joyce8/EMBER2024-capa huggingface dataset:
Function at 0x64c5e0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
pushfd
xor ebx, ebx
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x20], 0
push 0x1c
lea eax, [ebp - 0x1c]
push eax
push ebx
call dword [0x78c2e8]
cmp eax, 0x1c
jne 0x64c65b
cmp dword [ebp - 0xc], 0x1000
jne 0x64c656
cmp dword [ebp - 0x18], 0
je 0x64c656
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x20], eax
je 0x64c656
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
cmp eax, 0
jne 0x64c635
mov eax, dword [ebp - 0x18]
cmp eax, 0x80000000
jae 0x64c65b
push 2
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
push eax
call dword [0x78c2bc]
cmp eax, 0
je 0x64c656
push edi
push esi
mov eax, dword [ebp - 0x18]
push eax
call dword [0x78c330]
add ebx, dword [ebp - 0x10]
jmp 0x64c5f7
popfd
popal
add esp, 0x20
pop ebp
ret 0xc
Function at 0x650744
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x650935
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor edx, edx
mov eax, dword [0x78c170]
call fcn.0062325c
mov dword [0x7a3310], eax
xor edx, edx
mov eax, dword [0x78c174]
call fcn.0062325c
mov dword [0x7a3314], eax
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, 5
call fcn.0040ab00
lea eax, [ebp - 4]
call fcn.0040a558
mov byte [eax], 0x72
lea eax, [ebp - 4]
call fcn.0040a558
mov byte [eax + 1], 0x64
lea eax, [ebp - 4]
call fcn.0040a558
mov byte [eax + 2], 0x65
lea eax, [ebp - 4]
call fcn.0040a558
mov byte [eax + 3], 0x63
lea eax, [ebp - 4]
call fcn.0040a558
mov byte [eax + 4], 0x20
lea edx, [ebp - 0xc]
mov eax, dword [0x78c1fc]
call fcn.005d1348
push dword [ebp - 0xc]
push 0x650954
push dword [ebp - 4]
lea eax, [ebp - 0x10]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.005d0b00
push dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040a8f4
mov eax, dword [ebp - 4]
call fcn.0040aa3c
push eax
push 0
push 0
call fcn.004136e8
mov edx, dword [ebp + 8]
mov dword [edx - 4], eax
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 0
je 0x650912
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov dword [0x7a3304], esi
mov dword [0x7a3308], edi
cmp dword [0x7a3310], 0
je 0x650862
cmp dword [0x7a3314], 0
jne 0x6508e4
mov dl, 1
mov eax, dword [0x78c108]
call fcn.00623368
mov esi, eax
cmp dword [esi], 0x4244c8b
jne 0x6508f6
lea eax, [esi + 4]
mov eax, dword [eax]
and eax, 0xffffff
cmp eax, 0x241c8b
jne 0x6508f6
lea eax, [esi + 7]
cmp byte [eax], 0x51
jne 0x6508f6
lea eax, [esi + 8]
cmp byte [eax], 0x53
jne 0x6508f6
lea eax, [esi + 9]
cmp byte [eax], 0xe8
jne 0x6508f6
lea eax, [ebp - 8]
push eax
push 0x40
push 4
lea eax, [esi + 0xa]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x6508f6
lea edx, [esi + 0xe]
lea eax, [esi + 0xa]
add edx, dword [eax]
mov dword [0x7a330c], edx
mov edx, 0x6506f4
sub edx, esi
sub edx, 0xe
mov dword [eax], edx
lea edx, [ebp - 8]
push edx
mov edx, dword [ebp - 8]
push edx
push 4
push eax
call sub.kernel32.dll_VirtualProtect
mov bl, 1
jmp 0x6508f6
push 0x6506a0
push 0xffffffffffffffff
call dword [0x7a3310]
test eax, eax
setne bl
test bl, bl
jne 0x650912
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_ReleaseMutex
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65093c
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0040a020
lea eax, [ebp - 4]
call fcn.00409fb4
ret
Function at 0x650958
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
cmp dword [0x7a3310], 0
je 0x650970
cmp dword [0x7a3314], 0
jne 0x6509b1
mov dl, 1
mov eax, dword [0x78c108]
call fcn.00623368
mov ebx, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 4
lea esi, [ebx + 0xa]
push esi
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x6509bc
mov eax, dword [0x7a330c]
sub eax, ebx
sub eax, 0xe
mov dword [esi], eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
push eax
push 4
push esi
call sub.kernel32.dll_VirtualProtect
jmp 0x6509bc
push 0x6506a0
call dword [0x7a3314]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_ReleaseMutex
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_CloseHandle_1
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x652ba0
Capabilities:
Check os version
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd70
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x28c], edx
mov dword [ebp - 0x290], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x652d2e
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
je 0x652cf8
mov edi, 1
mov bl, 1
lea edx, [ebp - 0x28c]
mov eax, dword [0x78c248]
call fcn.005d1348
mov eax, dword [ebp - 0x28c]
push eax
lea eax, [ebp - 0x290]
mov edx, edi
add dl, 0x30
mov ecx, 0
call fcn.0040a704
mov ecx, dword [ebp - 0x290]
lea eax, [ebp - 4]
pop edx
call fcn.0040a870
mov eax, dword [ebp - 4]
call fcn.0040aa3c
push eax
push 0
push 4
call sub.kernel32.dll_OpenFileMappingA
mov esi, eax
test esi, esi
je 0x652ce9
push 0
push 0
push 0
push 4
push esi
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x652ce3
mov eax, dword [ebp - 0x14]
mov edx, dword [eax + 4]
mov eax, dword [eax]
push edx
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [eax]
cmp edx, dword [esp + 4]
jne 0x652c76
cmp eax, dword [esp]
pop edx
pop eax
jne 0x652cda
xor ebx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x652cda
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], 0
imul eax, dword [ebp - 0xc], 0x4e
mov edx, dword [ebp - 0x14]
push esi
push edi
lea esi, [edx + eax*8 + 0xc]
lea edi, [ebp - 0x288]
mov ecx, 0x9c
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
cmp byte [ebp - 0x288], 0
jne 0x652cbb
mov bl, 1
jmp 0x652cda
lea eax, [ebp - 0x288]
push eax
call sub.kernel32.dll_GetModuleHandleA
cmp eax, dword [ebp - 8]
jne 0x652cd2
mov byte [ebp - 0xd], 1
jmp 0x652cda
inc dword [ebp - 0xc]
dec dword [ebp - 0x18]
jne 0x652c92
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_UnmapViewOfFile
push esi
call sub.kernel32.dll_CloseHandle_1
or bl, byte [ebp - 0xd]
jne 0x652cf8
inc edi
cmp edi, 0xa
jne 0x652be7
cmp byte [ebp - 0xd], 0
jne 0x652d08
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.00652a50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x652d35
lea eax, [ebp - 0x290]
mov edx, 2
call fcn.0040a020
lea eax, [ebp - 4]
call fcn.00409fb4
ret
Function at 0x6556c8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
mov ebx, eax
push 0x20a
lea eax, [ebp - 0x214]
push eax
mov eax, dword [0x79fc50]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
push 0xa
lea eax, [ebp - 0xa]
push eax
push 3
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
lea eax, [ebp - 0x214]
push eax
call sub.kernel32.dll_lstrlenW_1
mov ebx, eax
add ebx, ebx
lea eax, [ebp - 0x214]
add ebx, eax
jmp 0x655717
sub ebx, 2
cmp word [ebx], 0x2e
je 0x655727
lea eax, [ebp - 0x214]
cmp ebx, eax
jne 0x655714
xor eax, eax
xor esi, esi
lea edx, [ebp - 0x214]
cmp ebx, edx
je 0x65577d
add ebx, 2
cmp word [ebp - 0xa], 0
je 0x65577d
lea eax, [ebp - 0xa]
push eax
push ebx
call sub.kernel32.dll_lstrcpyW
push 2
push 0
lea eax, [ebp - 0x214]
push eax
call sub.kernel32.dll_LoadLibraryExW_1
test eax, eax
jne 0x65577d
mov word [ebp - 6], 0
lea eax, [ebp - 0xa]
push eax
push ebx
call sub.kernel32.dll_lstrcpyW
push 2
push 0
lea eax, [ebp - 0x214]
push eax
call sub.kernel32.dll_LoadLibraryExW_1
test eax, eax
je 0x655788
call fcn.0065567c
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6612c8
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x158
call fcn.00407764
cmp dword [ebp - 4], 0
je 0x66137c
mov eax, dword [ebp - 4]
mov dword [ebx + 0x154], eax
movzx eax, word [ebp + 8]
mov edx, dword [ebp - 4]
movzx edx, word [edx + 8]
mov word [ebp - 6], dx
cmp ax, word [ebp - 6]
jbe 0x661338
movzx eax, ax
push eax
lea edx, [ebp - 0x46]
mov ecx, esi
mov eax, dword [ebp - 4]
call fcn.0066121c
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0xa]
movzx ecx, ax
lea edx, [ebx + 0xd4]
lea eax, [ebp - 0x46]
call fcn.00406900
jmp 0x661348
movzx ecx, ax
lea edx, [ebx + 0xd4]
mov eax, esi
call fcn.00406900
movzx edx, word [ebp - 6]
dec edx
test dx, dx
jb 0x661362
inc edx
lea eax, [ebx + 0xd4]
xor byte [eax], 0x36
inc eax
dec dx
jne 0x661359
mov eax, ebx
mov esi, dword [ebp - 4]
call dword [esi + 0xc]
movzx ecx, word [ebp - 6]
lea edx, [ebx + 0xd4]
mov eax, ebx
mov ebx, dword [ebp - 4]
call dword [ebx + 0x14]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x661394
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov dword [esp], edx
mov ebx, eax
mov eax, dword [ebx + 0x154]
test eax, eax
je 0x661416
movzx edx, word [eax + 8]
mov word [esp + 4], dx
mov esi, eax
mov edx, dword [esp]
mov eax, ebx
call dword [esi + 0x10]
movzx edx, word [esp + 4]
dec edx
test edx, edx
jl 0x6613d3
inc edx
lea eax, [ebx + 0xd4]
xor byte [eax], 0x6a
inc eax
dec edx
jne 0x6613cc
mov esi, dword [ebx + 0x154]
mov eax, ebx
call dword [esi + 0xc]
mov esi, dword [ebx + 0x154]
movzx ecx, word [esp + 4]
lea edx, [ebx + 0xd4]
mov eax, ebx
call dword [esi + 0x14]
mov eax, dword [ebx + 0x154]
mov esi, eax
movzx ecx, word [eax + 0xa]
mov edx, dword [esp]
mov eax, ebx
call dword [esi + 0x14]
mov esi, dword [ebx + 0x154]
mov edx, dword [esp]
mov eax, ebx
call dword [esi + 0x10]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x661620
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, eax
mov ecx, 0x10
mov eax, dword [edx]
xchg ah, al
rol eax, 0x10
xchg ah, al
mov dword [ebx], eax
add ebx, 4
add edx, 4
dec ecx
jne 0x661628
mov ecx, 0x40
mov eax, dword [ebx - 0xc]
xor eax, dword [ebx - 0x20]
xor eax, dword [ebx - 0x38]
xor eax, dword [ebx - 0x40]
rol eax, 1
mov dword [ebx], eax
add ebx, 4
dec ecx
jne 0x661641
pop ebx
ret
Function at 0x663d40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x663d6f
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x663dee
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.0066277c
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x663dbc
mov cx, word [esp]
sub cx, si
jmp 0x663dbe
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x663da5
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x663de4
mov cx, word [esp]
sub cx, si
jmp 0x663de6
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x663dcd
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x663ed3
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.00663aac
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x663e3a
mov ecx, dword [ebx + 0x38]
mov eax, dword [ebx + 0x6c]
movzx eax, byte [ecx + eax]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
mov eax, dword [ebx + 0x74]
cmp eax, 0x106
jae 0x663e50
mov edx, dword [ebx]
cmp dword [edx + 4], 0
jne 0x663d4a
mov ecx, dword [ebx + 0x3c]
mov edx, dword [ebx + 0x16c0]
cmp ecx, edx
jbe 0x663ed3
mov esi, dword [ebx + 0x6c]
add esi, eax
cmp esi, edx
jbe 0x663e92
mov edi, ecx
sub edi, esi
cmp edi, 0x102
jbe 0x663e77
mov edi, 0x102
push edi
push 0
mov eax, dword [ebx + 0x38]
add eax, esi
push eax
call fcn.00662764
add esp, 0xc
add edi, esi
mov dword [ebx + 0x16c0], edi
jmp 0x663ed3
lea edx, [esi + 0x102]
mov eax, dword [ebx + 0x16c0]
cmp edx, eax
jbe 0x663ed3
mov edi, edx
mov edx, dword [ebx + 0x3c]
sub edx, eax
sub edi, eax
cmp edi, edx
jbe 0x663eb8
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x16c0]
push edi
push 0
mov eax, dword [ebx + 0x38]
add eax, dword [ebx + 0x16c0]
push eax
call fcn.00662764
add esp, 0xc
add dword [ebx + 0x16c0], edi
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x66c6ac
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x66c6f1
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor al, byte [edx + ecx]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov byte [edx + ecx], al
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x66c6ce
mov esp, ebp
pop ebp
ret 4
Function at 0x67035c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x24]
mov eax, dword [eax + 0x38]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x24]
mov edx, dword [edx + 0x28]
shr edx, 1
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x24]
mov ecx, dword [eax + 0x28]
shr ecx, 1
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x24]
mov eax, dword [eax + 0x38]
call fcn.00406900
add dword [ebp - 8], 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x24]
mov eax, dword [eax + 0x4c]
shl eax, 2
sub eax, 5
test eax, eax
jl 0x67043b
inc eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
shr eax, 8
and eax, 0xff
mov eax, dword [eax*4 + 0x791e90]
mov edx, 8
call fcn.0066c4cc
mov ebx, eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
and eax, 0xff
xor ebx, dword [eax*4 + 0x791e90]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x791e90]
mov edx, 0x10
call fcn.0066c4cc
xor ebx, eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
shr eax, 0x18
mov eax, dword [eax*4 + 0x791e90]
mov edx, 0x18
call fcn.0066c4cc
xor ebx, eax
mov eax, dword [ebp - 8]
mov dword [eax], ebx
add dword [ebp - 8], 4
inc dword [ebp - 4]
dec dword [ebp - 0xc]
jne 0x6703be
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x67b0ec
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x67b165
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.0040af30
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.0040af30
mov eax, dword [ebp - 0x14]
call fcn.0040aec8
push eax
mov eax, dword [ebp - 0x10]
call fcn.0040aec8
push eax
call sub.kernel32.dll_MoveFileW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x15], al
mov al, byte [ebp - 0x15]
mov byte [ebp - 9], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x67b16c
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00409ff0
ret

Function at 0x67b174
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CopyFileW
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x67bf38
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x67bf9c
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004279f8
mov eax, dword [ebp - 4]
call fcn.0067be88
test al, al
je 0x67bf71
mov byte [ebp - 5], 1
jmp 0x67bf86
mov eax, dword [ebp - 0xc]
call fcn.0040aec8
push eax
call sub.kernel32.dll_GetDriveTypeW
cmp eax, 2
sete byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x67bfa3
lea eax, [ebp - 0xc]
call fcn.00409f90
ret

Function at 0x67c294
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x67c2ee
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
movzx eax, byte [eax + edx]
xor eax, dword [ebp - 0x10]
and eax, 0xff
mov eax, dword [eax*4 + 0x792f8c]
mov edx, dword [ebp - 0x10]
shr edx, 8
and edx, 0xffffff
xor eax, edx
mov dword [ebp - 0x10], eax
inc dword [ebp - 0x14]
dec dword [ebp - 0x18]
jne 0x67c2bc
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x67c4a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x67c4fd
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, dword [ebp - 0x14]
mov al, byte [eax]
mov byte [ebp - 0xe], al
mov eax, dword [ebp - 0xc]
call fcn.0067c3f0
xor al, byte [ebp - 0xe]
mov byte [ebp - 0xd], al
mov edx, dword [ebp - 0xc]
mov al, byte [ebp - 0xd]
call fcn.0067c358
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, dword [ebp - 0x14]
mov dl, byte [ebp - 0xd]
mov byte [eax], dl
inc dword [ebp - 0x14]
dec dword [ebp - 0x18]
jne 0x67c4c2
mov esp, ebp
pop ebp
ret
Function at 0x67c558
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0x12345678
mov dword [eax + 4], 0
mov eax, dword [ebp - 8]
mov dword [eax + 8], 0x23456789
mov dword [eax + 0xc], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x10], 0x34567890
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x67c5b0
mov eax, dword [ebp - 0x1c]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
dec eax
test eax, eax
jl 0x67c5e0
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
call fcn.0040aa3c
add eax, dword [ebp - 0x10]
mov al, byte [eax]
mov edx, dword [ebp - 8]
call fcn.0067c358
inc dword [ebp - 0x10]
dec dword [ebp - 0x18]
jne 0x67c5c3
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
call fcn.0067c3f0
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
xor al, byte [edx + ecx]
mov byte [ebp - 0x11], al
mov edx, dword [ebp - 8]
mov al, byte [ebp - 0x11]
call fcn.0067c358
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0x11]
mov byte [eax + edx], cl
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xc
jne 0x67c5e5
mov esp, ebp
pop ebp
ret
Function at 0x68a170
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x21e]
mov edx, 0x68a1fc
call fcn.00428244
mov eax, dword [ebp - 4]
cmp dword [eax + 0x54], 0
je 0x68a1ab
lea eax, [ebp - 0x208]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x54]
call fcn.00428244
jmp 0x68a1bc
lea eax, [ebp - 0x208]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathW
lea eax, [ebp - 0x428]
push eax
push 0
lea eax, [ebp - 0x21e]
push eax
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetTempFileNameW
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x428]
mov ecx, 0x105
call fcn.0040af84
mov esp, ebp
pop ebp
ret

Function at 0x6a6d34
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x6a6e5c
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.006a6c20
mov eax, dword [esi]
call fcn.0040c340
add eax, 0x28
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x41f238]
call fcn.0040c55c
add esp, 4
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1c]
mov ecx, 0x1c
call fcn.00406900
mov ebx, 0x1c
mov eax, dword [ebp - 4]
lea edx, [eax + ebx]
lea eax, [ebp - 0x2c]
mov ecx, 0x1c
call fcn.00406900
add ebx, 0x1c
mov eax, dword [esi]
call fcn.0040c340
mov dword [ebp - 0xc], eax
mov eax, dword [0x79c5f4]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea edx, [ebp - 4]
mov ecx, ebx
call fcn.00695e90
add ebx, 4
mov eax, dword [ebp - 4]
add eax, ebx
xor ecx, ecx
mov edx, 3
call fcn.00407764
add ebx, 3
mov eax, dword [ebp - 4]
mov byte [eax + ebx], 0x3a
inc ebx
mov eax, dword [esi]
mov byte [eax + 2], 0
mov eax, dword [esi]
mov byte [eax + 3], 0
push ebx
mov eax, dword [esi]
call fcn.0040c340
push eax
lea ecx, [ebp - 4]
mov eax, dword [esi]
xor edx, edx
call fcn.00695e6c
mov edx, dword [ebp - 4]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x98]
mov ebx, eax
mov eax, ebx
call fcn.00695c24
mov edx, esi
mov ecx, dword [ebp + 0x10]
call fcn.00695e88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a6e63
lea eax, [ebp - 4]
mov edx, dword [0x41f238]
call fcn.0040c680
ret