
jne 0xf7ac7a
push 0xe
push 1
push esi
call fcn.00f7a4d5
add esp, 0xc
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret