joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a0594
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, str.srcprngs_sober128.c
test edi, edi
jne 0x5a05b9
push 0xd4
push ebx
push str.in___NULL
call fcn.005accb1
add esp, 0xc
mov esi, dword [ebp + 0x10]
test esi, esi
jne 0x5a05d3
push 0xd5
push ebx
push str.prng___NULL
call fcn.005accb1
add esp, 0xc
cmp dword [esi + 0x94], 1
jne 0x5a0651
mov ebx, dword [ebp + 0xc]
test bl, 3
je 0x5a05ec
push 3
pop eax
jmp 0x5a06a0
xor eax, eax
mov dword [ebp + 8], eax
test ebx, ebx
je 0x5a061f
add eax, edi
push eax
call fcn.005a0f8d
add dword [esi + 0x3c], eax
push esi
call fcn.005a0fdc
push esi
call fcn.005a100f
xor dword [esi + 0x10], eax
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, 4
mov dword [ebp + 8], eax
cmp eax, ebx
jb 0x5a05f5
add dword [esi + 0x3c], ebx
push esi
call fcn.005a104c
push esi
call fcn.005a1563
push esi
call fcn.005a159c
and dword [esi + 0x90], 0
add esp, 0xc
and dword [esi + 0x94], 0
mov dword [esi + 0x98], 1
jmp 0x5a069e
push esi
call fcn.005a1588
mov ebx, dword [ebp + 0xc]
pop ecx
test bl, 3
jne 0x5a05e4
xor edi, edi
test ebx, ebx
je 0x5a068d
mov eax, dword [ebp + 8]
add eax, edi
push eax
call fcn.005a0f8d
add dword [esi + 0x3c], eax
push esi
call fcn.005a0fdc
push esi
call fcn.005a100f
xor dword [esi + 0x10], eax
add edi, 4
add esp, 0xc
cmp edi, ebx
jb 0x5a0666
add dword [esi + 0x3c], ebx
push esi
call fcn.005a104c
and dword [esi + 0x90], 0
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x5a20b9
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x5a20db
push 0xb1
push str.srchashes_sha2_sha512.c
push str.md___NULL
call fcn.005accb1
add esp, 0xc
xor eax, eax
mov dword [esi + 0x48], eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], 0xf3bcc908
mov dword [esi + 0xc], 0x6a09e667
mov dword [esi + 0x10], 0x84caa73b
mov dword [esi + 0x14], 0xbb67ae85
mov dword [esi + 0x18], 0xfe94f82b
mov dword [esi + 0x1c], 0x3c6ef372
mov dword [esi + 0x20], 0x5f1d36f1
mov dword [esi + 0x24], 0xa54ff53a
mov dword [esi + 0x28], 0xade682d1
mov dword [esi + 0x2c], 0x510e527f
mov dword [esi + 0x30], 0x2b3e6c1f
mov dword [esi + 0x34], 0x9b05688c
mov dword [esi + 0x38], 0xfb41bd6b
mov dword [esi + 0x3c], 0x1f83d9ab
mov dword [esi + 0x40], 0x137e2179
mov dword [esi + 0x44], 0x5be0cd19
pop esi
pop ebp
ret

Function at 0x5a2405
Capabilities:
Hash data using sha224

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x5a2424
push 0x29
push str.f:pe2010privacyeraserlibtomcrypt_srchashes_sha2_sha384.c
push str.md___NULL
call fcn.005accb1
add esp, 0xc
xor eax, eax
mov dword [esi + 0x48], eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], 0xc1059ed8
mov dword [esi + 0xc], 0xcbbb9d5d
mov dword [esi + 0x10], 0x367cd507
mov dword [esi + 0x14], 0x629a292a
mov dword [esi + 0x18], 0x3070dd17
mov dword [esi + 0x1c], 0x9159015a
mov dword [esi + 0x20], 0xf70e5939
mov dword [esi + 0x24], 0x152fecd8
mov dword [esi + 0x28], 0xffc00b31
mov dword [esi + 0x2c], 0x67332667
mov dword [esi + 0x30], 0x68581511
mov dword [esi + 0x34], 0x8eb44a87
mov dword [esi + 0x38], 0x64f98fa7
mov dword [esi + 0x3c], 0xdb0c2e0d
mov dword [esi + 0x40], 0xbefa4fa4
mov dword [esi + 0x44], 0x47b5481d
pop esi
pop ebp
ret
Function at 0x5a361b
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x5a363d
push 0xd0
push str.srchashes_sha2_sha256.c
push str.md___NULL
call fcn.005accb1
add esp, 0xc
xor eax, eax
mov dword [esi + 0x28], eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], 0x6a09e667
mov dword [esi + 0xc], 0xbb67ae85
mov dword [esi + 0x10], 0x3c6ef372
mov dword [esi + 0x14], 0xa54ff53a
mov dword [esi + 0x18], 0x510e527f
mov dword [esi + 0x1c], 0x9b05688c
mov dword [esi + 0x20], 0x1f83d9ab
mov dword [esi + 0x24], 0x5be0cd19
pop esi
pop ebp
ret

Function at 0x5a38f9
Capabilities:
Hash data using sha224

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x5a3918
push 0x2a
push str.f:pe2010privacyeraserlibtomcrypt_srchashes_sha2_sha224.c
push str.md___NULL
call fcn.005accb1
add esp, 0xc
xor eax, eax
mov dword [esi + 0x28], eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], 0xc1059ed8
mov dword [esi + 0xc], 0x367cd507
mov dword [esi + 0x10], 0x3070dd17
mov dword [esi + 0x14], 0xf70e5939
mov dword [esi + 0x18], 0xffc00b31
mov dword [esi + 0x1c], 0x68581511
mov dword [esi + 0x20], 0x64f98fa7
mov dword [esi + 0x24], 0xbefa4fa4
pop esi
pop ebp
ret
Function at 0x5a5d6b
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x5a5d8d
push 0xeb
push str.srchashesmd5.c
push str.md___NULL
call fcn.005accb1
add esp, 0xc
xor eax, eax
mov dword [esi + 8], 0x67452301
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0x14], 0x10325476
mov dword [esi + 0x18], eax
mov dword [esi], eax
mov dword [esi + 4], eax
pop esi
pop ebp
ret

Function at 0x5a66a3
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x5a66c5
push 0x112
push str.srchashes_rmd128.c
push str.md___NULL
call fcn.005accb1
add esp, 0xc
xor eax, eax
mov dword [esi + 0x4c], 0x67452301
mov dword [esi + 0x50], 0xefcdab89
mov dword [esi + 0x54], 0x98badcfe
mov dword [esi + 0x58], 0x10325476
mov dword [esi + 0x48], eax
mov dword [esi], eax
mov dword [esi + 4], eax
pop esi
pop ebp
ret
Function at 0x5a7537
Capabilities:
Hash data using ripemd256
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x5a7559
push 0x11b
push str.srchashes_rmd256.c
push str.md___NULL
call fcn.005accb1
add esp, 0xc
xor eax, eax
mov dword [esi + 0x4c], 0x67452301
mov dword [esi + 0x50], 0xefcdab89
mov dword [esi + 0x54], 0x98badcfe
mov dword [esi + 0x58], 0x10325476
mov dword [esi + 0x5c], 0x76543210
mov dword [esi + 0x60], 0xfedcba98
mov dword [esi + 0x64], 0x89abcdef
mov dword [esi + 0x68], 0x1234567
mov dword [esi + 0x48], eax
mov dword [esi], eax
mov dword [esi + 4], eax
pop esi
pop ebp
ret
Function at 0x5a8514
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, esi
push edi
mov edi, dword [ebp + 0x10]
mov ecx, edi
sub edx, edi
sub ebx, edi
push 4
pop edi
mov eax, dword [edx + ecx]
xor eax, dword [ecx]
mov dword [ebx + ecx], eax
lea ecx, [ecx + 4]
sub edi, 1
jne 0x5a852e
mov eax, dword [ebp + 0x14]
push eax
push esi
push esi
imul ecx, dword [eax + 0x2140], 0x60
call dword [ecx + 0x7e9c6c]
mov edi, dword [ebp + 0x10]
add esp, 0xc
test eax, eax
jne 0x5a8578
mov ecx, edi
push 4
sub ecx, esi
pop edx
mov eax, dword [ecx + esi]
xor dword [esi], eax
lea esi, [esi + 4]
sub edx, 1
jne 0x5a8562
push edi
call fcn.005adffb
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x5a8712
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, esi
push edi
mov edi, dword [ebp + 0x10]
mov ecx, edi
sub edx, edi
sub ebx, edi
push 4
pop edi
mov eax, dword [edx + ecx]
xor eax, dword [ecx]
mov dword [ebx + ecx], eax
lea ecx, [ecx + 4]
sub edi, 1
jne 0x5a872c
mov eax, dword [ebp + 0x14]
push eax
push esi
push esi
imul ecx, dword [eax + 0x2140], 0x60
call dword [ecx + 0x7e9c70]
mov edi, dword [ebp + 0x10]
add esp, 0xc
mov edx, edi
mov ebx, eax
sub edx, esi
push 4
pop eax
mov ecx, dword [edx + esi]
xor dword [esi], ecx
lea esi, [esi + 4]
sub eax, 1
jne 0x5a875e
push edi
call fcn.005adffb
pop ecx
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret
Function at 0x5ab124
Capabilities:
Encrypt data using twofish

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x18]
push ebx
push esi
mov eax, dword [eax]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
dec eax
sub eax, 1
je 0x5ab1de
sub eax, 1
je 0x5ab18e
sub eax, 1
jne 0x5ab28d
movzx eax, byte [ebp - 8]
mov cl, byte [esi + edx*4 + 0x18]
xor cl, byte [eax + 0x712820]
movzx eax, byte [ebp - 7]
mov bl, byte [eax + 0x712720]
movzx eax, byte [ebp - 6]
xor bl, byte [esi + edx*4 + 0x19]
mov ch, byte [eax + 0x712720]
movzx eax, byte [ebp - 5]
xor ch, byte [esi + edx*4 + 0x1a]
mov bh, byte [eax + 0x712820]
xor bh, byte [esi + edx*4 + 0x1b]
jmp 0x5ab19a
mov bh, byte [ebp - 5]
mov ch, byte [ebp - 6]
mov bl, byte [ebp - 7]
mov cl, byte [ebp - 8]
movzx eax, cl
mov cl, byte [esi + edx*4 + 0x10]
xor cl, byte [eax + 0x712820]
movzx eax, bl
mov byte [ebp - 1], cl
mov bl, byte [eax + 0x712820]
xor bl, byte [esi + edx*4 + 0x11]
movzx eax, ch
mov al, byte [eax + 0x712720]
xor al, byte [esi + edx*4 + 0x12]
mov byte [ebp - 2], al
movzx eax, bh
mov bh, byte [ebp - 2]
mov al, byte [eax + 0x712720]
xor al, byte [esi + edx*4 + 0x13]
mov byte [ebp + 0x17], al
mov al, cl
jmp 0x5ab1ed
mov al, byte [ebp - 5]
mov bh, byte [ebp - 6]
mov bl, byte [ebp - 7]
mov byte [ebp + 0x17], al
mov al, byte [ebp - 8]
movzx ecx, byte [esi + edx*4 + 8]
movzx eax, al
movzx eax, byte [eax + 0x712720]
xor ecx, eax
movzx eax, byte [esi + edx*4]
movzx ecx, byte [ecx + 0x712720]
xor ecx, eax
mov al, byte [ecx + 0x712820]
mov byte [ebp - 8], al
movzx eax, bl
movzx ecx, byte [eax + 0x712820]
movzx eax, byte [esi + edx*4 + 9]
xor ecx, eax
movzx eax, byte [esi + edx*4 + 1]
movzx ecx, byte [ecx + 0x712720]
xor ecx, eax
mov al, byte [ecx + 0x712720]
mov byte [ebp - 7], al
movzx eax, bh
movzx ecx, byte [eax + 0x712720]
movzx eax, byte [esi + edx*4 + 0xa]
xor ecx, eax
movzx eax, byte [esi + edx*4 + 2]
movzx ecx, byte [ecx + 0x712820]
xor ecx, eax
mov al, byte [ecx + 0x712820]
mov byte [ebp - 6], al
movzx eax, byte [ebp + 0x17]
movzx ecx, byte [eax + 0x712820]
movzx eax, byte [esi + edx*4 + 0xb]
xor ecx, eax
movzx eax, byte [esi + edx*4 + 3]
movzx ecx, byte [ecx + 0x712820]
xor ecx, eax
mov al, byte [ecx + 0x712720]
mov byte [ebp - 5], al
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
call fcn.005ab2a1
pop ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5ab2a1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor ecx, ecx
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov edx, ecx
movzx eax, byte [ecx + edi]
add eax, edx
add edx, 0x100
xor esi, dword [eax*4 + 0x712920]
inc ecx
cmp edx, 0x400
jl 0x5ab2b0
push 4
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push dword [ebp + 0xc]
call fcn.00643300
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5ab2e6
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov esi, 0x7126fc
xor edi, edi
sub esi, dword [ebp + 8]
mov ebx, dword [ebp + 8]
mov byte [edi + eax], 0
mov byte [ebp - 1], 0
mov dword [ebp - 8], 8
movzx eax, byte [esi + ebx]
push 0x14d
push eax
movzx eax, byte [ebx]
push eax
call fcn.005ab048
mov cl, byte [ebp - 1]
add esp, 0xc
xor cl, al
mov eax, dword [ebp + 0xc]
inc ebx
mov byte [ebp - 1], cl
sub dword [ebp - 8], 1
mov byte [edi + eax], cl
jne 0x5ab30d
inc edi
add esi, 8
cmp edi, 4
jl 0x5ab2fb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5acd15
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 4], 0
and dword [ebp - 8], 0
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov eax, esi
mov dword [ebp - 0x14], eax
test esi, esi
je 0x5acdce
push edi
dec esi
cmp dword [ebp + 0x10], 0
mov dword [ebp + 0xc], esi
je 0x5acd48
call dword [ebp + 0x10]
mov esi, dword [ebp - 8]
push 8
pop eax
mov ebx, dword [ebp - 4]
dec eax
mov dword [ebp - 0x10], eax
call fcn.0065c7e2
mov edi, eax
call fcn.0065c7e2
cmp edi, eax
jne 0x5acd74
xor esi, 1
call fcn.0065c7e2
cmp edi, eax
je 0x5acd65
mov dword [ebp - 8], esi
call fcn.0065c7e2
mov edi, eax
call fcn.0065c7e2
cmp edi, eax
jne 0x5acd9c
mov esi, dword [ebp - 4]
xor esi, 1
call fcn.0065c7e2
cmp edi, eax
je 0x5acd87
mov dword [ebp - 4], esi
mov esi, dword [ebp - 8]
mov ebx, dword [ebp - 4]
cmp esi, ebx
je 0x5acd55
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
add ebx, ebx
or ebx, esi
mov dword [ebp - 0xc], ebx
test eax, eax
jne 0x5acd4e
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov byte [eax], bl
inc eax
xor ebx, ebx
mov dword [ebp + 8], eax
mov dword [ebp - 0xc], ebx
test esi, esi
jne 0x5acd3b
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5ace2e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, 0x7028d4
lea eax, [ebp - 4]
push esi
push str._dev_urandom
push eax
call fcn.00654012
add esp, 0xc
test eax, eax
je 0x5ace68
push esi
lea eax, [ebp - 4]
push str._dev_random
push eax
call fcn.00654012
add esp, 0xc
test eax, eax
je 0x5ace68
xor eax, eax
jmp 0x5ace9d
xor esi, esi
push esi
push 4
push esi
push dword [ebp - 4]
call fcn.0064d1e3
add esp, 0x10
test eax, eax
jne 0x5ace92
push dword [ebp - 4]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call fcn.0065c66b
add esp, 0x10
mov esi, eax
push dword [ebp - 4]
call fcn.0064cb7d
pop ecx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5bc60f
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push ebp
mov ebp, esp
call fcn.00613c88
test eax, eax
jne 0x5bc773
push ebx
xor ebx, ebx
push esi
cmp byte [0x78478c], bl
jne 0x5bc62f
mov esi, ebx
jmp 0x5bc63a
push 5
call dword [0x7847d0]
pop ecx
mov esi, eax
push edi
push esi
call fcn.005bdbbc
pop ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
jle 0x5bc763
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x5bc763
cmp dword [0x7ea990], ebx
jne 0x5bc6e7
push ebx
call fcn.005bd876
push 0x10
push str.expand_32_byte_k
push 0x7ea990
mov edi, eax
call fcn.00643300
add esp, 0x10
test edi, edi
jne 0x5bc693
push 0x2c
push ebx
push 0x7ea9a0
call fcn.00644240
jmp 0x5bc6c6
cmp dword [0x78489c], ebx
je 0x5bc6bb
push 0x2c
push ebx
mov edi, 0x7ea9a0
push edi
call fcn.00644240
push 4
push 0x78489c
push edi
call fcn.00643300
add esp, 0x18
jmp 0x5bc6c9
push 0x7ea9a0
push 0x2c
push edi
call dword [edi + 0x38]
add esp, 0xc
mov eax, dword [0x7ea9c0]
mov ecx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [0x7ea9cc], eax
mov dword [0x7ea9c0], ebx
mov byte [0x7eaa10], bl
jmp 0x5bc6ed
mov bl, byte [0x7eaa10]
movzx eax, bl
cmp ecx, eax
jle 0x5bc73d
test bl, bl
je 0x5bc716
movzx eax, bl
push eax
push 0x7ea9d0
push edi
call fcn.00643300
movzx eax, byte [0x7eaa10]
add esp, 0xc
sub dword [ebp + 8], eax
add edi, eax
inc dword [0x7ea9c0]
push 0x7ea990
push 0x7ea9d0
call fcn.005c76cc
pop ecx
pop ecx
mov ecx, dword [ebp + 8]
mov bl, 0x40
mov byte [0x7eaa10], bl
cmp ecx, 0x40
jg 0x5bc6f4
movzx eax, bl
sub eax, ecx
push ecx
add eax, 0x7ea9d0
push eax
push edi
call fcn.00643300
mov ecx, dword [ebp + 8]
sub byte [0x7eaa10], cl
push esi
call fcn.005bdc31
add esp, 0x10
jmp 0x5bc770
push esi
mov dword [0x7ea990], ebx
call fcn.005bdc31
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x5bd826
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.005d9199
Function at 0x5def47
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0x18]
mov esi, dword [ebp + 8]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
mov byte [esi + 0x10], 1
push dword [ebp + 0xc]
push dword [ebp + 0xc]
push str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
push esi
call fcn.005f71da
add esp, 0x1c
cmp dword [ebp + 0x10], 0
jne 0x5def8c
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
push esi
call fcn.005f71da
add esp, 0x14
pop esi
pop ebp
ret
Function at 0x601ce6
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push 0x14
and dword [edi], 0
call fcn.005f6bc5
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x601d07
push 7
pop eax
jmp 0x601d7d
cmp byte [0x78478c], 0
push ebx
mov ebx, dword [ebp + 0x10]
je 0x601d54
mov eax, dword [0x784888]
test eax, eax
je 0x601d27
push 0xc8
call eax
pop ecx
jmp 0x601d29
xor eax, eax
test eax, eax
jne 0x601d54
mov eax, dword [ebp + 0xc]
mov dword [esi + 8], eax
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x601dd8
push 0
push 0
mov dword [esi + 0xc], ebx
call fcn.0065ca1a
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x601d61
push 0x14
push 0
push esi
call fcn.00644240
add esp, 0xc
cmp dword [esi + 8], 0
jne 0x601d78
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push ebx
mov dword [esi + 4], eax
call dword [ebp + 0xc]
pop ecx
mov dword [esi + 0x10], eax
mov dword [edi], esi
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x621bdb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
mov esi, dword [edx + 8]
test edi, edi
jle 0x621c0b
mov eax, dword [ebp + 0xc]
mov ecx, dword [edx]
mov al, byte [ebx + eax]
xor byte [ecx + esi], al
lea eax, [esi + 1]
xor esi, esi
inc ebx
cmp eax, dword [edx + 4]
cmovl esi, eax
cmp ebx, edi
jl 0x621bf0
add dword [edx + 0xc], edi
pop edi
mov dword [edx + 8], esi
pop esi
pop ebx
pop ebp
ret

Function at 0x62cf30
Capabilities:
Write file on windows

Disassembly:
push 2
mov dword [ecx], 0x7247f0
call fcn.0064ca83
push eax
push 0x37
push 1
push str.WindowsEnv_singleton_destroyed._Unsupported_behavior__n
call fcn.0064d045
add esp, 0x14
jmp fcn.0065416e

Function at 0x62f0b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x783760]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push 0
mov edi, ecx
lea ecx, [ebp - 0x30]
push ecx
push dword [ebp + 0x10]
push eax
push dword [edi + 0x10008]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x62f16d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0062de50
add esp, 8
cmp dword [eax + 0x14], 0x10
jb 0x62f105
mov ecx, dword [eax]
jmp 0x62f107
mov ecx, eax
cmp dword [edi + 0x10020], 0x10
mov dword [ebp - 0x24], ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x20], eax
jb 0x62f121
mov ecx, dword [edi + 0x1000c]
jmp 0x62f127
lea ecx, [edi + 0x1000c]
mov eax, dword [edi + 0x1001c]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ecx
push eax
push 5
mov ecx, esi
call fcn.0062f3f0
mov ecx, dword [ebp - 8]
cmp ecx, 0x10
jb 0x62f173
inc ecx
push ecx
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1c]
call fcn.0056cad6
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0056e1bf
mov esp, ebp
pop ebp
ret 0xc
mov dword [esi], 0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0056e1bf
mov esp, ebp
pop ebp
ret 0xc
Function at 0x63f170
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push edi
lea edi, [ebx + eax]
imul eax, eax, 0xc6a4a793
lea ecx, [ebx + 4]
xor eax, dword [ebp + 0x10]
cmp ecx, edi
ja 0x63f1c9
push esi
nop
movzx esi, byte [ebx + 3]
lea edx, [ebx]
mov ebx, ecx
shl esi, 8
movzx ecx, byte [edx + 2]
or esi, ecx
movzx ecx, byte [edx + 1]
shl esi, 8
or esi, ecx
movzx ecx, byte [edx]
shl esi, 8
or esi, ecx
add esi, eax
imul eax, esi, 0xc6a4a793
mov ecx, eax
shr ecx, 0x10
xor eax, ecx
lea ecx, [ebx + 4]
cmp ecx, edi
jbe 0x63f190
pop esi
sub edi, ebx
sub edi, 1
je 0x63f1ec
sub edi, 1
je 0x63f1e3
sub edi, 1
jne 0x63f1fe
movzx ecx, byte [ebx + 2]
shl ecx, 0x10
add eax, ecx
movzx ecx, byte [ebx + 1]
shl ecx, 8
add eax, ecx
movzx ecx, byte [ebx]
add ecx, eax
imul eax, ecx, 0xc6a4a793
mov ecx, eax
shr ecx, 0x18
xor eax, ecx
pop edi
pop ebx
pop ebp
ret

Function at 0x65f070
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0065eeef

Function at 0x663e03
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00663ac3

Function at 0x66c63b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x401e30
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4a0368]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [edx + 0x14], 0x10
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
jb 0x401e50
mov edx, dword [edx]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push edx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x401ea5
cmp dword [esi + 0x14], 0x10
mov eax, dword [esi + 0x10]
jb 0x401e80
mov esi, dword [esi]
cmp dword [edi + 0x14], 0x10
jb 0x401e88
mov edi, dword [edi]
push eax
push esi
push 1
push 0
push edi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0xc]
test eax, eax
je 0x401eb7
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00459004
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.00459004
mov esp, ebp
pop ebp
ret
Function at 0x40e310
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push edi
mov edi, dword [esp + 8]
test edi, edi
je 0x40e3af
push edi
call fcn.00420560
add esp, 4
test al, al
jne 0x40e3af
push ebx
push ebp
push esi
mov esi, edi
xor ebx, ebx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x40e338
sub esi, ecx
push esi
push 0x2e
push edi
call fcn.0042b9e0
add esp, 0xc
test eax, eax
je 0x40e36c
sub eax, edi
push eax
push 0x2e
push edi
call fcn.0042b9e0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x40e36e
inc ebx
mov ecx, edi
sub ecx, ebx
add esi, ecx
test ebx, ebx
cmovne edi, ebx
xor ecx, ecx
xor ebp, ebp
mov ebx, 0x1505
lea eax, [edi + esi]
cmp edi, eax
cmova esi, ecx
test esi, esi
je 0x40e3a7
mov al, byte [edi]
push eax
call fcn.0041cb90
movsx ecx, al
lea edi, [edi + 1]
mov eax, ebx
inc ebp
shl eax, 5
add esp, 4
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp ebp, esi
jb 0x40e386
pop esi
pop ebp
movzx eax, bl
pop ebx
pop edi
ret
xor eax, eax
pop edi
ret