joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44fcd0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
ja case.default.0x44fced
mov ecx, dword [ebp - 0x18]
jmp dword [ecx*4 + 0x44fe7c]
mov dword [ebp - 4], 0
jmp 0x44fd06
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 5
jge 0x44fd22
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov edx, dword [edx*4 + 0x621ed8]
mov dword [ecx + eax*4 + 4], edx
jmp 0x44fcfd
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x24], 0
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x28], 0
jmp case.default.0x44fced
mov dword [ebp - 8], 0
jmp 0x44fd4d
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 8
jge 0x44fd69
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x621ff0]
mov dword [ecx + eax*4 + 4], edx
jmp 0x44fd44
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x24], 0
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x28], 0
jmp case.default.0x44fced
mov dword [ebp - 0xc], 0
jmp 0x44fd94
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 8
jge 0x44fdc1
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax*8 + 0x622010]
mov edx, dword [eax*8 + 0x622014]
mov eax, dword [ebp - 0xc]
mov esi, dword [ebp - 0x14]
mov dword [esi + eax*8 + 0xac], ecx
mov dword [esi + eax*8 + 0xb0], edx
jmp 0x44fd8b
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0xec], 0
mov edx, dword [ebp - 0x14]
mov dword [edx + 0xf0], 0
mov eax, dword [ebp - 0x14]
mov dword [eax + 0xf4], 0
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0xf8], 0
jmp case.default.0x44fced
mov dword [ebp - 0x10], 0
jmp 0x44fe09
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 8
jge 0x44fe36
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax*8 + 0x6222d0]
mov edx, dword [eax*8 + 0x6222d4]
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
mov dword [esi + eax*8 + 0xac], ecx
mov dword [esi + eax*8 + 0xb0], edx
jmp 0x44fe00
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0xec], 0
mov edx, dword [ebp - 0x14]
mov dword [edx + 0xf0], 0
mov eax, dword [ebp - 0x14]
mov dword [eax + 0xf4], 0
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0xf8], 0
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
mov dword [edx], eax
mov eax, dword [ebp - 0x14]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x450520
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 3
ja case.default.0x45053f
mov edx, dword [ebp - 0x18]
jmp dword [edx*4 + 0x4506c4]
mov dword [ebp - 4], 0
jmp 0x450558
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 5
jge 0x450574
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax*4 + 0x621ed8]
mov dword [edx + ecx*4 + 4], eax
jmp 0x45054f
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x24], 0
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x28], 0
jmp case.default.0x45053f
mov dword [ebp - 8], 0
jmp 0x45059f
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 8
jge 0x4505bb
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov eax, dword [eax*4 + 0x621ff0]
mov dword [edx + ecx*4 + 4], eax
jmp 0x450596
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x24], 0
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x28], 0
jmp case.default.0x45053f
mov dword [ebp - 0xc], 0
jmp 0x4505e6
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 8
jge 0x450613
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx*8 + 0x622010]
mov eax, dword [ecx*8 + 0x622014]
mov ecx, dword [ebp - 0xc]
mov esi, dword [ebp - 0x14]
mov dword [esi + ecx*8 + 0xac], edx
mov dword [esi + ecx*8 + 0xb0], eax
jmp 0x4505dd
mov edx, dword [ebp - 0x14]
mov dword [edx + 0xec], 0
mov eax, dword [ebp - 0x14]
mov dword [eax + 0xf0], 0
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0xf4], 0
mov edx, dword [ebp - 0x14]
mov dword [edx + 0xf8], 0
jmp case.default.0x45053f
mov dword [ebp - 0x10], 0
jmp 0x45065b
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 8
jge 0x450688
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx*8 + 0x6222d0]
mov eax, dword [ecx*8 + 0x6222d4]
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
mov dword [esi + ecx*8 + 0xac], edx
mov dword [esi + ecx*8 + 0xb0], eax
jmp 0x450652
mov edx, dword [ebp - 0x14]
mov dword [edx + 0xec], 0
mov eax, dword [ebp - 0x14]
mov dword [eax + 0xf0], 0
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0xf4], 0
mov edx, dword [ebp - 0x14]
mov dword [edx + 0xf8], 0
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x45c190
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 0x67452301
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], 0xefcdab89
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], 0x98badcfe
mov eax, dword [ebp - 4]
mov dword [eax + 0x1c], 0x10325476
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x20], 0xc3d2e1f0
mov edx, dword [ebp - 4]
mov dword [edx + 0x24], 0
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov esp, ebp
pop ebp
ret
Function at 0x45dd20
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x18], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0x67452301
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0xefcdab89
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], 0x98badcfe
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], 0x10325476
mov esp, ebp
pop ebp
ret
Function at 0x4939a0
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [0x6a67ac]
test eax, eax
jne 0x493a8e
push 0x400
call fcn.0058c070
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov dword [0x6a67b0], ecx
mov dword [ebp - 4], 0x4c11db7
mov dword [ebp - 8], 0
jmp 0x4939e7
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0xff
ja 0x493a87
push 8
mov eax, dword [ebp - 8]
push eax
call fcn.00493ac0
add esp, 8
shl eax, 0x18
mov ecx, dword [ebp - 8]
mov edx, dword [0x6a67b0]
mov dword [edx + ecx*4], eax
mov dword [ebp - 0xc], 0
jmp 0x493a23
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 8
jae 0x493a60
mov ecx, dword [ebp - 8]
mov edx, dword [0x6a67b0]
mov eax, dword [edx + ecx*4]
shl eax, 1
mov ecx, dword [ebp - 8]
mov edx, dword [0x6a67b0]
mov ecx, dword [edx + ecx*4]
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, dword [ebp - 4]
xor eax, ecx
mov edx, dword [ebp - 8]
mov ecx, dword [0x6a67b0]
mov dword [ecx + edx*4], eax
jmp 0x493a1a
push 0x20
mov edx, dword [ebp - 8]
mov eax, dword [0x6a67b0]
mov ecx, dword [eax + edx*4]
push ecx
call fcn.00493ac0
add esp, 8
mov edx, dword [ebp - 8]
mov ecx, dword [0x6a67b0]
mov dword [ecx + edx*4], eax
jmp 0x4939de
mov byte [0x6a67ac], 1
mov esp, ebp
pop ebp
ret

Function at 0x4aebb0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d4861
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x6a1da0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov dword [eax], 0x62fe58
mov ecx, dword [ebp - 0x24]
add ecx, 8
call fcn.0041d8b0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x24]
add ecx, 0x30
call fcn.004037e0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x24]
add ecx, 0x50
call fcn.004037e0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x70], 0x80
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x74], 0
mov eax, dword [ebp - 0x24]
mov dword [eax + 0x78], 0
push 0x10
push 0
lea ecx, [ebp - 0x20]
push ecx
call fcn.005b3000
add esp, 0xc
push 0x10
lea edx, [ebp - 0x20]
push edx
mov ecx, dword [ebp - 0x24]
add ecx, 0x50
call fcn.00405cf0
push 0x10
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x24]
add ecx, 0x30
call fcn.00405cf0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005aeef3
mov esp, ebp
pop ebp
ret
Function at 0x4dcb50
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
movsx eax, byte [ebp + 8]
cmp eax, 0x41
jne 0x4dcb73
mov ecx, dword [ebp + 0xc]
and ecx, 1
setne al
jmp 0x4dce03
movsx edx, byte [ebp + 8]
cmp edx, 0x42
jne 0x4dcb8f
mov eax, dword [ebp + 0xc]
and eax, 2
setne al
jmp 0x4dce03
movsx ecx, byte [ebp + 8]
cmp ecx, 0x43
jne 0x4dcbab
mov edx, dword [ebp + 0xc]
and edx, 4
setne al
jmp 0x4dce03
movsx eax, byte [ebp + 8]
cmp eax, 0x44
jne 0x4dcbc7
mov ecx, dword [ebp + 0xc]
and ecx, 0x10
setne al
jmp 0x4dce03
movsx edx, byte [ebp + 8]
cmp edx, 0x45
jne 0x4dcbe3
mov eax, dword [ebp + 0xc]
and eax, 0x20
setne al
jmp 0x4dce03
movsx ecx, byte [ebp + 8]
cmp ecx, 0x46
jne 0x4dcbff
mov edx, dword [ebp + 0xc]
and edx, 0x40
setne al
jmp 0x4dce03
movsx eax, byte [ebp + 8]
cmp eax, 0x47
jne 0x4dcc1e
mov ecx, dword [ebp + 0xc]
and ecx, 0x80
setne al
jmp 0x4dce03
movsx edx, byte [ebp + 8]
cmp edx, 0x48
jne 0x4dcc3c
mov eax, dword [ebp + 0xc]
and eax, 0x200
setne al
jmp 0x4dce03
movsx ecx, byte [ebp + 8]
cmp ecx, 0x49
jne 0x4dcc5b
mov edx, dword [ebp + 0xc]
and edx, 0x400
setne al
jmp 0x4dce03
movsx eax, byte [ebp + 8]
cmp eax, 0x4a
jne 0x4dcc7a
mov ecx, dword [ebp + 0xc]
and ecx, 0x800
setne al
jmp 0x4dce03
movsx edx, byte [ebp + 8]
cmp edx, 0x4b
jne 0x4dcc98
mov eax, dword [ebp + 0xc]
and eax, 0x1000
setne al
jmp 0x4dce03
movsx ecx, byte [ebp + 8]
cmp ecx, 0x4c
jne 0x4dccb7
mov edx, dword [ebp + 0xc]
and edx, 0x2000
setne al
jmp 0x4dce03
movsx eax, byte [ebp + 8]
cmp eax, 0x4d
jne 0x4dccd6
mov ecx, dword [ebp + 0xc]
and ecx, 0x8000
setne al
jmp 0x4dce03
movsx edx, byte [ebp + 8]
cmp edx, 0x4e
jne 0x4dccf4
mov eax, dword [ebp + 0xc]
and eax, 0x10000
setne al
jmp 0x4dce03
movsx ecx, byte [ebp + 8]
cmp ecx, 0x4f
jne 0x4dcd13
mov edx, dword [ebp + 0xc]
and edx, 0x20000
setne al
jmp 0x4dce03
movsx eax, byte [ebp + 8]
cmp eax, 0x50
jne 0x4dcd32
mov ecx, dword [ebp + 0xc]
and ecx, 0x40000
setne al
jmp 0x4dce03
movsx edx, byte [ebp + 8]
cmp edx, 0x51
jne 0x4dcd50
mov eax, dword [ebp + 0xc]
and eax, 0x80000
setne al
jmp 0x4dce03
movsx ecx, byte [ebp + 8]
cmp ecx, 0x52
jne 0x4dcd6f
mov edx, dword [ebp + 0xc]
and edx, 0x100000
setne al
jmp 0x4dce03
movsx eax, byte [ebp + 8]
cmp eax, 0x53
jne 0x4dcd88
mov ecx, dword [ebp + 0xc]
and ecx, 0x400000
setne al
jmp 0x4dce03
movsx edx, byte [ebp + 8]
cmp edx, 0x54
jne 0x4dcda0
mov eax, dword [ebp + 0xc]
and eax, 0x800000
setne al
jmp 0x4dce03
movsx ecx, byte [ebp + 8]
cmp ecx, 0x55
jne 0x4dcdb9
mov edx, dword [ebp + 0xc]
and edx, 0x2000000
setne al
jmp 0x4dce03
movsx eax, byte [ebp + 8]
cmp eax, 0x56
jne 0x4dcdd2
mov ecx, dword [ebp + 0xc]
and ecx, 0x20000000
setne al
jmp 0x4dce03
movsx edx, byte [ebp + 8]
cmp edx, 0x57
jne 0x4dcdea
mov eax, dword [ebp + 0xc]
and eax, 0x40000000
setne al
jmp 0x4dce03
movsx ecx, byte [ebp + 8]
cmp ecx, 0x58
jne 0x4dce01
mov edx, dword [ebp + 0xc]
and edx, 0x80000000
setne al
jmp 0x4dce03
xor al, al
mov esp, ebp
pop ebp
ret 8
Function at 0x5446a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x404]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x408]
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0
jmp 0x5446d3
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp + 0x10]
jge 0x54474a
mov eax, dword [ebp - 8]
add eax, 1
movzx ecx, al
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + edx*4 + 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0xc]
movzx eax, dl
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + ecx*4 + 4]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov dword [edx + ecx*4 + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
mov dword [edx + ecx*4 + 4], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x10]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x14]
movzx ecx, al
mov eax, dword [ebp - 0x18]
xor edx, dword [eax + ecx*4 + 4]
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x10]
mov byte [ecx], dl
jmp 0x5446ca
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
mov dword [edx + 0x404], eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 4]
mov dword [ecx + 0x408], edx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x544a00
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov dword [ebp - 0xc], ecx
cmp dword [ebp + 0xc], 0x80
jbe 0x544a1a
xor al, al
jmp 0x544b77
cmp dword [ebp + 0x10], 0
jne 0x544a27
mov dword [ebp + 0x10], 0x400
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
add edx, 4
push edx
call fcn.005b3090
add esp, 0xc
cmp dword [ebp + 0xc], 0x80
jae 0x544aa0
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
add eax, dword [ebp + 0xc]
mov cl, byte [eax + 3]
mov byte [ebp - 1], cl
movzx edx, byte [ebp - 1]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
movzx ecx, byte [eax + 4]
add edx, ecx
and edx, 0xff
mov dl, byte [edx + 0x65ae20]
mov byte [ebp - 1], dl
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp + 0xc]
mov dl, byte [ebp - 1]
mov byte [ecx + 4], dl
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0xc], 0x80
jb 0x544a5a
mov ecx, dword [ebp + 0x10]
add ecx, 7
shr ecx, 3
mov dword [ebp + 0xc], ecx
mov edx, 0x80
sub edx, dword [ebp + 0xc]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
movzx esi, byte [eax + 4]
mov eax, dword [ebp + 0x10]
xor edx, edx
mov ecx, 8
div ecx
mov eax, 8
sub eax, edx
xor edx, edx
mov ecx, 8
div ecx
mov eax, 0xff
mov ecx, edx
sar eax, cl
and esi, eax
mov cl, byte [esi + 0x65ae20]
mov byte [ebp - 1], cl
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 8]
mov al, byte [ebp - 1]
mov byte [edx + 4], al
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
sub edx, 1
mov dword [ebp - 8], edx
test ecx, ecx
je 0x544b38
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp - 8]
add ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
movzx ecx, byte [edx + ecx + 4]
xor eax, ecx
mov dl, byte [eax + 0x65ae20]
mov byte [ebp - 1], dl
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov cl, byte [ebp - 1]
mov byte [eax + 4], cl
jmp 0x544afd
mov dword [ebp - 8], 0x3f
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
movzx ecx, byte [eax + edx*2 + 4]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
movzx edx, byte [eax + edx*2 + 5]
shl edx, 8
add ecx, edx
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov word [edx + eax*2 + 4], cx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
test eax, eax
jne 0x544b3f
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x583b90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x6a1da0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x20c]
mov edi, edx
push eax
push 0
mov ebx, ecx
call dword [0x5dd1dc]
push 0x6751e8
call fcn.00589df0
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push 0x675140
push eax
call fcn.0057dee0
lea eax, [ebp - 0x108]
push 0x6749dc
push eax
call fcn.005afc0b
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x583c0e
lea eax, [ebp - 0x108]
push eax
push 0x6751fc
call fcn.00589a10
add esp, 8
push esi
push 1
push edi
push ebx
call fcn.005b0e23
push esi
call fcn.005af5e5
add esp, 0x14
push dword [0x74dbe0]
call dword [0x5dd310]
lea eax, [ebp - 0x108]
push eax
push 0x675218
call fcn.00589df0
add esp, 8
lea eax, [ebp - 0x108]
push 5
push 0
push 0x6a9960
push eax
push 0x674d24
push 0
call dword [0x5dd334]
pop edi
pop esi
pop ebx
cmp eax, 0x20
jge 0x583c7b
push eax
lea eax, [ebp - 0x108]
push eax
push 0x675228
call fcn.00589a10
add esp, 0xc
push 0
call dword [0x5dd2e8]
push eax
call dword [0x5dd2ec]
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
call fcn.005aeef3
mov esp, ebp
pop ebp
ret

Function at 0x5856e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x6a1da0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x41c]
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
push eax
lea eax, [ebp - 0x418]
push eax
push edi
call fcn.0058adc0
add esp, 0xc
test al, al
je 0x58572b
mov eax, dword [ebp - 0x418]
cmp eax, dword [edi + 0x10e]
je 0x58580d
push edi
call dword [0x5dd2cc]
push edi
call dword [0x5dd478]
push 0x6749dc
push edi
call fcn.005afc0b
add esp, 8
mov dword [ebp - 0x410], eax
test eax, eax
je 0x585820
lea eax, [ebp - 0x414]
mov ecx, esi
push eax
lea eax, [ebp - 0x40c]
push eax
call fcn.004011c0
push eax
mov ecx, esi
call fcn.004011f0
push eax
push edi
lea ecx, [ebx + 0x4c0]
call fcn.0059aa10
mov eax, dword [edi + 0x106]
cmp eax, dword [ebp - 0x414]
je 0x5857a6
push 0
push 0x18b
push 0x675450
push 0x6758f0
call fcn.0058a2c0
add esp, 0x10
lea esi, [ebx + 0x20d6c]
push esi
call dword [0x5dd30c]
push dword [ebp - 0x410]
push 1
push dword [ebp - 0x414]
push dword [ebp - 0x40c]
call fcn.005b0e23
push dword [ebp - 0x410]
call fcn.005af5e5
add esp, 0x14
push esi
call dword [0x5dd308]
push 0x6a4fe0
push edi
call fcn.005b2f1b
add esp, 8
test eax, eax
jne 0x5857ff
mov byte [ebx + 0x215c4], 1
call fcn.00585ac0
push dword [ebp - 0x40c]
call fcn.0058bef0
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005aeef3
mov esp, ebp
pop ebp
ret 8
push edi
lea eax, [ebp - 0x408]
push 0x6758b8
push eax
call fcn.0057df00
add esp, 0xc
lea eax, [ebp - 0x408]
push eax
push ebx
call fcn.00584b10
int3
Function at 0x586700
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ccd30
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x6a1da0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
cmp dword [esi + 0x20d84], 0
je 0x586759
push 0
push 0x33b
push 0x675450
push 0x675d58
call fcn.0058a2c0
add esp, 0x10
mov ecx, esi
call fcn.00584b70
mov ecx, esi
call fcn.00584d90
test al, al
je 0x586784
mov ecx, esi
call fcn.00584e00
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov byte [esi + 0x84], 1
cmp dword [esi + 0x20d84], 5
push 0x674f98
sete al
lea eax, [eax*2 + 3]
mov dword [esi + 0x20d84], eax
lea eax, [esi + 0x20d8d]
push eax
call fcn.0057df00
mov edi, dword [0x5dd2d8]
add esp, 8
mov edi, edi
cmp dword [esi + 0x20d84], 5
jne 0x58686f
mov eax, dword [esi + 0x21750]
mov dword [0x74e290], eax
mov eax, dword [esi + 0x21754]
mov dword [0x74e294], eax
mov eax, dword [0x74e2a0]
or eax, dword [0x74e2a4]
je 0x586818
call fcn.0057e950
test al, al
je 0x586818
push 0
push 0
push 0x74e290
push 0x57e570
push 0
push 0
call fcn.005af87e
add esp, 0x18
mov dword [0x74e458], eax
mov ecx, esi
call fcn.005850b0
mov ecx, esi
call fcn.00585260
push dword [esi + 0x18]
push dword [esi + 0x5c4]
push 0x675d74
call fcn.00589df0
mov eax, dword [esi + 0x5c4]
add esp, 0xc
mov ecx, esi
cmp eax, dword [esi + 0x18]
jne 0x58684e
call fcn.00586630
call fcn.005854c0
mov ecx, esi
call fcn.00585c60
mov ecx, esi
call fcn.00586590
mov ecx, esi
call fcn.00586530
mov ecx, esi
call fcn.00586630
push 0x32
call edi
jmp 0x5867c0

Function at 0x5874c0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 0x215d0]
call fcn.00583ff0
push 0
push 0
push esi
push 0x587120
push 0
push 0
call fcn.005af87e
add esp, 0x18
mov dword [esi + 0x215c8], eax
pop esi
ret

Function at 0x587640
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, ecx
lea edx, [edi + 0x21968]
mov esi, edx
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x587650
sub esi, ecx
cmp esi, 0x13
je 0x587686
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x587661
sub edx, ecx
cmp edx, 0x1d
je 0x587686
push 0
push 0x676404
push 0x676418
push 0
call dword [0x5dd384]
pop edi
pop esi
ret
push 0
push 0
push edi
push 0x5874f0
push 0
push 0
call fcn.005af87e
add esp, 0x18
mov dword [edi + 0x215c8], eax
pop edi
pop esi
ret
Function at 0x587a00
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x21764]
mov edx, ecx
lea edi, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x587a10
sub edx, edi
cmp edx, 4
jae 0x587a3f
push 0
push 0x676404
push 0x67666c
push 0
mov dword [esi + 0x21760], 0
call dword [0x5dd384]
pop edi
pop esi
ret
call fcn.005876d0
test eax, eax
jne 0x587a63
push eax
push 0x676404
push 0x676688
push eax
mov dword [esi + 0x21760], eax
call dword [0x5dd384]
pop edi
pop esi
ret
lea ecx, [esi + 0x21864]
lea eax, [esi + 0x217e4]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x587a90
test dl, dl
je 0x587a8c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x587a90
add eax, 2
add ecx, 2
test dl, dl
jne 0x587a70
xor eax, eax
jmp 0x587a95
sbb eax, eax
or eax, 1
push 0
test eax, eax
je 0x587aba
push 0x676404
push 0x6766a4
push 0
mov dword [esi + 0x21760], 0
call dword [0x5dd384]
pop edi
pop esi
ret
push 0
push esi
push 0x5876b0
push 0
push 0
call fcn.005af87e
add esp, 0x18
mov dword [esi + 0x215c8], eax
pop edi
pop esi
ret

Function at 0x587cd0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x215b0], 0
je 0x587cf5
push 0
push 0x5b9
push 0x675450
push 0x67553c
call fcn.0058a2c0
add esp, 0x10
cmp dword [esi + 0x215c8], 0
je 0x587d17
push 0
push 0x5ba
push 0x675450
push 0x676794
call fcn.0058a2c0
add esp, 0x10
push 0
push 0
push esi
push 0x586930
push 0
push 0
call fcn.005af87e
push 0
push 0
push esi
push 0x5870e0
push 0
push 0
mov dword [esi + 0x215b0], eax
call fcn.005af87e
push 0
push 0
push esi
push 0x587100
push 0
push 0
mov dword [esi + 0x21c60], eax
call fcn.005af87e
add esp, 0x48
mov dword [esi + 0x215c0], eax
pop esi
ret

Function at 0x58ad90
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
or eax, 0xffffffff
test edx, edx
je 0x58adbc
push esi
mov esi, dword [esp + 8]
movzx ecx, byte [esi]
lea esi, [esi + 1]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x6a0c10]
dec edx
jne 0x58ada0
pop esi
not eax
ret

Function at 0x58adc0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
test ebx, ebx
jne 0x58ade2
push ebx
push 0x168
push 0x65ccac
push 0x65cd14
call fcn.0058a2c0
add esp, 0x10
push 0x65cc5c
push dword [esp + 0x10]
call fcn.005afc0b
mov esi, eax
add esp, 8
test esi, esi
jne 0x58adfe
pop esi
xor al, al
pop ebx
ret
push ebp
push edi
push 2
push 0
push esi
call fcn.005b51e0
push esi
call fcn.005b5609
push 0
push 0
push esi
mov edi, eax
call fcn.005b51e0
lea ecx, [edi + 1]
push 1
push ecx
call fcn.0058bf50
push esi
push edi
mov ebp, eax
push 1
push ebp
call fcn.005b5886
add esp, 0x34
cmp eax, edi
je 0x58ae5f
push esi
call fcn.005af5e5
push ebp
call fcn.0058bef0
push edi
push dword [esp + 0x20]
push 0x65cd20
call fcn.00589a10
add esp, 0x14
xor al, al
pop edi
pop ebp
pop esi
pop ebx
ret
push edi
push ebp
call fcn.0058ad90
push ebp
mov dword [esp + 0x24], eax
call fcn.0058bef0
push esi
call fcn.005af5e5
mov ecx, dword [esp + 0x2c]
add esp, 0x10
test ecx, ecx
je 0x58ae83
mov dword [ecx], edi
mov eax, dword [esp + 0x18]
pop edi
pop ebp
mov dword [ebx], eax
mov al, 1
pop esi
pop ebx
ret