joyce8/EMBER2024-capa huggingface dataset:
Function at 0x631ffc20
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x6757e9a0]
test eax, eax
je 0x631ffc93
mov eax, dword [0x6757e9a0]
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
call eax
sub esp, 8
mov eax, dword [0x6757e9a0]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_CloseWindow]
call eax
sub esp, 4
mov eax, dword [0x6757e9a0]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_DestroyWindow]
call eax
sub esp, 4
mov edx, dword [0x67602870]
mov eax, dword [0x67602884]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_UnregisterClassA]
call eax
sub esp, 8
mov dword [0x6757e9a0], 0
nop
leave
ret

Function at 0x631ffc96
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov dword [0x6757ee2c], eax
mov eax, dword [0x6757ee28]
cmp dword [ebp + 8], eax
je 0x631ffd7c
mov eax, dword [ebp + 8]
mov dword [0x6757ee28], eax
mov eax, dword [0x6757e9a0]
test eax, eax
je 0x631ffd7f
cmp dword [ebp + 8], 1
je 0x631ffcfc
cmp dword [ebp + 8], 2
je 0x631ffd42
cmp dword [ebp + 8], 0
jne 0x631ffd5e
mov eax, dword [0x6757e9a0]
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
call eax
sub esp, 8
jmp 0x631ffd80
mov eax, dword [0x6757e9a0]
mov dword [esp + 4], 1
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
call eax
sub esp, 8
mov eax, dword [0x6757e9a4]
mov dword [esp + 0xc], 0xffff
mov dword [esp + 8], 0
mov dword [esp + 4], 0xb6
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_SendMessageA]
call eax
sub esp, 0x10
jmp 0x631ffd80
mov eax, dword [0x6757e9a0]
mov dword [esp + 4], 6
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
call eax
sub esp, 8
jmp 0x631ffd80
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], str.Invalid_visLevel__d_sent_to_Sys_ShowConsole_n
call fcn.631e0ef5
mov dword [esp], eax
call fcn.631fb95a
nop
jmp 0x631ffd80
nop
jmp 0x631ffd80
nop
leave
ret
Function at 0x632000bf
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 8]
sar eax, 0x10
and eax, 0xff
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x29
jne 0x632000e3
mov eax, 0x7e
jmp 0x632001d4
mov eax, dword [ebp + 8]
and eax, 0x1000000
test eax, eax
je 0x632000f8
mov dword [ebp - 0x10], 1
jmp 0x632000ff
mov dword [ebp - 0x10], 0
cmp dword [ebp + 0xc], 0x8f
jg 0x63200161
mov eax, dword [ebp + 0xc]
lea edx, [eax + eax]
mov eax, dword [ebp - 0x10]
add eax, edx
add eax, 0x633aeb60
movzx eax, byte [eax]
movzx eax, al
mov dword [ebp - 0xc], eax
mov eax, 0xc5f8f4
mov eax, dword [eax + 4]
and eax, 0x11
test eax, eax
je 0x63200156
cmp dword [ebp - 0x10], 0
jne 0x63200156
cmp dword [ebp + 0xc], 0x5f
jle 0x63200149
cmp dword [ebp + 0xc], 0x69
jg 0x63200149
mov dword [ebp - 0xc], 0
cmp dword [ebp + 0xc], 0x6e
jne 0x63200156
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0
je 0x63200161
mov eax, dword [ebp - 0xc]
jmp 0x632001d4
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 2
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_MapVirtualKeyA]
call eax
sub esp, 8
and eax, 0xff
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x7f
jg 0x6320018c
mov eax, dword [ebp - 0xc]
jmp 0x632001d4
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + eax + 0x633aed60]
mov byte [ebp - 0x11], al
jmp 0x632001cb
movsx eax, byte [ebp - 0x11]
cmp dword [ebp - 0xc], eax
jne 0x632001b9
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + eax + 0x633aed61]
jmp 0x632001d4
add dword [ebp - 0x18], 1
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + eax + 0x633aed60]
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x632001a3
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x63202dfb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp + 4], 0x67602c40
mov dword [esp], 0x488e98
call fcn.631ed55f
mov dword [esp + 4], 0x67602c40
mov dword [esp], 0x488ee3
call fcn.631ed55f
mov dword [esp + 4], 0x67602c40
mov dword [esp], 0x488f0f
call fcn.631ed55f
mov dword [esp + 4], 0x67602b00
mov dword [esp], 0x488e67
call fcn.631ed55f
mov dword [esp + 4], 0x67602b00
mov dword [esp], 0x488f05
call fcn.631ed55f
mov dword [esp + 4], 0x67602b00
mov dword [esp], 0x489d55
call fcn.631ed55f
mov dword [esp + 4], 0x67602b00
mov dword [esp], 0x48aedf
call fcn.631ed55f
mov dword [esp + 4], 0x67602b00
mov dword [esp], 0x48af22
call fcn.631ed55f
mov dword [esp + 4], 0x67602b00
mov dword [esp], 0x48b00e
call fcn.631ed55f
mov dword [esp + 4], 0x67602b00
mov dword [esp], 0x48b088
call fcn.631ed55f
mov dword [esp + 4], 0x67602b00
mov dword [esp], 0x48b184
call fcn.631ed55f
mov dword [esp + 4], 0x67602b00
mov dword [esp], 0x48b585
call fcn.631ed55f
call fcn.63202caf
nop
leave
ret

Function at 0x63203660
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0xc], 0xffffffff
mov dword [esp + 4], 0x633d7ceb
mov eax, dword [ebp - 0x11c]
mov dword [esp], eax
call fcn.631e078c
test eax, eax
je 0x63203709
mov dword [esp + 4], str.common_mp
mov eax, dword [ebp - 0x11c]
mov dword [esp], eax
call fcn.631e078c
test eax, eax
je 0x63203709
mov dword [esp + 4], str.localized_common_mp
mov eax, dword [ebp - 0x11c]
mov dword [esp], eax
call fcn.631e078c
test eax, eax
je 0x63203709
mov dword [esp + 4], str.code_post_gfx_mp
mov eax, dword [ebp - 0x11c]
mov dword [esp], eax
call fcn.631e078c
test eax, eax
je 0x63203709
mov dword [esp + 4], str.localized_code_post_gfx_mp
mov eax, dword [ebp - 0x11c]
mov dword [esp], eax
call fcn.631e078c
test eax, eax
je 0x63203709
mov eax, dword [ebp - 0x11c]
mov dword [esp], eax
call fcn.63203580
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x6320377c
lea eax, [ebp - 0x110]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x100
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x11c]
mov dword [esp], eax
call fcn.631b7fdf
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x60000000
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x80000000
lea eax, [ebp - 0x110]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileA]
call eax
sub esp, 0x1c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x63203789
mov eax, 0
jmp 0x632037b7
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetFileSize]
call eax
sub esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
leave
ret
Function at 0x63207450
Capabilities:
Contain obfuscated stackstrings
Hash data using sha256
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xffffffc0
sub esp, 0xed0
mov eax, 0x448
mov edx, 0x5eb7
call fcn.63207470
Function at 0x632c25c6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x50
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
lea edx, [eax + 4]
mov ebx, 0x632c2450
mov esi, 0
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov ecx, edx
call fcn.633904b8
sub esp, 0xc
mov eax, dword [ebp - 0xc]
lea edx, [eax + 0x1c]
mov dword [ebp - 0x48], 0x632c24b4
mov dword [ebp - 0x44], 0
mov ecx, dword [ebp - 0x48]
mov ebx, dword [ebp - 0x44]
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov ecx, edx
call fcn.633906a8
sub esp, 0xc
mov eax, dword [ebp - 0xc]
lea edx, [eax + 0x34]
mov dword [ebp - 0x40], 0x632c2488
mov dword [ebp - 0x3c], 0
mov ecx, dword [ebp - 0x40]
mov ebx, dword [ebp - 0x3c]
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov ecx, edx
call fcn.63391248
sub esp, 0xc
mov eax, dword [ebp - 0xc]
lea edx, [eax + 0x4c]
mov dword [ebp - 0x38], 0x632c24dc
mov dword [ebp - 0x34], 0
mov ecx, dword [ebp - 0x38]
mov ebx, dword [ebp - 0x34]
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov ecx, edx
call fcn.63390c78
sub esp, 0xc
mov eax, dword [ebp - 0xc]
lea edx, [eax + 0x64]
mov dword [ebp - 0x30], 0x632c2508
mov dword [ebp - 0x2c], 0
mov ecx, dword [ebp - 0x30]
mov ebx, dword [ebp - 0x2c]
mov dword [esp + 4], ecx
Function at 0x632c35e2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], 0
mov eax, dword [ebp + 8]
mov word [eax], 0
mov dword [esp], str.HKCU
call fcn.632c33d5
mov edx, eax
lea eax, [ebp - 0x20]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20219
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareValveSteamActiveProcess
mov dword [esp], edx
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
test eax, eax
setne al
test al, al
je 0x632c364a
mov eax, 0
jmp 0x632c3716
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
mov dword [esp + 0x14], edx
mov edx, dword [ebp + 8]
mov dword [esp + 0x10], edx
lea edx, [ebp - 0x18]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], str.SteamClientDll
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call eax
sub esp, 0x18
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
cmp dword [ebp - 0x14], 0
je 0x632c369f
mov eax, 0
jmp 0x632c3716
mov eax, dword [ebp + 0xc]
add eax, 0x7fffffff
lea edx, [eax + eax]
mov eax, dword [ebp + 8]
add eax, edx
mov word [eax], 0
mov dword [ebp - 0xc], 0
mov dword [esp + 4], str.steamclient.dll
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcr100.dll_wcsstr
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x632c36f9
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
add dword [ebp - 0x10], 2
mov dword [esp + 4], str.steamclient.dll
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcr100.dll_wcsstr
mov dword [ebp - 0x10], eax
jmp 0x632c36d1
cmp dword [ebp - 0xc], 0
je 0x632c3711
mov eax, dword [ebp - 0xc]
sub eax, 2
mov word [eax], 0
mov eax, 1
jmp 0x632c3716
mov eax, 0
leave
ret
Function at 0x632c514a
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [ebp + 0x18]
mov byte [ebp - 0x1c], al
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x633d8e9e
mov dword [esp + 4], 0x800
mov dword [esp], 0x67581480
call fcn.632c2f24
mov dword [esp + 8], 0x100
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], eax
mov dword [esp], 0x67581c88
call fcn.631e0550
mov eax, dword [ebp + 0x10]
mov dword [0x67581c84], eax
mov eax, dword [ebp + 0xc]
mov dword [0x67581c80], eax
movzx eax, byte [ebp - 0x1c]
mov byte [0x67581d88], al
mov dword [esp], 0x632c5002
mov eax, dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call eax
sub esp, 4
mov dword [ebp - 0xc], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x67581480
mov dword [esp + 8], 0x632c5049
mov dword [esp + 4], 0x200000
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [0x67581464], eax
mov eax, dword [0x67581464]
test eax, eax
jne 0x632c521e
mov dword [esp + 4], str.Couldnt_run_SteamAPI_init_thread_n
mov dword [esp], 0x10
call fcn.631a9970
jmp 0x632c527c
mov eax, dword [0x67581464]
mov dword [esp + 4], 0x4e20
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
cmp eax, 0x102
sete al
test al, al
je 0x632c527c
mov eax, dword [0x67581464]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TerminateThread]
call eax
sub esp, 8
mov dword [0x67581460], 0
mov dword [esp + 4], str.Timeout_hit_while_waiting_for_SteamAPI_init_thread_n
mov dword [esp], 0x10
call fcn.631a9970
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call eax
sub esp, 4
mov eax, dword [0x67581460]
test eax, eax
je 0x632c529c
mov eax, 1
jmp 0x632c52a1
mov eax, 0
leave
ret
Function at 0x632c55a3
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
lea eax, [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
sub esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x632c55d1
mov eax, 0
jmp 0x632c56ae
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.633a3950
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.VERSION.dll_GetFileVersionInfoW
sub esp, 0x10
test eax, eax
sete al
test al, al
je 0x632c5616
mov eax, 0
jmp 0x632c56ae
lea eax, [ebp - 0x18]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 4], str.StringFileInfo040904B0CompanyName
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.VERSION.dll_VerQueryValueA
sub esp, 0x10
test eax, eax
sete al
test al, al
je 0x632c565d
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.633a3940
mov eax, 0
jmp 0x632c56ae
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], 0x11
mov dword [esp + 4], str.Valve_Corporation
mov dword [esp], eax
call sub.msvcr100.dll_strncmp
test eax, eax
je 0x632c5696
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.633a3940
mov eax, 0
jmp 0x632c56ae
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.633a3940
mov eax, 1
leave
ret

Function at 0x632c56b0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
lea eax, [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
sub esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x632c56de
mov eax, 0
jmp 0x632c57bb
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.633a3950
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.VERSION.dll_GetFileVersionInfoA
sub esp, 0x10
test eax, eax
sete al
test al, al
je 0x632c5723
mov eax, 0
jmp 0x632c57bb
lea eax, [ebp - 0x18]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 4], str.StringFileInfo040904B0CompanyName
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.VERSION.dll_VerQueryValueA
sub esp, 0x10
test eax, eax
sete al
test al, al
je 0x632c576a
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.633a3940
mov eax, 0
jmp 0x632c57bb
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], 0x11
mov dword [esp + 4], str.Valve_Corporation
mov dword [esp], eax
call sub.msvcr100.dll_strncmp
test eax, eax
je 0x632c57a3
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.633a3940
mov eax, 0
jmp 0x632c57bb
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.633a3940
mov eax, 1
leave
ret
Function at 0x632cbea5
Capabilities:
Encode data using xor
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x8c
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
test ebx, ebx
jne 0x632cbed7
mov dword [esp + 8], 0xd7
mov dword [esp + 4], str.hashes_blake2s.c
mov dword [esp], 0x633e1e71
call fcn.632cc18c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x7c], 0x10
dec eax
cmp eax, 0x1f
ja 0x632cbfbc
test esi, esi
setne dl
cmp dword [ebp + 0x14], 0
setne al
cmp dl, al
jne 0x632cbfb5
cmp dword [ebp + 0x14], 0x20
ja 0x632cbfb5
lea edx, [ebp - 0x74]
xor eax, eax
mov ecx, 7
mov word [ebp - 0x76], 0x101
mov edi, edx
lea edx, [ebx + 0x20]
rep stosd dword es:[edi], eax
mov cl, byte [ebp + 0xc]
mov edi, edx
mov byte [ebp - 0x78], cl
mov cl, byte [ebp + 0x14]
mov byte [ebp - 0x77], cl
mov ecx, 0x17
rep stosd dword es:[edi], eax
mov dword [ebx], 0x6a09e667
mov dword [ebx + 4], 0xbb67ae85
mov dword [ebx + 8], 0x3c6ef372
mov dword [ebx + 0xc], 0xa54ff53a
mov dword [ebx + 0x10], 0x510e527f
mov dword [ebx + 0x14], 0x9b05688c
mov dword [ebx + 0x18], 0x1f83d9ab
mov dword [ebx + 0x1c], 0x5be0cd19
mov edx, dword [ebp + eax*4 - 0x78]
xor dword [ebx + eax*4], edx
inc eax
cmp eax, 8
jne 0x632cbf6c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x7c], 0
mov dword [ebx + 0x74], eax
test esi, esi
je 0x632cbfbc
lea edx, [ebp - 0x58]
xor eax, eax
mov ecx, 0x10
mov edi, edx
rep stosd dword es:[edi], eax
mov edi, edx
mov ecx, dword [ebp + 0x14]
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], ebx
call fcn.632cbcc2
jmp 0x632cbfbc
mov dword [ebp - 0x7c], 0x10
mov eax, dword [ebp - 0x7c]
add esp, 0x8c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x632d24b8
Capabilities:
Hash data using tiger

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, edx
push ebx
sub esp, 0x14
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
xor eax, dword [ecx]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
xor eax, dword [ecx + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov dword [ecx], eax
shrd eax, edx, 0x10
mov dword [ecx + 4], edx
movzx eax, al
lea edx, [eax + 0x100]
mov eax, dword [ebp - 0x14]
mov edi, dword [edx*8 + 0x633e2640]
mov edx, dword [edx*8 + 0x633e2644]
movzx eax, al
add eax, 0x200
xor edi, dword [eax*8 + 0x633e2640]
xor edx, dword [eax*8 + 0x633e2644]
movzx eax, byte [ebp - 0x18]
xor edi, dword [eax*8 + 0x633e2640]
xor edx, dword [eax*8 + 0x633e2644]
mov eax, dword [ebp - 0x14]
shr eax, 0x10
movzx eax, al
add eax, 0x300
xor edi, dword [eax*8 + 0x633e2640]
xor edx, dword [eax*8 + 0x633e2644]
mov eax, dword [ebp - 0x1c]
sub dword [eax], edi
sbb dword [eax + 4], edx
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
shrd eax, edx, 8
shrd ecx, ebx, 0x18
movzx eax, al
movzx ecx, cl
add eax, 0x300
add ecx, 0x200
mov ebx, dword [eax*8 + 0x633e2640]
mov edx, dword [eax*8 + 0x633e2644]
xor ebx, dword [ecx*8 + 0x633e2640]
xor edx, dword [ecx*8 + 0x633e2644]
mov ecx, dword [ebp - 0x14]
shr ecx, 0x18
mov eax, dword [ecx*8 + 0x633e2640]
xor edx, dword [ecx*8 + 0x633e2644]
xor eax, ebx
mov ebx, dword [ebp - 0x14]
movzx edi, bh
add edi, 0x100
xor edx, dword [edi*8 + 0x633e2644]
xor eax, dword [edi*8 + 0x633e2640]
add eax, dword [esi]
adc edx, dword [esi + 4]
cmp dword [ebp + 0x10], 7
je 0x632d25e1
cmp dword [ebp + 0x10], 9
je 0x632d25f7
cmp dword [ebp + 0x10], 5
jne 0x632d2606
mov ecx, eax
mov ebx, edx
shld ebx, eax, 2
shl ecx, 2
jmp 0x632d2602
mov ecx, eax
mov ebx, edx
shl ecx, 3
shld ebx, eax, 3
sub ecx, eax
sbb ebx, edx
mov dword [esi], ecx
mov dword [esi + 4], ebx
jmp 0x632d260b
mov ecx, eax
mov ebx, edx
shld ebx, eax, 3
shl ecx, 3
add eax, ecx
adc edx, ebx
mov dword [esi], eax
mov dword [esi + 4], edx
add esp, 0x14
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x632dd432
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
lea eax, [ebp - 0x44]
mov dword [ebp - 0xc], eax
mov dword [esp + 8], 0x30
mov dword [esp + 4], 0
lea eax, [ebp - 0x44]
mov dword [esp], eax
call sub.msvcr100.dll_memset
mov dword [ebp - 0x14], 0
jmp 0x632dd4c5
mov dword [ebp - 0x10], 0x10
jmp 0x632dd490
mov eax, dword [ebp - 0x10]
sub eax, 1
mov edx, dword [ebp + 8]
movzx edx, byte [edx + eax]
add edx, 1
mov ecx, dword [ebp + 8]
mov byte [ecx + eax], dl
mov edx, dword [ebp + 8]
movzx eax, byte [edx + eax]
test al, al
jne 0x632dd498
sub dword [ebp - 0x10], 1
cmp dword [ebp - 0x10], 0
jg 0x632dd46b
jmp 0x632dd499
nop
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
add eax, 0x20
mov ecx, dword [ebp - 0xc]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], 1
mov dword [esp], eax
call fcn.632f61de
add dword [ebp - 0xc], 0x10
add dword [ebp - 0x14], 0x10
cmp dword [ebp - 0x14], 0x2f
jle 0x632dd462
mov dword [ebp - 0x10], 0
jmp 0x632dd4fa
lea eax, [ebp - 0x44]
mov edx, dword [ebp - 0x10]
add eax, edx
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 0xc]
add eax, edx
movzx eax, byte [eax]
xor ecx, eax
lea eax, [ebp - 0x44]
mov edx, dword [ebp - 0x10]
add eax, edx
mov byte [eax], cl
add dword [ebp - 0x10], 1
cmp dword [ebp - 0x10], 0x2f
jle 0x632dd4d4
mov eax, dword [ebp + 8]
lea edx, [eax + 0x20]
mov dword [esp + 8], 0x100
lea eax, [ebp - 0x44]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.632f4ae9
lea eax, [ebp - 0x44]
add eax, 0x20
mov edx, dword [ebp + 8]
mov dword [esp + 8], 0x10
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.msvcr100.dll_memcpy
mov eax, 0
leave
ret

Function at 0x632dd86a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov dword [ebp - 0xc], 0xffffffc6
mov dword [esp + 4], 0x633e5ea0
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.msvcr100.dll_fopen
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x632dd89d
mov eax, 0xffffffc6
jmp 0x632dd910
mov dword [esp + 8], 0x100
lea eax, [ebp - 0x110]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.632dd82d
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x632dd901
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x100
mov dword [esp + 4], 1
lea eax, [ebp - 0x110]
mov dword [esp], eax
call sub.msvcr100.dll_fwrite
cmp eax, 0x100
je 0x632dd8f8
mov dword [ebp - 0xc], 0xffffffc6
jmp 0x632dd902
mov dword [ebp - 0xc], 0
jmp 0x632dd902
nop
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcr100.dll_fclose
mov eax, dword [ebp - 0xc]
leave
ret