joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a40c0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x40
push ebx
push esi
mov esi, dword [esp + 0x50]
mov bx, word [esp + 0x4c]
cmp bx, 4
mov word [esi], 0
jbe 0x5a40e3
sub al, al
pop esi
pop ebx
add esp, 0x40
ret 8
lea eax, [esp + 0x38]
push 0x10
push eax
call fcn.005a3d20
lea eax, [esp + 0x28]
push 0x10
push eax
call fcn.005a3d80
lea eax, [esp + 0x18]
push 0x10
push eax
call fcn.005a3e40
lea eax, [esp + 0x18]
push eax
call fcn.005a3720
add bl, 0x31
and eax, 0xffff
mov byte [esp + eax + 0x18], bl
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0xc]
push 0x10
push eax
lea eax, [esp + 0x24]
push 0x5a40b0
push eax
lea eax, [esp + 0x3c]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
or eax, eax
je 0x5a4194
lea eax, [esp + 8]
push 0x2c
push eax
call fcn.005a4090
or ax, ax
je 0x5a415c
and eax, 0xffff
mov byte [esp + eax + 8], 0
cmp byte [esp + 8], 0x30
jne 0x5a4180
mov al, byte [esp + 9]
and al, 0xdf
cmp al, 0x58
jne 0x5a4180
lea eax, [esp + 0xa]
push esi
push eax
call fcn.005a3830
or al, al
jne 0x5a4194
jmp 0x5a418f
lea eax, [esp + 8]
push esi
push eax
call fcn.005a3780
or al, al
jne 0x5a4194
mov word [esi], 0
mov ax, word [esi]
or ax, ax
je 0x5a41ac
cmp ax, 0xffff
je 0x5a41ac
mov al, 1
pop esi
pop ebx
add esp, 0x40
ret 8
sub al, al
pop esi
pop ebx
add esp, 0x40
ret 8

Function at 0x5a41d0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x40
push ebx
push esi
mov esi, dword [esp + 0x50]
mov bx, word [esp + 0x4c]
cmp bx, 4
mov word [esi], 0
jbe 0x5a41f3
sub al, al
pop esi
pop ebx
add esp, 0x40
ret 8
lea eax, [esp + 0x38]
push 0x10
push eax
call fcn.005a3d20
lea eax, [esp + 0x28]
push 0x10
push eax
call fcn.005a3d80
lea eax, [esp + 0x18]
push 0x10
push eax
call fcn.005a3e40
lea eax, [esp + 0x18]
push eax
call fcn.005a3720
add bl, 0x31
and eax, 0xffff
mov byte [esp + eax + 0x18], bl
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0xc]
push 0x10
push eax
lea eax, [esp + 0x24]
push 0x5a41c0
push eax
lea eax, [esp + 0x3c]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
or eax, eax
je 0x5a42a4
lea eax, [esp + 8]
push 0x2c
push eax
call fcn.005a4090
or ax, ax
je 0x5a42a4
and eax, 0xffff
mov cl, byte [esp + eax + 9]
and cl, 0xdf
cmp cl, 0x54
jne 0x5a42a4
cmp byte [esp + eax + 0xa], 0x3a
jne 0x5a42a4
push esi
lea eax, [esp + eax + 0xf]
push eax
call fcn.005a3780
or al, al
jne 0x5a4290
jmp 0x5a429f
mov ax, word [esi]
cmp ax, 1
jl 0x5a429f
cmp ax, 6
jle 0x5a42a4
mov word [esi], 0
cmp word [esi], 1
sbb al, al
inc al
pop esi
pop ebx
add esp, 0x40
ret 8
Function at 0x5a42d0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x50
push esi
lea eax, [esp + 0x44]
push 0x10
push eax
call fcn.005a3d20
lea eax, [esp + 0x24]
push 0x10
push eax
call fcn.005a3d80
lea eax, [esp + 0x34]
push 0x10
push eax
call fcn.005a3f30
lea eax, [esp + 4]
push 0x10
push eax
call fcn.005a3ee0
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x18]
push 0x10
push eax
lea eax, [esp + 0x40]
push 0x5a42c0
push eax
lea eax, [esp + 0x38]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
mov esi, eax
or esi, esi
je 0x5a433f
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 8]
push eax
call fcn.005a35b0
mov ecx, dword [esp + 0x5c]
mov byte [ecx], al
cmp esi, 1
sbb al, al
inc al
pop esi
add esp, 0x50
ret 8

Function at 0x5a4350
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x30
lea eax, [esp + 0x20]
push 0x10
push eax
call fcn.005a3d20
lea eax, [esp]
push 0x10
push eax
call fcn.005a3d80
lea eax, [esp + 0x10]
push 0x10
push eax
call fcn.005a3e90
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x14]
push 0
push eax
lea eax, [esp + 0xc]
push eax
call sub.KERNEL32.dll_GetPrivateProfileIntA
mov ecx, dword [esp + 0x34]
cmp eax, 1
mov word [ecx], ax
sbb cl, cl
inc cl
mov al, cl
add esp, 0x30
ret 4

Function at 0x5a43c0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x70
push esi
mov esi, dword [esp + 0x78]
push 0x10
mov word [esi], 0
lea eax, [esp + 8]
push 0
push eax
call fcn.005a3740
lea eax, [esp + 0x64]
push 0x10
push eax
call fcn.005a3d20
lea eax, [esp + 0x44]
push 0x10
push eax
call fcn.005a3d80
lea eax, [esp + 0x54]
push 0x10
push eax
call fcn.005a3de0
lea eax, [esp + 0x34]
push 0x10
push eax
call fcn.005a3f90
lea eax, [esp + 0x24]
push 0x10
push eax
call fcn.005a4040
lea eax, [esp + 0x14]
push 0x10
push eax
call fcn.005a3ff0
lea eax, [esp + 0x64]
push eax
lea eax, [esp + 8]
push 0x10
push eax
lea eax, [esp + 0x60]
push 0x5a43b0
push eax
lea eax, [esp + 0x58]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
or eax, eax
je 0x5a4493
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 8]
push eax
call fcn.005a35b0
or al, al
je 0x5a4461
mov word [esi], 2
jmp 0x5a4493
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 8]
push eax
call fcn.005a35b0
or al, al
je 0x5a447b
mov word [esi], 3
jmp 0x5a4493
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 8]
push eax
call fcn.005a35b0
or al, al
je 0x5a4493
mov word [esi], 1
cmp word [esi], 1
sbb al, al
inc al
pop esi
add esp, 0x70
ret 4
Function at 0x5a4680
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 4
push ebx
push esi
push edi
push ebp
mov esi, dword [esp + 0x18]
mov byte [esp + 0x13], 0
lea eax, [esi + 4]
mov edi, dword [esp + 0x1c]
mov dword [esi], eax
mov ax, word [edi + 4]
mov word [esi + 4], ax
mov ax, word [edi + 0xa]
mov word [esi + 6], ax
mov ax, word [edi + 0x14]
mov word [esi + 0x16], ax
mov ax, word [edi + 8]
mov word [esi + 8], ax
mov ax, word [edi + 6]
mov word [esi + 0xa], ax
lea eax, [esi + 0x24]
mov dword [esi + 0x10], eax
lea eax, [esi + 4]
push eax
call fcn.005a4580
or al, al
jne 0x5a480a
test byte [edi + 0x1c], 4
je 0x5a46e3
mov byte [esp + 0x13], 1
sub cx, cx
sub dx, dx
lea esp, [esp]
mov ebp, ecx
and ebp, 0xffff
lea eax, [ebp*8]
sub eax, ebp
shl eax, 2
lea eax, [eax + eax*4]
lea ebx, [esi + eax]
lea eax, [ebp*4]
mov word [ebx + 0x36], cx
lea eax, [eax + eax*8]
lea ebp, [edi + eax]
mov ax, word [ebp + 0xe]
mov word [ebx + 0x9c], ax
mov ax, word [ebp + 0x12]
mov word [ebx + 0x8e], ax
mov ax, word [ebp + 0x16]
mov word [ebx + 0x34], ax
mov ax, word [ebp + 0x18]
mov word [ebx + 0x32], ax
mov eax, dword [ebp + 0x1c]
mov dword [ebx + 0x2c], eax
cmp cx, 3
mov eax, dword [ebp + 0x20]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp + 0x24]
mov dword [ebx + 0x28], eax
lea eax, [esi + 4]
mov dword [ebx + 0xa4], eax
jne 0x5a4770
mov dword [ebx + 0xa8], 0
jmp 0x5a477c
lea eax, [ebx + 0xb0]
mov dword [ebx + 0xa8], eax
or cx, cx
jne 0x5a4790
mov dword [ebx + 0xac], 0
jmp 0x5a4799
lea eax, [ebx - 0x68]
mov dword [ebx + 0xac], eax
cmp byte [esp + 0x13], 0
je 0x5a47b0
cmp word [ebp + 0xe], 0xffff
jne 0x5a47b0
or dword [ebx + 0x2c], 8
jmp 0x5a47b6
mov word [ebx + 0x36], dx
inc dx
inc cx
cmp cx, 4
jb 0x5a46f0
push esi
call fcn.005a45f0
push esi
call fcn.005a4530
push esi
call fcn.005a44f0
mov eax, dword [esi + 0x10]
push eax
call fcn.005a59b0
mov word [esi + 0xc], ax
or ax, ax
je 0x5a4800
lea eax, [esi + 4]
push eax
call fcn.005a5800
sub ax, ax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 8
push esi
call fcn.005a44c0
mov ax, 9
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 8

Function at 0x5a6900
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
push esi
push edi
lea eax, [esp + 0xa]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
push eax
push esi
call fcn.005a4820
mov eax, dword [esp + 0xc]
push 0xd
mov ax, word [eax + 4]
push eax
call fcn.005a6430
or al, al
jne 0x5a698a
mov eax, dword [esp + 0x10]
push eax
push esi
call fcn.005a7220
or al, al
jne 0x5a698a
mov eax, dword [esp + 0xc]
mov ax, word [eax + 0xa]
push eax
mov eax, dword [esp + 0x10]
mov al, byte [eax + 8]
push eax
mov eax, dword [esp + 0x14]
mov ax, word [eax + 6]
push eax
mov eax, dword [esp + 0x18]
mov ax, word [eax + 4]
push eax
mov eax, dword [esp + 0x20]
push eax
push esi
call fcn.005a70e0
mov di, ax
mov eax, dword [esp + 0x10]
push eax
push esi
call fcn.005a7270
or di, di
je 0x5a698a
mov ax, di
pop edi
pop esi
add esp, 0xc
ret 8
Function at 0x5a6a30
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [esp + 0xe]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
mov edi, dword [esp + 0x28]
push eax
mov esi, dword [esp + 0x28]
push edi
push esi
call fcn.005a4820
lea eax, [esp + 0xe]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
push edi
push esi
call fcn.005a4820
mov eax, dword [esp + 0x10]
push 0xe
mov ax, word [eax + 4]
push eax
call fcn.005a6430
or al, al
jne 0x5a6b13
mov eax, dword [esp + 0x14]
push eax
push esi
call fcn.005a7220
mov bx, ax
or bl, bl
jne 0x5a6ae2
mov eax, dword [esp + 0x10]
mov ax, word [eax + 0xe]
push eax
mov eax, dword [esp + 0x14]
mov ax, word [eax + 0xc]
push eax
mov eax, dword [esp + 0x18]
mov ax, word [eax + 0xa]
push eax
mov eax, dword [esp + 0x1c]
mov al, byte [eax + 8]
push eax
mov eax, dword [esp + 0x20]
mov ax, word [eax + 6]
push eax
mov eax, dword [esp + 0x24]
mov ax, word [eax + 4]
push eax
mov eax, dword [esp + 0x2c]
push eax
push esi
call fcn.005a7130
mov bx, ax
mov eax, dword [esp + 0x14]
push eax
push esi
call fcn.005a7270
push esi
call fcn.005a4930
cmp ax, 0xd
jne 0x5a6af2
mov bx, 0xd
cmp bl, 0xd
je 0x5a6afd
cmp bx, 3
jne 0x5a6b10
mov ax, word [esp + 0xe]
dec word [esp + 0xe]
or ax, ax
jne 0x5a6a82
mov ax, bx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 8

Function at 0x5a88c0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0xc
push esi
mov byte [esp + 4], 0x52
mov byte [esp + 5], 0x4e
mov byte [esp + 6], 0x42
mov byte [esp + 7], 0x4f
mov byte [esp + 8], 0x44
mov byte [esp + 9], 0x52
mov byte [esp + 0xa], 0x56
mov ax, word [esp + 0x18]
add al, 0x30
mov byte [esp + 0xb], al
mov esi, dword [esp + 0x14]
mov byte [esp + 0xc], 0
mov dword [esi], 0
push 0
push 0x80
push 3
push 0
push 3
lea eax, [esp + 0x18]
push 0xc0000000
push eax
call sub.KERNEL32.dll_CreateFileA
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x5a8956
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
jb 0x5a8933
cmp eax, 3
jbe 0x5a894b
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x5a8940
push eax
call sub.KERNEL32.dll_CloseHandle
mov ax, 0x80b
pop esi
add esp, 0xc
ret 8
mov ax, 0x80c
pop esi
add esp, 0xc
ret 8
mov ax, 0x800
pop esi
add esp, 0xc
ret 8

Function at 0x5a8970
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 4
push ebx
push esi
push edi
mov esi, dword [esp + 0x18]
push esi
mov word [esi + 6], 0xffff
call fcn.005a8860
lea eax, [esp + 0xc]
push 0
push eax
xor eax, eax
mov ax, word [esi + 2]
push eax
mov edi, dword [esp + 0x20]
push esi
mov eax, dword [edi]
push eax
call sub.KERNEL32.dll_WriteFile
mov ebx, eax
or ebx, ebx
je 0x5a89c0
lea eax, [esp + 0xc]
push 0
push eax
xor eax, eax
mov ax, word [esi + 2]
push eax
push esi
mov eax, dword [edi]
push eax
call sub.KERNEL32.dll_ReadFile
mov ebx, eax
push esi
call fcn.005a8820
or ebx, ebx
je 0x5a89d2
cmp word [esi + 6], 0xffff
jne 0x5a89d8
mov word [esi + 6], 0x83b
mov ax, word [esi + 6]
pop edi
pop esi
pop ebx
add esp, 4
ret 8
Function at 0x5a8b00
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x10
push esi
mov al, byte [esp + 0x1c]
push eax
lea eax, [esp + 8]
push eax
call fcn.005a8ac0
push 0
push 0x80
push 3
push 0
push 3
lea eax, [esp + 0x18]
push 0xc0000000
push eax
call sub.KERNEL32.dll_CreateFileA
mov esi, dword [esp + 0x18]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x5a8b70
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
jb 0x5a8b49
cmp eax, 3
jbe 0x5a8b61
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x5a8b56
push eax
call sub.KERNEL32.dll_CloseHandle
mov ax, 0x20b
pop esi
add esp, 0x10
ret 8
mov ax, 0x20c
pop esi
add esp, 0x10
ret 8
mov ax, 0x200
pop esi
add esp, 0x10
ret 8

Function at 0x5a8b80
Capabilities:
Check if file exists
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
mov byte [esp + 4], 0x5c
mov byte [esp + 5], 0x5c
mov byte [esp + 6], 0x2e
mov byte [esp + 7], 0x5c
mov byte [esp + 8], 0x53
mov byte [esp + 9], 0x6e
mov byte [esp + 0xa], 0x74
mov byte [esp + 0xb], 0x6e
mov byte [esp + 0xc], 0x6c
mov byte [esp + 0xd], 0x55
mov byte [esp + 0xe], 0x73
mov byte [esp + 0xf], 0x62
mov byte [esp + 0x10], 0
push 0
push 0x80
push 3
push 0
push 3
lea eax, [esp + 0x18]
push 0xc0000000
push eax
call sub.KERNEL32.dll_CreateFileA
mov esi, dword [esp + 0x18]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x5a8c20
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
jb 0x5a8bfb
cmp eax, 3
jbe 0x5a8c13
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x5a8c08
push eax
call sub.KERNEL32.dll_CloseHandle
mov ax, 0x20b
pop esi
add esp, 0x10
ret 8
mov ax, 0x20c
pop esi
add esp, 0x10
ret 8
mov ax, 0x200
pop esi
add esp, 0x10
ret 8

Function at 0x5a8c40
Capabilities:
Read file on windows

Disassembly:
sub esp, 4
push esi
push edi
mov esi, dword [esp + 0x14]
push esi
mov word [esi + 6], 0xffff
call fcn.005a8860
lea eax, [esp + 8]
push 0
push eax
xor eax, eax
mov ax, word [esi + 2]
push eax
mov eax, dword [esp + 0x1c]
push esi
mov eax, dword [eax]
push eax
call sub.KERNEL32.dll_ReadFile
mov edi, eax
push esi
call fcn.005a8820
cmp edi, 1
jne 0x5a8c85
cmp word [esi + 6], 0xffff
jne 0x5a8c8b
mov word [esi + 6], 0x23b
mov ax, word [esi + 6]
pop edi
pop esi
add esp, 4
ret 8
Function at 0x5a8e40
Capabilities:
Contain obfuscated stackstrings
Read .ini file

Disassembly:
sub esp, 0x24
mov byte [esp + 8], 0x53
mov byte [esp + 9], 0x59
mov byte [esp + 0xa], 0x53
mov byte [esp + 0xb], 0x54
mov byte [esp + 0xc], 0x45
mov byte [esp + 0xd], 0x4d
mov byte [esp + 0xe], 0x2e
mov byte [esp + 0xf], 0x49
mov byte [esp + 0x10], 0x4e
mov byte [esp + 0x11], 0x49
mov byte [esp + 0x12], 0
mov byte [esp + 0x14], 0x53
mov byte [esp + 0x15], 0x65
mov byte [esp + 0x16], 0x6e
mov byte [esp + 0x17], 0x74
mov byte [esp + 0x18], 0x69
mov byte [esp + 0x19], 0x6e
mov byte [esp + 0x1a], 0x65
mov byte [esp + 0x1b], 0x6c
mov byte [esp + 0x1c], 0x53
mov byte [esp + 0x1d], 0x65
mov byte [esp + 0x1e], 0x74
mov byte [esp + 0x1f], 0x75
mov byte [esp + 0x20], 0x70
mov byte [esp + 0x21], 0
mov byte [esp], 0x49
mov byte [esp + 1], 0x6f
lea eax, [esp + 8]
mov byte [esp + 2], 0x45
mov byte [esp + 3], 0x6e
mov byte [esp + 4], 0x74
mov byte [esp + 5], 0x72
mov byte [esp + 6], 0x79
mov byte [esp + 7], 0
push eax
lea eax, [esp + 4]
push 0
push eax
lea eax, [esp + 0x20]
push eax
call sub.KERNEL32.dll_GetPrivateProfileIntA
add esp, 0x24
ret

Function at 0x5af633
Capabilities:
Check os version
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
pop dword [esp - 4]
jno 0x5d38d4
shl cl, 0x20
jo 0x5af645
invalid
jo 0x5d38d4
or byte [edi], 0x8d
inc ebp
cld
push 0
jmp 0x5af653
push eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0xc]
push 6
push ecx
lea edx, [ebp - 0xc]
push 0x5e1875
ret
push esi
ja 0x5b9507
xchg bl, ch
xchg ch, bl
jbe 0x5d38e3
jecxz 0x5d394a
xchg bx, di
xchg ebx, edi
xchg di, bx
mov esi, dword [ebp + 8]
shl dx, 0x20
mov ebp, ebp
jmp fcn.005c7a95
add byte [eax - 0x627df0fe], ch
retf 0

Function at 0x5b22a1
Capabilities:
Check os version
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
pop dword [esp - 4]
mov eax, dword [0x77c4b1]
test eax, eax
jb 0x5e2103
xchg dl, dh
xchg dh, dl
jne 0x5e344b
je 0x5b22c1
fadd st(0), st(0)
std
call fcn.005ca407
test eax, eax
jb 0x5c92e1
xchg bx, di
xchg di, bx
jne 0x5e344b
je 0x5b22df
js 0x5b2323
adc eax, 0x89665e5f
rcr byte [ebx + 0x5d], 0xc3
ret 0xf1d
pop edi
pop esi
mov ax, ax
pop ebx
pop ebp
ret
sbb ecx, dword [eax + 0x5d]
add byte [eax], al
popal
add byte [eax + 0x38], al
add byte [ecx], ah
add byte [eax], al
mov esp, 0
adc byte [eax], al
add byte [eax], al
inc eax
add byte [eax], al
xor byte [eax], al
add byte [eax], al
cwde
enter 0x5d, 0x66
bound ebx, qword [ebp]
xor byte [eax], al
add byte [eax], al
xor al, 0
add byte [eax], al
movsb byte es:[edi], byte [esi]
and byte [eax + eax + 0x20], bl
add byte [eax], al
add byte [eax], dh
add byte [eax], al
add byte [eax + 0xc005c], ah
add byte [eax], al
xor al, 0
add byte [eax], al
invalid
add eax, 0xff5e8d57
Function at 0x5b4e17
Capabilities:
Check os version
Encrypt data using speck

Disassembly:
jno 0x5c79a1
jo 0x5b4e23
adc bh, byte ds:[ecx - 0x59]
jo 0x5c79a1
adc byte [ecx + 0x2df226ff], 0xf
xchg dword [edx - 0x69], esp
push ebp
js 0x5c5895
jns 0x5c79ac
cmc
lds ecx, [edi]
mov ebx, esp
fdivp st(7)
inc edi
cmp eax, 0x10820f
add byte [eax], al
shr cl, 0x40
jae 0x5c79c3
jns 0x5c5895
invalid
nop
cpuid
ret 0x768d
lea esi, [esi + 8]
jmp dword [esi]

Function at 0x5b7d7f
Capabilities:
Authenticate hmac
Check os version
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using speck

Disassembly:
js 0x5bd409
jns 0x5b7d8b
invalid
jns 0x5bd409
sub dl, 0xff
mov ebx, 0x66c98845
xchg esi, edx
xchg dx, si
mov ecx, dword [esi + 4]
mov dh, dh
mov ebx, dword [esi + 8]
lea esi, [esi + 0xc]
rol byte [ebx], cl
jmp dword [esi]
mov ax, ax
jno 0x5c63a3
jo 0x5bd418
cpuid
ret
jo 0x5c63a3
xor al, 0x77
call fcn.005aea3c
add esp, 0x24
test ax, ax
jb 0x5cfc33
je 0x5bd45e
jne 0x5bd43e
cmp ax, 0x1a
je 0x5bd45e
jne 0x5bd44e
cmp ax, 0xa
jne 0x5cab05
push ebp
mov ebp, esp
mov cx, cx
mov eax, dword [ebp + 0x10]
mov ecx, eax
dec eax
cmp edx, edx
test ecx, ecx
jb 0x5d6c17
jmp 0x5e101f
jmp fcn.005cab06
xor al, 0xf
fld dword [ecx - 0x75]
inc esi
add al, 0xf5
je 0x5c00e0
jne 0x5e1029
dec ebp
retf
mov ebp, ebp
lea ecx, [eax + 1]
push 0x5e489d
ret
Function at 0x5bcb25
Capabilities:
Check os version
Encrypt data using aes mixcolumns step

Disassembly:
push ebp
mov cx, cx
mov ebp, esp
mov eax, dword [ebp + 8]
and eax, 0xff
jb 0x5d1ba1
add eax, 0xffffffd8
cmp eax, 0xc2
lea edi, [edi]
ja 0x5bcb7b
jbe 0x5bcb51
nop
cpuid
ret
xor ecx, ecx
jb 0x5de6b8
shr ecx, 0x40
mov cl, byte [eax + 0x5ed424]
jmp dword [ecx*4 + 0x5ed41c]
xor eax, eax
jb 0x5de6d1
pop ebp
jne 0x5be7d7
mov dx, dx
je 0x5bcb93
cpuid
ret
je 0x5be7d7
add eax, 0x83df5f4
add byte [eax], al
add byte [esi - 0x3f], ah
out 0x20, al
mov byte [ebp + ebx], al
jmp dword [esi]
and dword [ebx - 0x75], ebx
pop ebp
inc esp
mov byte [0x40eac073], al
mov ebx, dword [ebp + 0x44]
mov edx, dword [esi + 8]
mov eax, dword [esi + 4]
jne 0x5e9fac
je 0x5de6ea
sub dword [ebx], ecx
inc ecx
je 0x5e9fac
fld dword [esi]
imul byte [ebp + ebx]
lea esi, [esi + 0xc]
shr cl, 0x40
jne 0x5cb7aa
je 0x5de708
cpuid
ret
je 0x5cb7aa
fidiv dword [edx + 0x1b]
dec eax
pop ebp
add byte [eax], al
popal
add byte [eax + 0x34], al
add byte [ecx], ah
add byte [eax], al
mov esp, 0
adc byte [eax], al
add byte [eax], al
inc eax
add byte [eax], al
xor byte [eax], al
add byte [eax], al
popal
xor byte [ebx], bl
pmaxub mm3, qword [edx]
inc esp
pop ebx
add byte [edi + 0x5d], al
add byte [eax + 0x44c3a20f], dl
pop ebx
add byte [esi - 0x25ffa140], bh
xchg ecx, eax
pop esi
pop ebp
ret
Function at 0x5c3dcc
Capabilities:
Check os version

Disassembly:
jmp dword [esi]
mov esi, dword [ebp - 0x14]
lea edx, [eax + ecx]
cmp edx, esi
jbe 0x5c3dba
mov ah, ah
ja 0x5bf033
sub bh, byte [ecx - 0xc0014eb]
jmp 0x5bf034
push ebx
call fcn.005d53fe
jmp 0x5c3d9f
mov ecx, dword [ebp + 0x20]
xchg cl, ah
xchg ah, cl
mov edx, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x18]
jmp 0x5c394e
push ecx
mov cx, cx
mov ecx, dword [ebp + 0x14]
push edx
mov edx, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
jmp 0x5c3961
add esp, 4
mov ax, 0xa
xchg dx, ax
xchg dx, ax
pop edi
pop esi
pop ebx
mov esp, ebp
xchg edi, edx
xchg edx, edi
pop ebp
ret
ja 0x5e06b1
jbe 0x5c3dc4
inc esi
test byte [edi], 0x86
out 0xc8, eax
add dword [eax], eax
jbe 0x5e06b1
xor eax, 0x24648d90
add al, 0x8b
inc esi
add al, 0xc0
in al, 0x20
mov ebx, dword [esi + 8]
mov dx, dx
lea esi, [esi + 0xc]
cmp esi, esi
and word [ebp + ebx], ax
jb 0x5c3273
shr ebp, 0x40
jmp dword [esi]
iretd
push eax
xchg bh, ah
xchg ah, bh
call fcn.005e9905
and eax, 0x8568b0b
mov ax, word [ebp + eax]
lea esi, [esi + 0xc]
and word [ebx + edx], ax
jb 0x5ca9f0
ja 0x5bec55
jbe 0x5e06df
cpuid
aas
ret
jbe 0x5bec55
fst dword [edx - 0x3dbbb71]
cmp eax, 2
je 0x5c3940
jne 0x5e06fc
jl 0x5e0738
sub ah, 0
cmp eax, 5
je 0x5cc06b

Function at 0x5c9f8e
Capabilities:
Check os version
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using speck

Disassembly:
pop dword [esp - 4]
mov byte [esi + 0xba], cl
mov byte [esi + 0xbb], 0
jne 0x5cc46f
je 0x5c9fa9
and al, 0xc5
je 0x5cc46f
invalid
push eax
shl cl, 0x20
lea eax, [eax]
jmp 0x5cc477
push esi
mov word [esi + 0xbc], dx
shl cl, 0x20
call fcn.005bc8d2
shl eax, 0x20
call fcn.005e424d
fnstcw word [ecx + 0x5b]
mov esp, ebp
pop ebp
ret
Function at 0x5ca020
Capabilities:
Check os version

Disassembly:
sub esp, 0x10
push ebx
push edi
pop edi
push esi
push edi
js 0x5c9ff5
jns 0x5adef7
pop ecx
pop edi
jae 0x5adf07
jns 0x5c9ff5
mov eax, edi
rol byte [ecx], 0
add eax, 0x2c26ff20
cli
xchg ebx, ebp
shl bh, 0x20
push ebp
mov ebp, esp
jno 0x5adede
jo 0x5b006e
nop
cpuid
ret 0x800f
jo 0x5adede
invalid
mov edi, dword [ebp + 0x10]
shl cl, 0x20
mov eax, dword [edi]
ja 0x5cce6b
shr ax, 0x40
jbe 0x5ca00b
push 0xffffffffffffffce
jbe 0x5cce6b
and eax, 0xd289664c
mov edx, dword [ebp + 0x38]
call fcn.005d2eb6
and eax, 0x24448f81
cld
js 0x5da17b
xchg ecx, ebp
mov di, di
xchg ebp, ecx
jns 0x5ca037
cpuid
nop
ret
jns 0x5da17b
invalid
push eax
ja 0x5bd3f5
jbe 0x5cce77
or dword [edx], 0x78860fe6
add eax, 0x3835ffff
add al, 0xe5
pop ebx
jbe 0x5bd3f5
xor eax, 0x5be50438
add byte [esi + 0x1c], bh
pop esp
add byte [edx], cl
sbb dword [ebp], ebx
xchg edx, eax
into
pop esp
add byte [ebx + 0x190af254], bh
pop ebp
add byte [esi + 0x1c], bh
pop esp
add bh, al
jae 0x5cce85
cmc
jne 0x5ccea1
add byte [ebx - 0x531617bb], cl
aaa
add byte [eax], al
cmp byte [eax], 0xc0
loopne 0x5ccece
mov al, byte [ebp + eax]
lea edi, [edi]
push 0x5b4db1
ret
add byte [edi], cl
adc byte [edx + 0x38], 0
add byte [ebp + 0x40fd04], cl
add byte [eax], al
mov al, byte [ebp + 0xb]
mov bl, bl
shl cl, 0x20
jmp 0x5da184
push esi
mov ah, ah
mov bh, bh
mov byte [esi + 0xba], bl
jno 0x5b3088
jo 0x5da19b
pop esi
sti
sbb al, 0xf
and bh, 0x8e
std
inc dword [edx + 0x24448f4d]
pop dword [esp - 4]
jo 0x5b3088
or byte [ebp - 0x71], 0x44
and al, 0xfc

Function at 0x5ca427
Capabilities:
Check os version
Encrypt data using aes mixcolumns step

Disassembly:
push ebp
ja 0x5d6136
jbe 0x5b4612
dec edi
sbb dword [esi], edx
sbb dword [edi], ecx
xchg byte [esi], bl
sbb eax, dword [edx]
add byte [edx + 0x40eac150], al
jbe 0x5d6136
adc byte [eax - 0x3f], 0xea
inc eax
jno 0x5b4605
jo 0x5ca432
dec edi
xor edi, ecx
jo 0x5b4605
xor eax, 0xfbe1e8e0
invalid
Function at 0x5cde80
Capabilities:
Check os version
Encode data using base64

Disassembly:
lea esp, [esp + 4]
mov ebx, dword [esi + 8]
shr ebx, 0x40
mov ecx, dword [esi + 4]
mov ebx, dword [ebp + ebx]
call fcn.005bf3f0
ficom dword [0xff5ffeb]
test dword [edi], edi
and edi, esi
push dword [ebx + eax - 0x2c]
xchg dword [edi + ecx - 0x1dccb7c], edx
invalid

Function at 0x5d13df
Capabilities:
Check os version
Encrypt data using aes mixcolumns step

Disassembly:
pop dword [esp - 4]
call fcn.005b065a
fxch st(1)

Function at 0x5d231d
Capabilities:
Check os version
Encrypt data using aes mixcolumns step

Disassembly:
mov ebx, ebx
jmp 0x5d230f
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
call fcn.005c283b
and eax, 0xab850f1d
int3

Function at 0x5d2eb6
Capabilities:
Check os version

Disassembly:
lea esp, [esp + 4]
lea esi, [esi + 4]
push 0xd30569ff
mov dword [esp], ebx
pushfd
mov ebx, 0xf597a04e
sub ebx, 0x800edc60
popfd
push eax
pop eax
call fcn.005c490a
xor eax, 0xee850f71
mov al, 0xfd
push dword [edx + eax - 0x68]