joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5f1780
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, dword [esp + 0x10]
push ebp
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.005f1990
add esp, 0xc
test eax, eax
js 0x5f1987
push ebx
push esi
push edi
mov edi, dword [ebp + 0xf0]
xor ebx, ebx
shl edi, 2
test edi, edi
jle 0x5f1800
lea esi, [ebp + 8]
lea esi, [esi + edi*4]
lea eax, [ebp + 8]
nop dword [eax]
mov edx, dword [eax - 8]
lea eax, [eax + 0x10]
mov ecx, dword [esi - 8]
lea esi, [esi - 0x10]
mov dword [eax - 0x18], ecx
add ebx, 4
mov ecx, dword [esi + 0xc]
sub edi, 4
mov dword [esi + 8], edx
mov edx, dword [eax - 0x14]
mov dword [eax - 0x14], ecx
mov ecx, dword [esi + 0x10]
mov dword [esi + 0xc], edx
mov edx, dword [eax - 0x10]
mov dword [eax - 0x10], ecx
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x10], edx
mov edx, dword [eax - 0xc]
mov dword [eax - 0xc], ecx
mov dword [esi + 0x14], edx
cmp ebx, edi
jl 0x5f17c0
mov edi, 1
cmp dword [ebp + 0xf0], edi
jle 0x5f1982
lea esi, [ebp + 4]
movzx eax, byte [esi + 0xd]
lea esi, [esi + 0x10]
mov edx, dword [esi - 4]
inc edi
movzx ecx, byte [eax*4 + 0x724160]
mov eax, edx
shr eax, 0x18
mov ecx, dword [ecx*4 + 0x725560]
movzx eax, byte [eax*4 + 0x724160]
xor ecx, dword [eax*4 + 0x724d60]
movzx eax, byte [esi - 2]
movzx eax, byte [eax*4 + 0x724160]
xor ecx, dword [eax*4 + 0x725160]
movzx eax, dl
mov edx, dword [esi]
movzx eax, byte [eax*4 + 0x724160]
xor ecx, dword [eax*4 + 0x725960]
mov eax, edx
shr eax, 0x10
movzx eax, al
mov dword [esi - 4], ecx
movzx ecx, byte [eax*4 + 0x724160]
mov eax, edx
shr eax, 8
movzx eax, al
mov ecx, dword [ecx*4 + 0x725160]
movzx eax, byte [eax*4 + 0x724160]
xor ecx, dword [eax*4 + 0x725560]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax*4 + 0x724160]
xor ecx, dword [eax*4 + 0x724d60]
movzx eax, dl
mov edx, dword [esi + 4]
movzx eax, byte [eax*4 + 0x724160]
xor ecx, dword [eax*4 + 0x725960]
mov eax, edx
shr eax, 0x10
movzx eax, al
mov dword [esi], ecx
movzx ecx, byte [eax*4 + 0x724160]
mov eax, edx
shr eax, 8
movzx eax, al
mov ecx, dword [ecx*4 + 0x725160]
movzx eax, byte [eax*4 + 0x724160]
xor ecx, dword [eax*4 + 0x725560]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax*4 + 0x724160]
xor ecx, dword [eax*4 + 0x724d60]
movzx eax, dl
mov edx, dword [esi + 8]
movzx eax, byte [eax*4 + 0x724160]
xor ecx, dword [eax*4 + 0x725960]
mov eax, edx
shr eax, 0x10
movzx eax, al
mov dword [esi + 4], ecx
movzx ecx, byte [eax*4 + 0x724160]
mov eax, edx
shr eax, 8
movzx eax, al
mov ecx, dword [ecx*4 + 0x725160]
movzx eax, byte [eax*4 + 0x724160]
xor ecx, dword [eax*4 + 0x725560]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax*4 + 0x724160]
xor ecx, dword [eax*4 + 0x724d60]
movzx eax, dl
movzx eax, byte [eax*4 + 0x724160]
xor ecx, dword [eax*4 + 0x725960]
mov dword [esi + 8], ecx
cmp edi, dword [ebp + 0xf0]
jl 0x5f1814
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x5f21a0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0x18], 0
je 0x5f21b4
mov dword [esp + 0x18], 0x5f1200
jmp fcn.005f25f0
mov dword [esp + 0x18], 0x5f0cb0
jmp fcn.005f22f0
Function at 0x5f3a80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebx + 0x48]
mov ecx, dword [edi + 0x18]
cmp ecx, 0xc
jle 0x5f3aa0
pop edi
mov dword [ebx + 0x40], 0x70
xor eax, eax
pop ebx
pop ebp
ret
push esi
cmp dword [edi + 0x2c], ecx
jge 0x5f3b60
lea esi, [edi + 0x44]
nop dword [eax]
mov dl, byte [esi]
test dl, dl
jne 0x5f3b32
mov ecx, dword [ebx + 0x48]
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x5f3acb
push 1
push esi
push ebx
call eax
add esp, 0xc
jmp 0x5f3adb
push dword [ecx + 0x38]
push 1
push 1
push esi
call fcn.005cb2c3
add esp, 0x10
cmp eax, 1
jne 0x5f3bb8
mov cl, byte [esi]
test cl, cl
je 0x5f3ba9
mov eax, dword [ebx + 0x48]
movzx ecx, cl
mov edx, dword [eax + 0x3c]
lea eax, [esi + 1]
test edx, edx
je 0x5f3b08
push ecx
push eax
push ebx
call edx
add esp, 0xc
jmp 0x5f3b1a
mov edx, dword [ebx + 0x48]
push dword [edx + 0x38]
push ecx
push 1
push eax
call fcn.005cb2c3
add esp, 0x10
mov dl, byte [esi]
mov ecx, eax
movzx eax, dl
cmp ecx, eax
jne 0x5f3bb8
mov al, byte [esi + 1]
mov byte [esi + 1], 2
jmp 0x5f3b40
mov cl, byte [esi + 1]
movzx eax, cl
inc cl
mov al, byte [eax + esi]
mov byte [esi + 1], cl
dec dl
movzx eax, al
mov byte [esi], dl
mov ecx, dword [edi + 0x2c]
shl eax, cl
or dword [edi + 0x30], eax
lea eax, [ecx + 8]
mov dword [edi + 0x2c], eax
mov ecx, dword [edi + 0x18]
cmp eax, ecx
jl 0x5f3ab0
mov eax, dword [ebp + 0xc]
movzx ecx, word [ecx*2 + 0x72608c]
and ecx, dword [edi + 0x30]
mov dword [eax], ecx
mov ecx, dword [edi + 0x18]
shr dword [edi + 0x30], cl
sub dword [edi + 0x2c], ecx
mov eax, dword [edi + 0x14]
cmp eax, 0x1001
jge 0x5f3b9f
mov edx, dword [edi + 0x1c]
inc eax
mov dword [edi + 0x14], eax
cmp eax, edx
jle 0x5f3b9f
cmp ecx, 0xc
jge 0x5f3b9f
lea eax, [edx + edx]
mov dword [edi + 0x1c], eax
lea eax, [ecx + 1]
mov dword [edi + 0x18], eax
pop esi
pop edi
mov eax, 1
pop ebx
pop ebp
ret
pop esi
mov eax, 0x70
mov dword [ebx + 0x40], eax
xor eax, eax
pop edi
pop ebx
pop ebp
ret
pop esi
mov eax, 0x66
mov dword [ebx + 0x40], eax
xor eax, eax
pop edi
pop ebx
pop ebp
ret
Function at 0x5f3ef0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 0x48]
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x5f3f10
push 1
lea ecx, [ebp + 0xb]
push ecx
push esi
call eax
add esp, 0xc
jmp 0x5f3f23
push dword [edi + 0x38]
lea eax, [ebp + 0xb]
push 1
push 1
push eax
call fcn.005cb2c3
add esp, 0x10
cmp eax, 1
jne 0x5f3f74
mov al, byte [ebp + 0xb]
lea ecx, [edi + 0x44]
test al, al
je 0x5f3f81
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
mov byte [ecx], al
mov eax, dword [esi + 0x48]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x5f3f54
movzx eax, byte [ebp + 0xb]
push eax
mov eax, dword [edx]
inc eax
push eax
push esi
call ecx
add esp, 0xc
jmp 0x5f3f6a
push dword [eax + 0x38]
movzx eax, byte [ebp + 0xb]
push eax
mov eax, dword [edx]
inc eax
push 1
push eax
call fcn.005cb2c3
add esp, 0x10
mov ecx, eax
movzx eax, byte [ebp + 0xb]
cmp ecx, eax
je 0x5f3f94
pop edi
mov dword [esi + 0x40], 0x66
xor eax, eax
pop esi
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
mov byte [ecx], 0
mov dword [edi + 0x34], 0
pop edi
mov eax, 1
pop esi
pop ebp
ret

Function at 0x5f3fa0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x48]
test byte [eax], 8
jne 0x5f3fbb
mov dword [esi + 0x40], 0x6f
xor eax, eax
pop esi
pop ebp
ret
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x5f3fd0
push 1
lea eax, [ebp + 0xb]
push eax
push esi
call ecx
add esp, 0xc
jmp 0x5f3fe3
push dword [eax + 0x38]
lea eax, [ebp + 0xb]
push 1
push 1
push eax
call fcn.005cb2c3
add esp, 0x10
cmp eax, 1
je 0x5f3ff4
mov dword [esi + 0x40], 0x66
xor eax, eax
pop esi
pop ebp
ret
mov eax, dword [ebp + 0xc]
push dword [ebp + 0x10]
movzx ecx, byte [ebp + 0xb]
push esi
mov dword [eax], ecx
call fcn.005f4010
add esp, 8
pop esi
pop ebp
ret

Function at 0x5f4010
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 0x48]
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x5f4030
push 1
lea ecx, [ebp + 0xb]
push ecx
push esi
call eax
add esp, 0xc
jmp 0x5f4043
push dword [edi + 0x38]
lea eax, [ebp + 0xb]
push 1
push 1
push eax
call fcn.005cb2c3
add esp, 0x10
cmp eax, 1
jne 0x5f4094
mov cl, byte [ebp + 0xb]
test cl, cl
je 0x5f40a1
mov edx, dword [ebp + 0xc]
lea eax, [edi + 0x44]
mov dword [edx], eax
mov byte [eax], cl
mov eax, dword [esi + 0x48]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x5f4074
movzx eax, byte [ebp + 0xb]
push eax
mov eax, dword [edx]
inc eax
push eax
push esi
call ecx
add esp, 0xc
jmp 0x5f408a
push dword [eax + 0x38]
movzx eax, byte [ebp + 0xb]
push eax
mov eax, dword [edx]
inc eax
push 1
push eax
call fcn.005cb2c3
add esp, 0x10
mov ecx, eax
movzx eax, byte [ebp + 0xb]
cmp ecx, eax
je 0x5f40aa
pop edi
mov dword [esi + 0x40], 0x66
xor eax, eax
pop esi
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
pop edi
mov eax, 1
pop esi
pop ebp
ret
Function at 0x5f4430
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x48]
test byte [eax], 8
jne 0x5f444b
mov dword [esi + 0x40], 0x6f
xor eax, eax
pop esi
pop ebp
ret
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x5f4460
push 1
lea eax, [ebp + 0xb]
push eax
push esi
call ecx
add esp, 0xc
jmp 0x5f4473
push dword [eax + 0x38]
lea eax, [ebp + 0xb]
push 1
push 1
push eax
call fcn.005cb2c3
add esp, 0x10
cmp eax, 1
je 0x5f4484
mov dword [esi + 0x40], 0x66
xor eax, eax
pop esi
pop ebp
ret
mov al, byte [ebp + 0xb]
cmp al, 0x21
je 0x5f44c7
cmp al, 0x2c
je 0x5f44b6
cmp al, 0x3b
mov eax, dword [ebp + 0xc]
je 0x5f44a8
mov dword [eax], 0
xor eax, eax
mov dword [esi + 0x40], 0x6b
pop esi
pop ebp
ret
mov dword [eax], 4
mov eax, 1
pop esi
pop ebp
ret
mov eax, dword [ebp + 0xc]
pop esi
mov dword [eax], 2
mov eax, 1
pop ebp
ret
mov eax, dword [ebp + 0xc]
pop esi
mov dword [eax], 3
mov eax, 1
pop ebp
ret
Function at 0x5f44e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x48]
test byte [eax], 8
jne 0x5f44fb
mov dword [esi + 0x40], 0x6f
xor eax, eax
pop esi
pop ebp
ret
push esi
push esi
call fcn.005f4680
add esp, 8
test eax, eax
je 0x5f44f6
lea eax, [esi + 4]
push eax
push esi
call fcn.005f4680
add esp, 8
test eax, eax
je 0x5f44f6
mov ecx, dword [esi + 0x48]
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x5f4532
push 3
lea ecx, [ebp + 8]
push ecx
push esi
call eax
add esp, 0xc
jmp 0x5f4545
push dword [ecx + 0x38]
lea eax, [ebp + 8]
push 3
push 1
push eax
call fcn.005cb2c3
add esp, 0x10
cmp eax, 3
je 0x5f4568
push dword [esi + 0x14]
mov dword [esi + 0x40], 0x66
call fcn.005f4890
add esp, 4
mov dword [esi + 0x14], 0
xor eax, eax
pop esi
pop ebp
ret
mov cl, byte [ebp + 8]
push ebx
push edi
movzx edi, cl
mov eax, edi
shr eax, 4
and eax, 7
inc eax
mov dword [esi + 8], eax
movzx eax, byte [ebp + 9]
mov dword [esi + 0xc], eax
mov al, byte [ebp + 0xa]
mov byte [esi + 0x10], al
test cl, cl
jns 0x5f4660
mov ecx, edi
mov eax, 1
and ecx, 7
inc ecx
shl eax, cl
push 0
push eax
call fcn.005f49c0
add esp, 8
mov dword [esi + 0x14], eax
test eax, eax
jne 0x5f45bc
pop edi
pop ebx
mov dword [esi + 0x40], 0x6d
pop esi
pop ebp
ret
shr edi, 3
xor ebx, ebx
and edi, 1
mov dword [eax + 8], edi
mov eax, dword [esi + 0x14]
cmp dword [eax], ebx
jle 0x5f4667
xor edi, edi
mov ecx, dword [esi + 0x48]
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x5f45ec
push 3
lea ecx, [ebp + 8]
push ecx
push esi
call eax
add esp, 0xc
jmp 0x5f45ff
push dword [ecx + 0x38]
lea eax, [ebp + 8]
push 3
push 1
push eax
call fcn.005cb2c3
add esp, 0x10
mov ecx, dword [esi + 0x14]
cmp eax, 3
jne 0x5f4642
mov ecx, dword [ecx + 0xc]
inc ebx
movzx eax, byte [ebp + 8]
mov byte [edi + ecx], al
mov eax, dword [esi + 0x14]
mov ecx, dword [eax + 0xc]
movzx eax, byte [ebp + 9]
mov byte [ecx + edi + 1], al
mov eax, dword [esi + 0x14]
mov ecx, dword [eax + 0xc]
movzx eax, byte [ebp + 0xa]
mov byte [ecx + edi + 2], al
add edi, 3
mov eax, dword [esi + 0x14]
cmp ebx, dword [eax]
jl 0x5f45d4
pop edi
pop ebx
mov eax, 1
pop esi
pop ebp
ret
push ecx
call fcn.005f4890
add esp, 4
mov dword [esi + 0x14], 0
mov dword [esi + 0x40], 0x66
xor eax, eax
pop edi
pop ebx
pop esi
pop ebp
ret
mov dword [esi + 0x14], 0
pop edi
pop ebx
mov eax, 1
pop esi
pop ebp
ret

Function at 0x5f4680
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x48]
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x5f469f
push 2
lea ecx, [ebp + 8]
push ecx
push esi
call eax
add esp, 0xc
jmp 0x5f46b2
push dword [ecx + 0x38]
lea eax, [ebp + 8]
push 2
push 1
push eax
call fcn.005cb2c3
add esp, 0x10
cmp eax, 2
je 0x5f46c3
mov dword [esi + 0x40], 0x66
xor eax, eax
pop esi
pop ebp
ret
mov ax, word [ebp + 8]
movzx ecx, ah
movzx eax, al
shl ecx, 8
or ecx, eax
mov eax, dword [ebp + 0xc]
pop esi
mov dword [eax], ecx
mov eax, 1
pop ebp
ret
Function at 0x5f46e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x7ce4e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
push 0x4c
call fcn.005cff37
mov edi, eax
add esp, 4
test edi, edi
jne 0x5f4725
test esi, esi
je 0x5f4846
pop edi
mov dword [esi], 0x6d
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005be209
mov esp, ebp
pop ebp
ret
push 0x4c
push 0
push edi
call fcn.005c0be0
push 0x614c
push 1
call fcn.005d08a5
mov ebx, eax
add esp, 0x14
test ebx, ebx
jne 0x5f476a
test esi, esi
je 0x5f474e
mov dword [esi], 0x6d
push edi
call fcn.005cff1c
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005be209
mov esp, ebp
pop ebp
ret
push 0x614c
push 0
push ebx
call fcn.005c0be0
mov eax, dword [ebp + 0xc]
add esp, 0xc
mov dword [edi + 0x48], ebx
mov dword [ebx + 0x3c], eax
mov eax, dword [ebp + 8]
mov dword [ebx + 4], 0
mov dword [ebx + 0x38], 0
mov dword [ebx], 8
mov ecx, dword [edi + 0x48]
mov dword [edi + 0x44], eax
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x5f47b5
push 6
lea ecx, [ebp - 0xc]
push ecx
push edi
call eax
add esp, 0xc
jmp 0x5f47c8
push dword [ecx + 0x38]
lea eax, [ebp - 0xc]
push 6
push 1
push eax
call fcn.005cb2c3
add esp, 0x10
cmp eax, 6
je 0x5f47d9
test esi, esi
je 0x5f47fe
mov dword [esi], 0x66
jmp 0x5f47fe
push 3
lea eax, [ebp - 0xc]
mov byte [ebp - 6], 0
push eax
push str.GIFVER
call fcn.005d1170
add esp, 0xc
test eax, eax
je 0x5f4820
test esi, esi
je 0x5f47fe
mov dword [esi], 0x67
push ebx
call fcn.005cff1c
push edi
call fcn.005cff1c
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005be209
mov esp, ebp
pop ebp
ret
push edi
call fcn.005f44e0
add esp, 4
test eax, eax
jne 0x5f4859
push ebx
call fcn.005cff1c
push edi
call fcn.005cff1c
add esp, 8
test esi, esi
je 0x5f4846
mov dword [esi], 0x68
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005be209
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
mov dword [edi + 0x40], 0
cmp byte [ebp - 9], 0x39
sete al
xor ecx, ebp
mov dword [ebx + 0x6148], eax
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.005be209
mov esp, ebp
pop ebp
ret
Function at 0x5f50e0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov eax, dword [esi + 0x14]
cmp eax, 0xca
jne 0x5f5114
push esi
call fcn.005f95b0
add esp, 4
cmp byte [esi + 0x40], 0
je 0x5f510b
pop edi
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
jmp 0x5f511b
cmp eax, 0xcb
jne 0x5f5193
mov eax, dword [esi + 0x1a8]
cmp byte [eax + 0x10], 0
je 0x5f517e
mov eax, dword [esi + 8]
test eax, eax
je 0x5f5136
mov eax, dword [eax]
push esi
call eax
add esp, 4
mov eax, dword [esi + 0x1a8]
push esi
mov eax, dword [eax]
call eax
add esp, 4
test eax, eax
je 0x5f5179
cmp eax, 2
je 0x5f517e
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x5f5127
cmp eax, 3
je 0x5f515e
cmp eax, 1
jne 0x5f5127
inc dword [ecx + 4]
mov edx, dword [esi + 8]
mov edi, dword [edx + 8]
cmp dword [ecx + 4], edi
jl 0x5f5127
mov eax, dword [esi + 0x128]
add eax, edi
mov dword [edx + 8], eax
jmp 0x5f5127
pop edi
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.005f51d0
add esp, 4
pop edi
pop esi
ret
cmp eax, 0xcc
je 0x5f51b5
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x15
mov ecx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x18], eax
mov eax, dword [esi]
mov eax, dword [eax]
call eax
add esp, 4
push esi
call fcn.005f51d0
add esp, 4
pop edi
pop esi
ret

Function at 0x5f51d0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
cmp dword [esi + 0x14], 0xcc
lea ebx, [esi + 0x78]
je 0x5f51ff
mov eax, dword [esi + 0x198]
push esi
mov eax, dword [eax]
call eax
add esp, 4
mov dword [ebx], 0
mov dword [esi + 0x14], 0xcc
mov eax, dword [esi + 0x198]
cmp byte [eax + 8], 0
je 0x5f5282
nop dword [eax + eax]
mov eax, dword [ebx]
cmp eax, dword [esi + 0x60]
jae 0x5f5256
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x5f5235
mov dword [ecx + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x60]
push esi
mov dword [ecx + 8], eax
mov eax, dword [esi + 8]
mov eax, dword [eax]
call eax
add esp, 4
mov eax, dword [esi + 0x19c]
mov edi, dword [ebx]
push 0
push ebx
mov eax, dword [eax + 4]
push 0
push esi
call eax
mov eax, dword [ebx]
add esp, 0x10
cmp eax, edi
je 0x5f5299
cmp eax, dword [esi + 0x60]
jb 0x5f5217
mov eax, dword [esi + 0x198]
push esi
mov eax, dword [eax + 4]
call eax
mov eax, dword [esi + 0x198]
push esi
mov eax, dword [eax]
call eax
mov dword [ebx], 0
add esp, 8
mov eax, dword [esi + 0x198]
cmp byte [eax + 8], 0
jne 0x5f5210
xor eax, eax
cmp byte [esi + 0x41], al
pop edi
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov al, 1
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
Function at 0x6003c0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x28]
mov edx, 0x100
mov ebp, dword [edi + 0x4c]
cmp ebp, 1
mov esi, dword [edi + 0x1c0]
sete al
mov dword [esp + 0x20], esi
mov dword [esp + 0x18], ebp
mov byte [esi + 0x1c], al
mov eax, 0x2fe
push dword [edi + 0x64]
mov ecx, dword [edi + 4]
cmovne eax, edx
push eax
push 1
push edi
mov eax, dword [ecx + 8]
call eax
xor ebx, ebx
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x14]
add esp, 0x10
mov dword [esp + 0x10], ebx
cmp dword [edi + 0x64], ebx
jle 0x6004f3
nop dword [eax]
mov ecx, dword [esi + ebx*4 + 0x20]
cdq
idiv ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
cmp ebp, 1
jne 0x60043e
mov eax, dword [esi + 0x18]
add dword [eax + ebx*4], 0xff
mov eax, dword [esi + 0x18]
lea edi, [ecx*2 - 2]
mov ebp, dword [eax + ebx*4]
lea eax, [ecx + 0xfe]
cdq
xor ebx, ebx
idiv edi
xor esi, esi
mov edx, eax
nop word [eax + eax]
cmp esi, edx
jle 0x600484
imul eax, ebx, 0x1fe
add ecx, 0xfe
add ecx, eax
add ecx, 0x1fe
inc ebx
mov eax, ecx
cdq
idiv edi
mov edx, eax
cmp esi, edx
jg 0x600472
mov ecx, dword [esp + 0x14]
movzx ecx, cl
movzx eax, bl
imul ecx, eax
mov byte [esi + ebp], cl
inc esi
mov ecx, dword [esp + 0x1c]
cmp esi, 0xff
jle 0x600460
cmp dword [esp + 0x18], 1
jne 0x6004d1
mov ecx, 1
lea edx, [ebp - 1]
movzx eax, byte [ebp]
lea edx, [edx - 1]
mov byte [edx + 1], al
movzx eax, byte [ebp + 0xff]
mov byte [ecx + ebp + 0xff], al
inc ecx
cmp ecx, 0xff
jle 0x6004b0
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 0x18]
inc ebx
mov esi, dword [esp + 0x20]
cmp ebx, dword [eax + 0x64]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], ebx
jl 0x600420
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x618410
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x618430
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x618430
mov eax, dword [eax + 0x44]
test eax, eax
je 0x618430
push dword [esp + 8]
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x620b90
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00620ba0

Function at 0x620e20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00620e40

Function at 0x628ca0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x628ccd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x628ccd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x631730
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc
call fcn.005beef0
mov eax, dword [esp + 0x10]
push ebx
push esi
test byte [eax + 0x10], 4
mov esi, dword [eax + 4]
lea ebx, [esi - 1]
je 0x6317d7
mov ecx, dword [eax + 8]
xor edx, edx
push ebp
xor ebp, ebp
mov dword [esp + 0xc], 0
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], ecx
test ecx, ecx
jle 0x6317c0
mov ecx, dword [eax]
mov dword [esp + 0x10], ecx
push edi
push dword [ecx]
mov eax, ebp
xor eax, ebx
lea edi, [eax - 1]
not eax
shr edi, 0x1f
shr eax, 0x1f
and edi, eax
neg edi
mov esi, edi
or esi, dword [esp + 0x14]
call fcn.00631800
mov ecx, dword [esp + 0x18]
mov edx, esi
not edx
mov dword [esp + 0x14], esi
and edx, 0x20
and eax, edi
add edx, dword [esp + 0x24]
inc ebp
add edx, eax
add ecx, 4
add esp, 4
mov dword [esp + 0x20], edx
mov dword [esp + 0x14], ecx
cmp ebp, dword [esp + 0x18]
jl 0x631773
pop edi
mov eax, ebx
shr ebx, 0x1f
not eax
dec eax
shr eax, 0x1f
and eax, ebx
pop ebp
dec eax
pop esi
and eax, edx
pop ebx
add esp, 0xc
ret
test esi, esi
jne 0x6317e3
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret
mov eax, dword [eax]
push dword [eax + esi*4 - 4]
call fcn.00631800
add esp, 4
shl esi, 5
add esi, 0xffffffe0
add eax, esi
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x64d140
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
xor ebp, ebp
push esi
test eax, eax
je 0x64d158
test byte [eax + 0x5c], 2
mov ebx, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz._
jne 0x64d15d
mov ebx, 0x744240
mov esi, dword [esp + 0x1c]
test esi, esi
jle 0x64d235
mov edx, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
inc edi
movzx eax, byte [edi - 1]
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], edx
cmp esi, 3
jb 0x64d1c9
movzx ecx, byte [edi]
shl eax, 8
or eax, ecx
movzx ecx, byte [edi + 1]
shl eax, 8
or eax, ecx
mov ecx, eax
shr ecx, 0x12
movzx ecx, byte [ecx + ebx]
mov byte [edx], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + ebx]
mov byte [edx + 1], cl
mov ecx, eax
shr ecx, 6
and ecx, 0x3f
and eax, 0x3f
movzx ecx, byte [ecx + ebx]
mov byte [edx + 2], cl
mov cl, byte [eax + ebx]
lea eax, [edx + 3]
jmp 0x64d215
shl eax, 0x10
cmp esi, 2
jne 0x64d1d9
movzx ecx, byte [edi]
shl ecx, 8
or eax, ecx
mov ecx, eax
shr ecx, 0x12
movzx ecx, byte [ecx + ebx]
mov byte [edx], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + ebx]
mov byte [edx + 1], cl
cmp esi, 1
jne 0x64d1fc
mov al, 0x3d
jmp 0x64d205
shr eax, 6
and eax, 0x3f
mov al, byte [eax + ebx]
mov ecx, dword [esp + 0x18]
mov byte [ecx + 2], al
mov cl, 0x3d
mov eax, dword [esp + 0x14]
add eax, 3
sub esi, 3
mov byte [eax], cl
add ebp, 4
lea edx, [eax + 1]
add edi, 3
test esi, esi
jg 0x64d173
pop edi
pop esi
mov eax, ebp
mov byte [edx], 0
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x14]
pop esi
mov byte [eax], 0
mov eax, ebp
pop ebp
pop ebx
ret