joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e6da50b
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov eax, eax
mov ebp, esp
push edi
push 5
pop edi
push ecx
mov ecx, dword [ebp + 0x10]
sub ecx, edi
pop ecx
jae 0x5e6da527
push 4
nop
nop
pop eax
jmp 0x5e6da5cd
mov edx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
movzx ecx, byte [edx + 4]
test dword [0x6104a63a], 0xd800541c
js 0x5e6c8c9d
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
nop
nop
movzx eax, byte [edx + 2]
shl ecx, 8
cmp dword [0x61035aeb], 0x4ea6fcdb
jne 0x5e6da584
wait
cmp dh, dh
or byte [edi + 0x9551a75], cl
jbe 0x5e6da54c
arpl word [0x6e631b], di
sahf
and dh, dh
hlt
or ecx, eax
nop
nop
nop
movzx eax, byte [edx + 1]
shl ecx, 8
or ecx, eax
mov eax, 0x1000
cmp ecx, eax
cmovb ecx, eax
mov dword [esi + 4], ecx
mov al, byte [edx]
push ecx
mov cl, al
sub cl, 0xe1
pop ecx
jb 0x5e6da5b0
nop
push 4
pop eax
jmp 0x5e6da5cc
movzx eax, al
cdq
push 9
pop ecx
idiv ecx
movzx eax, al
mov byte [esi], dl
cdq
nop
idiv edi
mov byte [esi + 2], al
nop
nop
xor eax, eax
mov byte [esi + 1], dl
pop esi
mov eax, eax
pop edi
mov ecx, ecx
pop ebp
mov ecx, ecx
ret
Function at 0x5e6dfc0e
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, eax
mov eax, dword [ebp + 0x10]
test byte [0x61096e4d], 0xf1
jb 0x5e70df2b
push esi
cmp byte [0x61064009], 0x68
je 0x5e6dfc5d
daa
mov al, ah
and al, 0xbd
invalid
push dword [ebp + 0x1c]
mov esi, dword [ebp + 8]
push dword [ebp + 0x18]
push 0
mov dword [esi + 0x290], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [esi + 0xb4], 1
test dword [0x6109e673], 0xcb348960
jae 0x5e6dfcc6
xchg ebx, eax
stosd dword es:[edi], eax
fstp qword [ebx]
and dword [0x1fa3608], eax
retf 0xe205
mov dword [esi + 0x7c], eax
call fcn.5e6de7ad
mov eax, eax
add esp, 0x10
push ebx
mov ebx, eax
and ebx, eax
pop ebx
jne 0x5e6dfcef
push dword [ebp + 0x14]
mov eax, eax
push esi
nop
nop
nop
call fcn.5e6dfcf5
mov ecx, ecx
pop ecx
nop
nop
pop ecx
nop
nop
pop esi
pop ebp
nop
ret
jmp fcn.5e6d04dc
nop
nop
push edi
test dword [0x610dcc29], 0x5df024ca
jo 0x5e6d5e6b
mov edi, dword [ebp + 0xc]
mov eax, edi
and eax, ebx
movlpd qword [ebp - 8], xmm0
test dword [0x60fd7177], 0xbe7e91d0
jo 0x5e70d554
movlpd qword [ebp - 0x10], xmm0
cmp eax, 0xffffffff
je 0x5e700670
mov eax, eax
mov edx, edi
mov esi, ebx
sub edx, dword [ecx + 8]
mov dword [ecx + 8], edi
sbb esi, dword [ecx + 0xc]
mov dword [ecx + 0xc], ebx
jmp 0x5e70067b
mov eax, eax
mov esi, dword [ebp - 4]
nop
nop
nop
mov edx, dword [ebp - 8]
mov ebx, dword [ebp + 0x14]
mov eax, ebx
mov ecx, ecx
mov edi, dword [ebp + 0x18]
test byte [0x60ff84d6], 0x45
js 0x5e72a431
and eax, edi
cmp eax, 0xffffffff
je 0x5e7006ac
mov eax, ebx
sub eax, dword [ecx + 0x10]
mov dword [ecx + 0x10], ebx
sbb edi, dword [ecx + 0x14]
mov ebx, dword [ebp + 0x18]
mov dword [ecx + 0x14], ebx
jmp 0x5e7006b2
mov edi, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
nop
nop
push edi
push eax
nop
nop
push esi
push edx
push dword [ecx + 4]
call fcn.5e6fec69
add esp, 0x14
pop edi
pop esi
pop ebx
mov eax, eax
mov esp, ebp
pop ebp
ret
je 0x5e700623
mov eax, dword [esi + 8]
nop
push dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov edx, dword [ebp + 0x14]
mov edi, eax
test edx, edx
je 0x5e70ac03
mov ecx, dword [ebp - 4]
mov dword [edx], ecx
nop
nop
mov ecx, dword [esi + 0xc]
push ebx
mov ebx, ecx
and ebx, ecx
pop ebx
je 0x5e70ac1a
push 0
push dword [ebp + 0x10]
call fcn.5e7088ae
mov eax, edi
pop edi
mov eax, eax
pop esi
mov ecx, ecx
mov esp, ebp
mov ecx, ecx
pop ebp
ret 0x10
nop
nop
xor eax, eax
jmp 0x5e70e127
call fcn.5e719214
jmp 0x5e70de8a
call fcn.5e71ad14
jmp 0x5e70de9c
push ebx
mov ebx, eax
and ebx, eax
pop ebx
js 0x5e70df60
push 0
cmp dword [0x60fdf386], 0x59249425
js 0x5e70abe2
call 0x5e70d16d
nop
nop
pop ecx
push edx
mov edx, eax
and edx, eax
pop edx
jne 0x5e70df60
inc dword [0x610ec7ee]
jmp 0x5e70e124
mov eax, eax
call fcn.5e71b47b
jmp 0x5e70df0f
xor eax, eax
inc eax
call fcn.5e716bae
ret 0xc
jmp 0x5e6ecbc6

Function at 0x5e6e2cf4
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
lea eax, [ebp - 0x44]
test dword [0x610ac989], 0x401c2063
jo fcn.5e6e8366
push ebx
nop
nop
mov ebx, dword [ebp + 8]
nop
Function at 0x5e6e3d8a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, ecx
mov edx, dword [ebp + 0x14]
mov eax, eax
mov eax, dword [ebp + 0xc]
push edi
cmp byte [0x61009e67], 0x1e
je 0x5e72a84e
xor edi, edi
mov ecx, ecx
mov edx, dword [edx]
nop
nop
and edx, 7
cmp eax, 5
jae 0x5e6e3dc0
nop
nop
nop
xor eax, eax
jmp 0x5e6e4007
mov ecx, ecx
add dword [ebp + 0x10], 5
lea ecx, [eax - 4]
push ebx
mov ebx, dword [ebp + 8]
mov ecx, ecx
add ecx, ebx
nop
push esi
mov dword [ebp + 0xc], ecx
lea esi, [edi + ebx]
nop
nop
nop
jmp 0x5e6e3e2b
mov al, byte [esi]
test byte [0x610ac1f5], 0xb5
jae 0x5e6e3e1f
int3
and al, 0xfe
push ebx
mov bl, al
sub bl, 0xe8
pop ebx
je 0x5e6e3e33
inc esi
push edx
mov edx, esi
sub edx, ecx
pop edx
jb 0x5e6e3dde
mov ecx, ecx
mov ecx, esi
sub ecx, edi
mov edi, esi
sub ecx, ebx
sub edi, ebx
cmp esi, dword [ebp + 0xc]
jae 0x5e6e3fbf
push ebx
mov ebx, ecx
sub ebx, 2
pop ebx
jbe 0x5e6e3ed9
mov eax, eax
xor edx, edx
movzx ebx, byte [esi + 4]
test dword [0x610b52c2], 0xaa579622
jo 0x5e6d4226
lea eax, [ebx + 1]
test al, 0xfe
jne 0x5e6e3fa9
mov eax, eax
movzx eax, byte [esi + 3]
test byte [0x60fdea72], 0xa7
jae 0x5e6e3eaa
mov es, word [0xe57efa37]
xchg edx, eax
xchg esi, eax
invalid
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 2]
shl ebx, 8
nop
nop
nop
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
mov eax, dword [ebp + 0x10]
add eax, edi
add edi, 5
cmp dword [ebp + 0x18], 0
mov dword [ebp - 4], eax
je 0x5e6e3f22
add ebx, eax
jmp 0x5e6e3f26
shr edx, cl
push eax
mov eax, edx
and eax, edx
pop eax
je 0x5e6e3e59
push ebx
mov ebx, edx
sub ebx, 4
pop ebx
ja 0x5e6e3f10
push ecx
mov ecx, edx
sub ecx, 3
pop ecx
je 0x5e6e3f10
mov eax, edx
shr eax, 1
movzx eax, byte [eax + esi + 1]
inc eax
push ecx
mov cl, al
and cl, 0xfe
pop ecx
jne 0x5e6e3e59
or edx, 8
shr edx, 1
mov eax, eax
inc edi
mov eax, eax
mov ecx, dword [ebp + 0xc]
jmp 0x5e6e3dd6
mov ecx, ecx
sub ebx, eax
test edx, edx
je 0x5e6e3f82
cmp dword [0x610c5cd7], 0x700342f2
je 0x5e729a5c
and edx, 6
nop
mov eax, ebx
shl edx, 2
mov ecx, edx
shr eax, cl
inc eax
push ecx
mov cl, al
and cl, 0xfe
pop ecx
jne 0x5e6e3f7e
mov eax, eax
mov eax, 0x100
test word [0x6100ceb6], 0x1a7f
jo 0x5e6fbe7e
shl eax, cl
nop
nop
dec eax
xor ebx, eax
cmp dword [ebp + 0x18], 0
je 0x5e6e3f7b
mov ecx, ecx
add ebx, dword [ebp - 4]
jmp 0x5e6e3f7e
sub ebx, dword [ebp - 4]
nop
nop
xor edx, edx
mov eax, ebx
mov byte [esi + 1], bl
shr eax, 8
mov eax, eax
mov byte [esi + 2], al
nop
nop
mov eax, ebx
shr ebx, 0x18
shr eax, 0x10
nop
and bl, 1
mov eax, eax
neg bl
mov byte [esi + 3], al
mov byte [esi + 4], bl
jmp 0x5e6e3fb6
nop
nop
nop
or edx, 8
mov eax, eax
shr edx, 1
mov eax, eax
inc edi
mov ebx, dword [ebp + 8]
nop
jmp 0x5e6e3f18
test dword [0x6100147e], 0xe149e241
jno 0x5e6e3fef
popfd
inc ebp
popal
cmpsb byte [esi], byte es:[edi]
cmp bh, byte [edi]
mov ebp, 0x8a204ed1
jmp 0x53f85e54
xor eax, eax
nop
shr edx, cl
push eax
mov eax, ecx
lodsb al, byte [esi]
ret 0xd4ec
mov eax, 0x5e72fe9c
jmp fcn.5e711bbd
mov ecx, ecx
lea ecx, [ebp - 0x30]
nop
jmp fcn.5e70436b
Function at 0x5e6e4bd4
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x20], 0
mov eax, eax
and dword [eax + 0x24], 0
mov dword [eax], 0x6a09e667
mov ecx, ecx
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov eax, eax
mov dword [eax + 0x1c], 0x5be0cd19
pop ebp
ret
Function at 0x5e6e7ea9
Capabilities:
Get file size

Disassembly:
push ebp
mov ecx, ecx
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
nop
nop
nop
push eax
cmp byte [0x6102cc06], 0x5f
js 0x5e6eb78c
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x5e6e7eea
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov ebx, eax
and ebx, eax
pop ebx
je 0x5e6e7eea
nop
nop
xor al, al
nop
nop
nop
jmp 0x5e6e7f03
mov eax, dword [ebp + 8]
xor ecx, ecx
mov eax, eax
mov edx, dword [ebp - 4]
add ecx, esi
adc edx, 0
nop
nop
nop
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
mov esp, ebp
pop ebp
mov eax, eax
ret 4
push dword [ebp - 0x18]
test al, al
jne 0x5e6eb7a4
mov eax, eax
call fcn.5e6d68f8
pop ecx
mov ecx, ecx
mov eax, 0x80070057
jmp 0x5e6eb7fa
lea ecx, [ebx + 0xc]
call fcn.5e6c9d68
cmp dword [0x60ff4838], 0xf770049b
je 0x5e6cafc0
push dword [ebp - 0x18]
nop
nop
or dword [ebp - 4], 0xffffffff
call fcn.5e6d68f8
pop ecx
test edi, edi
jns 0x5e6eb7d5
xor eax, eax
mov ecx, ecx
jmp 0x5e6eb7fa
mov ecx, ecx
mov eax, dword [ebp + 8]
lea esi, [ebx + 0x18]
mov ecx, esi
mov eax, dword [eax]
nop
lea eax, [eax + edi*2]
mov eax, eax
add eax, 2
push eax
mov eax, eax
call fcn.5e6c9049
push esi
mov ecx, ebx
call fcn.5e6eba91
nop
mov ecx, dword [ebp - 0xc]
pop edi
nop
nop
nop
pop esi
pop ebx
nop
nop
mov dword fs:[0], ecx
mov esp, ebp
nop
nop
pop ebp
mov ecx, ecx
ret 4

Function at 0x5e6e82b5
Capabilities:
Write file on windows

Disassembly:
push ebp
nop
nop
mov ebp, esp
mov edx, dword [ebp + 0xc]
lea eax, [ebp + 0xc]
cmp edx, dword [0x610e8384]
push 0
cmova edx, dword [0x610e8384]
and dword [ebp + 0xc], 0
push eax
cmp dword [0x610a92b0], 0xb14afa20
jne fcn.5e715ac3
push edx
push dword [ebp + 8]
test dword [0x61017cee], 0xc3cfcab0
jo 0x5e6b76af
push dword [ecx]
nop
nop
nop
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, ecx
mov edx, dword [ebp + 0x10]
test eax, eax
mov ecx, dword [ebp + 0xc]
setne al
mov eax, eax
mov dword [edx], ecx
pop ebp
ret 0xc
Function at 0x5e6e9f2f
Capabilities:
Delete file

Disassembly:
push ebp
mov eax, eax
mov ebp, esp
push dword [ebp + 8]
mov eax, eax
call fcn.5e6eac2d
pop ecx
cmp eax, 0xffffffff
je 0x5e6e9ff8
push ecx
mov cl, al
and cl, 0x10
pop ecx

Function at 0x5e6ea00c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x610b789c], 0x5f
je 0x5e6be90c
sub esp, 0x20c
push esi
nop
nop
nop
push edi
mov edi, dword [ebp + 8]
nop
xor ecx, ecx
mov eax, dword [edi]
and dword [edi + 4], 0
mov word [eax], cx
xor eax, eax
mov word [ebp - 0x20c], ax
nop
nop
lea eax, [ebp - 0x20c]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
nop
mov esi, eax
nop
mov ecx, edi
lea eax, [ebp - 0x20c]
push eax
nop
call fcn.5e6c9049
mov eax, eax
lea eax, [esi - 1]
nop
mov ecx, 0x103
cmp ecx, eax
pop edi
sbb eax, eax
inc eax
pop esi
nop
mov esp, ebp
pop ebp
nop
ret

Function at 0x5e6ea0ba
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ecx, ecx
mov ebp, esp
push dword [ebp + 0xc]
mov eax, eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
pop ebp
mov ecx, ecx
ret

Function at 0x5e6ea19d
Capabilities:
Print debug messages

Disassembly:
push ebp
test dword [0x610d41f7], 0x67bd6510
jne 0x5e6ea1db
jo 0x5e6ea167
cmp cl, al
sub al, 0xe9
fbld tbyte [ebx - 0x49]
fcmovb st(0), st(0)
and dword [ebx], ebp
cmp dword [edx], esi
frstor dword [esi]
out dx, eax
dec eax
lodsb al, byte [esi]
cmp eax, 0xba909852
in al, 0x96
js 0x5e6ea19e
hlt
and edx, dword [esi - 0x687dcc29]
mov ebp, esp
test dword [0x610974eb], 0x2e22d7e7
js 0x5e6b820e
mov edx, dword [ebp + 8]
nop
push esi
mov esi, dword [ebp + 0xc]
mov eax, dword [edx]
mov dword [esi + 0x20], eax
mov eax, dword [edx + 4]
mov dword [esi + 8], eax
mov eax, dword [edx + 8]
mov dword [esi + 0xc], eax
cmp dword [0x60fdf713], 0x1d402cf7
je 0x5e6ea248
sbb al, al
add edi, dword [esi + 0x21b54fcd]
js 0x5e6ea1d5
sahf
inc edx
mov ss, word [esi - 0xe8f6fa6]
mov esi, gs
inc esi
mov ch, 0x25
xchg byte [edi], dh
mov edx, 0xf8ea5f61
movsd dword es:[edi], dword [esi]
mov esp, 0xc40867d
xchg byte es:[esp + edx*2 - 0x23], bl
add ah, byte [ecx + 0x3ea574a8]
mov ebp, 0xcaead1cb
mov eax, dword [edx + 0xc]
mov dword [esi + 0x10], eax
nop
mov eax, dword [edx + 0x10]
mov dword [esi + 0x14], eax
cmp word [0x61033d92], 0x83f4
jns 0x5e729490
mov eax, dword [edx + 0x14]
mov dword [esi + 0x18], eax
test word [0x61079aa4], 0x151d
jo 0x5e71f255
mov eax, dword [edx + 0x18]
mov dword [esi + 0x1c], eax
mov ecx, ecx
xor eax, eax
add eax, dword [edx + 0x20]
mov ecx, dword [edx + 0x1c]
adc ecx, 0
mov dword [esi], eax
lea eax, [edx + 0x2c]
nop
mov dword [esi + 4], ecx
push eax
lea ecx, [esi + 0x28]
mov word [esi + 0x24], 0
call fcn.5e6c9049

Function at 0x5e6eac2d
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ecx, 0xffffffff
push ebx
mov ebx, eax
sub ebx, ecx
pop ebx
cmovne ecx, eax
mov eax, ecx
nop
pop ebp
ret
Function at 0x5e6f43df
Capabilities:
Parse pe header

Disassembly:
test word [0x6105a2f5], 0xe453
jo 0x5e71eef9
push ebp
nop
mov ebp, esp
push edx
mov edx, dword [ebp + 0xc]
sub edx, 0x200
pop edx
jb 0x5e6f445a
mov edx, dword [ebp + 8]
mov eax, eax
mov eax, 0x5a4d
cmp word [edx], ax
jne 0x5e6f445a
mov ecx, dword [edx + 0x3c]
cmp ecx, 0x1000
jae 0x5e6f445a
lea eax, [ecx + 0x200]
cmp eax, dword [ebp + 0xc]
ja 0x5e6f445a
test cl, 7
jne 0x5e6f445a
add ecx, edx
cmp dword [ecx], 0x4550
jne 0x5e6f445a
movzx eax, word [ecx + 4]
sub eax, 0x14c
je 0x5e6f4480
sub eax, 0x74
je 0x5e6f4477
nop
nop
nop
dec eax
dec eax
je 0x5e6f4477
dec eax
dec eax
je 0x5e6f446e
sub eax, 0x3c
je 0x5e6f4462
sub eax, 0x8464
je 0x5e6f4480
mov ecx, ecx
xor eax, eax
pop ebp
mov eax, eax
ret
nop
nop
nop
mov edx, 0x3030401
mov ecx, ecx
jmp 0x5e6f4485
mov edx, 0x3030701
mov eax, eax
jmp 0x5e6f4485
nop
nop
mov edx, 0x3030501
jmp 0x5e6f4485
mov edx, 0x3030103
mov eax, 0x400
cmp word [ecx + 0x14], ax
ja 0x5e6f445a
test word [0x6104e598], 0x5039
je 0x5e70d907
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x5e6f44b6
push ebx
mov ebx, eax
sub ebx, 0x20b
pop ebx
jne 0x5e6f445a
mov eax, dword [ebp + 0x10]
mov dword [eax], edx
mov eax, eax
xor eax, eax
inc eax
pop ebp
ret
adc ecx, ebx
cli
sbb al, 0x7f
ret
nop
push 1
call fcn.5e71d821
xor eax, eax
xor ebx, ebx
xor ecx, ecx
xor edx, edx
xor edi, edi
jmp esi

Function at 0x5e6f5136
Capabilities:
Allocate thread local storage

Disassembly:
nop
sub dword [esp + 4], 0x10
jmp fcn.5e6c0085
or edi, dword [ebx*4 + 0x75ff066a]
or byte [ebp - 0x17af1bbb], cl
insb byte es:[edi], dx
invalid
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
cmp dword [esi + 4], ecx
jne 0x5e6f51ee
push ebx
mov eax, ecx
mov ecx, ecx
lea ebx, [ecx + 1]
test dword [0x60ffd9de], 0xce730190
je 0x5e6c0316
shr eax, 2
xor ecx, ecx
push edi
cmp word [0x61014239], 0x9fa1
jns 0x5e6c6cdc
add ebx, eax
push 0x10
pop edx
mov eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.5e6bacbc

Function at 0x5e6fad59
Capabilities:
Hash data with crc32

Disassembly:
push ebp
nop
nop
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
nop
nop
nop
push esi
push edi
or dword [eax + 0x468], 0xffffffff
lea esi, [eax + 0x60]
nop
nop
nop
or dword [eax + 0x46c], 0xffffffff
nop
nop
nop
mov dword [eax + 0x34], ecx
mov word [eax + 0x1e], cx
mov eax, eax
mov dword [eax + 0x24], ecx
mov dword [eax + 0x30], 0x20
mov byte [eax + 0x1d], 1
mov ecx, ecx
mov dword [eax + 0x48], 4
push 8
mov edx, ecx
pop edi
mov eax, eax
mov eax, edx
nop
nop
nop
shr edx, 1
nop
and eax, 1
test byte [0x610b6889], 0x94
je 0x5e6fadeb
invalid
neg eax
nop
nop
nop
and eax, 0xedb88320
mov eax, eax
xor edx, eax
dec edi
jne 0x5e6fada4
mov dword [esi], edx
inc ecx
add esi, 4
cmp ecx, 0x100
jb 0x5e6fad9f
mov eax, eax
pop edi
pop esi
pop ebp
nop
nop
ret
Function at 0x5e701274
Capabilities:
Authenticate hmac
Encrypt data using aes
Generate random numbers via rtlgenrandom
Reference aes constants

Disassembly:
jmp fcn.5e6c7dc3
push ebp
mov ebp, esp
mov ecx, ecx
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
nop
nop
nop
mov ebx, ecx
xor esi, esi
lea ecx, [edi + 0x1c]
mov ecx, ecx
shr edi, 2
nop
mov eax, edi
mov dword [ebp - 0xc], ecx
shr eax, 1
nop
nop
add eax, 3
test byte [0x6102ed0e], 0xa6
je 0x5e6e6efb
mov dword [ebx], eax
add ebx, 0x10
push eax
mov eax, edi
and eax, edi
pop eax
je 0x5e70130b
mov eax, dword [edx]
cmp byte [0x6109256a], 0xe1
jns 0x5e6c7dfd
lea edx, [edx + 4]
mov eax, eax
mov dword [ebx + esi*4], eax
cmp byte [0x60ffb435], 0xed
js 0x5e701302
xchg ecx, edx
jmp 0xd0c8fea1
inc esi
push ebx
mov ebx, esi
sub ebx, edi
pop ebx
jb 0x5e7012b8
cmp esi, ecx
jae 0x5e7014b6
mov eax, eax
mov eax, esi
sub eax, edi
lea eax, [ebx + eax*4]
mov dword [ebp - 4], eax
Function at 0x5e704e57
Capabilities:
Encode data using xor

Disassembly:
sub dword [esp + 4], 0x1c
jmp fcn.5e6c15f2
push ebp
nop
mov ebp, esp
push esi
cmp dword [0x610a3034], 0xd08657
jne 0x5e6cb643
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
and dword [esi + 4], 0
cmp edi, dword [esi + 8]
jbe 0x5e704ecd
push dword [esi]
cmp word [0x610d4014], 0x2a45
jne 0x5e6bd7c4
call fcn.5e6d68f8
mov eax, eax
and dword [esi], 0
xor ecx, ecx
and dword [esi + 8], 0
cmp word [0x610420c6], 0x5426
je 0x5e6c19d8
mov eax, edi
push 4
pop edx
mul edx
seto cl
mov eax, eax
neg ecx
nop
nop
nop
or ecx, eax
push ecx
call fcn.5e6bacbc
pop ecx
pop ecx
mov dword [esi], eax
mov ecx, ecx
mov dword [esi + 8], edi
pop edi
pop esi
nop
pop ebp
ret 4
Function at 0x5e708039
Capabilities:
Get thread local storage value

Disassembly:
mov eax, eax
jmp fcn.5e6be926
nop
sub dword [esp + 4], 4
jmp fcn.5e6f47c6
cmp dword [0x60fd6c95], 0xcc599851
je 0x5e708066
cmp al, 0xe8
add al, 0x5c
dec esp
xchg ebp, eax
push 0x6e
cmp byte [eax - 0x22], dl
stosd dword es:[edi], eax
fcmovnu st(0), st(4)
pop ds
add edx, dword [ecx + 0x37911acc]
sub dword [ebp - 0x40e0897f], eax
popal
in eax, 0xd7
inc ebx
push 0xffffffffffffffb8
or eax, 0xe85e72aa
adc eax, 0x51000095
mov eax, 0x5e72aa0d
call fcn.5e711585
push ecx
test byte [0x610a1989], 0xb8
jno 0x5e70809b
xchg edx, eax
cmp al, 0xe8
sbb al, 0x7c
pushfd
push cs
shl byte [0xe1c9f71b], 1
add eax, 0xe16b66c3
sub eax, 0x3916e17d
xchg esi, eax
aam 0xde
std
pop edx
fld qword [esi + 0x12]
out 0x16, al
push ebx
mov ecx, ecx
push esi
mov eax, eax
mov esi, ecx
mov ecx, ecx
xor ebx, ebx
push edi
mov dword [ebp - 0x10], esi
cmp byte [0x610b54aa], 0x63
je 0x5e6e1503
mov dword [esi + 0xc], ebx
lea ecx, [esi + 0x10]
mov dword [ebp - 4], ebx
cmp word [0x6100a602], 0xbe9b
jne 0x5e7080f0
dec ecx
add dword [eax], 0x6b
mov esi, 0x6f72871c
and dl, cl
popfd
movsd dword es:[edi], dword [esi]
cdq
or ch, byte [ecx - 0x759645b2]
push esi
out dx, eax
pop ebx
sub al, dl
add esi, esi
add al, 0x1f
rol dword [esi + eax*8 - 0x179d6bc5], cl
mov esi, 0x8dfffc7f
dec esi
inc eax
call fcn.5e6d00b3
lea ecx, [esi + 0x40]
call fcn.5e6ec790
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
cmp word [0x610488da], 0x707
js 0x5e6f49c1
mov dword [esi + 0x88], ebx
mov ecx, ecx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x90], ebx
mov dword [esi + 0x94], ebx
mov dword [esi + 0x98], ebx
mov dword [esi + 0x9c], ebx
mov dword [esi + 0xa0], ebx
cmp byte [0x61038e14], 0x1d
jne 0x5e708180
lds eax, [eax + 0x58]
aad 0xc5
dec esi
popal
scasb al, byte es:[edi]
jnp 0x5e70817e
ret
js 0x5e7081b1
mov dword [esi + 0xa4], ebx
mov eax, eax
mov dword [esi + 0xa8], ebx
cmp byte [0x610a4e84], 0x9c
je 0x5e6bea9c
mov dword [esi + 0xac], ebx
mov eax, dword [ebp + 8]
mov byte [esi + 0xb0], bl
mov byte [ebp - 4], 6
push ecx
mov ecx, dword [eax + 4]
sub ecx, ebx
pop ecx
jne 0x5e7081d8
add al, 0x2b
retf
cmp byte [eax + 0x21], bl
jne 0x5e7081d8
nop
nop
push 0x5e72fe60
nop
nop
nop
lea eax, [ebp + 8]
mov dword [ebp + 8], 1
mov ecx, ecx
push eax
call fcn.5e70e33c
mov eax, eax
push eax
nop
lea ecx, [esi + 0x10]
call fcn.5e708742
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
nop
nop
nop
mov dword [esi + 8], ebx
mov eax, eax
pop edi
nop
pop esi
pop ebx
mov dword fs:[0], ecx
mov eax, eax
mov esp, ebp
mov eax, eax
pop ebp
mov eax, eax
ret 4
Function at 0x5e70d2cd
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push 0
call dword [sym.imp.KERNEL32.dll_EncodePointer]
mov esi, eax
push esi
call fcn.5e71682f
push esi
nop
call fcn.5e715d95
mov eax, eax
push esi
call fcn.5e715ab2
push esi
call fcn.5e716849
mov eax, eax
push esi
call fcn.5e7167cf
push esi
mov eax, eax
call fcn.5e716b4b
add esp, 0x18
mov eax, eax
pop esi
jmp 0x5e714fb2
push esi
push edi
push 0x610e1174
mov ecx, ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push str.FlsAlloc
mov eax, eax
push edi
nop
nop
nop
call esi
nop
xor eax, dword [0x610e8864]
push str.FlsFree
nop
push edi
mov dword [0x610f081a], eax
call esi
Function at 0x5e70de27
Capabilities:
Accept command line arguments
Get thread local storage value

Disassembly:
sar dl, 0xff
test byte [0x6100a7e8], 0x5f
jo 0x5e72911e
push 8
test word [0x60ff627c], 0x7691
jae 0x5e70de63
dec ebx
jle 0x5e70ddfd
int1
and al, 0xfa
mov edx, 0x100f8bf5
mov word [edx - 0x2e], cs
cmc
loop 0x5e70dde1
call 0x58420ebd
adc cl, ah
idiv ebp
push eax
and dword [edx + 0x47bfc41], esp
push 0x5e731aac
push 0x5e731aac
call fcn.5e716b5c
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, eax
sub ebx, 1
pop ebx
jne 0x5e70df69
call fcn.5e7191fa
push ebx
mov ebx, eax
and ebx, eax
pop ebx
jne 0x5e70de93
call fcn.5e71ac38
test eax, eax
jne 0x5e70dea3
call fcn.5e715e1f
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x610f089e], eax
call 0x5e71bcef
mov dword [0x610ec7f2], eax
cmp byte [0x60ffeef5], 0xef
jne 0x5e70df02
mov edx, dword [ebp - 0x79]
insb byte es:[edi], dx
into
test eax, 0x45d9061f
and ah, byte [edi - 0x70]
dec esp
mov dword [0xbab31250], eax
cdq
lds ebx, ss:[edx + 0x77]
push ebx
sbb dl, byte [esi + 0x27]
dec eax
pushfd
ret 0x5c08
call fcn.5e71afeb
push edx
mov edx, eax
and edx, eax
pop edx
jns 0x5e70df16
nop
nop
nop
call fcn.5e71b525
push edx
mov edx, eax
and edx, eax
pop edx
js 0x5e70df60
call fcn.5e71b941
push ebx
mov ebx, eax
and ebx, eax
pop ebx
jne 0x5e70e049
mov eax, dword [0x610ec7ee]
test eax, eax
jle 0x5e70de8a
cmp byte [0x610a9b33], 0x15
je 0x5e70dfc6
invalid
dec eax
mov dword [0x610ec7ee], eax
test byte [0x61056c1a], 0x8e
js 0x5e6f4e40
and dword [ebp - 4], 0
cmp dword [0x610ec7e2], 0
jne 0x5e70dfee
nop
nop
nop
call fcn.5e70d15e
call fcn.5e70cf85
test dword [0x610c3510], 0x11c9e5a1
js 0x5e729ce2
mov esi, dword [ebp + 0x10]
push ebx
mov ebx, esi
and ebx, esi
pop ebx
jne 0x5e70e01f
mov eax, eax
call fcn.5e71b47b
call fcn.5e71ad14
call fcn.5e719214
mov ecx, ecx
mov dword [ebp - 4], 0xfffffffe
nop
call fcn.5e70e036
jmp 0x5e70e124
cmp eax, 2
jne 0x5e70e10d
push dword [0x610e8f0c]
popal
call fcn.5e714e84
pop ecx
test eax, eax
jne 0x5e70e124
push 0x3bc
mov ecx, ecx
push 1
nop
nop
call fcn.5e714c3e
pop ecx
pop ecx
mov esi, eax
push ecx
mov ecx, esi
and ecx, esi
pop ecx
je 0x5e70de8a
push esi
push dword [0x610e8f0c]
test dword [0x60fe920e], 0x309323ca
je 0x5e728b27
call fcn.5e714ec8
pop ecx
cmp word [0x6106249c], 0xd1d
js 0x5e70e0d9
pop esi
sbb eax, 0x6c12f804
aas
in al, 0x29
jle 0x5e70e077
popfd
sub al, 0xbd
adc dword [edx - 0x287a1ae3], 0x5f7119d3
out dx, al
adc eax, 0x1886dba1
scasd eax, dword es:[edi]
fiadd dword [ecx + eax]
loopne 0x5e70e057
mov esi, 0x764f190e
mov ebx, 0x74c08559
pop ds
pop ecx
test eax, eax
je 0x5e70e0fd
push 0
push esi
call fcn.5e71ab26
pop ecx
mov ecx, ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi], eax
nop
nop
nop
or dword [esi + 4], 0xffffffff
mov ecx, ecx
jmp 0x5e70e124
nop
nop
push esi
mov ecx, ecx
call fcn.5e70d776
pop ecx
jmp 0x5e70de8a
push edx
mov edx, eax
sub edx, 3
pop edx
jne 0x5e70e124
mov eax, eax
push 0
mov eax, eax
call fcn.5e71a9d7
mov eax, eax
pop ecx