joyce8/EMBER2024-capa huggingface dataset:
Function at 0x445263
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x13379797
pop eax
mov dword [ebp - 0x3f0], eax
push esi
xor esi, 0x459a
jmp 0x445193
or esi, 0xb632
pop esi
push ecx
and ecx, 0xc1fd
pop ecx
push ebx
push edx
add esp, 4
call 0x4451b4
add byte [edx], bh
dec ecx
xor al, 0x32
xor ecx, dword [edx - 0x7d]
les eax, [ebx + ebx*2]
mov ecx, dword [ebp - 0x2098]
mov dword [ebp - 0x15c0], ecx
push esi
push ebx
add esp, 4
and esi, 0x103f
pop esi
push esi
call 0x4451e0
add byte [eax + 0x4c], al
inc ecx
cmp dword [ecx], edi
inc edi
xor al, 0x47
inc eax
add esp, 4
xor esi, 0x11095
xor esi, 0x19af
or esi, 0x12214
pop esi
mov edx, dword [ebp - 0x14]
add edx, 0x70
imul eax, dword [ebp - 0x10], 0x70
add eax, 0x44f3663b
imul ecx, dword [ebp - 0x10], 0x70
sub eax, ecx
xor edx, eax
imul edx, dword [ebp - 0x10]
mov dword [ebp - 0x15c0], edx
mov edx, dword [ebp - 0x3f0]
mov dword [ebp - 0x1ffc], edx
mov eax, dword [ebp - 0x1ffc]
add eax, dword [ebp - 0x15c0]
mov dword [ebp - 0x3f0], eax
test dword [eax], edx
cld
invalid
call dword [eax + 0x50]
add esp, 4
xor eax, 0xbc2f
add eax, 0x15668
pop eax
push ebx
push edi
add esp, 4
or ebx, 0x31c
add byte [eax], al
jmp 0x445257
call 0x445263
add byte [ebx + 0x50], cl
inc esi
cmp dword [edx], esi
cmp al, byte [ebx - 0x39a4fb3c]
test dword [esp + esi*8], edx
invalid
Function at 0x445344
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor ecx, 0x169f8
sub ecx, 0xcf0a
or ecx, 0x12856
pop ecx
push eax
sub eax, 0x172f9
xor eax, 0x22a2
pop eax
push edi
push eax
add esp, 4
jmp 0x44532c
pop edi
mov dword [ebp - 0x209c], 0xe
push ebx
call 0x445344
add byte [eax + 0x42], cl
xor cl, byte [ecx + 0x50]
cmp eax, dword [ebx + 0x7e804c4]
add byte [eax], al
add byte [eax], al
dec eax
inc esi
dec edx
cmp dh, byte [esi]
add esp, 4
add ebx, 0xf671
pop ebx
push ecx
push esi
add esp, 4
les eax, [ecx + eax*4]
loope 0x4452f1
add byte [ecx], 0
pop ecx
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xbec]
mov dword [ebp - 0x15c4], eax
push ebx
sub ebx, 0x44ca
add ebx, 0x7dea
sub ebx, 0x372e
pop ebx
push ecx
push edi
add esp, 4
or ecx, 0x1108c
xor ecx, 0xa9df
and ecx, 0x12ec9
add ecx, 0xc212
pop ecx
mov dword [ebp - 0x20a0], 0xffffffff
push ecx
push ecx
add esp, 4
and ecx, 0x2733
pop ecx
push edi
and edi, 0x9584
xor edi, 0x1807e
pop edi
push esi
push esi
add esp, 4
add esi, 0x8c63
sub esi, 0x1475e
add esi, 0x8ab0
pop esi
mov ecx, dword [ebp - 0x3f0]
mov dword [ebp - 0x4fc], ecx
jmp 0x445409
push ebx
add ebx, 0x1452e
pop ebx
push esi
push esi
add esp, 4
add esi, 0xd866
pop esi
push esi
push edx
add esp, 4
and esi, 0x1067a
xor esi, 0x5669
or esi, 0xe507
and esi, 0x133bd
pop esi
mov eax, dword [ebp - 0x4fc]
sub eax, dword [ebp - 0x3f0]
cmp eax, 0xffffffff
jb 0x445483
push esi
xor esi, 0x11ca8
xor esi, 0xb7e1
jmp 0x445462
pop esi
push ecx
jmp 0x44546d
pop ecx
push edx
xor edx, 0x27ef
jmp 0x44547d
pop edx
jmp 0x4456b1
mov dword [ebp - 0xc80], 7
mov ecx, dword [ebp - 0x4fc]
mov dword [ebp - 0xac4], ecx
push edi
push esi
add esp, 4
xor edi, 0xa633
and edi, 0x5d09
pop edi
push esi
call 0x4454bc
add byte [edi], dh
cmp eax, 0x4a41374c
inc ecx
dec edx
cmp al, 0x42
add esp, 4
jmp 0x4454c4
xor esi, 0x2e43
pop esi
mov edx, dword [ebp - 0x15c4]
mov dword [ebp - 0xa60], edx
invalid
test dword [ebx + esi*8 - 1], edi
inc dword [eax]
add byte [eax], al
Function at 0x445353
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor ecx, 0x169f8
sub ecx, 0xcf0a
or ecx, 0x12856
pop ecx
push eax
sub eax, 0x172f9
xor eax, 0x22a2
pop eax
push edi
push eax
add esp, 4
jmp 0x44532c
pop edi
mov dword [ebp - 0x209c], 0xe
push ebx
call 0x445344
add byte [eax + 0x42], cl
xor cl, byte [ecx + 0x50]
cmp eax, dword [ebx + 0x7e804c4]
add byte [eax], al
add byte [eax], al
dec eax
inc esi
dec edx
cmp dh, byte [esi]
add esp, 4
add ebx, 0xf671
pop ebx
push ecx
push esi
add esp, 4
les eax, [ecx + eax*4]
loope 0x4452f1
add byte [ecx], 0
pop ecx
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xbec]
mov dword [ebp - 0x15c4], eax
push ebx
sub ebx, 0x44ca
add ebx, 0x7dea
sub ebx, 0x372e
pop ebx
push ecx
push edi
add esp, 4
or ecx, 0x1108c
xor ecx, 0xa9df
and ecx, 0x12ec9
add ecx, 0xc212
pop ecx
mov dword [ebp - 0x20a0], 0xffffffff
push ecx
push ecx
add esp, 4
and ecx, 0x2733
pop ecx
push edi
and edi, 0x9584
xor edi, 0x1807e
pop edi
push esi
push esi
add esp, 4
add esi, 0x8c63
sub esi, 0x1475e
add esi, 0x8ab0
pop esi
mov ecx, dword [ebp - 0x3f0]
mov dword [ebp - 0x4fc], ecx
jmp 0x445409
push ebx
add ebx, 0x1452e
pop ebx
push esi
push esi
add esp, 4
add esi, 0xd866
pop esi
push esi
push edx
add esp, 4
and esi, 0x1067a
xor esi, 0x5669
or esi, 0xe507
and esi, 0x133bd
pop esi
mov eax, dword [ebp - 0x4fc]
sub eax, dword [ebp - 0x3f0]
cmp eax, 0xffffffff
jb 0x445483
push esi
xor esi, 0x11ca8
xor esi, 0xb7e1
jmp 0x445462
pop esi
push ecx
jmp 0x44546d
pop ecx
push edx
xor edx, 0x27ef
jmp 0x44547d
pop edx
jmp 0x4456b1
mov dword [ebp - 0xc80], 7
mov ecx, dword [ebp - 0x4fc]
mov dword [ebp - 0xac4], ecx
push edi
push esi
add esp, 4
xor edi, 0xa633
and edi, 0x5d09
pop edi
push esi
call 0x4454bc
add byte [edi], dh
cmp eax, 0x4a41374c
inc ecx
dec edx
cmp al, 0x42
add esp, 4
jmp 0x4454c4
xor esi, 0x2e43
pop esi
mov edx, dword [ebp - 0x15c4]
mov dword [ebp - 0xa60], edx
invalid
test dword [ebx + esi*8 - 1], edi
inc dword [eax]
add byte [eax], al

Function at 0x445360
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
invalid
les eax, [ecx + eax*4]
loope 0x4452f1
add byte [ecx], 0
Function at 0x4454bc
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor ecx, 0x169f8
sub ecx, 0xcf0a
or ecx, 0x12856
pop ecx
push eax
sub eax, 0x172f9
xor eax, 0x22a2
pop eax
push edi
push eax
add esp, 4
jmp 0x44532c
pop edi
mov dword [ebp - 0x209c], 0xe
push ebx
call 0x445344
add byte [eax + 0x42], cl
xor cl, byte [ecx + 0x50]
cmp eax, dword [ebx + 0x7e804c4]
add byte [eax], al
add byte [eax], al
dec eax
inc esi
dec edx
cmp dh, byte [esi]
add esp, 4
add ebx, 0xf671
pop ebx
push ecx
push esi
add esp, 4
les eax, [ecx + eax*4]
loope 0x4452f1
add byte [ecx], 0
pop ecx
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xbec]
mov dword [ebp - 0x15c4], eax
push ebx
sub ebx, 0x44ca
add ebx, 0x7dea
sub ebx, 0x372e
pop ebx
push ecx
push edi
add esp, 4
or ecx, 0x1108c
xor ecx, 0xa9df
and ecx, 0x12ec9
add ecx, 0xc212
pop ecx
mov dword [ebp - 0x20a0], 0xffffffff
push ecx
push ecx
add esp, 4
and ecx, 0x2733
pop ecx
push edi
and edi, 0x9584
xor edi, 0x1807e
pop edi
push esi
push esi
add esp, 4
add esi, 0x8c63
sub esi, 0x1475e
add esi, 0x8ab0
pop esi
mov ecx, dword [ebp - 0x3f0]
mov dword [ebp - 0x4fc], ecx
jmp 0x445409
push ebx
add ebx, 0x1452e
pop ebx
push esi
push esi
add esp, 4
add esi, 0xd866
pop esi
push esi
push edx
add esp, 4
and esi, 0x1067a
xor esi, 0x5669
or esi, 0xe507
and esi, 0x133bd
pop esi
mov eax, dword [ebp - 0x4fc]
sub eax, dword [ebp - 0x3f0]
cmp eax, 0xffffffff
jb 0x445483
push esi
xor esi, 0x11ca8
xor esi, 0xb7e1
jmp 0x445462
pop esi
push ecx
jmp 0x44546d
pop ecx
push edx
xor edx, 0x27ef
jmp 0x44547d
pop edx
jmp 0x4456b1
mov dword [ebp - 0xc80], 7
mov ecx, dword [ebp - 0x4fc]
mov dword [ebp - 0xac4], ecx
push edi
push esi
add esp, 4
xor edi, 0xa633
and edi, 0x5d09
pop edi
push esi
call 0x4454bc
add byte [edi], dh
cmp eax, 0x4a41374c
inc ecx
dec edx
cmp al, 0x42
add esp, 4
jmp 0x4454c4
xor esi, 0x2e43
pop esi
mov edx, dword [ebp - 0x15c4]
mov dword [ebp - 0xa60], edx
invalid
test dword [ebx + esi*8 - 1], edi
inc dword [eax]
add byte [eax], al
Function at 0x44555a
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp dword [ebp - 0xc80], 0
jle 0x445657
push ebx
add ebx, 0x3d10
add ebx, 0x18ba
call fcn.0044555a
add byte [edx + 0x3d], al
xor edi, dword [ecx]
inc esp
dec esp
dec esp
add esp, 4
call 0x44556d
add byte [ebp + 0x4a], al
inc esp
inc edx
push eax
cmp dword [edx + esi], edi
cmp bh, byte [eax]
add esp, 4
pop ebx
mov edx, dword [ebp - 0xac4]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0xa60]
movzx edx, byte [ecx]
cmp eax, edx
je 0x4455f3
push ecx
push esi
add esp, 4
xor ecx, 0x68dd
pop ecx
push edx
push eax
add esp, 4
xor edx, 0x11327
and edx, 0x13604
add edx, 0x3afd
pop edx
push ecx
or ecx, 0x8a28
and ecx, 0xb885
pop ecx
mov eax, dword [ebp - 0xac4]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0xa60]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x4455db
mov dword [ebp - 0x15c8], 1
jmp 0x4455e5
mov dword [ebp - 0x15c8], 0xffffffff
mov ecx, dword [ebp - 0x15c8]
mov dword [ebp - 0xc84], ecx
jmp 0x445657
push eax
push esi
add esp, 4
or eax, 0x13615
and eax, 0x10b57
and eax, 0xccfb
and eax, 0x17548
pop eax
push ebx
or ebx, 0x206c
or ebx, 0x7b6
or ebx, 0x108dc
pop ebx
mov edx, dword [ebp - 0xc80]
sub edx, 1
mov dword [ebp - 0xc80], edx
mov eax, dword [ebp - 0xac4]
add eax, 1
mov dword [ebp - 0xac4], eax
mov ecx, dword [ebp - 0xa60]
add ecx, 1
mov dword [ebp - 0xa60], ecx
jmp 0x445532
mov edx, dword [ebp - 0xc84]
mov dword [ebp - 0x15cc], edx

Function at 0x44556d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp dword [ebp - 0xc80], 0
jle 0x445657
push ebx
add ebx, 0x3d10
add ebx, 0x18ba
call fcn.0044555a
add byte [edx + 0x3d], al
xor edi, dword [ecx]
inc esp
dec esp
dec esp
add esp, 4
call 0x44556d
add byte [ebp + 0x4a], al
inc esp
inc edx
push eax
cmp dword [edx + esi], edi
cmp bh, byte [eax]
add esp, 4
pop ebx
mov edx, dword [ebp - 0xac4]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0xa60]
movzx edx, byte [ecx]
cmp eax, edx
je 0x4455f3
push ecx
push esi
add esp, 4
xor ecx, 0x68dd
pop ecx
push edx
push eax
add esp, 4
xor edx, 0x11327
and edx, 0x13604
add edx, 0x3afd
pop edx
push ecx
or ecx, 0x8a28
and ecx, 0xb885
pop ecx
mov eax, dword [ebp - 0xac4]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0xa60]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x4455db
mov dword [ebp - 0x15c8], 1
jmp 0x4455e5
mov dword [ebp - 0x15c8], 0xffffffff
mov ecx, dword [ebp - 0x15c8]
mov dword [ebp - 0xc84], ecx
jmp 0x445657
push eax
push esi
add esp, 4
or eax, 0x13615
and eax, 0x10b57
and eax, 0xccfb
and eax, 0x17548
pop eax
push ebx
or ebx, 0x206c
or ebx, 0x7b6
or ebx, 0x108dc
pop ebx
mov edx, dword [ebp - 0xc80]
sub edx, 1
mov dword [ebp - 0xc80], edx
mov eax, dword [ebp - 0xac4]
add eax, 1
mov dword [ebp - 0xac4], eax
mov ecx, dword [ebp - 0xa60]
add ecx, 1
mov dword [ebp - 0xa60], ecx
jmp 0x445532
mov edx, dword [ebp - 0xc84]
mov dword [ebp - 0x15cc], edx
Function at 0x4456d0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc edx
inc eax
dec edi
add esp, 4
pop edx
push edx
push eax
add esp, 4
xor edx, 0x116e8
add dword [eax], eax
pop edx
mov dword [ebp - 0x3e8], 0
mov edx, dword [ebp - 0x758]
add edx, 1
mov dword [ebp - 0x758], edx

Function at 0x4456d3
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc edx
inc eax
dec edi
add esp, 4
pop edx
push edx
push eax
add esp, 4
xor edx, 0x116e8
add dword [eax], eax
pop edx
mov dword [ebp - 0x3e8], 0
mov edx, dword [ebp - 0x758]
add edx, 1
mov dword [ebp - 0x758], edx

Function at 0x4456e0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc edx
inc eax
dec edi
add esp, 4
pop edx
push edx
push eax
add esp, 4
xor edx, 0x116e8
add dword [eax], eax
pop edx
mov dword [ebp - 0x3e8], 0
mov edx, dword [ebp - 0x758]
add edx, 1
mov dword [ebp - 0x758], edx
Function at 0x4461b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [ecx + 0x2fb5f3], al
add bl, ch
add esi, dword [edi + edi]
aaa

Function at 0x4461e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc dword [eax]
add byte [eax], al
add cl, ch
pushal
add al, byte [eax]
add byte [ebx - 0xca373], cl
dec dword [ecx - 0x50773]
call dword [edx + 0x53]
Function at 0x446f00
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x768]
add edx, 1
mov dword [ebp - 0x768], edx
push eax
add esp, 4
or ecx, 0x8bc6
and ecx, 0x3433
sub ecx, 0xd596
jmp 0x446f1c
pop ecx
mov edx, dword [ebp - 0x76c]
add edx, dword [ebp - 0x19c]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x19c]
movsx edx, byte [ebp + ecx - 0x878]
cmp eax, edx
jne 0x446f4a
mov dword [ebp - 0xcb8], 0
jmp 0x446fb9
push esi
push eax
add esp, 4
and esi, 0xdeb9
add esi, 0x10263
xor esi, 0x1109c
pop esi
push eax
and eax, 0x3c67
add eax, 0x128b1
pop eax
Function at 0x56d6e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5de798
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
mov esi, ecx
push esi
lea ecx, [esp + 0xc]
call fcn.0056d340
sub esp, 8
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0xc], esp
push eax
mov dword [esp + 0x30], 0
call fcn.004422b0
lea ecx, [esp + 0x10]
call fcn.0056d660
mov ecx, dword [esi + 0x20]
mov edx, dword [esp + 0x34]
mov dword [ecx + eax*4], edx
mov ecx, dword [esi + 0x24]
mov edx, dword [esp + 0x2c]
mov dword [ecx + eax*8], edx
lea eax, [ecx + eax*8]
mov ecx, dword [esp + 0x30]
mov dword [eax + 4], ecx
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
cmp eax, ecx
sbb edx, edx
neg edx
add eax, edx
mov dword [esi + 0xc], eax
imul eax, eax, 0x64
xor edx, edx
div ecx
cmp eax, dword [esi + 0x1c]
jbe 0x56d793
lea eax, [ecx + 1]
lea ecx, [eax - 1]
and ecx, eax
neg ecx
sbb cl, cl
inc cl
mov byte [esp + 0x34], cl
jne 0x56d78b
test eax, eax
mov ecx, 1
jle 0x56d789
sar eax, 1
shl ecx, 1
test eax, eax
jg 0x56d781
mov eax, ecx
push eax
mov ecx, esi
call fcn.0056d7c0
lea ecx, [esp + 8]
mov dword [esp + 0x24], 0xffffffff
call fcn.005466c0
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop esi
add esp, 0x24
ret 0xc

Function at 0x56dc10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5de7b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
push ecx
lea ecx, [esp + 0x10]
call fcn.0056d340
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 8]
mov dword [esp + 0x2c], 0
call fcn.004422b0
sub esp, 8
lea edx, [esp + 0xc]
mov ecx, esp
push edx
call fcn.004422b0
lea ecx, [esp + 0x14]
call fcn.0056d540
lea ecx, [esp + 0xc]
mov esi, eax
mov dword [esp + 0x28], 0xffffffff
call fcn.005466c0
mov ecx, dword [esp + 0x20]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0x28
ret 8

Function at 0x56e940
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5de8f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov ecx, dword [ecx + 0xc]
push esi
push edi
push ecx
lea ecx, [esp + 0x14]
call fcn.0056d340
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0
call fcn.004422b0
sub esp, 8
lea edx, [esp + 0x10]
mov ecx, esp
push edx
call fcn.004422b0
lea ecx, [esp + 0x18]
call fcn.0056d540
mov esi, eax
test esi, esi
je 0x56e9d1
mov edi, dword [esp + 0x3c]
nop
push edi
call fcn.005c7846
add esp, 4
push eax
push esi
call fcn.005c7846
add esp, 4
mov ecx, eax
call fcn.005c754b
neg eax
sbb eax, eax
test esi, eax
lea ecx, [esp + 0x10]
jne 0x56e9f7
call fcn.0056d370
mov esi, eax
test esi, esi
jne 0x56e9a0
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
call fcn.005466c0
xor al, al
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x28
ret 0xc
mov dword [esp + 0x2c], 0xffffffff
call fcn.005466c0
mov ecx, dword [esp + 0x24]
pop edi
mov al, 1
mov dword fs:[0], ecx
pop esi
add esp, 0x28
ret 0xc
Function at 0x5c8d17
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x60
push 0x5fed60
nop
nop
nop
nop
nop
mov edi, 0x94
mov eax, edi
call fcn.00441e25
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.kernel32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x6c74c0], ecx
mov eax, dword [esi + 4]
mov dword [0x6c74cc], eax
mov edx, dword [esi + 8]
mov dword [0x6c74d0], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x6c74c4], esi
cmp ecx, 2
je 0x5c8d77
or esi, 0x8000
mov dword [0x6c74c4], esi
shl eax, 8
add eax, edx
mov dword [0x6c74c8], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.kernel32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x5c8db2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x5c8db2
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x5c8dca
cmp eax, 0x20b
je 0x5c8db7
mov dword [ebp - 0x1c], esi
jmp 0x5c8dde
cmp dword [ecx + 0x84], 0xe
jbe 0x5c8db2
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x5c8dd8
cmp dword [ecx + 0x74], 0xe
jbe 0x5c8db2
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.005cda2e
pop ecx
test eax, eax
jne 0x5c8df2
push 0x1c
call fcn.005c8cf3
pop ecx
call fcn.005cc37e
test eax, eax
jne 0x5c8e03
push 0x10
call fcn.005c8cf3
pop ecx
call fcn.005cd98c
mov dword [ebp - 4], esi
call fcn.005d40bd
test eax, eax
jge 0x5c8e1c
push 0x1b
call fcn.005c8cce
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x6d1164], eax
call fcn.005d3f9b
mov dword [0x6c7504], eax
call fcn.005d3ef9
test eax, eax
jge 0x5c8e42
push 8
call fcn.005c8cce
pop ecx
call fcn.005d3cc6
test eax, eax
jge 0x5c8e53
push 9
call fcn.005c8cce
pop ecx
call fcn.005c87f6
mov dword [ebp - 0x20], eax
cmp eax, esi
je 0x5c8e66
push eax
call fcn.005c8cce
pop ecx
mov dword [ebp - 0x38], esi
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
call fcn.005d3c5d
mov dword [ebp - 0x68], eax
test byte [ebp - 0x38], 1
je 0x5c8e87
movzx eax, word [ebp - 0x34]
jmp 0x5c8e8a
push 0xa
pop eax
push eax
push dword [ebp - 0x68]
push esi
push esi
call edi
push eax
call fcn.00442410
mov edi, eax
mov dword [ebp - 0x6c], edi
cmp dword [ebp - 0x1c], esi
jne 0x5c8ea8
push edi
call fcn.005c892e
call fcn.005c8950
jmp 0x5c8eda
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.005cb77f
ret
Function at 0x6ef050
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov dword [ebp - 0x2c], 0
cmp dword [0x7adedc], 0
jne 0x6ef079
call dword [0x7c3bbc]
mov dword [0x7adedc], eax
jmp 0x6ef198
call dword [0x7c3bbc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
sub eax, dword [0x7adedc]
cmp eax, 0xea60
jbe 0x6ef198
cmp dword [0x7381a0], 0
je 0x6ef0ae
push 0x758bf0
push 3
call fcn.006f8ab0
add esp, 8
push 0x80
push 0x7183c8
lea ecx, [ebp - 0xb0]
push ecx
call fcn.0070add0
add esp, 0xc
push 0x80
push 0x717bc8
lea edx, [ebp - 0x134]
push edx
call fcn.0070add0
add esp, 0xc
lea eax, [ebp - 0xb0]
push eax
call fcn.006e2d40
add esp, 4
lea ecx, [ebp - 0x134]
push ecx
call fcn.006e2d40
add esp, 4
cmp dword [0x7381a0], 0
jne 0x6ef161
push 0x7adf38
lea edx, [ebp - 0xb0]
push edx
call fcn.0070b630
add esp, 8
test eax, eax
je 0x6ef161
push 0x10025
lea eax, [ebp - 0x134]
push eax
lea ecx, [ebp - 0xb0]
push ecx
push 0
call fcn.006e1d40
add esp, 0x10
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 2
jne 0x6ef154
mov dword [ebp - 0x2c], 1
jmp 0x6ef15f
call dword [0x7c3bbc]
mov dword [0x7adedc], eax
jmp 0x6ef16c
call dword [0x7c3bbc]
mov dword [0x7adedc], eax
push 0x80
push 0
lea edx, [ebp - 0xb0]
push edx
call fcn.0070b110
add esp, 0xc
push 0x80
push 0
lea eax, [ebp - 0x134]
push eax
call fcn.0070b110
add esp, 0xc
call dword [0x7c33b4]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
push ecx
push 0x758c38
lea edx, [ebp - 0x20]
push edx
call fcn.0070b260
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
push 0
push 0x1f0003
call dword [0x7c2f28]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x6ef1ef
cmp dword [0x7381a0], 0
je 0x6ef1e8
push 0x758c4c
push 3
call fcn.006f8ab0
add esp, 8
mov dword [ebp - 0x2c], 2
cmp dword [ebp - 0x2c], 0

Function at 0x6f9b10
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x10325476
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], 0
pop ebp
ret
Function at 0x6fcb20
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x7a9270
push 0x80000002
call dword [0x7cb818]
cmp dword [ebp - 4], 0
je 0x6fcbfd
mov dword [ebp - 8], 0
mov ecx, 1
test ecx, ecx
je 0x6fcbf3
mov dword [ebp - 0x214], 0x100
mov dword [ebp - 0xc], 0x100
push 0x100
push 0
lea edx, [ebp - 0x210]
push edx
call fcn.0070b110
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x210]
push ecx
push 0
push 0
lea edx, [ebp - 0x214]
push edx
lea eax, [ebp - 0x110]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [0x7cb808]
test eax, eax
je 0x6fcbba
jmp 0x6fcbf3
push 0
lea eax, [ebp - 0x110]
push eax
call fcn.00700160
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x6fcbe5
lea ecx, [ebp - 0x110]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [0x7cb80c]
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
jmp 0x6fcb55
mov ecx, dword [ebp - 4]
push ecx
call dword [0x7cb810]
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x705e40
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
jmp 0x705e74
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp + 8]
jae 0x705ee7
cmp dword [ebp + 0x10], 0
je 0x705eb1
cmp dword [ebp - 0x14], 1
jbe 0x705eb1
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0x14]
xor eax, eax
mov al, byte [edx - 2]
cmp eax, 0xff
jne 0x705eb1
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x14]
xor edx, edx
mov dl, byte [ecx - 1]
cmp edx, 0x15
jne 0x705eb1
mov dword [ebp - 0x10], 4
cmp dword [ebp - 0x10], 0
ja 0x705edc
mov eax, dword [ebp - 0xc]
shr eax, 8
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x14]
xor edx, edx
mov dl, byte [ecx]
xor edx, dword [ebp - 0xc]
and edx, 0xff
xor eax, dword [edx*4 + 0x7a9ce4]
mov dword [ebp - 0xc], eax
jmp 0x705ee5
mov eax, dword [ebp - 0x10]
sub eax, 1
mov dword [ebp - 0x10], eax
jmp 0x705e6b
mov ecx, dword [ebp - 0xc]
xor ecx, 0xffffffff
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x7078d0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0xc]
test edx, edx
je 0x707907
push ebx
push esi
lea esi, [edx]
mov bl, byte [ecx]
mov edx, eax
xor bl, al
and edx, 0x1ff
mov byte [ecx], bl
xor ebx, ebx
mov bl, ah
mov ax, word [edx*2 + 0x7c88a0]
inc ecx
or ax, bx
dec esi
jne 0x7078e4
pop esi
pop ebx
ret

Function at 0x707a60
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov ecx, 0x7c7f60
add eax, 0xc
push esi
push edi
sub ecx, eax
mov edx, 0x249
mov esi, dword [ecx + eax]
mov edi, dword [eax]
xor edi, esi
mov dword [eax], edi
add eax, 4
dec edx
jne 0x707a75
pop edi
pop esi
ret