joyce8/EMBER2024-capa huggingface dataset:
Function at 0x475540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, ecx
mov word [ebp - 0x30], ax
mov eax, edx
mov word [ebp - 0x34], ax
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x1c], 0
jmp 0x475575
add dword [ebp - 0x1c], 1
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
mov edx, dword [ebp - 0x1c]
shl edx, 2
add eax, edx
mov eax, dword [eax]
movzx eax, word [eax + 2]
cmp word [ebp - 0x30], ax
ja 0x475571
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
mov edx, dword [ebp - 0x1c]
shl edx, 2
add eax, edx
mov eax, dword [eax]
movzx eax, word [eax]
cmp word [ebp - 0x30], ax
je 0x4755e8
movzx edx, word [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x1c]
shl ecx, 2
add eax, ecx
mov eax, dword [eax]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004753fd
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov eax, dword [ebp - 0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call fcn.006c4c36
add dword [ebp - 0x1c], 1
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
jmp 0x4755f4
add dword [ebp - 0x1c], 1
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
mov edx, dword [ebp - 0x1c]
shl edx, 2
add eax, edx
mov eax, dword [eax]
movzx eax, word [eax + 2]
cmp word [ebp - 0x34], ax
ja 0x4755f0
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
mov edx, dword [ebp - 0x1c]
shl edx, 2
add eax, edx
mov eax, dword [eax]
movzx eax, word [eax + 2]
cmp word [ebp - 0x34], ax
je 0x47566a
movzx eax, word [ebp - 0x34]
add eax, 1
movzx edx, ax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x1c]
shl ecx, 2
add eax, ecx
mov eax, dword [eax]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004753fd
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call fcn.006c4c36
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
xor ecx, dword [sym.imp.libssp_0.dll___stack_chk_guard]
je 0x47567d
call sub.libssp_0.dll___stack_chk_fail
leave
ret
Function at 0x48caec
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [ebp - 0xc], eax
xor eax, eax
cmp dword [ebp - 0x30], 0
je 0x48cb27
call fcn.0058de8a
mov eax, dword [eax + 0x494]
test eax, eax
je 0x48cb3d
mov eax, 0
jmp 0x48cba9
call fcn.0058de8a
mov eax, dword [eax + 0x498]
test eax, eax
je 0x48cb3d
mov eax, 0
jmp 0x48cba9
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x20]
mov dword [esp], eax
call fcn.006b450a
test eax, eax
js 0x48cb9a
mov eax, 0
jmp 0x48cba9
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call fcn.0048a429
test eax, eax
jne 0x48cb8d
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
cmp al, 0x2d
je 0x48cb8d
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
cmp al, 0x2e
je 0x48cb8d
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
cmp al, 0x5f
jne 0x48cb93
add dword [ebp - 0x2c], 1
jmp 0x48cb9a
mov eax, 1
jmp 0x48cba9
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test al, al
jne 0x48cb5a
mov eax, 0
mov edx, dword [ebp - 0xc]
xor edx, dword [sym.imp.libssp_0.dll___stack_chk_guard]
je 0x48cbb9
call sub.libssp_0.dll___stack_chk_fail
leave
ret

Function at 0x4b948d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x44], 0x2000
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0x2000
mov dword [ebp - 0x30], 0x2d78616d
mov dword [ebp - 0x2c], 0x736e6f63
mov dword [ebp - 0x28], 0x75736e65
mov dword [ebp - 0x24], 0x67612d73
mov dword [ebp - 0x20], 0x6f742d65
mov dword [ebp - 0x1c], 0x6361632d
mov dword [ebp - 0x18], 0x662d6568
mov dword [ebp - 0x14], 0x642d726f
mov dword [ebp - 0x10], 0x666669
call fcn.0058de8a
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x670]
test eax, eax
je 0x4b952a
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x670]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x3c]
imul eax, eax, 0xe10
cmp dword [ebp - 0x34], eax
jl 0x4b9525
mov eax, dword [ebp - 0x3c]
jmp 0x4b9558
mov eax, dword [ebp - 0x34]
jmp 0x4b9558
mov eax, dword [ebp - 0x3c]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x40]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x44]
mov dword [esp + 8], eax
lea eax, [ebp - 0x30]
mov dword [esp + 4], eax
mov dword [esp], 0
call fcn.00518fb8
imul eax, eax, 0xe10
mov edx, dword [ebp - 0xc]
xor edx, dword [sym.imp.libssp_0.dll___stack_chk_guard]
je 0x4b9568
call sub.libssp_0.dll___stack_chk_fail
leave
ret
Function at 0x4ca38c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [ebp - 0xc], eax
xor eax, eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
test eax, eax
jne 0x4ca3c4
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
test eax, eax
jne 0x4ca3c4
mov eax, 0
jmp 0x4ca4ba
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
test eax, eax
jne 0x4ca3d7
mov eax, 0xffffffff
jmp 0x4ca4ba
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
test eax, eax
jne 0x4ca3ea
mov eax, 1
jmp 0x4ca4ba
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x1c]
add eax, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x30]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x18]
add eax, edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
movzx eax, al
movzx eax, byte [eax + 0x737360]
mov byte [ebp - 0x1e], al
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
movzx eax, al
movzx eax, byte [eax + 0x737360]
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1e], 0xff
jne 0x4ca456
cmp byte [ebp - 0x1d], 0xff
jne 0x4ca44f
mov eax, 0
jmp 0x4ca4ba
mov eax, 0xffffffff
jmp 0x4ca4ba
cmp byte [ebp - 0x1d], 0xff
jne 0x4ca463
mov eax, 1
jmp 0x4ca4ba
movzx eax, byte [ebp - 0x1e]
cmp al, byte [ebp - 0x1d]
jae 0x4ca473
mov eax, 0xffffffff
jmp 0x4ca4ba
movzx eax, byte [ebp - 0x1e]
cmp al, byte [ebp - 0x1d]
jbe 0x4ca483
mov eax, 1
jmp 0x4ca4ba
add dword [ebp - 0x1c], 1
add dword [ebp - 0x18], 1
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x14]
jne 0x4ca4a9
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x10]
jne 0x4ca4a2
mov eax, 0
jmp 0x4ca4ba
mov eax, 0xffffffff
jmp 0x4ca4ba
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x10]
jne 0x4ca416
mov eax, 1
mov ecx, dword [ebp - 0xc]
xor ecx, dword [sym.imp.libssp_0.dll___stack_chk_guard]
je 0x4ca4ca
call sub.libssp_0.dll___stack_chk_fail
leave
ret
Function at 0x50210d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [ebp + 8]
mov dword [ebp - 0x5c], eax
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [esp], 3
call fcn.005dbeea
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x43], 0x2d766572
mov dword [ebp - 0x3f], 0x6e756f63
mov dword [ebp - 0x3b], 0x2d726574
mov dword [ebp - 0x37], 0x656e6567
mov dword [ebp - 0x33], 0x69746172
mov word [ebp - 0x2f], 0x6e6f
mov byte [ebp - 0x2d], 0
mov eax, dword [ebp - 0x5c]
add eax, 0xd0
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x50]
mov dword [esp + 8], 0x17
lea edx, [ebp - 0x43]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.005dc072
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x50]
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.005dc072
mov eax, dword [ebp - 0x50]
mov dword [esp + 8], 0x20
lea edx, [ebp - 0x2c]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.005dc22f
lea eax, [ebp - 0x50]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
mov dword [esp], eax
call fcn.005dbffa
mov eax, dword [ebp - 0x48]
mov dword [eax], 0
lea eax, [ebp - 0x2c]
mov dword [esp], eax
call fcn.005d66b8
mov ecx, dword [ebp - 0xc]
xor ecx, dword [sym.imp.libssp_0.dll___stack_chk_guard]
je 0x5021ef
call sub.libssp_0.dll___stack_chk_fail
leave
ret
Function at 0x509738
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [ebp - 0xc], eax
xor eax, eax
cmp dword [ebp - 0x20], 0
je 0x5097e6
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call fcn.00509510
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jne 0x5097ad
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x5097a8
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sub.msvcrt.dll__unlink
mov eax, dword [ebp - 0x10]
jmp 0x5097ff
cmp dword [ebp - 0x10], 0
je 0x5097b8
mov eax, dword [ebp - 0x10]
jmp 0x5097ff
mov dword [esp], 2
mov eax, dword [fcn.006f3460]
call eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1f
mov dword [esp + 4], 1
mov dword [esp], str.Not_encrypting_the_secret_key._n
call sub.msvcrt.dll_fwrite
mov eax, dword [ebp - 0x28]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call fcn.005d45f5
mov edx, dword [ebp - 0xc]
xor edx, dword [sym.imp.libssp_0.dll___stack_chk_guard]
je 0x50980f
call sub.libssp_0.dll___stack_chk_fail
leave
ret
Function at 0x530621
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [ebp - 0xc], eax
xor eax, eax
mov eax, dword [ebp - 0x2c]
add eax, 0x1c
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov dword [esp], eax
call fcn.0053042c
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0
mov dword [esp], 2
call fcn.0068d71a
test eax, eax
jne 0x53067f
mov eax, dword [ebp - 0x2c]
mov dword [eax + 0x1c], 0
mov eax, dword [ebp - 0x2c]
mov dword [eax + 0x18], 0
jmp 0x53078d
call fcn.0068d67a
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call fcn.005303e5
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x1c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], 0
jmp 0x530781
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 0x20]
shl edx, 2
add eax, edx
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.0068c753
cwde
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
js 0x530743
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x18]
cmp dword [ebp - 0x10], eax
setl al
movzx eax, al
test eax, eax
jne 0x53072c
mov dword [esp], str.src_feature_nodelist_routerset.c
call fcn.006c14d2
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], str.cc___target__n_countries
mov dword [esp + 8], 0x74e7c0
mov dword [esp + 4], 0x60
mov dword [esp], eax
call fcn.006c1140
call fcn.006c14b8
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x1c]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00530471
jmp 0x530776
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.Country_code__s_is_not_recognized.
mov dword [esp + 0xc], str.routerset_refresh_countries
mov dword [esp + 4], 8
mov dword [esp + 8], 0
mov dword [esp], 4
call fcn.006bf072
mov dword [ebp - 0x14], 0
add dword [ebp - 0x20], 1
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x18]
jl 0x5306b6
mov eax, dword [ebp - 0xc]
xor eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
je 0x53079d
call sub.libssp_0.dll___stack_chk_fail
leave
ret
Function at 0x541244
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, edx
mov word [ebp - 0x30], ax
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [ebp - 0xc], eax
xor eax, eax
call fcn.00417ee4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], 0
jmp 0x5412cf
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov edx, dword [ebp - 0x1c]
shl edx, 2
add eax, edx
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 8]
and eax, 0x1f
movzx eax, al
cmp dword [ebp - 0x2c], eax
jne 0x5412c4
mov eax, dword [ebp - 0x10]
movzx eax, word [eax + 0x4e]
test ax, ax
jne 0x5412c4
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0x34]
movzx eax, word [ebp - 0x30]
cmp edx, eax
jne 0x5412c4
mov eax, dword [ebp - 0x10]
movzx eax, word [eax + 0x4c]
jmp 0x5412dc
mov dword [ebp - 0x10], 0
add dword [ebp - 0x1c], 1
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x14]
jl 0x54127d
mov eax, 0
mov ecx, dword [ebp - 0xc]
xor ecx, dword [sym.imp.libssp_0.dll___stack_chk_guard]
je 0x5412ec
call sub.libssp_0.dll___stack_chk_fail
leave
ret

Function at 0x547f0e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [ebp - 0xc], eax
xor eax, eax
call fcn.0058de8a
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 0x10], eax
mov dword [esp + 4], str.sign
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x547f53
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.00547db3
jmp 0x547fb4
mov dword [esp], 2
mov eax, dword [fcn.006f3460]
call eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x2d
mov dword [esp + 4], 1
mov dword [esp], str.No_valid_argument_to___key_expiration_found__n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
mov eax, dword [fcn.006f3460]
call eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x2b
mov dword [esp + 4], 1
mov dword [esp], str.Currently_recognised_arguments_are:_sign_n
call sub.msvcrt.dll_fwrite
mov eax, 0xffffffff
mov edx, dword [ebp - 0xc]
xor edx, dword [sym.imp.libssp_0.dll___stack_chk_guard]
je 0x547fc4
call sub.libssp_0.dll___stack_chk_fail
leave
ret
Function at 0x548547
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [ebp - 0xc], eax
xor eax, eax
call fcn.005a0db8
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0
jmp 0x5485c3
call fcn.005a0db8
mov eax, dword [eax]
mov edx, dword [ebp - 0x18]
shl edx, 2
add eax, edx
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 0x18]
cmp al, 6
je 0x5485b1
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 0x18]
cmp al, 0xd
je 0x5485b1
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 0x18]
cmp al, 0xf
je 0x5485b1
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 0x18]
cmp al, 0xe
jne 0x5485b8
mov eax, 1
jmp 0x5485d0
mov dword [ebp - 0x10], 0
add dword [ebp - 0x18], 1
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x14]
jl 0x548571
mov eax, 0
mov ecx, dword [ebp - 0xc]
xor ecx, dword [sym.imp.libssp_0.dll___stack_chk_guard]
je 0x5485e0
call sub.libssp_0.dll___stack_chk_fail
leave
ret

Function at 0x55c988
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x20], 0
call fcn.0043a1a6
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 0
jmp 0x55ca40
call fcn.0043a1a6
mov eax, dword [eax]
mov edx, dword [ebp - 0x1c]
shl edx, 2
add eax, edx
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, word [eax + 0x50]
test ax, ax
jne 0x55ca35
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + 0x20]
cmp al, 4
jne 0x55ca35
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + 0x21]
cmp al, 0x10
je 0x55c9fd
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + 0x21]
cmp al, 0x11
jne 0x55ca35
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.00438459
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xb8]
test eax, eax
je 0x55ca35
mov eax, dword [ebp - 0x2c]
add eax, 0x29
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00551bc7
test eax, eax
je 0x55ca35
add dword [ebp - 0x20], 1
mov dword [ebp - 0x14], 0
add dword [ebp - 0x1c], 1
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x18]
jl 0x55c9bc
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
xor ecx, dword [sym.imp.libssp_0.dll___stack_chk_guard]
je 0x55ca5f
call sub.libssp_0.dll___stack_chk_fail
leave
ret
Function at 0x5992b2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x144
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x110], 0
lea edx, [ebp - 0x10c]
mov eax, 0
mov ecx, 0x40
mov edi, edx
rep stosd dword es:[edi], eax
mov eax, dword [0x7cc58c]
test eax, eax
je 0x5992f7
mov eax, 0x7cc5a0
jmp 0x59944f
lea eax, [ebp - 0x11c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x1a
mov dword [esp], 0
mov eax, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
call eax
sub esp, 0xc
test eax, eax
jns 0x59937a
mov dword [esp + 4], 0x104
mov dword [esp], 0x7cc5a0
call sub.msvcrt.dll__getcwd
mov dword [0x7cc58c], 1
mov dword [esp + 0x14], 0x7cc5a0
mov dword [esp + 0x10], str.I_couldnt_find_your_application_data_folder:_are_you_running_an_ancient_version_of_Windows_95__Defaulting_to___s_
mov dword [esp + 0xc], str.get_windows_conf_root
mov dword [esp + 4], 8
mov dword [esp + 8], 0
mov dword [esp], 4
call fcn.006bf072
mov eax, 0x7cc5a0
jmp 0x59944f
mov eax, dword [ebp - 0x11c]
lea edx, [ebp - 0x110]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
call eax
sub esp, 8
mov dword [ebp - 0x114], eax
mov dword [esp + 8], 0x209
lea eax, [ebp - 0x110]
mov dword [esp + 4], eax
mov dword [esp], 0x7cc5a0
call fcn.006c1a88
lea eax, [ebp - 0x118]
mov dword [esp], eax
mov eax, dword [sym.imp.SHELL32.dll_SHGetMalloc]
call eax
sub esp, 4
mov eax, dword [ebp - 0x118]
test eax, eax
je 0x599414
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0x11c]
mov edx, dword [ebp - 0x118]
mov dword [esp + 4], ecx
mov dword [esp], edx
call eax
sub esp, 8
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x118]
mov dword [esp], edx
call eax
sub esp, 4
cmp dword [ebp - 0x114], 0
jns 0x599424
mov eax, 0
jmp 0x59944f
mov dword [esp + 8], 0x104
mov dword [esp + 4], str._tor
mov dword [esp], 0x7cc5a0
call fcn.006c1b00
mov dword [0x7cc58c], 1
mov eax, 0x7cc5a0
mov edi, dword [ebp - 0xc]
xor edi, dword [sym.imp.libssp_0.dll___stack_chk_guard]
je 0x59945f
call sub.libssp_0.dll___stack_chk_fail
mov edi, dword [ebp - 4]
leave
ret
Function at 0x59e379
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [ebp - 0xc], eax
xor eax, eax
cmp dword [ebp - 0x3c], 0
jne 0x59e39f
mov eax, 0
jmp 0x59e488
mov dword [ebp - 0x24], 0x775ece
mov dword [ebp - 0x20], 0x775ed3
mov dword [ebp - 0x1c], str.https
mov dword [ebp - 0x18], str.email
mov dword [ebp - 0x14], str.moat
mov dword [ebp - 0x10], str.hyphae
mov dword [ebp - 0x2c], 0
jmp 0x59e3fc
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x24]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__stricmp]
call eax
test eax, eax
jne 0x59e3f8
mov eax, 0
jmp 0x59e488
add dword [ebp - 0x2c], 1
cmp dword [ebp - 0x2c], 5
jbe 0x59e3d2
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x28], eax
jmp 0x59e40e
add dword [ebp - 0x28], 1
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call fcn.0058db61
test eax, eax
jne 0x59e40a
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
cmp al, 0x2d
je 0x59e40a
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
cmp al, 0x5f
je 0x59e40a
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test al, al
jne 0x59e483
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call fcn.006bd8bd
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.Unrecognized_BridgeDistribution_value__s._Ill_assume_you_know_what_you_are_doing...
mov dword [esp + 0xc], str.check_bridge_distribution_setting
mov dword [esp + 4], 8
mov dword [esp + 8], 0
mov dword [esp], 4
call fcn.006bf072
mov eax, 0
jmp 0x59e488
mov eax, 0xffffffff
mov edx, dword [ebp - 0xc]
xor edx, dword [sym.imp.libssp_0.dll___stack_chk_guard]
je 0x59e498
call sub.libssp_0.dll___stack_chk_fail
leave
ret
Function at 0x5a0069
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0
jmp 0x5a00ff
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
mov edx, dword [ebp - 0x18]
shl edx, 2
add eax, edx
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 0x2c]
and eax, 2
test al, al
jne 0x5a00f4
cmp dword [ebp - 0x34], 0
jne 0x5a00d8
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 0x1c]
and eax, 1
test al, al
jne 0x5a00f7
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 0x18]
movzx eax, al
cmp dword [ebp - 0x30], eax
jne 0x5a00fa
add dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 0
jmp 0x5a00fb
nop
jmp 0x5a00fb
nop
jmp 0x5a00fb
nop
add dword [ebp - 0x18], 1
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x14]
jl 0x5a00a4
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
xor ecx, dword [sym.imp.libssp_0.dll___stack_chk_guard]
je 0x5a011a
call sub.libssp_0.dll___stack_chk_fail
leave
ret