joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5bd9c0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [0x8bb040]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
push dword [ebp + 8]
mov esi, ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0x10], esi
push edx
mov byte [0x9736a8], 0
mov dword [0x9736ec], 0
mov dword [0x9736f0], 0
mov dword [0x9736f4], 0x67452301
mov dword [0x9736f8], 0xefcdab89
mov dword [0x9736fc], 0x98badcfe
mov dword [0x973700], 0x10325476
call fcn.005bd600
cmp byte [0x9736a8], 0
jne 0x5bdaea
xor edx, edx
mov ecx, 0x9736ed
nop
movzx eax, byte [ecx - 1]
lea ecx, [ecx + 4]
mov byte [esp + edx + 0xc], al
movzx eax, byte [ecx - 4]
mov byte [esp + edx + 0xd], al
movzx eax, byte [ecx - 3]
mov byte [esp + edx + 0xe], al
movzx eax, byte [ecx - 2]
mov byte [esp + edx + 0xf], al
add edx, 4
cmp edx, 8
jb 0x5bda40
mov edx, dword [0x9736ec]
mov ecx, 0x78
shr edx, 3
mov eax, 0x38
and edx, 0x3f
sub ecx, edx
sub eax, edx
cmp edx, 0x38
cmovae eax, ecx
push eax
push 0x823e78
call fcn.005bd600
push 8
lea eax, [esp + 0x10]
push eax
call fcn.005bd600
xor ecx, ecx
mov edx, 0x9736f5
lea esp, [esp]
movzx eax, byte [edx - 1]
lea edx, [edx + 4]
mov byte [ecx + 0x973704], al
movzx eax, byte [edx - 4]
mov byte [ecx + 0x973705], al
movzx eax, byte [edx - 3]
mov byte [ecx + 0x973706], al
movzx eax, byte [edx - 2]
mov byte [ecx + 0x973707], al
add ecx, 4
cmp ecx, 0x10
jb 0x5bdab0
mov byte [0x9736a8], 1
push esi
call fcn.005bd6c0
mov ecx, dword [esp + 0x14]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0073297b
mov esp, ebp
pop ebp
ret
Function at 0x5c4020
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
push ebx
push esi
mov esi, ecx
push edi
push dword [esi + 0x78]
mov byte [esi + 0x4b], 1
mov ecx, dword [esi + 8]
call fcn.00538090
push dword [esi + 0x60]
mov ecx, dword [esi + 8]
test eax, eax
setne bl
mov byte [esp + 0x17], bl
call fcn.00538090
mov ecx, dword [esi + 0xac]
mov edi, eax
mov eax, ecx
mov dword [esp + 0x14], edi
sub eax, edi
cdq
xor eax, edx
sub eax, edx
cmp eax, 0xa
jle 0x5c40a5
push dword [0x8e7dd4]
lea edx, [esp + 0x18]
call fcn.005c4240
mov dword [esi + 0x58], eax
add esp, 4
mov dword [esi + 0x5c], edx
mov ecx, dword [esi + 0x3c]
test ecx, ecx
je 0x5c4096
mov dword [esp + 0x18], 1
lea edx, [esp + 0x18]
mov eax, dword [ecx]
push edx
call dword [eax + 8]
mov eax, dword [esp + 0x14]
mov dword [esi + 0xac], eax
jmp 0x5c41d9
lea eax, [esp + 0x13]
mov dword [esi + 0xac], edi
push eax
mov ecx, esi
call fcn.005c4430
cmp byte [esi + 0x90], 0
je 0x5c40e0
mov eax, dword [esi + 0x94]
inc eax
mov dword [esi + 0x94], eax
cmp eax, dword [0x8bba04]
jle 0x5c40e0
mov eax, dword [0x8bbbb4]
mov dword [esi + 0x94], eax
push dword [esi + 0x68]
mov ecx, dword [esi + 8]
mov byte [esi + 0x90], 0
call fcn.00538090
test eax, eax
je 0x5c411d
mov ecx, dword [esi + 0xb4]
mov edx, dword [esi + 0x94]
mov byte [esi + 0x90], 1
mov eax, dword [esi + ecx*4 + 0x9c]
cmp eax, edx
jle 0x5c411d
sub eax, edx
mov dword [esi + ecx*4 + 0x9c], eax
push dword [esi + 0x6c]
mov ecx, dword [esi + 8]
call fcn.00538090
test eax, eax
je 0x5c4155
mov edx, dword [esi + 0xb4]
mov byte [esi + 0x90], 1
mov eax, dword [esi + edx*4 + 0x9c]
add eax, dword [esi + 0x94]
cmp eax, dword [0x8bbb24]
jge 0x5c4155
mov dword [esi + edx*4 + 0x9c], eax
mov eax, dword [esi + 0x9c]
mov dword [esp + 0x18], eax
cmp eax, dword [esi + 0xa4]
je 0x5c41d5
fild dword [esp + 0x18]
mov byte [esp + 0x20], 1
fstp qword [esp + 0x18]
fld qword [esp + 0x18]
fmul qword [0x892af8]
fnstcw word [esp + 0x14]
movzx eax, word [esp + 0x14]
or eax, 0xc00
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x20]
mov dword [esi + 0x58], eax
fmul qword [0x892f10]
fldcw word [esp + 0x18]
fistp qword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov dword [esi + 0x5c], ecx
mov ecx, dword [esi + 0x3c]
fldcw word [esp + 0x14]
test ecx, ecx
je 0x5c41c9
mov dword [esp + 0x18], 1
lea edx, [esp + 0x18]
mov eax, dword [ecx]
push edx
call dword [eax + 8]
mov eax, dword [esi + 0x9c]
mov dword [esi + 0xa4], eax
mov bl, byte [esp + 0x13]
cmp byte [0x8d652c], 0
je 0x5c421b
mov ecx, dword [0x8e7dc8]
test ecx, ecx
je 0x5c421b
test bl, bl
je 0x5c421b
mov eax, dword [esi + 0x40]
sub eax, ecx
mov dword [esi + 0x40], eax
test eax, eax
jg 0x5c4204
add eax, 0x8000
mov dword [esi + 0x40], eax
cmp eax, 0x4000
setg bl
test bl, bl
sete al
mov byte [esi + 0x4b], al
pop edi
pop esi
pop ebx
add esp, 0x20
ret
test bl, bl
mov dword [esi + 0x40], 0
pop edi
sete al
mov byte [esi + 0x4b], al
pop esi
pop ebx
add esp, 0x20
ret
Function at 0x5dc4c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x750d7d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x8bb040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.005db780
mov dword [ebp - 4], 0
lea esi, [edi + 0xb4]
mov dword [edi], 0x880f68
mov dword [edi + 0x70], 0
mov dword [edi + 0x74], 0
mov dword [edi + 0x78], 0
mov dword [edi + 0x7c], 0
mov dword [edi + 0x80], 0
mov dword [edi + 0x84], 0
mov dword [edi + 0x88], 0
mov dword [edi + 0x8c], 0
mov dword [edi + 0x90], 0
mov dword [edi + 0x94], 0
mov dword [edi + 0x98], 0
mov dword [edi + 0x9c], 0
mov dword [edi + 0xa0], 0
mov dword [edi + 0xa4], 0
mov dword [edi + 0xa8], 0
mov dword [edi + 0xac], 0
mov byte [edi + 0xb0], 0
mov dword [esi], 0x881018
mov dword [esi + 4], 0x81f520
mov dword [esi + 8], 0
call dword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
mov dword [esi + 8], eax
mov ecx, esi
push 1
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 1
mov dword [esi + 0x28], 5
mov dword [esi + 0x2c], 0x39
mov dword [esi + 0x30], 0x19
mov dword [esi + 0x34], 0xa
mov dword [esi + 0x38], 1
mov dword [esi + 0x3c], 1
mov byte [esi + 0x40], 1
call fcn.005dce80
mov eax, dword [edi]
mov ecx, edi
mov word [edi + 4], 0
mov byte [edi + 6], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
call dword [eax + 0x60]
mov ecx, edi
call fcn.005dcd30
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5e8170
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub esp, 0x3c
mov eax, dword [0x8bb040]
xor eax, esp
mov dword [esp + 0x34], eax
push ebx
push ebp
push esi
push edi
push dword [esp + 0x54]
mov ebx, ecx
push dword [esp + 0x54]
call fcn.005e82e0
xor al, 1
mov byte [esp + 0x17], al
je 0x5e81bf
mov eax, dword [esp + 0x50]
mov ecx, ebx
mov edx, dword [esp + 0x54]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x28]
mov dword [esp + 0x20], edx
push eax
call fcn.005e9480
jmp 0x5e82c1
push dword [esp + 0x54]
xor eax, eax
lea ecx, [esp + 0x30]
push dword [esp + 0x54]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
call fcn.004815d0
mov eax, dword [esp + 0x40]
lea edx, [esp + 0x2c]
mov ebp, dword [esp + 0x2c]
cmp eax, 0xf
mov esi, dword [esp + 0x3c]
mov edi, 0x811c9dc5
cmova edx, ebp
mov dword [esp + 0x18], eax
xor ecx, ecx
test esi, esi
je 0x5e8221
nop
movzx eax, byte [ecx + edx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, esi
jb 0x5e8210
push edi
lea eax, [esp + 0x30]
mov ecx, ebx
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.005e9bf0
mov esi, dword [eax + 4]
test esi, esi
je 0x5e828d
mov ecx, dword [ebx + 0x18]
mov eax, dword [ebx + 0xc]
and ecx, edi
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], esi
jne 0x5e8262
cmp eax, esi
jne 0x5e825a
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x5e826a
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x5e826a
cmp eax, esi
jne 0x5e826a
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
dec dword [ebx + 8]
mov eax, dword [esi + 4]
mov dword [eax], ecx
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
lea ecx, [esi + 8]
call fcn.00481520
push 0x20
push esi
call fcn.00732c0f
add esp, 8
mov ecx, dword [esp + 0x18]
cmp ecx, 0xf
jbe 0x5e82c1
inc ecx
mov eax, ebp
cmp ecx, 0x1000
jb 0x5e82b7
mov ebp, dword [eax - 4]
add ecx, 0x23
sub eax, ebp
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x5e82b7
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push ebp
call fcn.00732c0f
add esp, 8
mov ecx, dword [esp + 0x44]
mov al, byte [esp + 0x17]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0073297b
add esp, 0x3c
ret 8
Function at 0x5e82e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub esp, 0x2c
mov eax, dword [0x8bb040]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
push esi
push edi
push dword [esp + 0x44]
xor eax, eax
mov ebp, ecx
push dword [esp + 0x44]
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
call fcn.004815d0
cmp dword [esp + 0x30], 0xf
lea edi, [esp + 0x1c]
mov esi, dword [esp + 0x1c]
mov edx, 0x811c9dc5
mov ebx, dword [esp + 0x2c]
cmova edi, esi
xor ecx, ecx
test ebx, ebx
je 0x5e8351
mov edi, edi
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x5e8340
push edx
lea eax, [esp + 0x20]
mov ecx, ebp
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.005e9bf0
mov eax, dword [eax + 4]
test eax, eax
jne 0x5e836d
mov eax, dword [ebp + 4]
cmp eax, dword [ebp + 4]
mov eax, dword [esp + 0x30]
setne bl
cmp eax, 0xf
jbe 0x5e83a9
lea ecx, [eax + 1]
mov eax, esi
cmp ecx, 0x1000
jb 0x5e839f
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x5e839f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push esi
call fcn.00732c0f
add esp, 8
mov ecx, dword [esp + 0x34]
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0073297b
add esp, 0x2c
ret 8
Function at 0x5e9260
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x18
push ebp
mov ebp, ecx
mov ecx, dword [esp + 0x20]
cmp ecx, eax
je 0x5e93d4
cmp dword [ecx + 0x1c], 0xf
lea edx, [ecx + 8]
mov eax, dword [ebp + 4]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [edx + 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [ecx + 4]
push esi
mov dword [esp + 0xc], eax
mov esi, ecx
jbe 0x5e929d
mov edx, dword [edx]
xor ecx, ecx
push edi
mov edi, 0x811c9dc5
test ebx, ebx
je 0x5e92c1
lea esp, [esp]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x5e92b0
mov eax, dword [ebp + 0x18]
mov ecx, dword [esp + 0x1c]
and eax, edi
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [esp + 0x14], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x24], eax
mov edi, edi
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.00481520
push 0x20
push edi
call fcn.00732c0f
dec dword [ebp + 8]
add esp, 8
cmp ebx, dword [esp + 0x24]
je 0x5e9331
mov eax, dword [esp + 0x30]
cmp esi, eax
jne 0x5e92e0
mov ecx, dword [esp + 0x18]
cmp ecx, dword [esp + 0x2c]
jne 0x5e93c8
mov ecx, dword [esp + 0x14]
pop edi
mov dword [ecx], esi
mov ecx, dword [esp + 0xc]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
pop ebp
add esp, 0x18
ret 8
mov ecx, dword [esp + 0x18]
cmp ecx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x14]
jne 0x5e9347
mov eax, dword [esp + 0x20]
mov dword [ecx], eax
jmp 0x5e934b
mov eax, dword [esp + 0x10]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x30]
cmp esi, eax
je 0x5e93c8
cmp dword [esi + 0x1c], 0xf
lea edx, [esi + 8]
mov ebx, dword [edx + 0x10]
jbe 0x5e9364
mov edx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
test ebx, ebx
je 0x5e9381
nop
movzx eax, byte [ecx + edx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x5e9370
mov eax, dword [ebp + 0x18]
mov ecx, dword [esp + 0x1c]
and eax, edi
lea eax, [ecx + eax*8]
mov dword [esp + 0x2c], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x24], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.00481520
push 0x20
push edi
call fcn.00732c0f
dec dword [ebp + 8]
add esp, 8
mov eax, dword [esp + 0x30]
cmp ebx, dword [esp + 0x24]
je 0x5e93db
cmp esi, eax
jne 0x5e9398
mov ecx, dword [esp + 0x2c]
mov dword [ecx], esi
mov ecx, dword [esp + 0x10]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
pop ebp
add esp, 0x18
ret 8
mov ecx, dword [esp + 0x2c]
mov edi, dword [esp + 0x20]
mov dword [ecx], edi
mov dword [ecx + 4], edi
cmp esi, eax
jne 0x5e9356
mov ecx, dword [esp + 0x10]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
pop ebp
add esp, 0x18
ret 8
Function at 0x634290
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x758368
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x8bb040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
xor eax, eax
push dword [ebp + 8]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
call fcn.004815d0
mov dword [ebp - 4], 0
lea ecx, [edi + 0x18]
xor eax, eax
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
push esi
push dword [ebp + 0x10]
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
call fcn.004815d0
mov byte [ebp - 4], 1
lea ecx, [edi + 0x30]
push dword [ebp + 0x1c]
xor eax, eax
push dword [ebp + 0x18]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
call fcn.004815d0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18

Function at 0x634340
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7583a8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x8bb040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [ebp + 0xc]
xor eax, eax
push dword [ebp + 8]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
call fcn.004815d0
mov dword [ebp - 4], 0
xor eax, eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], 0xf
mov byte [esi + 0x18], al
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
push dword [ebp + 0x14]
mov dword [ecx], eax
push dword [ebp + 0x10]
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
call fcn.004815d0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x6353a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ecx
cmp edx, eax
je 0x635539
cmp dword [edx + 0x1c], 0xf
mov eax, dword [ecx + 4]
push ebp
mov ebp, dword [edx + 0x18]
push esi
mov dword [esp + 0x1c], eax
mov esi, edx
mov eax, dword [ecx + 0xc]
push edi
lea edi, [edx + 8]
mov dword [esp + 0x1c], eax
mov eax, dword [edx + 4]
mov dword [esp + 0xc], eax
jbe 0x6353df
mov edi, dword [edi]
xor edx, edx
push ebx
mov ebx, 0x811c9dc5
test ebp, ebp
je 0x635401
jmp 0x6353f0
movzx eax, byte [edx + edi]
inc edx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp edx, ebp
jb 0x6353f0
mov eax, dword [ecx + 0x18]
mov ecx, dword [esp + 0x20]
and eax, ebx
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [esp + 0x14], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x28], eax
mov edi, edi
mov ebx, esi
mov ebp, esi
mov esi, dword [esi]
lea ecx, [ebx + 0x20]
call fcn.00481520
lea ecx, [ebx + 8]
call fcn.00481520
push 0x38
push ebx
call fcn.00732c0f
mov eax, dword [esp + 0x20]
add esp, 8
dec dword [eax + 8]
cmp ebp, dword [esp + 0x28]
je 0x63547d
mov eax, dword [esp + 0x34]
cmp esi, eax
jne 0x635420
mov ecx, dword [esp + 0x1c]
cmp ecx, dword [esp + 0x30]
jne 0x63552c
mov ecx, dword [esp + 0x14]
pop ebx
pop edi
mov dword [ecx], esi
mov ecx, dword [esp + 8]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebp
add esp, 0x1c
ret 8
mov ecx, dword [esp + 0x1c]
cmp ecx, dword [esp + 0x30]
mov ecx, dword [esp + 0x14]
jne 0x635493
mov eax, dword [esp + 0x24]
mov dword [ecx], eax
jmp 0x635497
mov eax, dword [esp + 0x10]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x34]
cmp esi, eax
je 0x63552c
cmp dword [esi + 0x1c], 0xf
lea edx, [esi + 8]
mov ebx, dword [edx + 0x10]
jbe 0x6354b4
mov edx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
test ebx, ebx
je 0x6354d1
nop
movzx eax, byte [ecx + edx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x6354c0
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx + 0x18]
mov ecx, dword [esp + 0x20]
and eax, edi
lea eax, [ecx + eax*8]
mov dword [esp + 0x30], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x28], eax
lea esp, [esp]
mov ebx, esi
mov ebp, esi
mov esi, dword [esi]
lea ecx, [ebx + 0x20]
call fcn.00481520
lea ecx, [ebx + 8]
call fcn.00481520
push 0x38
push ebx
call fcn.00732c0f
mov ecx, dword [esp + 0x20]
add esp, 8
mov eax, dword [esp + 0x34]
dec dword [ecx + 8]
cmp ebp, dword [esp + 0x28]
je 0x63553f
cmp esi, eax
jne 0x6354f0
mov ecx, dword [esp + 0x30]
mov dword [ecx], esi
mov ecx, dword [esp + 0x10]
pop ebx
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebp
add esp, 0x1c
ret 8
mov ecx, dword [esp + 0x30]
mov ebp, dword [esp + 0x24]
mov dword [ecx], ebp
mov dword [ecx + 4], ebp
cmp esi, eax
jne 0x6354a6
mov ecx, dword [esp + 0x10]
pop ebx
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebp
add esp, 0x1c
ret 8
Function at 0x64f400
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x75a47b
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 8
push esi
push edi
mov eax, dword [0x8bb040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
push dword [ebx + 0x38]
push dword [ebx + 0x34]
push 0
push dword [ebx + 0x24]
push dword [ebx + 0x1c]
push dword [ebx + 0x18]
push dword [ebx + 0x14]
push dword [ebx + 0x10]
push dword [ebx + 0xc]
push dword [ebx + 8]
call fcn.0064e900
mov eax, dword [ebx + 0x20]
mov dword [ebp - 4], 0
mov dword [esi + 0x170], eax
xor eax, eax
mov dword [esi], 0x8897a8
mov dword [esi + 0xf8], 0x8896ec
mov dword [esi + 0x15c], getpeername
mov dword [esi + 0x160], 1
mov dword [esi + 0x164], 0
mov dword [esi + 0x168], 0x64
mov byte [esi + 0x16c], 0
mov dword [esi + 0x174], eax
mov dword [esi + 0x178], eax
mov dword [esi + 0x17c], eax
mov dword [esi + 0x180], eax
mov dword [esi + 0x184], eax
mov dword [esi + 0x188], 0xf
mov byte [esi + 0x174], al
mov byte [ebp - 4], 1
lea ecx, [esi + 0x18c]
push dword [ebx + 0x40]
mov dword [ecx], eax
push dword [ebx + 0x3c]
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
call fcn.004815d0
cmp dword [esi + 0x110], 0
mov al, byte [ebx + 0x30]
mov edi, dword [ebx + 0x28]
mov dword [esi + 0x1a4], 0
mov dword [esi + 0x1a8], edi
mov byte [esi + 0x1ac], al
mov dword [esi + 0x1b0], 0
mov dword [esi + 0x54], 0x31
mov dword [esi + 0x84], 0x10a
mov dword [esi + 0x88], 0x10a
je 0x64f584
cmp dword [esi + 0x170], 0
jne 0x64f584
cmp dword [esi + 0x114], 0xf
lea ecx, [esi + 0x100]
jbe 0x64f56f
mov ecx, dword [esi + 0x100]
push dword [esi + 0x110]
push ecx
mov ecx, dword [esi + 0x6c]
call fcn.006179e0
mov dword [esi + 0x170], eax
test edi, edi
jne 0x64f58e
mov dword [esi + 0x1a4], edi
mov eax, dword [ebx + 0xc]
mov ecx, dword [esi + 0x170]
mov eax, dword [eax + 8]
cdq
sub eax, edx
sar eax, 1
add ecx, eax
mov dword [esi + 0x1a4], eax
add ecx, dword [ebx + 0x18]
mov eax, esi
add ecx, edi
mov dword [esi + 0x48], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x3c
Function at 0x67f8f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx + 4]
test eax, eax
je 0x67f91d
push esi
lea esi, [edx + 1]
jmp 0x67f900
mov ecx, dword [eax + 0x98]
mov edx, esi
xor edx, ecx
and edx, 3
xor edx, ecx
mov dword [eax + 0x98], edx
mov eax, dword [eax + 8]
test eax, eax
jne 0x67f900
pop esi
ret
Function at 0x68bd40
Capabilities:
Create thread

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov ebp, ecx
mov ebx, edx
push 0
push 0x14
mov dword [esp + 0x1c], ebx
mov dword [ebp], 0
call fcn.00654640
mov esi, eax
add esp, 8
test esi, esi
jne 0x68bd73
lea eax, [esi + 7]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
cmp byte [0x8bbcbc], 0
je 0x68bdc0
mov eax, dword [0x8bbdb8]
test eax, eax
je 0x68bd93
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x68bdc0
mov eax, dword [esp + 0x1c]
lea edi, [esi + 8]
mov dword [edi], ebx
lea ebx, [esi + 4]
push ebx
push 0
push esi
push 0x657bf0
push 0
push 0
mov dword [esi + 0xc], eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x68bdd6
jmp 0x68bdc6
lea edi, [esi + 8]
lea ebx, [esi + 4]
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
cmp dword [edi], 0
jne 0x68bdf1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push dword [esp + 0x1c]
mov dword [ebx], eax
call dword [esp + 0x18]
add esp, 4
mov dword [esi + 0x10], eax
pop edi
mov dword [ebp], esi
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x70cc50
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x114
mov eax, dword [0x8bb040]
xor eax, esp
mov dword [esp + 0x110], eax
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x30], 0xf
lea eax, [esi + 0x1c]
jbe 0x70cc7b
mov eax, dword [esi + 0x1c]
push 0
lea ecx, [esp + 0x14]
push ecx
push 0x103
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
je 0x70ccb7
lea ecx, [esp + 0x10]
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x70cca0
sub ecx, edx
lea eax, [esp + 0x10]
push ecx
push eax
lea ecx, [esi + 0x1c]
call fcn.004833e0
cmp dword [esi + 0x30], 0xf
lea ebx, [esi + 0x1c]
jbe 0x70ccc3
mov ebx, dword [esi + 0x1c]
mov edi, dword [esi + 0x2c]
test edi, edi
jne 0x70cce5
cmp dword [0x8bc2a0], 0xf
mov eax, 0x8bc28c
mov ecx, dword [0x8bc29c]
cmova eax, dword [0x8bc28c]
jmp 0x70cd0e
push 2
push ecx
lea eax, [edi - 2]
mov edx, edi
push eax
mov ecx, ebx
call fcn.0048f210
inc eax
add esp, 0xc
cmp edi, eax
jb 0x70cda3
sub edi, eax
or ecx, 0xffffffff
add eax, ebx
cmp edi, 0xffffffff
cmovb ecx, edi
push ecx
push eax
lea ecx, [esi + 4]
call fcn.004833e0
cmp dword [esi + 0x30], 0xf
lea eax, [esi + 0x1c]
jbe 0x70cd23
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x70cd4e
mov word [esi + 0x35], 0
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0073297b
mov esp, ebp
pop ebp
ret
shr ecx, 4
and cl, 1
mov al, cl
mov byte [esi + 0x35], cl
xor al, 1
mov byte [esi + 0x36], al
test cl, cl
je 0x70cd88
cmp dword [esi + 0x2c], 0
jbe 0x70cd88
cmp dword [esi + 0x30], 0xf
lea ecx, [esi + 0x1c]
jbe 0x70cd74
mov ecx, dword [esi + 0x1c]
mov eax, dword [esi + 0x2c]
cmp byte [eax + ecx - 1], 0x5c
je 0x70cd88
lea ecx, [esi + 0x1c]
push 0x5c
call fcn.0048eba0
mov ecx, dword [esp + 0x11c]
mov al, 1
pop edi
mov byte [esi + 0x34], 0
pop esi
pop ebx
xor ecx, esp
call fcn.0073297b
mov esp, ebp
pop ebp
ret
call fcn.00488cc0
int3