joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403eef
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1404
call fcn.0040d790
push ebx
mov ebx, dword [sym.imp.GDI32.dll_GetCharWidthI]
push esi
push edi
xor esi, esi
xor edi, edi
cmp edi, 0x9a4
jge 0x403f30
push esi
call dword [sym.imp.USER32.dll_GetCaretPos]
push esi
call dword [sym.imp.USER32.dll_SetClipboardViewer]
push esi
push esi
push esi
push esi
push esi
call ebx
push esi
call dword [sym.imp.USER32.dll_GetSysColorBrush]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp edi, 0x4f47acc
jg 0x403f52
inc edi
cmp edi, 0x3361729
jl 0x403f0c
cmp dword [0x283c71c], 0x400
jne 0x404051
push esi
call dword [sym.imp.USER32.dll_GetDC]
push esi
lea eax, [esp + 0x414]
push eax
push esi
push 0x4038c4
push esi
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
push esi
push esi
lea eax, [esp + 0xc18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
push esi
lea eax, [esp + 0x14]
push eax
push 0x4038fc
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
push 0x403904
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push esi
call fcn.004045e4
pop ecx
push esi
push esi
call fcn.0040471a
push esi
call fcn.00404ce9
add esp, 0xc
push esi
call fcn.00404f0a
fldz
sub esp, 0xc
fst qword [esp + 8]
fstp qword [esp]
call fcn.004040c0
add esp, 8
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.004041a0
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00404860
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.004042d0
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.004049e0
fstp st(0)
push esi
push esi
call fcn.00404b34
push esi
call fcn.00404f7e
add esp, 0x14
push esi
push esi
call fcn.0040461e
push esi
push esi
call fcn.00404574
push esi
call fcn.00404d4e
add esp, 0x14
xor edi, edi
cmp edi, 0x16d2a
jge 0x404062
push esi
push esi
push esi
push esi
push esi
call ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp edi, 0x12e82fe
jg 0x404080
inc edi
cmp edi, 0x3011b
jl 0x404053
mov eax, dword [0x444b84]
mov dword [0x283c71c], eax
call fcn.00403c41
mov edi, 0x2ec37
cmp dword [0x283c71c], 0x51f
jne 0x4040ac
push esi
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
dec edi
jne 0x404094
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4073a8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4411f8]
jne 0x4073b2
repz ret
jmp fcn.0040c130
Function at 0x40d1ef
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4411f8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00408fd1
and dword [ebp - 0x14], 0
cmp dword [0x459708], 0
mov dword [ebp - 0x18], eax
jne 0x40d2a2
push 0x402ef4
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40d34a
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402ee8
push ebx
call edi
test eax, eax
je 0x40d34a
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x402ed8
push ebx
mov dword [0x459708], eax
call edi
push eax
call esi
push 0x402ec4
push ebx
mov dword [0x45970c], eax
call edi
push eax
call esi
push 0x402ea8
push ebx
mov dword [0x459710], eax
call edi
push eax
call esi
mov dword [0x459718], eax
test eax, eax
je 0x40d2a2
push 0x402e90
push ebx
call edi
push eax
call esi
mov dword [0x459714], eax
mov eax, dword [0x459714]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40d2fb
cmp dword [0x459718], ecx
je 0x40d2fb
push eax
call esi
push dword [0x459718]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40d2fb
test ebx, ebx
je 0x40d2fb
call edi
test eax, eax
je 0x40d2f2
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40d2f2
test byte [ebp - 8], 1
jne 0x40d2fb
or dword [ebp + 0x10], 0x200000
jmp 0x40d32e
mov eax, dword [0x45970c]
cmp eax, dword [ebp - 0x18]
je 0x40d32e
push eax
call esi
test eax, eax
je 0x40d32e
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40d32e
mov eax, dword [0x459710]
cmp eax, dword [ebp - 0x18]
je 0x40d32e
push eax
call esi
test eax, eax
je 0x40d32e
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x459708]
call esi
test eax, eax
je 0x40d34a
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40d34c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004073a8
leave
ret
Function at 0x5d7908
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push ebp
push esi
xor esi, esi
push edi
mov edi, ecx
mov eax, esi
movd xmm0, eax
pshufd xmm0, xmm0, 0
paddd xmm0, xmmword [0x63d2a0]
movups xmmword [edi + eax*4], xmm0
add eax, 4
cmp eax, 0x100
jl 0x5d7912
mov ebp, dword [esp + 0x14]
mov ebx, esi
xor edx, edx
mov eax, ebx
div dword [esp + 0x18]
movzx eax, byte [edx + ebp]
add eax, dword [edi + ebx*4]
add esi, eax
and esi, 0x800000ff
jns 0x5d7958
dec esi
or esi, 0xffffff00
inc esi
mov cl, byte [edi + ebx*4]
mov eax, dword [edi + esi*4]
mov dword [edi + ebx*4], eax
inc ebx
movzx eax, cl
mov dword [edi + esi*4], eax
cmp ebx, 0x100
jl 0x5d7937
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x5d7977
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x400
lea eax, [esp]
push ebx
push esi
push edi
push 0x400
push ecx
xor esi, esi
push eax
mov edi, esi
call fcn.00607590
mov edx, dword [esp + 0x420]
add esp, 0xc
mov ebx, esi
add edx, 1
je 0x5d7a07
push ebp
mov ebp, dword [esp + 0x414]
inc esi
and esi, 0x800000ff
jns 0x5d79bd
dec esi
or esi, 0xffffff00
inc esi
mov eax, dword [esp + esi*4 + 0x10]
add edi, eax
and edi, 0x800000ff
jns 0x5d79d3
dec edi
or edi, 0xffffff00
inc edi
mov cl, al
mov eax, dword [esp + edi*4 + 0x10]
mov dword [esp + esi*4 + 0x10], eax
movzx eax, cl
mov dword [esp + edi*4 + 0x10], eax
mov ecx, dword [esp + esi*4 + 0x10]
add ecx, eax
and ecx, 0x800000ff
jns 0x5d79fa
dec ecx
or ecx, 0xffffff00
inc ecx
mov al, byte [esp + ecx*4 + 0x10]
xor byte [ebx + ebp], al
inc ebx
cmp ebx, edx
jb 0x5d79ac
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x400
ret 8
Function at 0x5e14f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x30
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x38], ebx
je 0x5e1627
cmp byte [edi + 0x3d], bl
je 0x5e1627
call fcn.005d3a9d
mov esi, eax
mov ecx, edi
mov eax, dword [edi]
push esi
call dword [eax + 0xc]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], esi
push eax
call fcn.005deb38
pop ecx
pop ecx
test al, al
je 0x5e1546
xor al, al
jmp 0x5e1629
push ebx
push 8
lea ecx, [esp + 0x30]
call fcn.005d5e0c
lea ebp, [edi + 0x40]
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x30]
call fcn.005d30bc
mov ecx, eax
call fcn.005d3f9b
lea ecx, [esp + 0x2c]
mov esi, eax
call fcn.005d307c
add esi, eax
lea ecx, [esp + 0x2c]
push esi
lea eax, [esp + 0x1c]
push eax
call fcn.005d30bc
mov ecx, eax
call fcn.005d3f9b
mov ecx, dword [edi + 0x38]
push eax
push ebp
call fcn.005deebc
sub eax, ebx
je 0x5e15ae
sub eax, 1
je 0x5e15b1
dec eax
sub eax, 1
jne 0x5e161a
inc eax
jmp 0x5e1618
mov byte [edi + 0x3d], bl
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x2c]
call fcn.005d30bc
mov ecx, eax
call fcn.005d3f9b
mov esi, dword [esp + 0x1c]
sub esi, eax
je 0x5e15f6
push dword [edi + 0x4c]
lea eax, [esp + 0x28]
push esi
push 1
push eax
lea ecx, [esp + 0x38]
call fcn.005d30bc
mov ecx, eax
call fcn.005d3f9b
push eax
call fcn.0061115c
add esp, 0x10
cmp esi, eax
jne 0x5e1616
cmp byte [edi + 0x3d], bl
je 0x5e1614
test esi, esi
jne 0x5e1555
push ebx
push 8
lea ecx, [esp + 0x30]
call fcn.005d3651
jmp 0x5e1555
mov bl, 1
mov al, bl
mov bl, al
lea ecx, [esp + 0x28]
call fcn.005d2bd8
mov al, bl
jmp 0x5e1629
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5e258a
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x28
push ebx
mov ebx, ecx
push ebp
push esi
push edi
mov esi, dword [ebx]
mov edx, dword [ebx + 0x3c]
movzx ebp, word [esi + 0x14]
add ebp, esi
mov eax, dword [ebp + 0x20]
mov ecx, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x24], eax
call fcn.005e23c1
lea edx, [ebp + 0x18]
mov dword [esp + 0x28], eax
mov ecx, ebx
call fcn.005e24ce
mov ebx, dword [ebp + 0x3c]
mov edi, eax
and dword [esp + 0x34], 0
xor eax, eax
inc eax
mov dword [esp + 0x2c], edi
add ebp, 0x40
mov dword [esp + 0x30], ebx
cmp ax, word [esi + 6]
mov esi, ecx
mov dword [esp + 0x20], eax
jae 0x5e269c
mov eax, dword [ebp + 8]
mov ecx, eax
mov edx, dword [esi + 0x3c]
mov dword [esp + 0x1c], eax
call fcn.005e23c1
mov edx, ebp
mov dword [esp + 0x14], eax
mov ecx, esi
call fcn.005e24ce
mov edx, dword [esp + 0x10]
mov ecx, eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], ecx
cmp dword [esp + 0x28], eax
je 0x5e2653
lea ecx, [edi + edx]
cmp ecx, eax
ja 0x5e264f
lea edx, [esp + 0x24]
mov ecx, esi
call fcn.005e24ed
test eax, eax
je 0x5e26b9
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov ebx, dword [ebp + 0x24]
mov dword [esp + 0x10], edx
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], eax
jmp 0x5e2677
mov ecx, dword [esp + 0x18]
mov eax, dword [ebp + 0x24]
mov edi, 0x2000000
test edi, eax
je 0x5e2667
test edi, ebx
je 0x5e2667
or ebx, eax
jmp 0x5e266f
or ebx, eax
and ebx, 0xfdffffff
mov edi, ecx
sub edi, edx
add edi, dword [esp + 0x1c]
mov eax, dword [esi]
add ebp, 0x28
mov ecx, dword [esp + 0x20]
inc ecx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], edi
movzx eax, word [eax + 6]
mov dword [esp + 0x20], ecx
cmp ecx, eax
jl 0x5e25e6
xor eax, eax
inc eax
lea edx, [esp + 0x24]
mov dword [esp + 0x34], eax
mov ecx, esi
call fcn.005e24ed
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
xor eax, eax
jmp 0x5e26b1
Function at 0x5f2cb4
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [ecx + 4]
xor eax, eax
xor edx, edx
movzx ecx, word [esi]
cmp ax, cx
jae 0x5f2cdf
movzx eax, dx
mov al, byte [eax + esi + 4]
cmp al, 0x13
je 0x5f2cdf
cmp al, 0xc0
je 0x5f2cdf
cmp al, 0xcc
je 0x5f2cdf
add edx, 2
cmp dx, cx
jb 0x5f2cc4
pop esi
ret

Function at 0x5f578e
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, edx
mov edx, dword [esp + 0x10]
lea esi, [edi + 4]
push esi
call fcn.005f572b
mov edx, dword [esp + 0x10]
pop ecx
push 4
sub edx, edi
pop ecx
mov al, byte [edx + edi]
mov byte [edi], al
inc edi
sub ecx, 1
jne 0x5f57a9
push 8
pop ecx
mov al, byte [esi + edx]
xor byte [esi], al
inc esi
sub ecx, 1
jne 0x5f57b7
pop edi
pop esi
ret

Function at 0x5f7a12
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x5f7a2a
sub edx, ecx
mov eax, dword [edx + ecx]
xor dword [ecx], eax
lea ecx, [ecx + 4]
sub esi, 1
jne 0x5f7a1d
pop esi
ret

Function at 0x5f7a2c
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
or eax, edx
push esi
mov esi, dword [esp + 8]
or eax, esi
test al, 3
jne 0x5f7a47
shr esi, 2
push esi
call fcn.005f7a12
pop ecx
pop esi
ret
test esi, esi
je 0x5f7a58
sub edx, ecx
mov al, byte [edx + ecx]
xor byte [ecx], al
inc ecx
sub esi, 1
jne 0x5f7a4d
pop esi
ret

Function at 0x5f7a5a
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
xor eax, eax
mov esi, edx
mov ebx, ecx
test edi, edi
jle 0x5f7a7e
sub ebx, esi
movzx edx, byte [ebx + esi]
movzx ecx, byte [esi]
xor edx, ecx
or eax, edx
inc esi
sub edi, 1
jne 0x5f7a6d
pop edi
pop esi
pop ebx
ret
Function at 0x5ffdef
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
test edi, edi
je 0x5ffee9
cmp dword [esp + 0x14], 0
mov esi, dword [esp + 0x18]
jne 0x5ffe10
test esi, esi
jne 0x5ffee9
cmp edx, 3
je 0x5ffe46
cmp edx, 4
je 0x5ffe46
cmp edx, 5
je 0x5ffe46
cmp edx, 6
je 0x5ffe46
cmp edx, 7
je 0x5ffe46
cmp edx, 8
je 0x5ffe46
cmp edx, 0xa
je 0x5ffe46
cmp edx, 0xb
je 0x5ffe46
cmp edx, 0xc
je 0x5ffe46
cmp edx, 0xd
jne 0x5ffee9
xor ebx, ebx
mov byte [edi + 0x114], dl
push ecx
mov byte [edi + 0x115], bl
call fcn.005ffdd2
mov ebp, eax
pop ecx
test ebp, ebp
jne 0x5ffeee
cmp byte [edi + 0x114], 6
lea ecx, [edi + 0x70]
jne 0x5ffee9
cmp esi, 0x40
ja 0x5ffe8c
cmp dword [esp + 0x14], ebx
je 0x5ffeb5
push esi
push dword [esp + 0x18]
push ecx
call fcn.00607590
add esp, 0xc
jmp 0x5ffeb2
mov edx, dword [esp + 0x14]
mov ecx, edi
push esi
call fcn.00604cd1
mov ebp, eax
pop ecx
test ebp, ebp
jne 0x5ffee5
lea edx, [edi + 0x70]
mov ecx, edi
call fcn.00604dac
mov ebp, eax
test ebp, ebp
jne 0x5ffee5
push 0x20
pop esi
lea ecx, [edi + 0x70]
cmp esi, 0x40
jae 0x5ffecd
push 0x40
pop eax
sub eax, esi
push eax
lea eax, [ecx + esi]
push ebx
push eax
call fcn.00607b10
add esp, 0xc
mov al, byte [ebx + edi + 0x70]
xor al, 0x5c
mov byte [edi + ebx + 0xb0], al
xor byte [ebx + edi + 0x70], 0x36
inc ebx
cmp ebx, 0x40
jb 0x5ffecd
mov eax, ebp
jmp 0x5ffeee
mov eax, 0xffffff53
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x603d6d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xd4
push ebx
push ebp
push esi
xor ebx, ebx
xor esi, esi
push edi
inc ebx
inc esi
cmp dword [esp + 0xe8], 0
mov edi, ecx
push 0
cmovne ebx, dword [esp + 0xec]
mov ebp, edx
pop ecx
test bl, 0x1f
mov eax, ebx
push 0x37
push dword [esp + 0xf0]
setne cl
shr eax, 5
add eax, ecx
mov dword [esp + 0x18], eax
lea eax, [esp + 0x44]
push eax
call fcn.00607590
and dword [esp + 0x20], 0
add esp, 0xc
cmp dword [esp + 0x10], 0
jbe 0x603eab
lea ecx, [esp + 0x74]
call fcn.00604deb
mov esi, eax
test esi, esi
jne 0x603eab
push 0x37
lea edx, [esp + 0x40]
lea ecx, [esp + 0x78]
call fcn.00604cd1
mov esi, eax
pop ecx
test esi, esi
jne 0x603eab
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x74]
call fcn.00604dac
mov esi, eax
test esi, esi
jne 0x603eab
push 4
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00607590
mov eax, dword [esp + 0x24]
add esp, 0xc
cmp dword [edi], 1
jbe 0x603e56
cmp eax, dword [edi + 4]
jne 0x603e56
cmp byte [edi + 0x76], 1
je 0x603ec9
mov edx, dword [esp + 0x10]
mov byte [edi + 0x76], 1
lea eax, [edx - 1]
cmp dword [esp + 0x14], eax
lea ecx, [edx + 1]
cmovne ecx, edx
mov dword [esp + 0x10], ecx
jmp 0x603e5d
mov byte [edi + 0x76], 0
mov dword [edi + 4], eax
test ebp, ebp
je 0x603e98
test ebx, ebx
je 0x603e98
lea eax, [esp + 0x1c]
cmp ebx, 0x20
jb 0x603e8b
push 0x20
push eax
push ebp
call fcn.00607590
add esp, 0xc
lea ecx, [esp + 0x3c]
sub ebx, 0x20
add ebp, 0x20
call fcn.00603d5e
jmp 0x603e98
push ebx
push eax
push ebp
call fcn.00607590
add esp, 0xc
xor ebx, ebx
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
cmp eax, dword [esp + 0x10]
jl 0x603dcb
push 0x37
pop edx
lea ecx, [esp + 0x3c]
call fcn.005ee31f
xor eax, eax
test esi, esi
setne al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xd4
ret
push 3
pop eax
jmp 0x603ebe

Function at 0x6045c5
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, ecx
test esi, esi
jne 0x604571
mov eax, 0xffffff53
pop esi
ret
push edi
push 0x20
xor edi, edi
push edi
push esi
call fcn.00607b10
add esp, 0xc
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
xor eax, eax
mov dword [esi + 0x68], edi
mov dword [esi], 0x6a09e667
pop edi
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
pop esi
ret
test ecx, ecx
jne 0x6045cf
mov eax, 0xffffff53
ret
mov dword [ecx + 0x6c], edx
jmp 0x604563
Function at 0x604cf0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, ecx
test ebx, ebx
jne 0x604cfe
mov eax, 0xffffff53
pop ebx
ret
mov eax, dword [ebx + 0x60]
push ebp
push esi
push edi
push 0x40
pop edi
lea ebp, [ebx + 0x20]
mov byte [eax + ebp], 0x80
inc dword [ebx + 0x60]
mov ecx, dword [ebx + 0x60]
push 0x38
pop esi
cmp ecx, esi
jbe 0x604d4b
mov eax, edi
sub eax, ecx
push eax
lea eax, [ecx + ebp]
push 0
push eax
call fcn.00607b10
push edi
mov edx, ebp
mov dword [ebx + 0x60], edi
mov ecx, ebp
call fcn.00604539
add esp, 0x10
mov edx, ebp
mov ecx, ebx
call fcn.006045d7
test eax, eax
jne 0x604da7
and dword [ebx + 0x60], eax
mov eax, dword [ebx + 0x60]
sub esi, eax
push esi
add eax, ebp
push 0
push eax
call fcn.00607b10
lea edi, [ebx + 0x64]
mov edx, ebp
mov ecx, dword [edi]
lea esi, [ebx + 0x68]
mov eax, dword [esi]
shr ecx, 0x1d
push 0x40
lea eax, [ecx + eax*8]
mov ecx, ebp
mov dword [esi], eax
mov eax, dword [edi]
shl eax, 3
mov dword [edi], eax
call fcn.00604539
push 4
lea eax, [ebp + 0x38]
push esi
push eax
call fcn.00607590
push 4
lea eax, [ebp + 0x3c]
push edi
push eax
call fcn.00607590
add esp, 0x28
mov edx, ebp
mov ecx, ebx
pop edi
pop esi
pop ebp
pop ebx
jmp fcn.006045d7
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x604dac
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
je 0x604de3
test edi, edi
je 0x604de3
call fcn.00604cf0
test eax, eax
jne 0x604de8
push 0x20
mov edx, esi
mov ecx, esi
call fcn.00604539
push 0x20
push esi
push edi
call fcn.00607590
add esp, 0x10
mov ecx, esi
pop edi
pop esi
jmp 0x604563
mov eax, 0xffffff53
pop edi
pop esi
ret

Function at 0x604e9b
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov eax, edx
mov ebp, ecx
neg eax
mov dword [esp + 8], eax
test ebp, ebp
je 0x604f35
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x604f35
mov edx, dword [ebp]
mov ecx, ebx
inc edx
call fcn.0060057e
mov dword [esp + 0xc], eax
test eax, eax
jne 0x604f3a
xor edx, edx
push esi
push edi
cmp dword [ebp], edx
jle 0x604efb
mov edi, dword [ebx + 0xc]
mov ecx, ebp
call fcn.00604e85
mov ecx, ebx
mov esi, eax
call fcn.00604e85
mov ecx, dword [esp + 0x10]
xor esi, eax
and esi, ecx
xor dword [edi + edx*4], esi
inc edx
cmp edx, dword [ebp]
jl 0x604ed5
jmp 0x604f20
mov ecx, dword [esp + 0x10]
jmp 0x604f20
mov edi, dword [ebx + 0xc]
mov ecx, ebp
call fcn.00604e85
mov ecx, ebx
mov esi, eax
call fcn.00604e85
mov ecx, dword [esp + 0x10]
xor esi, eax
and esi, ecx
xor dword [edi + edx*4], esi
inc edx
cmp edx, dword [ebx]
jl 0x604f01
mov eax, dword [ebp]
xor eax, dword [ebx]
and eax, ecx
xor dword [ebx], eax
mov eax, dword [esp + 0x14]
pop edi
pop esi
jmp 0x604f3a
mov eax, 0xffffff53
pop ebp
pop ebx
pop ecx
pop ecx
ret

Function at 0x61cd66
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0061cbe5
Function at 0x824c1da
Capabilities:
Encode data using xor

Disassembly:
call 0x824c153
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or eax, dword [ebx - 0x178f73c]
xor esi, 0xde5af04
add eax, esi
lea esp, [esp - 0xe]
mov esi, dword [esp + 0xe]
lea esp, [esp + 0x12]
xor esi, dword [esp]
push eax
sub eax, 0xf24f2b00
mov eax, esp
or dword [eax - 0x22], ebx
pop eax
jmp 0x824c183
xor dword [esp], esi
xor eax, 0
mov dword [esp], esi
add esp, 4
add esi, dword [ebp + 8]
push ebp
add ebp, 0xc
mov ecx, dword [ebp]
pop ebp
ja 0x824c19f
xor edx, 0
jmp 0x824c1aa
xor edx, edx
jmp 0x824c1c1
jmp 0x824c1cd
xor eax, eax
push 0x8427d7c0
call 0x824c1da
stc
add esp, 8
add esi, 0
cmp ecx, 0
je 0x824c216
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0x824c1ef
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
or eax, edx
xor eax, eax
add eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
xchg dword [esp], ecx
mov dword [esp], ecx
lea esp, [esp + 4]
pop edx
leave
je 0x824c22d
add eax, 0
jno 0x824c232
add esi, 0
ret 0x10

Function at 0x824cf9b
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp - 0x63]
mov dword [esp + 0x5f], ebx
lea esp, [esp + 0x5f]
mov ebx, 0x8dff8662
xchg dword [esp], ebx
and dword [esp], ebp
jmp 0x824cfbd
add ebx, 0
or dword [esp], ebp
mov ebp, esp
push eax
push edi
lea esp, [esp - 4]
xchg dword [esp], ecx
pop ecx
lea esp, [esp - 4]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp + 0x14]
ja 0x824d15f
cmp edi, dword [ebp + 0x10]
jb 0x824d15f
lea esi, [esi]
sub esi, 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
sub esp, 0x6a
mov dword [esp + 0x66], 0xc2ccbc3c
add esp, 0x66
mov dword [esp], edi
or edi, 0xffffffff
and edi, 0xcedcf875
xor edi, 0xce9c140e
xchg dword [esp], edi
push edx
mov edx, esp
xor edx, 0
add edx, 0
push ebx
lea ebx, [edx + 4]
mov dword [ebx], eax
pop ebx
pop edx
push edi
call fcn.0824ca87
inc edi
jmp 0x824d046
jmp 0x824d053
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.0824ca87
inc edi
and dword [esp - 0x4e], ecx
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.0824ca87
inc edi
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push 0
sub esi, 0
add dword [esp], edx
xor edx, edx
je 0x824d0a7
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or edx, 0x13e27bd2
push ebx
add ebx, esi
mov ebx, esp
xor dword [ebx - 0x2a], edi
fdiv qword [ecx]
jnp 0x824d08b
pop ebx
xor edx, 0x1b7d0cc
add edx, 0xedeb415d
xchg dword [esp], edx
push edx
mov edx, esp
call int.0824d0d5
add dword [eax], 0x39
jle 0x824d0b1
sub al, 0xf5
mov ch, al
call fcn.0824d0ea
mov dword [edi], eax
pop ecx
pop edi
pop eax
leave
ret 0x10