joyce8/EMBER2024-capa huggingface dataset:
Function at 0x784ab0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x844
mov eax, dword [0x773564]
xor eax, esp
mov dword [esp + 0x840], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x860]
push 0x7ff
lea eax, [esp + 0x55]
push 0
push eax
mov dword [esp + 0x20], edi
mov esi, 1
mov byte [esp + 0x5c], 0
call fcn.00786f70
mov ecx, dword [esp + 0x864]
imul ecx, ecx, 0x126
add esp, 0xc
cmp dword [ecx + 0x798370], 0
jne 0x784b11
mov eax, 0xa2
jmp 0x784c11
mov ebx, dword [esp + 0x864]
push ebx
lea edx, [esp + 0x54]
push edi
push edx
call fcn.00787470
lea eax, [esp + 0x24]
push 0x19
push eax
call fcn.00781e50
mov eax, ebx
add esp, 0x14
and eax, 0xf
je 0x784b52
add eax, ebx
cmp ebx, eax
jae 0x784b52
sub eax, ebx
push eax
lea ecx, [esp + ebx + 0x54]
push 0
push ecx
call fcn.00786f70
add esp, 0xc
xor ebp, ebp
test ebx, ebx
jbe 0x784c00
mov al, byte [esp + 0x85c]
xor al, 0x2c
mov byte [esp + 0x13], al
jmp 0x784b74
mov al, byte [esp + 0x13]
mov byte [esp + 0x1b], al
mov byte [esp + 0x19], 0x42
mov byte [esp + 0x1a], 0x2c
xor eax, eax
mov cl, byte [esp + ebp + 0x50]
xor cl, 0x2c
mov byte [esp + eax + 0x1e], cl
add eax, 1
add ebp, 1
cmp eax, 0x10
jb 0x784b84
sub esp, 0x1c
mov ecx, 6
lea esi, [esp + 0x34]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.007821c0
mov ecx, dword [esp + 0x874]
lea edx, [esp + 0x50]
mov byte [esp + 0x4c], al
push edx
lea eax, [esp + 0x38]
push eax
push ecx
call fcn.00782010
mov esi, eax
add esp, 0x28
test esi, esi
ja 0x784c2c
cmp ebp, ebx
mov edx, dword [esp + 0x3a]
mov eax, dword [esp + 0x3e]
mov ecx, dword [esp + 0x42]
mov dword [esp + ebp + 0x40], edx
mov edx, dword [esp + 0x46]
mov dword [esp + ebp + 0x44], eax
mov dword [esp + ebp + 0x48], ecx
mov dword [esp + ebp + 0x4c], edx
jb 0x784b70
mov edi, dword [esp + 0x14]
push ebx
lea eax, [esp + 0x54]
push eax
push edi
call fcn.00787470
add esp, 0xc
mov eax, esi
mov ecx, dword [esp + 0x850]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00786f61
add esp, 0x844
ret 0x10
mov eax, 0x29
jmp 0x784c11
Function at 0x784c40
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x844
mov eax, dword [0x773564]
xor eax, esp
mov dword [esp + 0x840], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x860]
push 0x7ff
lea eax, [esp + 0x55]
push 0
push eax
mov dword [esp + 0x20], edi
mov esi, 1
mov byte [esp + 0x5c], 0
call fcn.00786f70
mov ecx, dword [esp + 0x864]
imul ecx, ecx, 0x126
add esp, 0xc
cmp dword [ecx + 0x798370], 0
jne 0x784ca1
mov eax, 0xa2
jmp 0x784da1
mov ebx, dword [esp + 0x864]
push ebx
lea edx, [esp + 0x54]
push edi
push edx
call fcn.00787470
lea eax, [esp + 0x24]
push 0x19
push eax
call fcn.00781e50
mov eax, ebx
add esp, 0x14
and eax, 0xf
je 0x784ce2
add eax, ebx
cmp ebx, eax
jae 0x784ce2
sub eax, ebx
push eax
lea ecx, [esp + ebx + 0x54]
push 0
push ecx
call fcn.00786f70
add esp, 0xc
xor ebp, ebp
test ebx, ebx
jbe 0x784d90
mov al, byte [esp + 0x85c]
xor al, 0x2c
mov byte [esp + 0x13], al
jmp 0x784d04
mov al, byte [esp + 0x13]
mov byte [esp + 0x1b], al
mov byte [esp + 0x19], 0x43
mov byte [esp + 0x1a], 0x2c
xor eax, eax
mov cl, byte [esp + ebp + 0x50]
xor cl, 0x2c
mov byte [esp + eax + 0x1e], cl
add eax, 1
add ebp, 1
cmp eax, 0x10
jb 0x784d14
sub esp, 0x1c
mov ecx, 6
lea esi, [esp + 0x34]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.007821c0
mov ecx, dword [esp + 0x874]
lea edx, [esp + 0x50]
mov byte [esp + 0x4c], al
push edx
lea eax, [esp + 0x38]
push eax
push ecx
call fcn.00782010
mov esi, eax
add esp, 0x28
test esi, esi
ja 0x784dbc
cmp ebp, ebx
mov edx, dword [esp + 0x3a]
mov eax, dword [esp + 0x3e]
mov ecx, dword [esp + 0x42]
mov dword [esp + ebp + 0x40], edx
mov edx, dword [esp + 0x46]
mov dword [esp + ebp + 0x44], eax
mov dword [esp + ebp + 0x48], ecx
mov dword [esp + ebp + 0x4c], edx
jb 0x784d00
mov edi, dword [esp + 0x14]
push ebx
lea eax, [esp + 0x54]
push eax
push edi
call fcn.00787470
add esp, 0xc
mov eax, esi
mov ecx, dword [esp + 0x850]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00786f61
add esp, 0x844
ret 0x10
mov eax, 0x2a
jmp 0x784da1
Function at 0x785030
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov cl, 0xcc
mov byte [eax], cl
mov byte [eax + 1], cl
mov byte [eax + 2], cl
xor cl, cl
mov byte [eax + 3], cl
mov byte [esp + 8], cl
mov cl, byte [esp + 8]
cmp cl, 0x79
jae 0x785098
mov ecx, dword [esp + 4]
movzx edx, byte [esp + 8]
movzx edx, dl
movzx edx, byte [edx + ecx]
xor byte [eax], dl
movzx edx, byte [esp + 8]
movzx edx, dl
movzx edx, byte [edx + ecx + 1]
xor byte [eax + 1], dl
movzx edx, byte [esp + 8]
movzx edx, dl
movzx edx, byte [edx + ecx + 2]
xor byte [eax + 2], dl
movzx edx, byte [esp + 8]
add edx, 4
mov byte [esp + 8], dl
movzx edx, byte [esp + 8]
cmp dl, 0x79
jb 0x785054
ret
Function at 0x785420
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x3c
mov eax, dword [0x773564]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x40]
imul eax, eax, 0x126
cmp dword [eax + 0x798370], 0
push ebx
push ebp
mov ebp, dword [esp + 0x4c]
push esi
push edi
jne 0x785463
mov eax, 0xa2
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00786f61
add esp, 0x3c
ret 8
lea ecx, [esp + 0x10]
push 0x19
push ecx
call fcn.00781e50
add esp, 8
xor ebx, ebx
mov edx, dword [ebp]
mov eax, dword [ebp + 4]
mov ecx, dword [ebp + 8]
mov dword [esp + 0x15], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 0x19], eax
mov byte [esp + 0x11], 0xa7
mov byte [esp + 0x12], 0x2c
mov byte [esp + 0x13], bl
mov dword [esp + 0x1d], ecx
mov dword [esp + 0x21], edx
xor eax, eax
xor byte [esp + eax + 0x13], 0x2c
add eax, 1
cmp eax, 0x12
jl 0x7854a0
sub esp, 0x1c
mov ecx, 6
lea esi, [esp + 0x2c]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.007821c0
mov edx, dword [esp + 0x6c]
mov byte [esp + 0x44], al
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x30]
push ecx
push edx
call fcn.00782010
add esp, 0x28
test eax, eax
jne 0x7854ed
add ebx, 1
add ebp, 0x10
cmp ebx, 8
jl 0x785474
sub esp, 0x1c
mov byte [esp + 0x2d], 0xa7
mov byte [esp + 0x2e], 0x2c
mov byte [esp + 0x2f], 0x24
mov ecx, 6
lea esi, [esp + 0x2c]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.007821c0
mov edx, dword [esp + 0x6c]
mov byte [esp + 0x44], al
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x30]
push ecx
push edx
call fcn.00782010
mov ecx, dword [esp + 0x70]
add esp, 0x28
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00786f61
add esp, 0x3c
ret 8
Function at 0x785550
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x3c
mov eax, dword [0x773564]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x40]
imul eax, eax, 0x126
cmp dword [eax + 0x798370], 0
push ebx
push ebp
mov ebp, dword [esp + 0x4c]
push esi
push edi
jne 0x785593
mov eax, 0xa2
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00786f61
add esp, 0x3c
ret 8
lea ecx, [esp + 0x10]
push 0x19
push ecx
call fcn.00781e50
add esp, 8
xor ebx, ebx
mov edx, dword [ebp]
mov eax, dword [ebp + 4]
mov ecx, dword [ebp + 8]
mov dword [esp + 0x15], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 0x19], eax
mov byte [esp + 0x11], 0xa8
mov byte [esp + 0x12], 0x2c
mov byte [esp + 0x13], bl
mov dword [esp + 0x1d], ecx
mov dword [esp + 0x21], edx
xor eax, eax
xor byte [esp + eax + 0x13], 0x2c
add eax, 1
cmp eax, 0x12
jl 0x7855d0
sub esp, 0x1c
mov ecx, 6
lea esi, [esp + 0x2c]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.007821c0
mov edx, dword [esp + 0x6c]
mov byte [esp + 0x44], al
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x30]
push ecx
push edx
call fcn.00782010
add esp, 0x28
test eax, eax
jne 0x78561d
add ebx, 1
add ebp, 0x10
cmp ebx, 8
jl 0x7855a4
sub esp, 0x1c
mov byte [esp + 0x2d], 0xa8
mov byte [esp + 0x2e], 0x2c
mov byte [esp + 0x2f], 0x24
mov ecx, 6
lea esi, [esp + 0x2c]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.007821c0
mov edx, dword [esp + 0x6c]
mov byte [esp + 0x44], al
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x30]
push ecx
push edx
call fcn.00782010
mov ecx, dword [esp + 0x70]
add esp, 0x28
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00786f61
add esp, 0x3c
ret 8
Function at 0x785af0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x3c
mov eax, dword [0x773564]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x40]
imul eax, eax, 0x126
cmp dword [eax + 0x798370], 0
push ebx
push ebp
mov ebp, dword [esp + 0x4c]
push esi
push edi
jne 0x785b33
mov eax, 0xa2
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00786f61
add esp, 0x3c
ret 8
xor bl, bl
lea ecx, [esp + 0x10]
push 0x19
push ecx
call fcn.00781e50
movzx eax, bl
mov dl, bl
xor dl, 0x2c
shl eax, 4
mov ecx, dword [eax + ebp]
add eax, ebp
mov byte [esp + 0x1b], dl
mov edx, dword [eax + 4]
mov dword [esp + 0x1e], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x22], edx
mov edx, dword [eax + 0xc]
add esp, 8
mov byte [esp + 0x11], 0xf1
mov byte [esp + 0x12], 0x2c
mov byte [esp + 0x14], 0x2c
mov byte [esp + 0x15], 0x2c
mov dword [esp + 0x1e], ecx
mov dword [esp + 0x22], edx
xor eax, eax
jmp 0x785b90
xor byte [esp + eax + 0x16], 0x2c
add eax, 1
cmp eax, 0x10
jl 0x785b90
sub esp, 0x1c
mov ecx, 6
lea esi, [esp + 0x2c]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.007821c0
mov edx, dword [esp + 0x6c]
mov byte [esp + 0x44], al
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x30]
push ecx
push edx
call fcn.00782010
add esp, 0x28
test eax, eax
jne 0x785bde
add bl, 1
cmp bl, 8
jb 0x785b35
mov ecx, dword [esp + 0x48]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00786f61
add esp, 0x3c
ret 8

Function at 0x785c00
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
sub esp, 0x3c
mov eax, dword [0x773564]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x40]
imul eax, eax, 0x126
cmp dword [eax + 0x798370], 0
push ebx
push ebp
mov ebp, dword [esp + 0x4c]
push esi
push edi
jne 0x785c43
mov eax, 0xa2
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00786f61
add esp, 0x3c
ret 8
lea ecx, [esp + 0x10]
push 0x19
push ecx
call fcn.00781e50
mov bl, 0x2c
sub esp, 0x14
mov byte [esp + 0x2d], 0xf0
mov byte [esp + 0x2e], bl
mov byte [esp + 0x2f], bl
mov byte [esp + 0x30], bl
mov byte [esp + 0x31], bl
mov ecx, 6
lea esi, [esp + 0x2c]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.007821c0
mov ecx, dword [esp + 0x6c]
lea edx, [esp + 0x48]
mov byte [esp + 0x44], al
push edx
lea eax, [esp + 0x30]
push eax
push ecx
call fcn.00782010
lea edx, [esp + 0x5a]
add esp, 0x28
mov edi, eax
mov ecx, ebp
sub edx, ebp
mov esi, 0xc
mov al, byte [edx + ecx]
xor al, bl
mov byte [ecx], al
add ecx, 1
sub esi, 1
jne 0x785ca6
mov ecx, dword [esp + 0x48]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00786f61
add esp, 0x3c
ret 8
Function at 0x786330
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x40
mov eax, dword [0x773564]
xor eax, esp
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x48]
push ebx
mov ebx, dword [esp + 0x48]
mov ecx, ebx
imul ecx, ecx, 0x126
cmp dword [ecx + 0x798370], 0
push ebp
mov ebp, dword [esp + 0x54]
push esi
push edi
mov dword [esp + 0x10], 0
jne 0x786381
mov eax, 0xa2
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.00786f61
add esp, 0x40
ret 0xc
lea edx, [esp + 0x10]
push edx
push eax
call fcn.00785970
add esp, 8
test al, al
jne 0x7863ad
mov eax, 0x20
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.00786f61
add esp, 0x40
ret 0xc
lea eax, [esp + 0x14]
push 0x19
push eax
call fcn.00781e50
mov eax, dword [esp + 0x18]
mov dword [esp + 0x1f], eax
xor byte [esp + 0x20], 0x2c
xor byte [esp + 0x21], 0x2c
xor byte [esp + 0x22], 0x2c
sub esp, 0x14
xor al, 0x2c
mov byte [esp + 0x33], al
mov byte [esp + 0x31], 0xa4
mov byte [esp + 0x32], 0x2c
mov ecx, 6
lea esi, [esp + 0x30]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.007821c0
lea ecx, [esp + 0x4c]
push ecx
lea edx, [esp + 0x34]
push edx
push ebx
mov byte [esp + 0x54], al
call fcn.00782010
add esp, 0x28
mov esi, eax
xor eax, eax
xor byte [esp + eax + 0x31], 0x2c
add eax, 1
cmp eax, 0x14
jl 0x786411
mov eax, dword [esp + 0x34]
push ebp
push eax
call fcn.00785a60
mov ecx, dword [esp + 0x54]
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00786f61
add esp, 0x40
ret 0xc

Function at 0x786e80
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebp, edi
xor ecx, ecx
sub ebp, edx
xor eax, eax
mov bl, cl
or bl, al
add bl, byte [eax + edi]
add eax, 1
add byte [edx], bl
cmp eax, 8
jl 0x786e94
xor esi, esi
mov al, byte [esi + edi]
sub al, 1
imul cl
xor byte [edx], al
add esi, 1
cmp esi, 8
jl 0x786ea7
mov al, byte [edx + ebp]
shl al, cl
add ecx, 1
add edx, 1
xor byte [edx - 1], al
cmp ecx, 8
jl 0x786e92
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x786f61
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x773564]
jne 0x786f6b
repz ret
jmp fcn.007888b1
Function at 0x792767
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0078979c
xor ebx, ebx
cmp dword [0x79b0e8], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x79283c
push 0x779e68
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x7927a7
xor eax, eax
jmp 0x792900
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x779e5c
push edi
call esi
cmp eax, ebx
je 0x7927a0
push eax
call fcn.00789739
mov dword [esp], 0x779e4c
push edi
mov dword [0x79b0e8], eax
call esi
push eax
call fcn.00789739
mov dword [esp], 0x779e38
push edi
mov dword [0x79b0ec], eax
call esi
push eax
call fcn.00789739
mov dword [0x79b0f0], eax
lea eax, [ebp - 8]
push eax
call fcn.00789fcf
test eax, eax
pop ecx
pop ecx
je 0x79280a
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0078bb8d
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x79283c
push 0x779e1c
push edi
call esi
push eax
call fcn.00789739
cmp eax, ebx
pop ecx
mov dword [0x79b0f8], eax
je 0x79283c
push 0x779e04
push edi
call esi
push eax
call fcn.00789739
pop ecx
mov dword [0x79b0f4], eax
mov eax, dword [0x79b0f4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x7928b5
cmp dword [0x79b0f8], esi
je 0x7928b5
push eax
call fcn.007897a5
pop ecx
call eax
cmp eax, ebx
je 0x792882
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x79b0f8]
call fcn.007897a5
pop ecx
call eax
test eax, eax
je 0x792882
test byte [ebp - 0x18], 1
jne 0x7928b5
lea eax, [ebp - 0xc]
push eax
call fcn.0078a006
test eax, eax
pop ecx
je 0x79289d
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0078bb8d
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x7928ac
or dword [ebp + 0x10], 0x200000
jmp 0x7928e6
or dword [ebp + 0x10], 0x40000
jmp 0x7928e6
mov eax, dword [0x79b0ec]
cmp eax, esi
je 0x7928e6
push eax
call fcn.007897a5
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x7928e6
mov eax, dword [0x79b0f0]
cmp eax, esi
je 0x7928e6
push dword [ebp - 4]
push eax
call fcn.007897a5
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x79b0e8]
call fcn.007897a5
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x347ea95b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x347ea96a
pop dword [ebp - 0x30]
mov eax, 0x347ea96a
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x57536d1f
sub dword [ebp - 0x40], 0x90127d4
mov dword [ebp - 0x3c], 0xf5ec335c
add dword [ebp - 0x3c], 0x3c4718e9
mov dword [ebp - 0x38], 0x7c61ad5b
sub dword [ebp - 0x38], 0x3015692d
mov dword [ebp - 0x34], 0x29c2d223
add dword [ebp - 0x34], 0xd63d2ddd
lea eax, [ebp - 0x40]
push eax
mov eax, 0xd4832e4b
add eax, 0x5ff3e2a5
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x599579a0
sub dword [ebp - 0x40], 0xe523104a
mov dword [ebp - 0x3c], 0x14d78a7c
sub dword [ebp - 0x3c], 0xd36b2907
mov dword [ebp - 0x38], 0x7931da7d
sub dword [ebp - 0x38], 0x15c26e11
mov dword [ebp - 0x34], 0xaac69319
add dword [ebp - 0x34], 0x55396ce7
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x38fde
push 0
call eax
mov ecx, 0xd1081772
add ecx, 0x2ef8383f
mov ebx, eax
mov esi, 0x92642828
sub esi, 0x5de4b828
add esi, dword [ebp - 0x30]
mov edx, 0x75a1262a
sub edx, 0xe537e7e6
xor dword [ebp - 0x20], ebx
mov edi, dword [esi]
xor dword [ebp - 0x10], ebx
add edi, edx
xor dword [ebp - 0x10], 0xf2efd731
mov dword [ebx], edi
xor dword [ebp - 0xc], ebx
add ebx, 0xe2018e7b
sub ebx, 0xe2018e77
add esi, 0x4ee6e8c8
add esi, 0xb119173c
loop 0x347eaa82
add eax, 0xe0c847dd
add eax, 0x1f38e9ba
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, sym.acerep.dll_Ordinal_2003
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x79602100
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 2
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [0x79609178]
movzx edx, byte [ecx]
and edx, 8
je 0x79602169
push 0x7960df98
push 0x156
push 0x7960df99
push 0x7960c370
mov eax, dword [0x79609178]
push eax
push 3
call fcn.79607630
add esp, 0x18
cmp eax, 0xffffffff
je 0x79602169
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str._p___p___u___08x___semi_stub_n
call fcn.796076a0
add esp, 0x14
cmp dword [ebp - 4], 0
jne 0x79602183
mov edx, dword [ebp + 0x14]
and edx, 2
jne 0x79602181
mov eax, 0xc0000008
jmp 0x796022cc
jmp 0x796021a1
mov eax, dword [ebp - 4]
cmp dword [eax], 0x414c4730
jne 0x79602197
mov ecx, dword [ebp - 4]
cmp dword [ecx + 4], 4
je 0x796021a1
mov eax, 0xc0000008
jmp 0x796022cc
cmp dword [ebp + 0xc], 0
jne 0x796021b1
mov eax, 0xc000000d
jmp 0x796022cc
mov edx, dword [ebp - 8]
not edx
and edx, dword [ebp + 0x14]
je 0x79602208
mov eax, dword [0x79609178]
movzx ecx, byte [eax]
and ecx, 1
je 0x79602208
push 0x7960df9e
push 0x167
push 0x7960df9f
push 0x7960c4d8
mov edx, dword [0x79609178]
push edx
push 0
call fcn.79607630
add esp, 0x18
cmp eax, 0xffffffff
je 0x79602208
mov eax, dword [ebp - 8]
not eax
and eax, dword [ebp + 0x14]
push eax
push 0x7960c528
call fcn.796076a0
add esp, 8
cmp dword [ebp - 4], 0
je 0x79602252
mov ecx, dword [0x79609178]
movzx edx, byte [ecx]
and edx, 1
je 0x79602252
push 0x7960dfa0
push 0x16a
push 0x7960dfa1
push 0x7960c568
mov eax, dword [0x79609178]
push eax
push 0
call fcn.79607630
add esp, 0x18
cmp eax, 0xffffffff
je 0x79602252
push str.ignoring_selected_algorithm_n
call fcn.796076a0
add esp, 4
cmp dword [ebp + 0x10], 0
jne 0x7960225c
xor eax, eax
jmp 0x796022cc
cmp dword [ebp - 4], 0
jne 0x7960226a
mov ecx, dword [ebp + 0x14]
and ecx, 2
je 0x79602282
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call sub.advapi32.dll_SystemFunction036
movzx ecx, al
test ecx, ecx
je 0x79602282
xor eax, eax
jmp 0x796022cc
mov edx, dword [0x79609178]
movzx eax, byte [edx]
and eax, 1
je 0x796022c7
push 0x7960dfa2
push 0x176
push 0x7960dfa3
push 0x7960c5f0
mov ecx, dword [0x79609178]
push ecx
push 0
call fcn.79607630
add esp, 0x18
cmp eax, 0xffffffff
je 0x796022c7
push str.called_with_unsupported_parameters__returning_error_n
call fcn.796076a0
add esp, 4
mov eax, 0xc0000002
mov esp, ebp
pop ebp
ret 0x10
Function at 0x79604d60
Capabilities:
Hash data using sha256

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov ecx, 4
imul ecx, ecx, 0
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 8], 0x6a09e667
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 8], 0xbb67ae85
mov edx, 4
shl edx, 1
mov eax, dword [ebp + 8]
mov dword [eax + edx + 8], 0x3c6ef372
mov ecx, 4
imul ecx, ecx, 3
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 8], 0xa54ff53a
mov eax, 4
shl eax, 2
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 8], 0x510e527f
mov edx, 4
imul edx, edx, 5
mov eax, dword [ebp + 8]
mov dword [eax + edx + 8], 0x9b05688c
mov ecx, 4
imul ecx, ecx, 6
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 8], 0x1f83d9ab
mov eax, 4
imul eax, eax, 7
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 8], 0x5be0cd19
pop ebp
ret

Function at 0x79605880
Capabilities:
Hash data using sha224

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov ecx, 8
imul ecx, ecx, 0
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 8], 0xc1059ed8
mov dword [edx + ecx + 0xc], 0xcbbb9d5d
mov eax, 8
shl eax, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 8], 0x367cd507
mov dword [ecx + eax + 0xc], 0x629a292a
mov edx, 8
shl edx, 1
mov eax, dword [ebp + 8]
mov dword [eax + edx + 8], 0x3070dd17
mov dword [eax + edx + 0xc], 0x9159015a
mov ecx, 8
imul ecx, ecx, 3
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 8], 0xf70e5939
mov dword [edx + ecx + 0xc], 0x152fecd8
mov eax, 8
shl eax, 2
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 8], 0xffc00b31
mov dword [ecx + eax + 0xc], 0x67332667
mov edx, 8
imul edx, edx, 5
mov eax, dword [ebp + 8]
mov dword [eax + edx + 8], 0x68581511
mov dword [eax + edx + 0xc], 0x8eb44a87
mov ecx, 8
imul ecx, ecx, 6
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 8], 0x64f98fa7
mov dword [edx + ecx + 0xc], 0xdb0c2e0d
mov eax, 8
imul eax, eax, 7
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 8], 0xbefa4fa4
mov dword [ecx + eax + 0xc], 0x47b5481d
pop ebp
ret