joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b3927
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
imul edi, edi, 0x3c
add edi, dword [ecx + 0x2c]
shl esi, 6
add esi, dword [edi + 4]
mov dword [ebp - 4], ecx
mov eax, dword [esi + 0x24]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov ebx, eax
mov edx, dword [ebx + 4]
mov eax, dword [ebx + 0xc]
add eax, dword [edi]
xor ecx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 4]
test byte [edx + 0xe8], 1
mov dword [ebp - 8], ecx
mov dword [ebp + 0xc], eax
mov dword [ebp + 8], ecx
jne 0x5b39a3
push ecx
push ecx
call fcn.00678b3d
mov ecx, dword [ebp - 4]
push 0x30000
push 0x10000
mov dword [ecx + 0xe4], eax
call fcn.00678b3d
mov eax, dword [ebp - 4]
or dword [eax + 0xe8], 1
mov eax, dword [ebp + 0xc]
add esp, 0x10
xor ecx, ecx
cmp dword [esi + 0x28], ecx
je 0x5b3a7f
mov edx, dword [edi]
mov ecx, dword [ebx + 0x10]
add ecx, edx
mov dword [ebp - 8], ecx
mov ecx, dword [ebx + 0x14]
add ecx, edx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebx + 0x18]
add ecx, edx
mov dword [ebp - 0xc], ecx
xor ecx, ecx
cmp word [esi + 0x32], cx
mov dword [ebp + 8], ecx
jbe 0x5b3a71
movzx ecx, word [ebp + 8]
mov edx, dword [esi + 0x20]
lea ecx, [ecx + ecx*2]
lea ecx, [edx + ecx*8]
mov edx, dword [ecx + 0x14]
test dl, 1
je 0x5b3a5e
mov eax, dword [ecx + 0xc]
and edx, 0xfffffffe
mov dword [ecx + 0x14], edx
movzx edx, word [eax + 4]
sub edx, 0
je 0x5b3a38
dec edx
je 0x5b3a17
dec edx
jne 0x5b3a9d
movzx edx, word [eax + 8]
push eax
movzx eax, word [eax + 6]
shl eax, 5
add eax, dword [ebp - 8]
jmp 0x5b3a26
movzx edx, word [eax + 8]
push eax
movzx eax, word [eax + 6]
shl eax, 5
add eax, dword [ebp - 0xc]
push dword [esi + 0x28]
push edx
push eax
push dword [ecx + 8]
mov ecx, dword [ebp - 4]
call fcn.005b338d
jmp 0x5b3a57
movzx edx, word [eax + 8]
push eax
push dword [esi + 0x28]
movzx eax, word [eax + 6]
push edx
mov edx, dword [ebp - 0x10]
lea eax, [edx + eax*8]
push eax
push dword [ecx + 8]
mov ecx, dword [ebp - 4]
call fcn.005b340e
test eax, eax
jl 0x5b3a96
mov eax, dword [ebp + 0xc]
xor ecx, ecx
inc dword [ebp + 8]
mov dx, word [ebp + 8]
cmp dx, word [esi + 0x32]
jb 0x5b39d5
mov edi, dword [edi]
add edi, dword [ebx + 0x10]
mov edx, dword [ebx + 8]
mov dword [ebp - 8], edi
mov dword [ebp + 8], edx
push dword [ebp - 0x14]
add ebx, 0x20
push ecx
push dword [ebp + 8]
push ecx
push eax
push ecx
push dword [ebp - 8]
push ecx
push ebx
call fcn.00593503
pop edi
pop esi
pop ebx
leave
ret 8
mov eax, 0x80004005
jmp 0x5b3a96

Function at 0x5bf6f0
Capabilities:
Check for software breakpoints

Disassembly:
cmp dword [esi + 0x14], 0xcc
je 0x5bf713
mov eax, dword [esi + 0x1a8]
push esi
call dword [eax]
mov dword [esi + 0x8c], 0
mov dword [esi + 0x14], 0xcc
mov ecx, dword [esi + 0x1a8]
mov eax, dword [ecx + 8]
test eax, eax
je 0x5bf739
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x30
call dword [eax]
mov edx, dword [esi + 0x1a8]
mov eax, dword [edx + 8]
test eax, eax
jne 0x5bf720
mov edx, dword [esi + 0x44]
xor eax, eax
test edx, edx
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov eax, 1
ret
Function at 0x5bf7f0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x5bf822
push esi
call fcn.005e5dc0
mov eax, dword [esi + 0x40]
test eax, eax
je 0x5bf81b
mov dword [esi + 0x14], 0xcf
mov eax, 1
pop esi
ret 4
mov dword [esi + 0x14], 0xcb
mov ecx, dword [esi + 0x14]
cmp ecx, 0xcb
jne 0x5bf8a5
mov eax, dword [esi + 0x1b8]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x5bf890
lea ebx, [ebx]
mov eax, dword [esi + 8]
test eax, eax
je 0x5bf84a
push esi
call dword [eax]
mov ecx, dword [esi + 0x1b8]
push esi
call dword [ecx]
test eax, eax
je 0x5bf88a
cmp eax, 2
je 0x5bf890
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x5bf840
cmp eax, 3
je 0x5bf86d
cmp eax, 1
jne 0x5bf840
mov eax, dword [ecx + 4]
inc eax
mov edx, eax
mov dword [ecx + 4], eax
mov eax, dword [ecx + 8]
cmp edx, eax
jl 0x5bf840
mov edx, dword [esi + 0x144]
add edx, eax
mov dword [ecx + 8], edx
jmp 0x5bf840
xor eax, eax
pop esi
ret 4
mov eax, dword [esi + 0x94]
mov dword [esi + 0x9c], eax
call fcn.005bf6f0
pop esi
ret 4
cmp ecx, 0xcc
je 0x5bf8bc
mov eax, dword [esi]
mov dword [eax + 0x14], 0x14
push esi
mov dword [eax + 0x18], ecx
call dword [eax]
call fcn.005bf6f0
pop esi
ret 4

Function at 0x5c5f27
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
lea eax, [ebp - 0x24]
mov esi, ecx
and dword [esi], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp + 0xc]
and dword [esi + 8], 0
and dword [esi + 0xc], 0
and dword [esi + 0x10], 0
lea eax, [ecx + eax - 1]
dec ecx
not ecx
and eax, ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
mov dword [esi + 4], eax
jne 0x5c5f67
mov ecx, 0x100000
lea ecx, [eax + ecx - 1]
dec eax
not eax
and ecx, eax
mov dword [esi + 0x14], ecx
mov eax, esi
pop esi
leave
ret 8
Function at 0x5e7142
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
jne 0x5e7151
xor eax, eax
jmp 0x5e7234
mov eax, dword [esp + 0xc]
cmp eax, 8
push ebx
push esi
mov esi, dword [esp + 0xc]
not esi
mov ecx, 0xff
jb 0x5e7214
push edi
mov edi, eax
shr edi, 3
xor ebx, ebx
mov bl, byte [edx]
sub eax, 8
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x6c7080]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x6c7080]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x6c7080]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x6c7080]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x6c7080]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x6c7080]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x6c7080]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x6c7080]
inc edx
dec edi
jne 0x5e7171
pop edi
test eax, eax
je 0x5e722e
xor ebx, ebx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x6c7080]
inc edx
dec eax
jne 0x5e7218
mov eax, esi
pop esi
not eax
pop ebx
ret 0xc
Function at 0x5e73d5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebx + 0x24]
push esi
mov dword [ebp - 8], edx
push edi
mov ecx, dword [ebx + 0x64]
mov eax, dword [ebx + 0x34]
mov esi, dword [ebx + 0x6c]
sub eax, ecx
sub eax, esi
mov dword [ebp - 4], eax
jne 0x5e7401
test ecx, ecx
jne 0x5e740b
test esi, esi
jne 0x5e740b
mov eax, edx
jmp 0x5e747c
cmp eax, 0xffffffff
jne 0x5e740b
push 0xfffffffffffffffe
pop eax
jmp 0x5e747c
mov esi, dword [ebx + 0x24]
lea esi, [edx + esi - 0x106]
cmp ecx, esi
jb 0x5e747c
mov edi, dword [ebx + 0x30]
mov ecx, edx
mov eax, ecx
shr ecx, 2
lea esi, [edi + edx]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x44]
mov eax, dword [ebx + 0x3c]
sub dword [ebx + 0x68], edx
sub dword [ebx + 0x64], edx
sub dword [ebx + 0x54], edx
lea eax, [eax + ecx*2]
dec eax
dec eax
movzx esi, word [eax]
mov edi, esi
sub edi, edx
cmp esi, edx
sbb esi, esi
not esi
and esi, edi
dec ecx
mov word [eax], si
jne 0x5e7441
mov eax, dword [ebx + 0x38]
mov esi, edx
lea eax, [eax + edx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edi, ecx
sub edi, edx
cmp ecx, edx
sbb ecx, ecx
not ecx
and ecx, edi
dec esi
mov word [eax], cx
jne 0x5e7460
mov eax, dword [ebp - 4]
add eax, edx
mov esi, dword [ebx]
cmp dword [esi + 4], 0
mov dword [ebp - 0xc], esi
je 0x5e7529
mov edi, dword [ebx + 0x6c]
add edi, dword [ebx + 0x64]
mov ecx, dword [esi + 4]
add edi, dword [ebx + 0x30]
cmp ecx, eax
mov dword [ebp - 4], ecx
jbe 0x5e74a1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5e74ab
xor ecx, ecx
jmp 0x5e74ea
sub ecx, dword [ebp - 4]
mov eax, dword [esi + 0x1c]
mov dword [esi + 4], ecx
cmp dword [eax + 0x18], 0
jne 0x5e74cd
push dword [ebp - 4]
push dword [esi]
push dword [esi + 0x30]
call fcn.00624570
mov edx, dword [ebp - 8]
mov dword [esi + 0x30], eax
mov ecx, dword [ebp - 4]
mov esi, dword [esi]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
mov eax, dword [ebp - 0xc]
add dword [eax], ecx
add dword [eax + 8], ecx
add dword [ebx + 0x6c], ecx
mov edi, dword [ebx + 0x6c]
cmp edi, 3
jb 0x5e7515
mov eax, dword [ebx + 0x64]
mov ecx, dword [ebx + 0x30]
lea esi, [eax + ecx]
movzx eax, byte [esi]
mov ecx, dword [ebx + 0x50]
mov dword [ebx + 0x40], eax
shl eax, cl
movzx ecx, byte [esi + 1]
xor eax, ecx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp edi, 0x106
jae 0x5e7529
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x5e73e3
pop edi
pop esi
leave
ret
Function at 0x62c8f0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov edx, dword [esi]
mov ecx, edx
xor ecx, eax
and ecx, 0xff
mov ecx, dword [edi + ecx*4]
shr edx, 8
xor ecx, edx
mov edx, dword [esi + 4]
mov dword [esi], ecx
and ecx, 0xff
add ecx, edx
mov edx, dword [esi + 8]
imul ecx, ecx, 0x8088405
inc ecx
mov dword [esi + 4], ecx
shr ecx, 0x18
xor ecx, edx
push ebx
and ecx, 0xff
mov ebx, dword [edi + ecx*4]
shr edx, 8
xor edx, ebx
mov dword [esi + 8], edx
pop ebx
ret

Function at 0x62c940
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push esi
mov esi, eax
xor eax, eax
mov dword [edx], 0x12345678
mov dword [edx + 4], 0x23456789
mov dword [edx + 8], 0x34567890
mov al, byte [esi]
test al, al
je 0x62c9a7
push ebx
mov ecx, dword [edx]
xor eax, ecx
and eax, 0xff
mov eax, dword [edi + eax*4]
shr ecx, 8
xor eax, ecx
mov ecx, dword [edx + 4]
mov dword [edx], eax
and eax, 0xff
add eax, ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
mov ebx, dword [edi + eax*4]
shr ecx, 8
xor ecx, ebx
inc esi
mov dword [edx + 8], ecx
mov al, byte [esi]
test al, al
jne 0x62c960
pop ebx
pop esi
ret
Function at 0x631a10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
push 0
push eax
push edx
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
pop ebp
ret

Function at 0x631a30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
push 0
push eax
push edx
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
ret
Function at 0x676e85
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.00676300
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x676f20
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x7e40e8]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x676f20
cmp eax, 1
je 0x676f41
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x676f20
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x676eed
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x676f1c
xor eax, eax
inc eax
jmp 0x676f60
cmp edi, eax
jae 0x676f24
xor eax, eax
jmp 0x676f60
cmp eax, esi
jae 0x676f2b
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x7e40e8]
jmp 0x676f44
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x678618
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x678635
call fcn.006783be
mov dword [eax], 0x16
xor eax, eax
jmp 0x67869f
push esi
push 0x8c
push 1
call fcn.0068371c
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x67868a
push esi
call fcn.0067bbb0
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x678668
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x678583
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x67869e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.0067544a
test ebx, ebx
pop ecx
je 0x67869c
push ebx
call fcn.006783d0
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6786ec
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x6cddf0
call fcn.0067b28c
mov edi, 0x94
mov eax, edi
call fcn.00676300
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x7e40e8], ecx
mov eax, dword [esi + 4]
mov dword [0x7e40f4], eax
mov edx, dword [esi + 8]
mov dword [0x7e40f8], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x7e40ec], esi
cmp ecx, 2
je 0x67874c
or esi, 0x8000
mov dword [0x7e40ec], esi
shl eax, 8
add eax, edx
mov dword [0x7e40f0], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x678787
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x678787
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x67879f
cmp eax, 0x20b
je 0x67878c
mov dword [ebp - 0x1c], esi
jmp 0x6787b3
cmp dword [ecx + 0x84], 0xe
jbe 0x678787
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x6787ad
cmp dword [ecx + 0x74], 0xe
jbe 0x678787
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.0067d39e
pop ecx
test eax, eax
jne 0x6787c7
push 0x1c
call fcn.006786c8
pop ecx
call fcn.0067bdaa
test eax, eax
jne 0x6787d8
push 0x10
call fcn.006786c8
pop ecx
call fcn.00683c2b
mov dword [ebp - 4], esi
call fcn.00682221
test eax, eax
jge 0x6787f1
push 0x1b
call fcn.006786a3
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x7e59d0], eax
call fcn.00683b09
mov dword [0x7e40cc], eax
call fcn.00683a67
test eax, eax
jge 0x678817
push 8
call fcn.006786a3
pop ecx
call fcn.00683834
test eax, eax
jge 0x678828
push 9
call fcn.006786a3
pop ecx
push 1
call fcn.00679e7a
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x67883e
push eax
call fcn.006786a3
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.006837d7
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x67885f
movzx eax, word [ebp - 0x40]
jmp 0x678862
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.005044a0
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x678880
push edi
call fcn.00679fa7
call fcn.00679fc9
jmp 0x6788b2
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.0067b2c7
ret
Function at 0x679ee4
Capabilities:
Terminate process

Disassembly:
push 8
push 0x6ce008
call fcn.0067b28c
push 8
call fcn.0067b259
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x7e4128], esi
jne 0x679f18
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x7e4124], esi
mov al, byte [ebp + 0x10]
mov byte [0x7e4120], al
cmp dword [ebp + 0xc], edi
jne 0x679f62
cmp dword [0x7e59c0], edi
je 0x679f52
mov eax, dword [0x7e59bc]
sub eax, 4
mov dword [0x7e59bc], eax
cmp eax, dword [0x7e59c0]
jb 0x679f52
mov eax, dword [eax]
cmp eax, edi
je 0x679f33
call eax
jmp 0x679f33
push 0x6dbe90
mov eax, 0x6dbe84
call fcn.00679e62
pop ecx
push 0x6dbe9c
mov eax, 0x6dbe94
call fcn.00679e62
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x679f93
cmp dword [ebp + 0x10], edi
jne 0x679fa1
mov dword [0x7e4128], esi
push dword [ebp + 8]
call fcn.00679e20
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x679fa0
push 8
call fcn.0067b1a4
pop ecx
ret
call fcn.0067b2c7
ret

Function at 0x67d1d4
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x6f2220]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x6f2858]
je 0x67d209
inc eax
cmp eax, 0x13
jb 0x67d1fa
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x6f2858]
jne 0x67d32f
mov eax, dword [0x7e40d4]
cmp eax, 1
je 0x67d307
cmp eax, edx
jne 0x67d239
cmp dword [0x6f24d4], 1
je 0x67d307
cmp ecx, 0xfc
je 0x67d32f
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x67d26f
lea eax, [ebp - 0x80]
push 0x6cdbc8
push eax
call fcn.0067a2a0
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.0067a8f0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x67d2a3
mov eax, edi
push eax
call fcn.0067a8f0
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x697b44
push edi
call fcn.00674b40
add esp, 0x10
push edi
call fcn.0067a8f0
push dword [esi + 0x6f285c]
mov ebx, eax
call fcn.0067a8f0
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.00676300
mov ebx, esp
push 0x6cecc8
push ebx
call fcn.0067a2a0
push edi
push ebx
call fcn.0067a2b0
push 0x6b5db0
push ebx
call fcn.0067a2b0
push dword [esi + 0x6f285c]
push ebx
call fcn.0067a2b0
push 0x12010
push 0x6cdb94
push ebx
call fcn.006826dd
add esp, 0x2c
jmp 0x67d32f
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x6f285c]
push dword [esi]
call fcn.0067a8f0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.00674e87
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x681e7c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x682050
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x7e4860]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x682050
test cl, 0x48
je 0x681ee7
cmp byte [eax + 5], 0xa
je 0x681ee7
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x681f39
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x681f21
call fcn.006783be
mov dword [eax], 9
call fcn.006783c7
mov dword [eax], esi
jmp 0x681f31
cmp eax, 0x6d
je 0x682050
push eax
call fcn.006783d0
pop ecx
or eax, 0xffffffff
jmp 0x682052
mov eax, dword [ebp - 0xc]
mov ecx, dword [edi]
add dword [ebp - 8], eax
test byte [ecx + esi + 4], 0x80
je 0x68204b
test eax, eax
je 0x681f60
cmp byte [ebx], 0xa
jne 0x681f60
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x681f69
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x682045
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x682035
cmp al, 0xd
je 0x681f9b
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x682027
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x681fb5
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x681fb0
add dword [ebp + 0x10], 2
jmp 0x682009
mov dword [ebp + 0x10], eax
jmp 0x682023
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x681fdd
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x682023
cmp dword [ebp - 0xc], 0
je 0x682023
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x681ffe
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x682009
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x682026
cmp ebx, dword [ebp + 0xc]
jne 0x68200e
cmp byte [ebp - 1], 0xa
jne 0x68200e
mov byte [ebx], 0xa
jmp 0x682026
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00682102
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x682027
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x681f7f
jmp 0x682045
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x682045
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x682052
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret