joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5967b0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x596838
mov eax, dword [ebp + 0xc]
test eax, eax
jle 0x596838
mov edx, 0x100
push ebx
cmp eax, edx
push edi
cmovge eax, edx
push eax
mov dword [esi + 0x204], eax
lea eax, [esi + 0x102]
push ecx
push eax
call fcn.0060e810
add esp, 0xc
mov word [esi + 0x100], 0
xor bh, bh
xor eax, eax
mov byte [eax + esi], al
inc eax
cmp eax, 0x100
jl 0x5967f4
xor edi, edi
mov eax, edi
mov bl, byte [edi + esi]
cdq
idiv dword [esi + 0x204]
movzx eax, byte [edx + esi + 0x102]
add al, bl
add bh, al
movzx ecx, bh
movzx eax, byte [ecx + esi]
mov byte [edi + esi], al
inc edi
mov byte [ecx + esi], bl
cmp edi, 0x100
jl 0x596801
pop edi
pop ebx
mov al, 1
pop esi
pop ebp
ret 8
xor al, al
pop esi
pop ebp
ret 8

Function at 0x596870
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
test edx, edx
je 0x5968be
push ebx
push esi
mov ebx, 0x6f1668
mov byte [edx], 0xd0
push edi
mov esi, 0x6f166a
lea eax, [edx + 3]
sub ebx, edx
mov edi, 0x15
movzx ecx, byte [esi - 1]
lea esi, [esi + 3]
xor cl, byte [edx]
lea eax, [eax + 3]
mov byte [eax - 5], cl
movzx ecx, byte [edx]
xor cl, byte [esi - 3]
mov byte [eax - 4], cl
movzx ecx, byte [ebx + eax - 3]
xor cl, byte [edx]
mov byte [eax - 3], cl
sub edi, 1
jne 0x596894
pop edi
pop esi
pop ebx
mov eax, 0x40
pop ebp
ret 4

Function at 0x5968d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
test edx, edx
je 0x596937
push ebx
mov ebx, 0x6f16f0
mov byte [edx], 0x30
push esi
mov ecx, 0x6f16f1
lea eax, [edx + 3]
sub ebx, edx
mov esi, str.1e210
sub ecx, edx
push edi
mov dword [ebp + 8], ecx
mov edi, 0x56
nop
movzx ecx, byte [esi - 1]
lea esi, [esi + 4]
xor cl, byte [edx]
lea eax, [eax + 4]
mov byte [eax - 6], cl
movzx ecx, byte [esi - 4]
xor cl, byte [edx]
mov byte [eax - 5], cl
movzx ecx, byte [ebx + eax - 4]
xor cl, byte [edx]
mov byte [eax - 4], cl
mov ecx, dword [ebp + 8]
movzx ecx, byte [ecx + eax - 4]
xor cl, byte [edx]
mov byte [eax - 3], cl
sub edi, 1
jne 0x596900
pop edi
pop esi
pop ebx
mov eax, 0x159
pop ebp
ret 4

Function at 0x596970
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
test edx, edx
je 0x5969be
push ebx
push esi
mov ebx, 0x6f16a8
mov byte [edx], 0xbd
push edi
mov esi, 0x6f16aa
lea eax, [edx + 3]
sub ebx, edx
mov edi, 0x15
movzx ecx, byte [esi - 1]
lea esi, [esi + 3]
xor cl, byte [edx]
lea eax, [eax + 3]
mov byte [eax - 5], cl
movzx ecx, byte [edx]
xor cl, byte [esi - 3]
mov byte [eax - 4], cl
movzx ecx, byte [ebx + eax - 3]
xor cl, byte [edx]
mov byte [eax - 3], cl
sub edi, 1
jne 0x596994
pop edi
pop esi
pop ebx
mov eax, 0x40
pop ebp
ret 4
Function at 0x596e30
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x694b48
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push esi
mov eax, dword [0x780784]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
push 0x6e9f60
lea ecx, [ebp - 0x70]
mov dword [ebp - 4], 0
mov dword [esi], vtable.std::codecvt_wchar_t__char__struct__Mbstatet_.0
call fcn.00469850
lea eax, [ebp - 0x3c]
push eax
call fcn.005fa473
add esp, 4
lea ecx, [ebp - 0x70]
movups xmm0, xmmword [eax]
movups xmmword [esi + 8], xmm0
movups xmm0, xmmword [eax + 0x10]
movups xmmword [esi + 0x18], xmm0
movq xmm0, qword [eax + 0x20]
movq qword [esi + 0x28], xmm0
mov eax, dword [eax + 0x28]
mov dword [esi + 0x30], eax
call fcn.00469910
mov dword [esi], vtable.std::codecvt_utf8_wchar_t__1114111__0_.0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x59ad80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 8]
test edx, edx
je 0x59adf7
push ebx
push esi
push edi
mov esi, 0x6f1c7a
mov byte [edx], 0xda
mov edi, 0x6f1c78
mov dword [ebp + 8], 0x33
mov ebx, 0x6f1c79
lea eax, [edx + 3]
mov ecx, esi
sub edi, edx
sub ebx, edx
sub ecx, edx
mov dword [ebp - 4], ecx
movzx ecx, byte [esi - 1]
lea esi, [esi + 5]
xor cl, byte [edx]
lea eax, [eax + 5]
mov byte [eax - 7], cl
movzx ecx, byte [esi - 5]
xor cl, byte [edx]
mov byte [eax - 6], cl
movzx ecx, byte [edi + eax - 5]
xor cl, byte [edx]
mov byte [eax - 5], cl
movzx ecx, byte [ebx + eax - 5]
xor cl, byte [edx]
mov byte [eax - 4], cl
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + eax - 5]
xor cl, byte [edx]
sub dword [ebp + 8], 1
mov byte [eax - 3], cl
jne 0x59adb5
pop edi
pop esi
pop ebx
mov eax, 0x100
mov esp, ebp
pop ebp
ret
Function at 0x5a5590
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x695e7e
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x780784]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0xf
mov byte [edi + 0x18], 0
lea esi, [edi + 0x40]
mov byte [ebp - 4], 1
push 0x2c
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0060c962
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0x48]
mov byte [ebp - 4], 2
push 0x2c
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0060c962
add esp, 8
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x50], eax
mov eax, edi
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x5aaee8
Capabilities:
Reference sql statements

Disassembly:
push 0x28
mov eax, 0x6916b8
call fcn.0060ddca
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
lea eax, [ebp - 0x28]
mov dword [ebp - 4], ebx
push eax
lea eax, [edi + 0x30]
push eax
lea esi, [edi + 0x18]
push esi
call fcn.005ababc
add esp, 0xc
test al, al
jne 0x5aaf28
push 0xa
pop esi
jmp 0x5ab071
lea eax, [ebp - 0x28]
push eax
call fcn.005aba22
pop ecx
test al, al
jne 0x5aaf5d
lea eax, [ebp - 0x28]
push eax
call fcn.005abbb6
pop ecx
test al, al
je 0x5aaf4c
xor esi, esi
inc esi
jmp 0x5ab071
push esi
call fcn.005aad50
mov esi, eax
pop ecx
test esi, esi
jne 0x5ab071
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push ebx
push dword [ebp + 8]
cmovae eax, dword [ebp - 0x28]
lea esi, [edi + 4]
push esi
push eax
call fcn.004ce680
add esp, 0x10
test eax, eax
je 0x5aaf8d
push eax
mov dword [esi], ebx
call fcn.005aadca
pop ecx
mov esi, eax
jmp 0x5ab071
push 0x7d0
push dword [esi]
call fcn.004cb030
cmp byte [edi + 0x4c], 0
mov esi, ebx
pop ecx
pop ecx
mov dword [edi], ebx
je 0x5ab071
mov eax, dword [edi + 0x50]
mov ecx, ebx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ebx
sub eax, ebx
je 0x5aafd1
sub eax, 1
je 0x5aafcc
sub eax, 1
jne 0x5aafd1
xor ecx, ecx
inc ecx
mov dword [ebp - 0x30], ecx
push 3
jmp 0x5aafd3
xor ebx, ebx
inc ebx
jmp 0x5aafd4
push 2
pop ebx
push str.SELECT_value_FROM_pcd_meta_WHERE_key__schema_version
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x34], ecx
push eax
push edi
call fcn.005ab483
mov esi, eax
add esp, 0xc
mov eax, dword [ebp - 0x30]
mov ecx, eax
test esi, esi
jne 0x5ab02a
push dword [ebp - 0x2c]
call fcn.0061cf3a
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x2c]
mov dword [esp], str.SELECT_value_FROM_pcd_meta_WHERE_key__schema_compatibility_version
push eax
push edi
call fcn.005ab483
mov ecx, dword [ebp - 0x34]
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x5ab027
push dword [ebp - 0x2c]
call fcn.0061cf3a
pop ecx
mov ecx, eax
mov eax, dword [ebp - 0x30]
cmp ebx, ecx
jge 0x5ab033
push 0xd
pop esi
jmp 0x5ab068
inc eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], eax
cmp eax, ebx
jg 0x5ab064
push eax
mov ecx, edi
call fcn.005ab086
mov esi, eax
test esi, esi
jne 0x5ab059
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp eax, ebx
jle 0x5ab03e
jmp 0x5ab06f
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp eax, dword [ebp - 0x2c]
cmove esi, ecx
test esi, esi
je 0x5ab06f
mov ecx, edi
call fcn.005aaeba
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.00468b80
mov eax, esi
call fcn.0060dd85
ret 4
Function at 0x5ab7f7
Capabilities:
Create directory

Disassembly:
push 0x1c
mov eax, 0x682aa8
call fcn.0060ddca
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x28]
push 4
pop edi
push esi
push eax
call fcn.005bceed
xor ebx, ebx
push esi
mov dword [ebp - 4], ebx
call fcn.005abbb6
add esp, 0xc
test al, al
jne 0x5ab83f
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push ebx
cmovae eax, dword [ebp - 0x28]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
neg eax
sbb eax, eax
and edi, eax
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.004688e0
mov eax, edi
call fcn.0060dd85
ret

Function at 0x5ab852
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0x240
mov eax, 0x69658b
call fcn.0060ddca
mov esi, dword [ebp + 8]
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x21c], 7
mov bl, cl
mov dword [ebp - 0x220], ecx
mov word [ebp - 0x230], ax
lea eax, [ebp - 0x24c]
mov dword [ebp - 4], ecx
push eax
push ecx
push ecx
push 0x2b
push ecx
mov dword [ebp - 0x24c], ecx
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
test eax, eax
lea eax, [ebp - 0x218]
push eax
js 0x5ab8f7
push dword [ebp - 0x24c]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x5ab8e7
cmp word [ebp - 0x218], 0
jne 0x5ab8c5
xor eax, eax
jmp 0x5ab8d2
lea eax, [ebp - 0x218]
push eax
call fcn.00625b69
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00468970
mov bl, 1
push dword [ebp - 0x24c]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor edi, edi
jmp 0x5ab937
xor edi, edi
push edi
push edi
push 0x2b
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x5ab937
cmp word [ebp - 0x218], di
jne 0x5ab915
mov eax, edi
jmp 0x5ab922
lea eax, [ebp - 0x218]
push eax
call fcn.00625b69
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00468970
mov bl, 1
mov ecx, dword [ebp - 0x220]
test ecx, ecx
je 0x5ab9ad
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
cmp word [eax + ecx*2 - 2], 0x5c
jne 0x5ab96d
lea eax, [ecx - 1]
push edi
push eax
lea ecx, [ebp - 0x230]
call fcn.005abdea
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.005bcfa0
pop ecx
pop ecx
push eax
mov ecx, esi
call fcn.0047e830
push edi
push 1
lea ecx, [ebp - 0x248]
call fcn.00468b80
mov edi, str.Adobe
push edi
call fcn.0062b740
pop ecx
push eax
push edi
mov ecx, esi
call fcn.0046f2b0
push 0
push 1
lea ecx, [ebp - 0x230]
call fcn.004688e0
mov al, bl
call fcn.0060dd85
ret
Function at 0x5ab9c4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x780784]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.005bceed
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
pop ecx
cmovae eax, dword [ebp - 0x1c]
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x5aba03
test al, 0x10
jbe 0x5aba03
mov bl, 1
jmp 0x5aba05
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.004688e0
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0060cdfa
mov esp, ebp
pop ebp
ret

Function at 0x5abbb6
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x780784]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.005bceed
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
pop ecx
cmovae eax, dword [ebp - 0x1c]
pop ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push 0
push 1
lea ecx, [ebp - 0x1c]
lea ebx, [eax - 1]
neg ebx
sbb bl, bl
inc bl
call fcn.004688e0
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0060cdfa
mov esp, ebp
pop ebp
ret
Function at 0x5bc690
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
pop ebp
ret

Function at 0x5be1b0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0
pop ebp
ret
Function at 0x5f9070
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x69846b
mov eax, dword fs:[0]
push eax
sub esp, 0x13c
mov eax, dword [0x780784]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x114]
push 0x104
push eax
call fcn.00494e50
push 0x6c4834
call fcn.004948c0
push eax
push 0x6c4834
lea eax, [ebp - 0x114]
push 0x104
push eax
call fcn.00494860
push str.adobegc.log
call fcn.004948c0
push eax
push str.adobegc.log
lea eax, [ebp - 0x114]
push 0x104
push eax
call fcn.00494860
lea eax, [ebp - 0x114]
mov dword [ebp - 0x134], 0
add esp, 0x30
mov dword [ebp - 0x130], 0xf
mov byte [ebp - 0x144], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5f9117
sub eax, edx
lea ecx, [ebp - 0x144]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.004753c0
cmp dword [ebp - 0x130], 0x10
lea edx, [ebp - 0x144]
mov ebx, dword [ebp - 0x134]
lea edi, [ebp - 0x144]
cmovae edx, dword [ebp - 0x144]
lea ecx, [ebp - 0x12c]
add ebx, edx
mov dword [ebp - 4], 0
cmp dword [ebp - 0x130], 0x10
mov dword [ebp - 0x11c], 0
cmovae edi, dword [ebp - 0x144]
xor eax, eax
mov word [ebp - 0x12c], ax
mov eax, ebx
sub eax, edi
mov dword [ebp - 0x118], 7
push eax
call fcn.004717f0
push dword [ebp - 0x148]
lea ecx, [ebp - 0x12c]
push ebx
push edi
call fcn.00473f70
cmp dword [ebp - 0x118], 8
lea eax, [ebp - 0x12c]
cmovae eax, dword [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp - 0x118]
cmp edx, 8
jb 0x5f9201
mov ecx, dword [ebp - 0x12c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x5f91f7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5f926f
push edx
push ecx
call fcn.0060c992
add esp, 8
mov edx, dword [ebp - 0x130]
xor eax, eax
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 7
mov word [ebp - 0x12c], ax
cmp edx, 0x10
jb 0x5f9254
mov ecx, dword [ebp - 0x144]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x5f924a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5f926f
push edx
push ecx
call fcn.0060c992
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0060cdfa
mov esp, ebp
pop ebp
ret
call fcn.0061883f
int3
Function at 0x6326b7
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0063252d

Function at 0x639f04
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00639a57

Function at 0x64195d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 1
push edi
call fcn.00641907
mov esi, dword [ebp + 0xc]
pop ecx
pop ecx
test al, al
je 0x6419e2
push 1
push esi
call fcn.00641907
mov edx, dword [ebp + 0x10]
pop ecx
pop ecx
test al, al
je 0x6419e5
mov ecx, edx
mov eax, ebx
shr ecx, 2
test ecx, ecx
je 0x6419b7
mov edx, edi
mov dword [ebp - 4], ecx
sub edx, esi
mov edi, esi
mov eax, dword [edx + edi]
xor eax, dword [edi]
lea edi, [edi + 4]
or ebx, eax
sub ecx, 1
jne 0x64199f
mov edx, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 4]
shl eax, 2
sub edx, eax
jne 0x6419c7
xor eax, eax
test ebx, ebx
sete al
jmp 0x6419fd
add edi, eax
add esi, eax
mov ecx, ebx
mov eax, ebx
shr eax, 0x10
shr ecx, 0x18
or cl, al
mov eax, ebx
shr eax, 8
or cl, al
or bl, cl
jmp 0x6419e5
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x6419f8
sub edi, esi
mov al, byte [esi + edi]
xor al, byte [esi]
or bl, al
inc esi
sub edx, 1
jne 0x6419eb
test bl, bl
sete al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x641a04
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
push ebx
call fcn.00641907
mov edi, dword [ebp + 0xc]
pop ecx
pop ecx
test al, al
je 0x641a87
push 1
push edi
call fcn.00641907
mov esi, dword [ebp + 0x10]
pop ecx
pop ecx
test al, al
je 0x641a8a
push 1
push esi
call fcn.00641907
pop ecx
pop ecx
mov ecx, dword [ebp + 0x14]
test al, al
je 0x641a8d
mov edx, ecx
xor eax, eax
shr edx, 2
test edx, edx
je 0x641a78
mov ecx, edi
mov dword [ebp - 8], edx
mov eax, ebx
sub ecx, esi
sub eax, esi
mov ebx, esi
mov edi, eax
mov eax, dword [ecx + ebx]
xor eax, dword [ebx]
mov dword [edi + ebx], eax
lea ebx, [ebx + 4]
sub edx, 1
jne 0x641a5c
mov ecx, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 8]
shl eax, 2
sub ecx, eax
je 0x641aa3
add ebx, eax
add edi, eax
add esi, eax
jmp 0x641a8d
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x641aa3
sub edi, esi
sub ebx, esi
mov al, byte [esi + edi]
xor al, byte [esi]
mov byte [esi + ebx], al
inc esi
sub ecx, 1
jne 0x641a95
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x641aaa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push 1
push esi
call fcn.00641907
mov edi, dword [ebp + 0xc]
pop ecx
pop ecx
test al, al
je 0x641b0e
push 1
push edi
call fcn.00641907
pop ecx
pop ecx
mov ecx, dword [ebp + 0x10]
test al, al
je 0x641b11
mov edx, ecx
xor eax, eax
shr edx, 2
test edx, edx
je 0x641b01
mov eax, edi
mov dword [ebp - 8], edx
push ebx
sub eax, esi
mov ebx, esi
mov esi, eax
mov eax, dword [esi + ebx]
xor dword [ebx], eax
lea ebx, [ebx + 4]
sub edx, 1
jne 0x641aed
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 8]
pop ebx
shl eax, 2
sub ecx, eax
je 0x641b22
add esi, eax
add edi, eax
jmp 0x641b11
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x641b22
sub edi, esi
mov al, byte [esi + edi]
xor byte [esi], al
inc esi
sub ecx, 1
jne 0x641b17
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x652247
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
pop ebp
ret

Function at 0x652271
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push 0x20
push 0x7156e0
push dword [ebp + 8]
call fcn.0060e810
add esp, 0xc
pop ebp
ret
Function at 0x659f40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ecx
push 1
push edi
mov dword [ebp - 4], eax
mov ebx, dword [eax + 4]
call fcn.00641907
mov esi, dword [ebp + 0xc]
pop ecx
pop ecx
test al, al
jne 0x659f85
test esi, esi
je 0x659f85
movzx eax, byte [edi]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
push 1
xor ebx, dword [ecx*4 + 0x7164d8]
inc edi
push edi
dec esi
call fcn.00641907
jmp 0x659f5d
cmp esi, 4
jb 0x659fd0
mov ecx, esi
shr ecx, 2
xor ebx, dword [edi]
sub esi, 4
movzx eax, bl
add edi, 4
shr ebx, 8
xor ebx, dword [eax*4 + 0x7164d8]
movzx eax, bl
shr ebx, 8
xor ebx, dword [eax*4 + 0x7164d8]
movzx eax, bl
shr ebx, 8
xor ebx, dword [eax*4 + 0x7164d8]
movzx eax, bl
shr ebx, 8
xor ebx, dword [eax*4 + 0x7164d8]
sub ecx, 1
jne 0x659f8f
test esi, esi
je 0x659fec
movzx eax, byte [edi]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x7164d8]
inc edi
sub esi, 1
jne 0x659fd4
mov eax, dword [ebp - 4]
pop edi
pop esi
mov dword [eax + 4], ebx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x65c3e2
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor edx, edx
push esi
mov dword [ebp - 0x14], edx
push edi
movzx edi, byte [edx + 0x717198]
mov eax, edi
mov dword [ebp - 8], edi
shr eax, 5
mov esi, edi
mov edx, eax
shr esi, 6
mov ebx, eax
lea ecx, [edi + edi]
xor ecx, edi
and eax, 1
mov dword [ebp - 0x10], eax
and ebx, 2
shr edi, 7
and edx, 4
mov dword [ebp - 0xc], edx
mov edx, esi
lea eax, [ecx + ecx]
and esi, 1
xor eax, dword [ebp - 8]
and edx, 2
shl eax, 0x19
mov dword [ebp - 4], eax
imul eax, edi, 0x1b000000
shl ecx, 2
xor ecx, dword [ebp - 8]
shl ecx, 8
xor dword [ebp - 4], eax
imul eax, dword [ebp - 0x10], 0x1b000000
xor dword [ebp - 4], eax
imul eax, ebx, 0x1b000000
xor dword [ebp - 4], eax
imul eax, esi, 0x1b000000
xor dword [ebp - 4], eax
imul eax, edx, 0x1b000000
xor dword [ebp - 4], eax
imul eax, dword [ebp - 0xc], 0x1b000000
xor dword [ebp - 4], eax
imul eax, dword [ebp - 0x10], 0x11b00
xor ecx, eax
imul eax, ebx, 0x11b00
xor ecx, eax
imul eax, esi, 0x11b00
xor ecx, eax
imul eax, edx, 0x11b00
mov edx, dword [ebp - 4]
xor ecx, eax
imul eax, dword [ebp - 0xc], 0x11b00
xor ecx, eax
imul eax, dword [ebp - 0x10], 0x11b0000
or edx, ecx
mov ecx, dword [ebp - 8]
shl ecx, 3
xor ecx, dword [ebp - 8]
shl ecx, 0x10
xor ecx, eax
imul eax, ebx, 0x11b0000
xor ecx, eax
imul eax, dword [ebp - 0xc], 0x11b0000
xor ecx, eax
imul eax, edi, 0x11b
or edx, ecx
mov ecx, dword [ebp - 8]
shl ecx, 2
xor ecx, dword [ebp - 8]
add ecx, ecx
xor ecx, eax
imul eax, dword [ebp - 0x10], 0x11b
xor ecx, eax
imul eax, ebx, 0x11b
mov ebx, dword [ebp - 8]
xor ecx, eax
imul eax, dword [ebp - 0xc], 0x11b
xor ecx, eax
xor eax, eax
xor ecx, ebx
or ebx, edx
or ecx, edx
mov edx, dword [ebp - 0x14]
or eax, ebx
mov dword [edx*8 + 0x78a6b0], eax
mov dword [edx*8 + 0x78a6b4], ecx
inc edx
mov dword [ebp - 0x14], edx
cmp edx, 0x100
jl 0x65c3f0
pop edi
pop esi
mov byte [0x78aeb1], 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6656b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
mov esi, ecx
push eax
push 0
push esi
push 0x663d50
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
pop esi
test eax, eax
jne 0x6656f2
call fcn.00662530
push str.FileDownloadManager::runThisThread:_failed_to_create_a_new_thread._Fatal_Error
push 0x71e93c
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
add esp, 0xc
xor al, al
mov esp, ebp
pop ebp
ret
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x6666b0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [ebp + 8]
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
je 0x666704
cmp eax, 0xb7
je 0x666704
cmp eax, 0x50
je 0x666704
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
call fcn.00662530
mov esi, eax
mov edi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.failed_to_create_dir._Error____d
push 0x71e93c
push esi
call dword [edi + 0x24]
add esp, 0x10
xor al, al
pop edi
pop esi
pop ebp
ret
mov al, 1
pop ebp
ret