joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d3a3b
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop eax
mov byte [ebp - 0x830], 0x4c
mov byte [ebp - 0x82f], 0x6f
mov byte [ebp - 0x82e], 0x61
mov byte [ebp - 0x82d], 0x64
mov byte [ebp - 0x82c], 0x4c
mov byte [ebp - 0x82b], 0x69
mov byte [ebp - 0x82a], 0x62
mov byte [ebp - 0x829], 0x72
mov byte [ebp - 0x828], 0x61
mov byte [ebp - 0x827], 0x72
mov byte [ebp - 0x826], 0x79
mov byte [ebp - 0x825], 0x57
mov byte [ebp - 0x824], 0
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x18d8], ecx
mov edx, dword [ebp - 0x18d8]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x18dc], eax
mov ecx, dword [ebp - 0x18dc]
mov dword [ebp - 0x1518], ecx
push ecx
push esi
add esp, 4
and ecx, 0x10e48
add ecx, 0x1932
jmp 0x4d3adb
pop ecx
push edx
call 0x4d3aea
add byte [edi], bh
cmp ecx, dword [ecx + 0x4d]
xor cl, byte [ebp + 0x3b]
add esp, 4
and edx, 0x9845
pop edx
cmp dword [ebp - 0x1518], 0
jne 0x4d3b0c
mov dword [ebp - 0x710], 0
jmp 0x4d3db3
mov edx, dword [ebp - 0x1518]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc58], ecx
push ebx
or ebx, 0x5eeb
sub ebx, 0x11aae
xor ebx, 0x17691
pop ebx
push edx
push ecx
add esp, 4
or edx, 0x14e8c
pop edx
push ebx
push eax
add esp, 4
or ebx, 0xb8d5
or ebx, 0x54c9
pop ebx
cmp dword [ebp - 0xc58], 0
jne 0x4d3b68
mov dword [ebp - 0x710], 0
jmp 0x4d3db3
mov edx, dword [ebp - 0xc58]
mov dword [ebp - 0x4e8], edx

Function at 0x4d3aea
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop eax
mov byte [ebp - 0x830], 0x4c
mov byte [ebp - 0x82f], 0x6f
mov byte [ebp - 0x82e], 0x61
mov byte [ebp - 0x82d], 0x64
mov byte [ebp - 0x82c], 0x4c
mov byte [ebp - 0x82b], 0x69
mov byte [ebp - 0x82a], 0x62
mov byte [ebp - 0x829], 0x72
mov byte [ebp - 0x828], 0x61
mov byte [ebp - 0x827], 0x72
mov byte [ebp - 0x826], 0x79
mov byte [ebp - 0x825], 0x57
mov byte [ebp - 0x824], 0
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x18d8], ecx
mov edx, dword [ebp - 0x18d8]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x18dc], eax
mov ecx, dword [ebp - 0x18dc]
mov dword [ebp - 0x1518], ecx
push ecx
push esi
add esp, 4
and ecx, 0x10e48
add ecx, 0x1932
jmp 0x4d3adb
pop ecx
push edx
call 0x4d3aea
add byte [edi], bh
cmp ecx, dword [ecx + 0x4d]
xor cl, byte [ebp + 0x3b]
add esp, 4
and edx, 0x9845
pop edx
cmp dword [ebp - 0x1518], 0
jne 0x4d3b0c
mov dword [ebp - 0x710], 0
jmp 0x4d3db3
mov edx, dword [ebp - 0x1518]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc58], ecx
push ebx
or ebx, 0x5eeb
sub ebx, 0x11aae
xor ebx, 0x17691
pop ebx
push edx
push ecx
add esp, 4
or edx, 0x14e8c
pop edx
push ebx
push eax
add esp, 4
or ebx, 0xb8d5
or ebx, 0x54c9
pop ebx
cmp dword [ebp - 0xc58], 0
jne 0x4d3b68
mov dword [ebp - 0x710], 0
jmp 0x4d3db3
mov edx, dword [ebp - 0xc58]
mov dword [ebp - 0x4e8], edx
Function at 0x4d453d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop eax
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp 0x4d45b7

Function at 0x4d4567
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
jmp 0x4d437f
pop edi
push ebx
push ecx
add esp, 4
sub ebx, 0x64e1
xor ebx, 0x163ed
add ebx, 0x14732
pop ebx
push edi
push eax
add esp, 4
and edi, 0x12c33
add edi, 0xd619
pop edi
lea eax, [ebp - 0x1628]
mov dword [ebp - 0xc64], eax
mov ecx, dword [ebp - 0x4ec]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc60], edx
xor eax, eax
mov word [ebp - 0x20c], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push ecx
push ecx
add esp, 4
add ecx, 0x713c
pop ecx
push ebx
sub ebx, 0x7677
xor ebx, 0x6cee
pop ebx
push esi
push esi
add esp, 4
or esi, 0x1b1b
and esi, 0x78e4
and esi, 0xa28
pop esi
mov edx, dword [ebp - 0xc60]
mov ax, word [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
mov edx, dword [ebp - 0xc64]
add edx, 2
mov dword [ebp - 0xc64], edx
mov ax, word [ebp - 0xf94]
mov word [ebp - 0x40], ax
push esi
push ecx
add esp, 4
add esi, 0x37ef
and esi, 0x97dc
pop esi
push edi
push ebx
add esp, 4
sub edi, 0x5533
xor edi, 0xf10b
pop edi
push esi
add esi, 0xd98e
sub esi, 0x5392
pop esi
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x4d44ac
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x4d4506
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x4d43d4
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x4d43d4
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x4d44f0
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x4d44fa
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x4d454f
push edx
add edx, 0xc507
add edx, 0xfdef
pop edx
push edx
push eax
add esp, 4
sub edx, 0x11eb4
pop edx
push eax
push esi
add esp, 4
call fcn.004d453d
add byte [eax + 0x39], dl
dec edi
inc ebx
inc esp
dec edx
aas
xor al, 0x50
push esi
xor esi, 0xe570
pop esi
push ecx
call fcn.004d4567
add byte [ecx + 0x44], cl
aas
cmp eax, 0x344a344d
dec esi
add esp, 4
sub ecx, 0x1ea3
pop ecx
push edx
and edx, 0x69f4
pop edx
push eax
xor eax, 0xbd70
pop eax
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x4d45ad
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x4d4378
mov dword [ebp - 0x2a8], 0
Function at 0x54cd40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp byte [esp + 0xc], 0
mov eax, ecx
je 0x54cebc
mov edx, dword [eax + 4]
push ebx
mov ebx, edx
push esi
shr ebx, 0x1e
add dword [eax + 0xc], 2
mov ecx, dword [eax + 0xc]
lea edx, [edx*4]
push edi
mov dword [eax + 4], edx
js 0x54cd84
mov esi, dword [eax + 8]
movzx edi, byte [esi]
shl edi, cl
add esi, 1
mov dword [eax + 8], esi
add edi, edx
add ecx, 0xfffffff8
mov dword [eax + 4], edi
mov dword [eax + 0xc], ecx
cmp ebx, 3
jb 0x54cdcf
mov ebx, 3
mov edi, edi
mov ecx, dword [eax + 4]
mov edx, ecx
lea esi, [ecx + ecx]
and edx, 0x80000000
add dword [eax + 0xc], 1
mov ecx, dword [eax + 0xc]
mov dword [eax + 4], esi
js 0x54cdc6
mov edi, dword [eax + 8]
movzx edi, byte [edi]
shl edi, cl
add edi, esi
mov esi, dword [eax + 8]
add esi, 1
add ecx, 0xfffffff8
mov dword [eax + 4], edi
mov dword [eax + 8], esi
mov dword [eax + 0xc], ecx
test edx, edx
je 0x54cdcf
add ebx, 1
jmp 0x54cd90
test ebx, ebx
je 0x54ce9d
mov esi, dword [eax + 4]
add dword [eax + 0xc], ebx
or edi, 0xffffffff
mov ecx, ebx
shl edi, cl
mov ecx, 0x20
sub ecx, ebx
mov edx, esi
sar edx, cl
mov ecx, ebx
shl esi, cl
cmp ebx, 0x10
push ebp
mov ebp, dword [eax + 0xc]
mov dword [eax + 4], esi
jb 0x54ce28
mov ecx, dword [eax + 8]
movzx ecx, byte [ecx]
mov dword [esp + 0x1c], ecx
mov ecx, ebp
mov ebp, dword [esp + 0x1c]
shl ebp, cl
mov ecx, dword [eax + 8]
add ecx, 1
mov dword [eax + 8], ecx
mov ecx, dword [eax + 0xc]
add ebp, esi
add ecx, 0xfffffff8
mov dword [eax + 4], ebp
mov dword [eax + 0xc], ecx
cmp ebx, 8
jb 0x54ce47
mov esi, dword [eax + 8]
movzx ebp, byte [esi]
mov ecx, dword [eax + 0xc]
shl ebp, cl
add esi, 1
mov dword [eax + 8], esi
add dword [eax + 4], ebp
add ecx, 0xfffffff8
mov dword [eax + 0xc], ecx
test bl, 7
pop ebp
je 0x54ce6b
mov ecx, dword [eax + 0xc]
test ecx, ecx
jl 0x54ce6b
mov esi, dword [eax + 8]
movzx ebx, byte [esi]
shl ebx, cl
add esi, 1
mov dword [eax + 8], esi
add dword [eax + 4], ebx
add ecx, 0xfffffff8
mov dword [eax + 0xc], ecx
xor edx, edi
mov ecx, edx
sar ecx, 0x1f
sub edx, ecx
mov ecx, dword [esp + 0x14]
add dword [ecx], edx
test dword [ecx], 0xffffff00
je 0x54cea1
or dword [eax + 0x4098], 5
xor edx, edx
cmp dword [ecx], edx
setl dl
sub edx, 1
and edx, 0xff
mov dword [ecx], edx
jmp 0x54cea1
mov ecx, dword [esp + 0x14]
mov ecx, dword [ecx]
mov edx, dword [eax + 0x18]
push ecx
mov ecx, dword [esp + 0x14]
push 1
push edx
mov edx, dword [eax + 0x60]
push ecx
mov ecx, eax
call edx
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [eax + 0x18]
mov edx, dword [esp + 4]
push 0
push 0
push ecx
mov ecx, eax
mov eax, dword [eax + 0x60]
push edx
call eax
ret 0xc
Function at 0x553dc0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 0x787d2]
cmp dword [esi + 0x24], eax
jbe 0x553edb
push edi
mov edi, dword [esi + 0x1c]
test edi, edi
je 0x553e7d
mov edx, esi
sub edx, dword [esi + 0x10]
add edi, 0xffffffff
add edx, 0x7c8
test edi, edi
mov dword [esi + 0x1c], 0
jle 0x553e7d
push ebx
push ebp
lea ecx, [ecx]
mov ecx, dword [esi + 8]
movzx eax, byte [ecx + edx + 3]
movzx ebx, byte [ecx + edx + 2]
movzx ebp, byte [ecx + edx + 4]
and eax, 0x3ff
add eax, eax
and ebx, 0xfff
add eax, eax
xor eax, ebx
movzx ebx, byte [ecx + edx + 1]
and ebx, 0x3fff
add eax, eax
add eax, eax
xor eax, ebx
movzx ebx, byte [ecx + edx + 5]
add ebx, ebx
xor ebx, ebp
movzx ebp, byte [ecx + edx]
shl ebx, 7
add eax, eax
xor ebx, ebp
and ebx, 0xffff
add eax, eax
xor eax, ebx
mov ebx, dword [esi + eax*4 + 0x307d0]
and ecx, 0x7fff
mov dword [esi + ecx*4 + 0x107d0], ebx
mov ecx, dword [esi + 8]
sub edi, 1
mov dword [esi + eax*4 + 0x307d0], ecx
add dword [esi + 8], 1
test edi, edi
jg 0x553e00
pop ebp
pop ebx
mov edx, dword [esi + 0x24]
mov ecx, dword [esp + 0xc]
mov word [edx], 0x100
mov edx, dword [esi + 0x28]
add dword [esi + 0x24], 2
mov eax, dword [esi + 0x24]
sub edx, esi
push 0
sub eax, esi
push ecx
sub edx, 0x887d4
sar edx, 1
sub eax, 0x787d2
push edx
sar eax, 1
push eax
mov ecx, esi
call fcn.005530a0
mov edx, dword [esi + 8]
lea eax, [esi + 0x787d2]
mov dword [esi + 0x24], eax
lea eax, [esi + 0x887d4]
lea ecx, [esi + 0x707d0]
mov dword [esi + 0x28], eax
mov dword [esi + 0x20], ecx
mov dword [esi + 0x14], edx
mov dword [esi + 0x18], 0
pop edi
pop esi
ret 4
Function at 0x577470
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
push ebx
push esi
mov esi, dword [esp + 0xc]
mov eax, 3
sub eax, dword [esp + 0x14]
push edi
jns 0x5774c9
or ebx, 0xffffffff
sub ebx, eax
shr ebx, 2
add ebx, 1
lea eax, [eax + ebx*4]
mov dword [esp + 0x18], eax
push ebp
mov edi, edi
mov eax, dword [ecx]
mov edi, dword [edx]
mov ebp, eax
xor ebp, edi
shr ebp, 1
and ebp, 0x7f7f7f7f
or eax, edi
sub eax, ebp
mov dword [esi], eax
add esi, 4
add ecx, 4
add edx, 4
sub ebx, 1
jne 0x5774a0
mov eax, dword [esp + 0x1c]
pop ebp
sub eax, 3
jns 0x5774ee
neg eax
mov edi, eax
movzx eax, byte [edx]
movzx ebx, byte [ecx]
lea eax, [eax + ebx + 1]
sar eax, 1
mov byte [esi], al
add esi, 1
add ecx, 1
add edx, 1
sub edi, 1
jne 0x5774d2
pop edi
pop esi
pop ebx
ret

Function at 0x577650
Capabilities:
Encode data using xor

Disassembly:
cmp byte [esp + 0x10], 0x80
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
mov esi, dword [eax]
push edi
mov edi, dword [eax + 4]
jb 0x57766a
mov eax, edi
mov edi, esi
mov esi, eax
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
mov ebp, ecx
sar ebp, 2
and ecx, 3
test ebp, ebp
mov dword [esp + 0x1c], ecx
je 0x5776b9
mov ecx, dword [esi]
mov edx, dword [edi]
mov eax, edx
xor eax, ecx
shr eax, 1
and edx, ecx
and eax, 0x7f7f7f7f
add eax, edx
mov edx, eax
xor edx, ecx
shr edx, 1
and edx, 0x7f7f7f7f
or eax, ecx
sub eax, edx
mov dword [ebx], eax
add esi, 4
add edi, 4
add ebx, 4
sub ebp, 1
jne 0x577682
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x5776e0
lea ecx, [ecx]
movzx eax, byte [esi]
movzx edx, byte [edi]
lea eax, [eax + eax*2]
lea eax, [eax + edx + 2]
sar eax, 2
mov byte [ebx], al
add ebx, 1
add esi, 1
add edi, 1
sub ecx, 1
jne 0x5776c0
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x57b720
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0x14]
push ebx
mov ebx, dword [esp + 0x14]
mov eax, ecx
and eax, 0xfffffffe
mov edx, eax
neg edx
lea edx, [ebx + edx*4]
push ebp
push esi
mov esi, dword [esp + 0x18]
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x14]
neg eax
mov ebx, 1
push edi
mov edi, dword [esp + 0x14]
lea eax, [edx + eax*2]
sub ebx, ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ebx
jmp 0x57b764
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x57b80d
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov ebp, edx
xor ebp, ecx
shr ebp, 1
and ebp, 0x7f7f7f7f
mov eax, edx
or eax, ecx
sub eax, ebp
mov ebp, eax
xor ebp, ecx
or eax, ecx
shr ebp, 1
and ebp, 0x7f7f7f7f
sub eax, ebp
and edx, 0xffffff00
and eax, 0xff00ff
shl edx, 0x10
add eax, edx
and ecx, 0xff00
add eax, ecx
mov dword [edi], eax
add edi, 4
add esi, 8
add ebx, 2
jns 0x57b80d
mov ecx, dword [esi + 4]
mov eax, dword [esi - 4]
mov edx, dword [esi]
mov dword [esp + 0x1c], eax
mov ebp, ecx
xor ebp, eax
shr ebp, 1
and ebp, 0x7f7f7f7f
mov eax, ecx
or eax, dword [esp + 0x1c]
and ecx, 0xffffff00
sub eax, ebp
mov ebp, eax
xor ebp, edx
or eax, edx
shr ebp, 1
and ebp, 0x7f7f7f7f
sub eax, ebp
and eax, 0xff00ff
shl ecx, 0x10
add eax, ecx
and edx, 0xff00
add eax, edx
mov dword [edi], eax
add edi, 4
add esi, 8
add ebx, 2
js 0x57b7b8
test bl, 1
jne 0x57b816
mov ecx, dword [esi]
mov dword [edi], ecx
add esi, dword [esp + 0x20]
add edi, dword [esp + 0x18]
sub dword [esp + 0x28], 1
jne 0x57b760
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x57b830
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0x14]
push ebx
mov ebx, dword [esp + 0x14]
mov eax, ecx
and eax, 0xfffffffe
mov edx, eax
neg edx
lea edx, [ebx + edx*4]
push ebp
push esi
mov esi, dword [esp + 0x18]
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x14]
neg eax
mov ebx, 1
push edi
mov edi, dword [esp + 0x14]
lea eax, [edx + eax*2]
sub ebx, ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ebx
jmp 0x57b874
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x57b91d
mov edx, dword [esi]
mov ecx, dword [esi + 4]
mov ebp, ecx
xor ebp, edx
shr ebp, 1
and ebp, 0x7f7f7f7f
mov eax, ecx
or eax, edx
sub eax, ebp
mov ebp, eax
xor ebp, edx
or eax, edx
shr ebp, 1
and ebp, 0x7f7f7f7f
sub eax, ebp
shl eax, 8
and eax, 0xff00ff00
movzx edx, dh
and ecx, 0xff00
add eax, edx
shl ecx, 8
add eax, ecx
mov dword [edi], eax
add edi, 4
add esi, 8
add ebx, 2
jns 0x57b91d
mov ecx, dword [esi + 4]
mov eax, dword [esi - 4]
mov edx, dword [esi]
mov dword [esp + 0x1c], eax
mov ebp, ecx
xor ebp, eax
shr ebp, 1
and ebp, 0x7f7f7f7f
mov eax, ecx
or eax, dword [esp + 0x1c]
and ecx, 0xff00
sub eax, ebp
mov ebp, eax
xor ebp, edx
or eax, edx
shr ebp, 1
and ebp, 0x7f7f7f7f
sub eax, ebp
shl eax, 8
and eax, 0xff00ff00
movzx edx, dh
add eax, edx
shl ecx, 8
add eax, ecx
mov dword [edi], eax
add edi, 4
add esi, 8
add ebx, 2
js 0x57b8c8
test bl, 1
jne 0x57b937
mov eax, dword [esi]
mov ecx, eax
shr eax, 8
shl ecx, 8
xor eax, ecx
and eax, 0xff00ff
xor eax, ecx
mov dword [edi], eax
add esi, dword [esp + 0x20]
add edi, dword [esp + 0x18]
sub dword [esp + 0x28], 1
jne 0x57b870
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x57b950
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x18]
add ebx, 1
push ebp
mov ebp, dword [esp + 0x10]
sar ebx, 1
lea eax, [ebx*4]
push esi
mov esi, dword [esp + 0x10]
sub ebp, eax
sub dword [esp + 0x1c], eax
push edi
mov edi, ebx
mov eax, dword [edx]
mov ecx, eax
shr eax, 8
shl ecx, 8
xor eax, ecx
and eax, 0xff00ff
xor eax, ecx
mov dword [esi], eax
add edx, 4
add esi, 4
sub edi, 1
jne 0x57b978
add edx, dword [esp + 0x20]
add esi, ebp
sub dword [esp + 0x28], 1
jne 0x57b976
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x57c5b0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x20]
push ebx
push ebp
add eax, 0xfffffffe
push esi
mov dword [esp + 0xc], eax
push edi
mov ecx, dword [esp + 0x28]
movzx eax, byte [ecx]
movzx edx, byte [ecx + 2]
movsx ebp, word [edx*2 + 0x6c6798]
movsx edi, word [eax*2 + 0x6c6d98]
movsx edx, word [edx*2 + 0x6c6b98]
add edi, edx
movsx edx, word [eax*2 + 0x6c6998]
movzx eax, byte [ecx + 1]
movsx esi, word [eax*2 + 0x6c6598]
mov eax, dword [esp + 0x20]
add esi, 0x6c70ad
movzx ebx, byte [esi + edx]
mov byte [eax], bl
movzx ebx, byte [esi + edi]
mov byte [eax + 1], bl
movzx ebx, byte [esi + ebp]
mov esi, dword [esp + 0x10]
mov byte [eax + 2], bl
add eax, 3
test esi, esi
mov dword [esp + 0x30], esi
jle 0x57c6e4
lea esp, [esp]
movzx esi, byte [ecx + 6]
mov ebx, edx
movzx edx, byte [ecx + 4]
mov dword [esp + 0x18], ebp
movsx ebp, word [esi*2 + 0x6c6798]
movsx esi, word [esi*2 + 0x6c6b98]
mov dword [esp + 0x14], edi
movsx edi, word [edx*2 + 0x6c6d98]
movsx edx, word [edx*2 + 0x6c6998]
add edi, esi
movzx esi, byte [ecx + 3]
movsx esi, word [esi*2 + 0x6c6598]
lea ebx, [ebx + edx + 1]
sar ebx, 1
add esi, 0x6c70ad
movzx ebx, byte [ebx + esi]
mov byte [eax], bl
mov ebx, dword [esp + 0x14]
lea ebx, [ebx + edi + 1]
sar ebx, 1
movzx ebx, byte [ebx + esi]
mov byte [eax + 1], bl
mov ebx, dword [esp + 0x18]
lea ebx, [ebx + ebp + 1]
sar ebx, 1
movzx ebx, byte [ebx + esi]
mov byte [eax + 2], bl
movzx esi, byte [ecx + 5]
movsx esi, word [esi*2 + 0x6c6598]
add esi, 0x6c70ad
movzx ebx, byte [esi + edx]
mov byte [eax + 3], bl
movzx ebx, byte [esi + edi]
mov byte [eax + 4], bl
movzx ebx, byte [esi + ebp]
mov esi, dword [esp + 0x30]
sub esi, 2
mov byte [eax + 5], bl
add eax, 6
add ecx, 4
test esi, esi
mov dword [esp + 0x30], esi
jg 0x57c630
test byte [esp + 0x30], 1
jne 0x57c710
movzx ecx, byte [ecx + 3]
movsx ecx, word [ecx*2 + 0x6c6598]
add ecx, 0x6c70ad
movzx edx, byte [ecx + edx]
mov byte [eax], dl
movzx edx, byte [ecx + edi]
mov byte [eax + 1], dl
mov cl, byte [ecx + ebp]
mov byte [eax + 2], cl
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
add dword [esp + 0x28], edx
add dword [esp + 0x20], eax
sub dword [esp + 0x34], 1
jne 0x57c5c2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x57c740
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x20]
push ebx
push ebp
add eax, 0xfffffffe
push esi
mov dword [esp + 0xc], eax
push edi
mov ecx, dword [esp + 0x28]
movzx eax, byte [ecx]
movzx edx, byte [ecx + 2]
movsx ebp, word [edx*2 + 0x6c6798]
movsx edi, word [eax*2 + 0x6c6d98]
movsx edx, word [edx*2 + 0x6c6b98]
add edi, edx
movsx edx, word [eax*2 + 0x6c6998]
movzx eax, byte [ecx + 1]
movsx esi, word [eax*2 + 0x6c6598]
mov eax, dword [esp + 0x20]
add esi, 0x6c70ad
movzx ebx, byte [esi + edx]
mov byte [eax], bl
movzx ebx, byte [esi + edi]
mov byte [eax + 1], bl
movzx ebx, byte [esi + ebp]
mov esi, dword [esp + 0x10]
mov byte [eax + 2], bl
add eax, 4
test esi, esi
mov dword [esp + 0x30], esi
jle 0x57c874
lea esp, [esp]
movzx esi, byte [ecx + 6]
mov ebx, edx
movzx edx, byte [ecx + 4]
mov dword [esp + 0x18], ebp
movsx ebp, word [esi*2 + 0x6c6798]
movsx esi, word [esi*2 + 0x6c6b98]
mov dword [esp + 0x14], edi
movsx edi, word [edx*2 + 0x6c6d98]
movsx edx, word [edx*2 + 0x6c6998]
add edi, esi
movzx esi, byte [ecx + 3]
movsx esi, word [esi*2 + 0x6c6598]
lea ebx, [ebx + edx + 1]
sar ebx, 1
add esi, 0x6c70ad
movzx ebx, byte [ebx + esi]
mov byte [eax], bl
mov ebx, dword [esp + 0x14]
lea ebx, [ebx + edi + 1]
sar ebx, 1
movzx ebx, byte [ebx + esi]
mov byte [eax + 1], bl
mov ebx, dword [esp + 0x18]
lea ebx, [ebx + ebp + 1]
sar ebx, 1
movzx ebx, byte [ebx + esi]
mov byte [eax + 2], bl
movzx esi, byte [ecx + 5]
movsx esi, word [esi*2 + 0x6c6598]
add esi, 0x6c70ad
movzx ebx, byte [esi + edx]
mov byte [eax + 4], bl
movzx ebx, byte [esi + edi]
mov byte [eax + 5], bl
movzx ebx, byte [esi + ebp]
mov esi, dword [esp + 0x30]
sub esi, 2
mov byte [eax + 6], bl
add eax, 8
add ecx, 4
test esi, esi
mov dword [esp + 0x30], esi
jg 0x57c7c0
test byte [esp + 0x30], 1
jne 0x57c8a0
movzx ecx, byte [ecx + 3]
movsx ecx, word [ecx*2 + 0x6c6598]
add ecx, 0x6c70ad
movzx edx, byte [ecx + edx]
mov byte [eax], dl
movzx edx, byte [ecx + edi]
mov byte [eax + 1], dl
mov cl, byte [ecx + ebp]
mov byte [eax + 2], cl
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
add dword [esp + 0x28], edx
add dword [esp + 0x20], eax
sub dword [esp + 0x34], 1
jne 0x57c752
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x57ec22
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov eax, dword [esp + 0x14]
add ebx, eax
add ecx, eax
add edx, eax
neg eax
pcmpeqb mm7, mm7
movq mm0, qword [ebx + eax]
movq mm1, qword [ecx + eax]
movq mm2, mm0
movq mm3, qword [ebx + eax + 8]
pxor mm0, mm7
pxor mm1, mm7
movq mm4, qword [ecx + eax + 8]
movq mm5, mm3
pxor mm3, mm7
pxor mm4, mm7
pavgb mm0, mm1
pavgb mm3, mm4
pxor mm0, mm7
pxor mm3, mm7
pavgb mm0, mm2
movq qword [edx + eax], mm0
pavgb mm3, mm5
movq qword [edx + eax + 8], mm3
add eax, 0x10
jne 0x57ec3e
pop ebx
ret
Function at 0x5fd271
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6b174c]
jne 0x5fd27b
repz ret
jmp fcn.00609c4f

Function at 0x6008f7
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x6b1890]
je 0x600912
inc edi
cmp edi, 0x17
jb 0x600903
cmp edi, 0x17
jae 0x600a92
push ebp
push 3
call fcn.0060a74e
cmp eax, 1
pop ecx
je 0x600a5e
push 3
call fcn.0060a74e
test eax, eax
pop ecx
jne 0x600946
cmp dword [0x6b16ec], 1
je 0x600a5e
cmp ebx, 0xfc
je 0x600a91
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x6d2ef8
push ebp
call fcn.00601954
add esp, 0xc
test eax, eax
je 0x60097c
push esi
push esi
push esi
push esi
push esi
call fcn.00601719
add esp, 0x14
push 0x104
mov esi, 0x6d2f11
push esi
push 0
mov byte [0x6d3015], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x6009c0
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00601954
add esp, 0xc
test eax, eax
je 0x6009c0
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00601719
add esp, 0x14
push esi
call fcn.005fc590
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x600a05
push esi
call fcn.005fc590
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x6d320c
push 0x68d334
sub ecx, eax
push ecx
push eax
call fcn.00605d6e
add esp, 0x14
test eax, eax
je 0x600a05
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00601719
add esp, 0x14
jmp 0x600a07
xor esi, esi
push 0x68d330
push ebx
push ebp
call fcn.0060a6dd
add esp, 0xc
test eax, eax
je 0x600a27
push esi
push esi
push esi
push esi
push esi
call fcn.00601719
add esp, 0x14
push dword [edi*8 + 0x6b1894]
push ebx
push ebp
call fcn.0060a6dd
add esp, 0xc
test eax, eax
je 0x600a49
push esi
push esi
push esi
push esi
push esi
call fcn.00601719
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0060a520
add esp, 0xc
jmp 0x600a91
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x600a91
cmp ebp, 0xffffffff
je 0x600a91
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x6b1894]
push dword [esi]
call fcn.005fc590
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret