joyce8/EMBER2024-capa huggingface dataset:
Function at 0x566f41
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push ebp
push esi
xor esi, esi
push edi
mov edi, ecx
mov eax, esi
movd xmm0, eax
pshufd xmm0, xmm0, 0
paddd xmm0, xmmword [0x5cb1d0]
movups xmmword [edi + eax*4], xmm0
add eax, 4
cmp eax, 0x100
jl 0x566f4b
mov ebp, dword [esp + 0x14]
mov ebx, esi
xor edx, edx
mov eax, ebx
div dword [esp + 0x18]
movzx eax, byte [edx + ebp]
add eax, dword [edi + ebx*4]
add esi, eax
and esi, 0x800000ff
jns 0x566f91
dec esi
or esi, 0xffffff00
inc esi
mov cl, byte [edi + ebx*4]
mov eax, dword [edi + esi*4]
mov dword [edi + ebx*4], eax
inc ebx
movzx eax, cl
mov dword [edi + esi*4], eax
cmp ebx, 0x100
jl 0x566f70
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x566fb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x400
lea eax, [esp]
push ebx
push esi
push edi
push 0x400
push ecx
xor esi, esi
push eax
mov edi, esi
call fcn.00595de0
mov edx, dword [esp + 0x420]
add esp, 0xc
mov ebx, esi
add edx, 1
je 0x567040
push ebp
mov ebp, dword [esp + 0x414]
inc esi
and esi, 0x800000ff
jns 0x566ff6
dec esi
or esi, 0xffffff00
inc esi
mov eax, dword [esp + esi*4 + 0x10]
add edi, eax
and edi, 0x800000ff
jns 0x56700c
dec edi
or edi, 0xffffff00
inc edi
mov cl, al
mov eax, dword [esp + edi*4 + 0x10]
mov dword [esp + esi*4 + 0x10], eax
movzx eax, cl
mov dword [esp + edi*4 + 0x10], eax
mov ecx, dword [esp + esi*4 + 0x10]
add ecx, eax
and ecx, 0x800000ff
jns 0x567033
dec ecx
or ecx, 0xffffff00
inc ecx
mov al, byte [esp + ecx*4 + 0x10]
xor byte [ebx + ebp], al
inc ebx
cmp ebx, edx
jb 0x566fe5
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x400
ret 8
Function at 0x5709f8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x30
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x38], ebx
je 0x570b2f
cmp byte [edi + 0x3d], bl
je 0x570b2f
call fcn.00563a7d
mov esi, eax
mov ecx, edi
mov eax, dword [edi]
push esi
call dword [eax + 0xc]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], esi
push eax
call fcn.0056e001
pop ecx
pop ecx
test al, al
je 0x570a4e
xor al, al
jmp 0x570b31
push ebx
push 8
lea ecx, [esp + 0x30]
call fcn.00565dec
lea ebp, [edi + 0x40]
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x30]
call fcn.0056309c
mov ecx, eax
call fcn.00563f7b
lea ecx, [esp + 0x2c]
mov esi, eax
call fcn.0056305c
add esi, eax
lea ecx, [esp + 0x2c]
push esi
lea eax, [esp + 0x1c]
push eax
call fcn.0056309c
mov ecx, eax
call fcn.00563f7b
mov ecx, dword [edi + 0x38]
push eax
push ebp
call fcn.0056e385
sub eax, ebx
je 0x570ab6
sub eax, 1
je 0x570ab9
dec eax
sub eax, 1
jne 0x570b22
inc eax
jmp 0x570b20
mov byte [edi + 0x3d], bl
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x2c]
call fcn.0056309c
mov ecx, eax
call fcn.00563f7b
mov esi, dword [esp + 0x1c]
sub esi, eax
je 0x570afe
push dword [edi + 0x4c]
lea eax, [esp + 0x28]
push esi
push 1
push eax
lea ecx, [esp + 0x38]
call fcn.0056309c
mov ecx, eax
call fcn.00563f7b
push eax
call fcn.0059f9dc
add esp, 0x10
cmp esi, eax
jne 0x570b1e
cmp byte [edi + 0x3d], bl
je 0x570b1c
test esi, esi
jne 0x570a5d
push ebx
push 8
lea ecx, [esp + 0x30]
call fcn.00563631
jmp 0x570a5d
mov bl, 1
mov al, bl
mov bl, al
lea ecx, [esp + 0x28]
call fcn.00562bb8
mov al, bl
jmp 0x570b31
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x571a92
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x28
push ebx
mov ebx, ecx
push ebp
push esi
push edi
mov esi, dword [ebx]
mov edx, dword [ebx + 0x3c]
movzx ebp, word [esi + 0x14]
add ebp, esi
mov eax, dword [ebp + 0x20]
mov ecx, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x24], eax
call fcn.005718c9
lea edx, [ebp + 0x18]
mov dword [esp + 0x28], eax
mov ecx, ebx
call fcn.005719d6
mov ebx, dword [ebp + 0x3c]
mov edi, eax
and dword [esp + 0x34], 0
xor eax, eax
inc eax
mov dword [esp + 0x2c], edi
add ebp, 0x40
mov dword [esp + 0x30], ebx
cmp ax, word [esi + 6]
mov esi, ecx
mov dword [esp + 0x20], eax
jae 0x571ba4
mov eax, dword [ebp + 8]
mov ecx, eax
mov edx, dword [esi + 0x3c]
mov dword [esp + 0x1c], eax
call fcn.005718c9
mov edx, ebp
mov dword [esp + 0x14], eax
mov ecx, esi
call fcn.005719d6
mov edx, dword [esp + 0x10]
mov ecx, eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], ecx
cmp dword [esp + 0x28], eax
je 0x571b5b
lea ecx, [edi + edx]
cmp ecx, eax
ja 0x571b57
lea edx, [esp + 0x24]
mov ecx, esi
call fcn.005719f5
test eax, eax
je 0x571bc1
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov ebx, dword [ebp + 0x24]
mov dword [esp + 0x10], edx
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], eax
jmp 0x571b7f
mov ecx, dword [esp + 0x18]
mov eax, dword [ebp + 0x24]
mov edi, 0x2000000
test edi, eax
je 0x571b6f
test edi, ebx
je 0x571b6f
or ebx, eax
jmp 0x571b77
or ebx, eax
and ebx, 0xfdffffff
mov edi, ecx
sub edi, edx
add edi, dword [esp + 0x1c]
mov eax, dword [esi]
add ebp, 0x28
mov ecx, dword [esp + 0x20]
inc ecx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], edi
movzx eax, word [eax + 6]
mov dword [esp + 0x20], ecx
cmp ecx, eax
jl 0x571aee
xor eax, eax
inc eax
lea edx, [esp + 0x24]
mov dword [esp + 0x34], eax
mov ecx, esi
call fcn.005719f5
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
xor eax, eax
jmp 0x571bb9
Function at 0x58152e
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [ecx + 4]
xor eax, eax
xor edx, edx
movzx ecx, word [esi]
cmp ax, cx
jae 0x581559
movzx eax, dx
mov al, byte [eax + esi + 4]
cmp al, 0x13
je 0x581559
cmp al, 0xc0
je 0x581559
cmp al, 0xcc
je 0x581559
add edx, 2
cmp dx, cx
jb 0x58153e
pop esi
ret

Function at 0x584008
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, edx
mov edx, dword [esp + 0x10]
lea esi, [edi + 4]
push esi
call fcn.00583fa5
mov edx, dword [esp + 0x10]
pop ecx
push 4
sub edx, edi
pop ecx
mov al, byte [edx + edi]
mov byte [edi], al
inc edi
sub ecx, 1
jne 0x584023
push 8
pop ecx
mov al, byte [esi + edx]
xor byte [esi], al
inc esi
sub ecx, 1
jne 0x584031
pop edi
pop esi
ret

Function at 0x58628c
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x5862a4
sub edx, ecx
mov eax, dword [edx + ecx]
xor dword [ecx], eax
lea ecx, [ecx + 4]
sub esi, 1
jne 0x586297
pop esi
ret

Function at 0x5862a6
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
or eax, edx
push esi
mov esi, dword [esp + 8]
or eax, esi
test al, 3
jne 0x5862c1
shr esi, 2
push esi
call fcn.0058628c
pop ecx
pop esi
ret
test esi, esi
je 0x5862d2
sub edx, ecx
mov al, byte [edx + ecx]
xor byte [ecx], al
inc ecx
sub esi, 1
jne 0x5862c7
pop esi
ret

Function at 0x5862d4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
xor eax, eax
mov esi, edx
mov ebx, ecx
test edi, edi
jle 0x5862f8
sub ebx, esi
movzx edx, byte [ebx + esi]
movzx ecx, byte [esi]
xor edx, ecx
or eax, edx
inc esi
sub edi, 1
jne 0x5862e7
pop edi
pop esi
pop ebx
ret

Function at 0x5862fc
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
xor eax, eax
mov ecx, 0x5c66e0
push 0x20
pop edx
and eax, dword [ecx]
add ecx, 0x20
sub edx, 1
jne 0x586306
cmp ecx, 0x5c76e0
jl 0x586303
ret
Function at 0x58ad63
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
lea eax, [edx + 0x3f]
push esi
shr eax, 6
mov esi, edx
sub esi, eax
mov dword [esp + 0x10], edx
push edi
xor edi, edi
mov ebx, ecx
and dword [esp + 0x18], edi
inc esi
imul eax, esi, 3
shr eax, 2
cmp eax, dword [ebp]
jbe 0x58ad9a
mov eax, 0xffffff53
jmp 0x58af6d
mov esi, dword [esp + 0x20]
cmp edx, 3
jbe 0x58af5b
lea eax, [esp + 0x18]
mov ecx, ebx
push eax
lea edx, [esp + 0x18]
call fcn.0058ad05
add esp, 4
test eax, eax
jne 0x58af54
mov eax, dword [esp + 0x18]
mov cl, byte [eax + ebx]
inc eax
mov byte [esp + 0x13], cl
mov dword [esp + 0x18], eax
test cl, cl
je 0x58af5b
dec dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
mov ecx, ebx
call fcn.0058ad05
add esp, 4
test eax, eax
jne 0x58af6d
mov eax, dword [esp + 0x18]
mov cl, byte [eax + ebx]
inc eax
dec dword [esp + 0x14]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
mov byte [esp + 0x12], cl
mov ecx, ebx
push eax
call fcn.0058ad05
add esp, 4
test eax, eax
jne 0x58af6d
mov eax, dword [esp + 0x18]
mov cl, byte [eax + ebx]
inc eax
dec dword [esp + 0x14]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
mov byte [esp + 0x24], cl
mov ecx, ebx
push eax
call fcn.0058ad05
add esp, 4
test eax, eax
jne 0x58af6d
mov eax, dword [esp + 0x18]
mov dl, byte [esp + 0x13]
mov dh, byte [eax + ebx]
inc eax
dec dword [esp + 0x14]
mov dword [esp + 0x18], eax
cmp dl, 0x2b
jb 0x58af4d
mov cl, byte [esp + 0x12]
cmp cl, 0x2b
jb 0x58af4d
mov al, byte [esp + 0x24]
cmp al, 0x2b
jb 0x58af4d
cmp dh, 0x2b
jb 0x58af4d
cmp dl, 0x7a
ja 0x58af4d
cmp cl, 0x7a
ja 0x58af4d
cmp al, 0x7a
ja 0x58af4d
cmp dh, 0x7a
ja 0x58af4d
xor ecx, ecx
cmp al, 0x3d
setne cl
xor eax, eax
inc ecx
cmp dh, 0x3d
setne al
add ecx, edi
add eax, ecx
cmp eax, dword [ebp]
ja 0x58ad90
mov cl, byte [esp + 0x12]
movzx eax, dl
mov al, byte [eax + 0x5c7825]
mov byte [esp + 0x13], al
movzx eax, cl
mov ch, byte [eax + 0x5c7825]
mov al, byte [esp + 0x24]
cmp al, 0x3d
jne 0x58aef0
xor cl, cl
jmp 0x58aef9
movzx eax, al
mov cl, byte [eax + 0x5c7825]
cmp dh, 0x3d
jne 0x58af02
xor al, al
jmp 0x58af0b
movzx eax, dh
mov al, byte [eax + 0x5c7825]
mov ah, byte [esp + 0x13]
mov dl, cl
shl dl, 6
or dl, al
shl ah, 2
mov al, ch
shr al, 4
or al, ah
mov byte [edi + esi], al
inc edi
cmp byte [esp + 0x24], 0x3d
je 0x58af37
shr cl, 2
shl ch, 4
or cl, ch
mov byte [edi + esi], cl
inc edi
cmp dh, 0x3d
je 0x58af5b
mov byte [edi + esi], dl
inc edi
cmp dword [esp + 0x14], 3
ja 0x58ada7
jmp 0x58af5b
mov eax, 0xffffff66
jmp 0x58af6d
cmp eax, 0xffffff7c
jne 0x58af6d
test esi, esi
je 0x58af68
cmp dword [ebp], edi
jbe 0x58af68
mov byte [edi + esi], 0
mov dword [ebp], edi
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x58e669
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
test edi, edi
je 0x58e763
cmp dword [esp + 0x14], 0
mov esi, dword [esp + 0x18]
jne 0x58e68a
test esi, esi
jne 0x58e763
cmp edx, 3
je 0x58e6c0
cmp edx, 4
je 0x58e6c0
cmp edx, 5
je 0x58e6c0
cmp edx, 6
je 0x58e6c0
cmp edx, 7
je 0x58e6c0
cmp edx, 8
je 0x58e6c0
cmp edx, 0xa
je 0x58e6c0
cmp edx, 0xb
je 0x58e6c0
cmp edx, 0xc
je 0x58e6c0
cmp edx, 0xd
jne 0x58e763
xor ebx, ebx
mov byte [edi + 0x114], dl
push ecx
mov byte [edi + 0x115], bl
call fcn.0058e64c
mov ebp, eax
pop ecx
test ebp, ebp
jne 0x58e768
cmp byte [edi + 0x114], 6
lea ecx, [edi + 0x70]
jne 0x58e763
cmp esi, 0x40
ja 0x58e706
cmp dword [esp + 0x14], ebx
je 0x58e72f
push esi
push dword [esp + 0x18]
push ecx
call fcn.00595de0
add esp, 0xc
jmp 0x58e72c
mov edx, dword [esp + 0x14]
mov ecx, edi
push esi
call fcn.0059354b
mov ebp, eax
pop ecx
test ebp, ebp
jne 0x58e75f
lea edx, [edi + 0x70]
mov ecx, edi
call fcn.00593626
mov ebp, eax
test ebp, ebp
jne 0x58e75f
push 0x20
pop esi
lea ecx, [edi + 0x70]
cmp esi, 0x40
jae 0x58e747
push 0x40
pop eax
sub eax, esi
push eax
lea eax, [ecx + esi]
push ebx
push eax
call fcn.00596360
add esp, 0xc
mov al, byte [ebx + edi + 0x70]
xor al, 0x5c
mov byte [edi + ebx + 0xb0], al
xor byte [ebx + edi + 0x70], 0x36
inc ebx
cmp ebx, 0x40
jb 0x58e747
mov eax, ebp
jmp 0x58e768
mov eax, 0xffffff53
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x5925e7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xd4
push ebx
push ebp
push esi
xor ebx, ebx
xor esi, esi
push edi
inc ebx
inc esi
cmp dword [esp + 0xe8], 0
mov edi, ecx
push 0
cmovne ebx, dword [esp + 0xec]
mov ebp, edx
pop ecx
test bl, 0x1f
mov eax, ebx
push 0x37
push dword [esp + 0xf0]
setne cl
shr eax, 5
add eax, ecx
mov dword [esp + 0x18], eax
lea eax, [esp + 0x44]
push eax
call fcn.00595de0
and dword [esp + 0x20], 0
add esp, 0xc
cmp dword [esp + 0x10], 0
jbe 0x592725
lea ecx, [esp + 0x74]
call fcn.00593665
mov esi, eax
test esi, esi
jne 0x592725
push 0x37
lea edx, [esp + 0x40]
lea ecx, [esp + 0x78]
call fcn.0059354b
mov esi, eax
pop ecx
test esi, esi
jne 0x592725
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x74]
call fcn.00593626
mov esi, eax
test esi, esi
jne 0x592725
push 4
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00595de0
mov eax, dword [esp + 0x24]
add esp, 0xc
cmp dword [edi], 1
jbe 0x5926d0
cmp eax, dword [edi + 4]
jne 0x5926d0
cmp byte [edi + 0x76], 1
je 0x592743
mov edx, dword [esp + 0x10]
mov byte [edi + 0x76], 1
lea eax, [edx - 1]
cmp dword [esp + 0x14], eax
lea ecx, [edx + 1]
cmovne ecx, edx
mov dword [esp + 0x10], ecx
jmp 0x5926d7
mov byte [edi + 0x76], 0
mov dword [edi + 4], eax
test ebp, ebp
je 0x592712
test ebx, ebx
je 0x592712
lea eax, [esp + 0x1c]
cmp ebx, 0x20
jb 0x592705
push 0x20
push eax
push ebp
call fcn.00595de0
add esp, 0xc
lea ecx, [esp + 0x3c]
sub ebx, 0x20
add ebp, 0x20
call fcn.005925d8
jmp 0x592712
push ebx
push eax
push ebp
call fcn.00595de0
add esp, 0xc
xor ebx, ebx
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
cmp eax, dword [esp + 0x10]
jl 0x592645
push 0x37
pop edx
lea ecx, [esp + 0x3c]
call fcn.0057cb99
xor eax, eax
test esi, esi
setne al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xd4
ret
push 3
pop eax
jmp 0x592738

Function at 0x592e3f
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, ecx
test esi, esi
jne 0x592deb
mov eax, 0xffffff53
pop esi
ret
push edi
push 0x20
xor edi, edi
push edi
push esi
call fcn.00596360
add esp, 0xc
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
xor eax, eax
mov dword [esi + 0x68], edi
mov dword [esi], 0x6a09e667
pop edi
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
pop esi
ret
test ecx, ecx
jne 0x592e49
mov eax, 0xffffff53
ret
mov dword [ecx + 0x6c], edx
jmp 0x592ddd
Function at 0x59356a
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, ecx
test ebx, ebx
jne 0x593578
mov eax, 0xffffff53
pop ebx
ret
mov eax, dword [ebx + 0x60]
push ebp
push esi
push edi
push 0x40
pop edi
lea ebp, [ebx + 0x20]
mov byte [eax + ebp], 0x80
inc dword [ebx + 0x60]
mov ecx, dword [ebx + 0x60]
push 0x38
pop esi
cmp ecx, esi
jbe 0x5935c5
mov eax, edi
sub eax, ecx
push eax
lea eax, [ecx + ebp]
push 0
push eax
call fcn.00596360
push edi
mov edx, ebp
mov dword [ebx + 0x60], edi
mov ecx, ebp
call fcn.00592db3
add esp, 0x10
mov edx, ebp
mov ecx, ebx
call fcn.00592e51
test eax, eax
jne 0x593621
and dword [ebx + 0x60], eax
mov eax, dword [ebx + 0x60]
sub esi, eax
push esi
add eax, ebp
push 0
push eax
call fcn.00596360
lea edi, [ebx + 0x64]
mov edx, ebp
mov ecx, dword [edi]
lea esi, [ebx + 0x68]
mov eax, dword [esi]
shr ecx, 0x1d
push 0x40
lea eax, [ecx + eax*8]
mov ecx, ebp
mov dword [esi], eax
mov eax, dword [edi]
shl eax, 3
mov dword [edi], eax
call fcn.00592db3
push 4
lea eax, [ebp + 0x38]
push esi
push eax
call fcn.00595de0
push 4
lea eax, [ebp + 0x3c]
push edi
push eax
call fcn.00595de0
add esp, 0x28
mov edx, ebp
mov ecx, ebx
pop edi
pop esi
pop ebp
pop ebx
jmp fcn.00592e51
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x593626
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
je 0x59365d
test edi, edi
je 0x59365d
call fcn.0059356a
test eax, eax
jne 0x593662
push 0x20
mov edx, esi
mov ecx, esi
call fcn.00592db3
push 0x20
push esi
push edi
call fcn.00595de0
add esp, 0x10
mov ecx, esi
pop edi
pop esi
jmp 0x592ddd
mov eax, 0xffffff53
pop edi
pop esi
ret

Function at 0x593715
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov eax, edx
mov ebp, ecx
neg eax
mov dword [esp + 8], eax
test ebp, ebp
je 0x5937af
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x5937af
mov edx, dword [ebp]
mov ecx, ebx
inc edx
call fcn.0058edf8
mov dword [esp + 0xc], eax
test eax, eax
jne 0x5937b4
xor edx, edx
push esi
push edi
cmp dword [ebp], edx
jle 0x593775
mov edi, dword [ebx + 0xc]
mov ecx, ebp
call fcn.005936ff
mov ecx, ebx
mov esi, eax
call fcn.005936ff
mov ecx, dword [esp + 0x10]
xor esi, eax
and esi, ecx
xor dword [edi + edx*4], esi
inc edx
cmp edx, dword [ebp]
jl 0x59374f
jmp 0x59379a
mov ecx, dword [esp + 0x10]
jmp 0x59379a
mov edi, dword [ebx + 0xc]
mov ecx, ebp
call fcn.005936ff
mov ecx, ebx
mov esi, eax
call fcn.005936ff
mov ecx, dword [esp + 0x10]
xor esi, eax
and esi, ecx
xor dword [edi + edx*4], esi
inc edx
cmp edx, dword [ebx]
jl 0x59377b
mov eax, dword [ebp]
xor eax, dword [ebx]
and eax, ecx
xor dword [ebx], eax
mov eax, dword [esp + 0x14]
pop edi
pop esi
jmp 0x5937b4
mov eax, 0xffffff53
pop ebp
pop ebx
pop ecx
pop ecx
ret

Function at 0x5ab566
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005ab3e5
Function at 0xc361f0
Capabilities:
Contain obfuscated stackstrings
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0x48
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 0x10]
cmp ebx, esi
je 0xc36352
cmp edi, esi
je 0xc36352
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
add eax, edi
mov dword [ebp - 0x48], 0x44434241
mov dword [ebp - 0x44], 0x48474645
mov dword [ebp - 0x40], 0x4c4b4a49
mov dword [ebp - 0x3c], 0x504f4e4d
mov dword [ebp - 0x38], 0x54535251
mov dword [ebp - 0x34], 0x58575655
mov dword [ebp - 0x30], 0x62615a59
mov dword [ebp - 0x2c], 0x66656463
mov dword [ebp - 0x28], 0x6a696867
mov dword [ebp - 0x24], 0x6e6d6c6b
mov dword [ebp - 0x20], 0x7271706f
mov dword [ebp - 0x1c], 0x76757473
mov dword [ebp - 0x18], 0x7a797877
mov dword [ebp - 0x14], 0x33323130
mov dword [ebp - 0x10], 0x37363534
mov dword [ebp - 0xc], 0x2f2b3938
mov dword [ebp - 4], esi
mov ecx, edi
mov dword [ebp - 8], eax
cmp edx, esi
jbe 0xc36342
add edi, 4
jmp 0xc362a3
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0xc362b8
mov dword [ebp - 4], 2
jmp 0xc362d9
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0xc362cf
mov dword [ebp - 4], 1
jmp 0xc362d9
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0xc36352
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x48]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x48]
mov byte [ecx + 1], bl
mov ebx, dword [ebp - 4]
cmp ebx, 1
jbe 0xc36310
mov byte [ecx + 2], 0x3d
jmp 0xc3631d
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x48]
mov byte [ecx + 2], al
add ecx, 3
add edi, 3
test ebx, ebx
je 0xc3632c
mov byte [ecx], 0x3d
jmp 0xc36332
mov dl, byte [ebp + edx - 0x48]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0xc362a0
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
sub ecx, edi
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001550
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov ecx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ebx, edi
and ebx, 0x20
lea eax, [ebx + ecx]
mov esi, eax
or esi, ecx
imul esi, eax
xor esi, ecx
add ebx, esi
xor ebx, esi
lea eax, [ebx + esi]
mov dword [ebp - 0x10], eax
push edi
push esi
push eax
call dword [sym.imp.USER32.dll_RemoveMenu]
imul ebx, dword [ebp - 0x10]
lea eax, [ebx + esi]
or edi, eax
add edi, eax
or edi, esi
imul edi, eax
mov esi, dword [ebp + 8]
imul esi, edi
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_EqualSid]
add esi, 0xf4
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x10001630
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
imul eax, dword [0x1004c0ac], 0x360
push eax
add eax, 0x3c4
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor eax, eax
pop ebp
ret

Function at 0x10003320
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push 0x97171155
call fcn.10008470
add esp, 4
push eax
push 0
call fcn.10004200
add esp, 8
call eax
cmp eax, dword [0x1004d524]
je 0x10003353
mov dword [0x1004d524], eax
push eax
call fcn.100094a0
add esp, 4
pop ebp
jmp fcn.10032710
Function at 0x100094a0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov edi, dword [ebp + 8]
mov esi, 1
mov dword [0x1004e5d4], 1
mov dword [0x1004e5dc], edi
nop
mov ebx, edi
shr ebx, 0x1e
mov eax, ebx
not eax
push eax
push 0x1dc41eea
call fcn.100067d0
add esp, 8
and ebx, 1
or ebx, eax
xor ebx, edi
xor ebx, 0x1dc41eea
imul ebx, ebx, 0x6c078965
push 0x56ee0513
call fcn.10008470
add esp, 4
mov ecx, esi
sub ecx, eax
lea edi, [ecx + ebx - 0x3ec03aee]
mov ecx, ebx
sub ecx, eax
lea eax, [esi + ecx - 0x3ec03aee]
mov dword [ebp - 0x10], eax
push esi
push ebx
call fcn.100050e0
add esp, 8
mov eax, dword [ebp - 0x10]
mov dword [esi*4 + 0x1004e5dc], eax
inc esi
cmp esi, 0x270
jne 0x100094c0
push 0x97d1c271
call fcn.10008470
add esp, 4
mov dword [0x1004e5d4], eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1000a030
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [ebp + 8]
test eax, eax
je 0x1000a173
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1000a179
mov ecx, dword [str.NGjnEcnJPW9NSQ8]
movzx eax, byte [eax]
mov bh, byte [ecx]
mov byte [ebp - 0x14], bh
not bh
and bh, al
push 0xff
push eax
call fcn.100077e0
add esp, 8
mov bl, al
and bl, byte [ebp - 0x14]
or bl, bh
mov byte [esi], bl
je 0x1000a177
mov edi, 1
jmp 0x1000a136
shr esi, 4
mov ecx, 1
mov eax, esi
shl eax, 4
add eax, esi
sub ecx, eax
mov eax, dword [ebp + 8]
add ecx, dword [str.NGjnEcnJPW9NSQ8]
movzx eax, byte [eax + edi]
movzx esi, byte [edi + ecx - 1]
mov dword [ebp - 0x14], eax
push 0xff
push esi
call fcn.100077e0
add esp, 8
and al, 0xe9
mov byte [ebp - 0xe], al
push 0xe8
call fcn.10009090
add esp, 4
mov bh, al
not bh
movzx eax, bh
push eax
push esi
call fcn.100073a0
add esp, 8
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0x14]
mov bl, al
not bl
push 0xe8
call fcn.10009090
add esp, 4
movzx ecx, byte [ebp - 0xe]
and bh, byte [ebp - 0x14]
and al, bl
movzx eax, al
or byte [ebp - 0xd], cl
movzx ecx, bh
push ecx
push eax
call fcn.10002bd0
add esp, 8
mov ebx, eax
push dword [ebp - 0x14]
push esi
call fcn.100077e0
add esp, 8
xor bl, byte [ebp - 0xd]
mov eax, dword [ebp + 0xc]
mov byte [eax + edi], bl
lea edi, [edi + 1]
je 0x1000a179
mov eax, edi
mov ecx, 0xf0f0f0f1
mul ecx
mov esi, edx
push 0x21
call fcn.10009090
add esp, 4
cmp bl, 0x7f
je 0x1000a158
cmp bl, al
jge 0x1000a090
cmp bl, 0xd
ja 0x1000a16e
movzx eax, bl
mov ecx, 0x2600
bt ecx, eax
jb 0x1000a090
mov eax, dword [ebp + 8]
jmp 0x1000a179
xor eax, eax
jmp 0x1000a179
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret