joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6587dc
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd80
xor edx, edx
mov dword [ebp - 0x280], edx
mov dword [ebp - 0x27c], edx
mov dword [ebp - 0x278], edx
mov dword [ebp - 0x274], eax
lea eax, [ebp - 0x270]
mov edx, dword [0x41cb60]
call fcn.0040b634
xor eax, eax
push ebp
push 0x658998
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [ebp - 0x274]
call fcn.00425cb0
test al, al
je 0x65883a
mov eax, dword [ebp - 0x274]
call fcn.004261bc
lea edx, [ebp - 0x278]
mov eax, dword [ebp - 0x274]
call fcn.0042e2c0
lea eax, [ebp - 0x278]
mov edx, 0x6589b0
call fcn.0040b0a8
mov eax, dword [ebp - 0x278]
lea ecx, [ebp - 0x270]
mov edx, 0x1ff
call fcn.0042612c
test eax, eax
jne 0x658945
xor eax, eax
push ebp
push 0x65893e
push dword fs:[eax]
mov dword fs:[eax], esp
test byte [ebp - 0x260], 0x10
jne 0x6588bf
lea edx, [ebp - 0x27c]
mov eax, dword [ebp - 0x274]
call fcn.0042e2c0
lea eax, [ebp - 0x27c]
mov edx, dword [ebp - 0x25c]
call fcn.0040b0a8
mov eax, dword [ebp - 0x27c]
call fcn.004261bc
jmp 0x658910
mov eax, dword [ebp - 0x25c]
mov edx, 0x6589c4
call fcn.0040b298
je 0x658910
mov eax, dword [ebp - 0x25c]
mov edx, 0x6589d4
call fcn.0040b298
je 0x658910
lea edx, [ebp - 0x280]
mov eax, dword [ebp - 0x274]
call fcn.0042e2c0
lea eax, [ebp - 0x280]
mov edx, dword [ebp - 0x25c]
call fcn.0040b0a8
mov eax, dword [ebp - 0x280]
call fcn.006587dc
lea eax, [ebp - 0x270]
call fcn.0042617c
test eax, eax
je 0x658887
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x658945
lea eax, [ebp - 0x270]
call fcn.004261a0
pop eax
jmp eax
mov dl, 1
mov eax, dword [ebp - 0x274]
call fcn.00425d48
test al, al
je 0x658967
mov eax, dword [ebp - 0x274]
call fcn.0040ae9c
push eax
call sub.kernel32.dll_RemoveDirectoryW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65899f
lea eax, [ebp - 0x280]
mov edx, 3
call fcn.0040a23c
lea eax, [ebp - 0x270]
mov edx, dword [0x41cb60]
call fcn.0040ba20
pop eax
jmp eax
Function at 0x658a88
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x658be6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x71763c]
call fcn.0040db1c
mov ebx, eax
push 0xa
push 0x658bf4
push ebx
call sub.kernel32.dll_FindResourceW
mov edi, eax
test edi, edi
jne 0x658b34
mov eax, esi
call fcn.00658a20
mov eax, dword [esi]
test eax, eax
je 0x658ad7
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
dec ebx
cmp ebx, 2
jl 0x658bbb
lea eax, [ebp - 0x10]
mov edx, dword [esi]
movzx edx, word [edx + ebx*2 - 2]
call fcn.0040aebc
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
mov edx, dword [esi]
movzx edx, word [edx + ebx*2 - 2]
call fcn.0040aebc
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.004243ac
mov edx, dword [ebp - 0x14]
pop eax
call fcn.0040b298
jne 0x658b29
mov edx, esi
mov ecx, ebx
mov eax, 0x658c24
call fcn.0040b374
dec ebx
cmp ebx, 1
jne 0x658ae3
jmp 0x658bbb
push edi
push ebx
call sub.kernel32.dll_LoadResource
test eax, eax
je 0x658bb6
push eax
call sub.kernel32.dll_LockResource
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x658baf
push edi
push ebx
call sub.kernel32.dll_SizeofResource
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x404cf0]
call fcn.0040d280
add esp, 4
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov ecx, ebx
call fcn.004077e0
xor eax, eax
mov dword [ebp - 0xc], eax
call fcn.004320cc
mov ecx, eax
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004315c0
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x658b9e
sub ebx, 4
mov ebx, dword [ebx]
push ebx
push esi
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.00431f74
jmp 0x658bbb
call fcn.0042f4e8
jmp 0x658bbb
call fcn.0042f4e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x658bed
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.0040a23c
lea eax, [ebp - 4]
mov edx, dword [0x404cf0]
call fcn.0040d3a4
pop eax
jmp eax
Function at 0x65b6f4
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x65b7f1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4799b8]
call fcn.004a3ce0
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x65b7d2
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetEnvironmentStringsW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x65b7af
xor eax, eax
push ebp
push 0x65b7a8
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebp - 0xc]
jmp 0x65b789
lea eax, [ebp - 4]
mov edx, esi
call fcn.0040aefc
mov edx, dword [ebp - 4]
mov eax, 0x65b80c
call fcn.004bd714
mov ebx, eax
test bl, bl
jne 0x65b779
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, esi
call fcn.0040a700
mov edi, eax
inc edi
mov eax, edi
add eax, eax
add esi, eax
cmp word [esi], 0
jne 0x65b751
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65b7af
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FreeEnvironmentStringsW
pop eax
jmp eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65b7d9
mov eax, dword [ebp - 0x10]
call fcn.00408510
pop eax
jmp eax
Function at 0x65d650
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0x65d8c0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x71b44c
xor ecx, ecx
mov edx, 0x10
call fcn.00407e64
mov eax, dword [0x713234]
movzx eax, byte [eax]
xor al, 1
mov byte [ebp - 9], al
mov byte [ebp - 0xa], 0
cmp byte [ebp - 9], 0
jne 0x65d774
lea eax, [ebp - 0x20]
call fcn.0065d5dc
mov eax, dword [ebp - 0x20]
call fcn.0040ae9c
push eax
push 0
push 4
call sub.kernel32.dll_OpenFileMappingW
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x65d774
xor eax, eax
push ebp
push 0x65d76d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x65d754
xor eax, eax
push ebp
push 0x65d74d
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x71b44c
mov eax, dword [ebp - 8]
mov ecx, 0x10
call fcn.004077e0
cmp dword [0x71b44c], 0
je 0x65d72b
cmp dword [0x71b450], 0
je 0x65d72b
cmp dword [0x71b454], 0
je 0x65d72b
cmp dword [0x71b458], 0
jne 0x65d72f
xor eax, eax
jmp 0x65d731
mov al, 1
mov byte [ebp - 0xa], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65d754
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_UnmapViewOfFile
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65d774
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle
pop eax
jmp eax
cmp byte [ebp - 0xa], 0
jne 0x65d860
mov eax, dword [0x710af4]
call fcn.00407294
mov dword [0x710b48], eax
mov eax, 0x710b54
mov edx, dword [0x713c44]
mov edx, dword [edx]
call fcn.0040a5cc
cmp byte [ebp - 9], 0
je 0x65d860
lea eax, [ebp - 0x24]
call fcn.0065d5dc
mov eax, dword [ebp - 0x24]
call fcn.0040ae9c
push eax
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingW
mov dword [0x710b58], eax
cmp dword [0x710b58], 0
je 0x65d860
push 0
push 0
push 0
push 2
mov eax, dword [0x710b58]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x65d860
xor eax, eax
push ebp
push 0x65d859
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
xor ecx, ecx
mov edx, 0x10
call fcn.00407e64
mov dword [ebp - 0x1c], fcn.0065a0a0
mov dword [ebp - 0x18], 0x659e40
mov dword [ebp - 0x14], 0x659ff4
mov dword [ebp - 0x10], 0x65ab18
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x1c]
mov ecx, 0x10
call fcn.004077e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65d860
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_UnmapViewOfFile
pop eax
jmp eax
cmp byte [ebp - 9], 0
je 0x65d887
cmp dword [0x710b58], 0
je 0x65d87b
mov eax, 0x65d8d8
call fcn.00659e8c
jmp 0x65d8a3
mov eax, 0x65d92c
call fcn.00659e8c
jmp 0x65d8a3
cmp byte [ebp - 0xa], 0
je 0x65d899
mov eax, 0x65d988
call fcn.00659e8c
jmp 0x65d8a3
mov eax, 0x65d9dc
call fcn.00659e8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65d8c7
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.0040a23c
pop eax
jmp eax
Function at 0x66221c
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push 0
call sub.ws2_32.dll_select
test eax, eax
setg byte [ebp - 9]
cmp byte [ebp - 9], 0
je 0x6622e8
mov esi, ebx
dec esi
test esi, esi
jl 0x6622e8
inc esi
xor edi, edi
mov edx, dword [ebp - 4]
add edx, edi
mov eax, dword [ebp + 0x10]
mov eax, dword [eax - 4]
call fcn.0049f5f0
mov ebx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
push ebx
call sub.ws2_32.dll___WSAFDIsSet
test eax, eax
setne al
test al, al
je 0x6622ba
push 2
push 1
lea eax, [ebp - 0xa]
push eax
push ebx
call sub.ws2_32.dll_recv
dec eax
jne 0x6622ab
mov eax, dword [ebp + 0x10]
mov eax, dword [eax - 8]
mov edx, ebx
call fcn.0049f46c
jmp 0x6622e0
mov eax, dword [ebp + 0x10]
mov eax, dword [eax - 0xc]
mov edx, ebx
call fcn.0049f46c
jmp 0x6622e0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
push ebx
call sub.ws2_32.dll___WSAFDIsSet
test eax, eax
setne al
test al, al
je 0x6622e0
mov eax, dword [ebp + 0x10]
mov eax, dword [eax - 0xc]
mov edx, ebx
call fcn.0049f46c
inc edi
dec esi
jne 0x662260
movzx eax, byte [ebp - 9]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x662e74
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x662f3d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [esi + 0x28]
cmp eax, 0xffffffff
setne bl
test bl, bl
je 0x662f25
lea edx, [ebp - 3]
push edx
push 0
lea edx, [ebp - 2]
xor ecx, ecx
call dword [0x710b94]
test al, al
je 0x662ebd
cmp byte [ebp - 3], 0
je 0x662ec1
xor ebx, ebx
jmp 0x662ec3
mov bl, 1
test byte [ebp - 2], bl
je 0x662edd
push 2
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [esi + 0x28]
push eax
call sub.ws2_32.dll_recv
dec eax
sete bl
test bl, bl
jne 0x662f25
lea eax, [ebp - 8]
push eax
mov eax, dword [esi + 0x2c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0x11
movzx eax, word [esi + 0x10]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x18]
mov ecx, 1
mov eax, 0x662f58
call fcn.00426c18
mov edx, dword [ebp - 8]
mov ecx, 0x662f98
mov eax, 7
call fcn.0065b09c
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x662f44
lea eax, [ebp - 8]
call fcn.0040a1dc
pop eax
jmp eax
Function at 0x663ac0
Capabilities:
Set socket configuration

Disassembly:
push ebx
push ecx
mov ebx, eax
xor eax, eax
mov dword [ebx + 0x34], eax
mov eax, dword [ebx + 0x30]
call fcn.004072b0
xor eax, eax
mov dword [ebx + 0x30], eax
mov eax, dword [ebx + 0x28]
cmp eax, 0xffffffff
je 0x663b1b
cmp byte [ebx + 0x14], 0
je 0x663b0c
mov word [esp], 1
movzx edx, word [ebx + 0x16]
mov word [esp + 2], dx
push 4
lea edx, [esp + 4]
push edx
push 0x80
push 0xffff
push eax
call sub.ws2_32.dll_setsockopt
jmp 0x663b14
push 2
push eax
call sub.ws2_32.dll_shutdown
mov eax, ebx
call fcn.00662fd4
pop edx
pop ebx
ret

Function at 0x663b20
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov esi, eax
xor eax, eax
push ebp
push 0x663c09
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [esi + 0x34], 0
jbe 0x663b4a
mov bl, 1
jmp 0x663bf1
mov eax, dword [esi + 0x28]
cmp eax, 0xffffffff
jne 0x663b59
xor ebx, ebx
jmp 0x663bf1
xor ebx, ebx
mov byte [ebp - 2], 0
lea ecx, [ebp - 4]
push ecx
push edx
lea edx, [ebp - 3]
xor ecx, ecx
call dword [0x710b94]
test al, al
je 0x663ba1
cmp byte [ebp - 4], 0
jne 0x663ba1
cmp byte [ebp - 3], 0
je 0x663b9d
push 2
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [esi + 0x28]
push eax
call sub.ws2_32.dll_recv
dec eax
jne 0x663b97
mov bl, 1
jmp 0x663ba5
mov byte [ebp - 2], 1
jmp 0x663ba5
xor ebx, ebx
jmp 0x663ba5
mov byte [ebp - 2], 1
cmp byte [ebp - 2], 0
je 0x663bf1
lea eax, [ebp - 8]
push eax
mov eax, dword [esi + 0x2c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0x11
movzx eax, word [esi + 0x10]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x18]
mov ecx, 1
mov eax, 0x663c24
call fcn.00426c18
mov edx, dword [ebp - 8]
mov ecx, 0x663c64
mov eax, 7
call fcn.0065b09c
xor ebx, ebx
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x663c10
lea eax, [ebp - 8]
call fcn.0040a1dc
pop eax
jmp eax
Function at 0x663d60
Capabilities:
Send data
Send data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x663f11
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x18]
test al, al
je 0x663ef9
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], 4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x1001
push 0xffff
mov eax, dword [esi + 0x28]
push eax
call sub.ws2_32.dll_getsockopt
test eax, eax
jne 0x663ee1
cmp edi, dword [ebp - 0x10]
jle 0x663ee1
mov dword [ebp - 0x10], edi
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x1001
push 0xffff
mov eax, dword [esi + 0x28]
push eax
call sub.ws2_32.dll_setsockopt
jmp 0x663ee1
mov byte [ebp - 0x15], 0
mov byte [ebp - 0x16], 0
mov eax, dword [esi + 0x28]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x16]
push eax
push 0x5dc
lea ecx, [ebp - 0x15]
xor edx, edx
mov eax, dword [ebp - 0x1c]
call dword [0x710b94]
mov byte [ebp - 0x1d], al
movzx ebx, byte [ebp - 0x1d]
test byte [ebp - 0x15], bl
je 0x663e72
cmp byte [ebp - 0x16], 0
jne 0x663e72
push 0
push edi
mov eax, dword [ebp - 4]
push eax
mov eax, dword [esi + 0x28]
push eax
call sub.ws2_32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x663e54
sub edi, dword [ebp - 8]
mov eax, dword [ebp - 8]
add dword [ebp - 4], eax
mov eax, dword [ebp - 8]
cdq
add dword [esi + 0x38], eax
adc dword [esi + 0x3c], edx
jmp 0x663e87
cmp dword [ebp - 8], 0
jge 0x663e63
mov dword [ebp - 0xc], 0xb
jmp 0x663e87
inc dword [ebp - 0xc]
push 0x5dc
call sub.kernel32.dll_Sleep
jmp 0x663e87
xor bl, 1
or bl, byte [ebp - 0x16]
je 0x663e7d
inc dword [ebp - 0xc]
push 0x5dc
call sub.kernel32.dll_Sleep
cmp dword [ebp - 0xc], 0xa
jle 0x663ee1
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0
lea eax, [ebp - 0x28]
push eax
push 0
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [esi + 0x2c]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0x11
movzx eax, word [esi + 0x10]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0
lea edx, [ebp - 0x3c]
mov ecx, 1
mov eax, 0x663f30
call fcn.00426c18
mov edx, dword [ebp - 0x2c]
mov ecx, 0x663f70
mov eax, 7
call fcn.0065b0b4
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x10]
test edi, edi
jle 0x663ef4
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x18]
test al, al
jne 0x663def
test edi, edi
setle bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x663f18
lea eax, [ebp - 0x2c]
call fcn.0040a1dc
pop eax
jmp eax
Function at 0x689e48
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x71b890], 0
jne 0x689e5f
call fcn.00689e04
mov eax, edi
dec eax
test eax, eax
jl 0x689e87
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x71b490]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x689e69
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x68cf04
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x68cf35
dec al
je 0x68cf70
dec al
je 0x68cfb4
dec al
je 0x68d026
jmp 0x68d0c1
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x68d0c1
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x68cf45
jmp 0x68d0c1
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x68d0c1
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
movzx ecx, al
mov ecx, dword [ebx + ecx*4 + 0x40]
add dl, byte [ecx + esi]
and dl, 0xff
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x68cf80
jmp 0x68d0c1
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x68d0c1
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
jbe 0x68cfe7
xor edx, edx
mov dword [esp + 4], edx
jmp 0x68cffc
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov ebp, dword [ebx + edx*4 + 0x40]
movzx edx, byte [ebp + esi]
add eax, dword [esp + 4]
sar eax, 1
jns 0x68d014
adc eax, 0
add dl, al
and dl, 0xff
mov byte [ebp + esi], dl
inc esi
dec edi
jne 0x68cfc4
jmp 0x68d0c1
xor eax, eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x68d0c1
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
ja 0x68d08d
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 8], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 8]
push eax
movzx eax, byte [esp + 8]
pop edx
call fcn.00689e90
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [esp]
and al, 0xff
mov byte [edx + esi], al
inc esi
dec edi
jne 0x68d042
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x697e64
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x697eb5
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x697e9c
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x697e8c
jmp 0x697eb5
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x697e9d
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6abc60
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x6abc8e
mov eax, ebx
call fcn.006ac71c
cmp dword [ebx + 0x40], 0
je 0x6abc87
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x6abcff
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x6abcf1
cmp dword [ebx + 8], 0
je 0x6abcb0
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x6abcc2
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x6abcf1
cmp dword [ebx + 8], 0
je 0x6abca3
cmp eax, 3
je 0x6abcd5
dec eax
jne 0x6abca3
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x6abca3
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x6abca3
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x6abd1d
cmp dword [ebx + 0x14], 0xcc
je 0x6abd1d
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.006abd28
pop ebx
ret
Function at 0x6c96cc
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
cmp byte [eax + 0xc0], 0
je 0x6c9706
lea eax, [ebp - 0x10]
push eax
call sub.kernel32.dll_QueryPerformanceCounter
test eax, eax
jne 0x6c9706
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
xor edx, edx
push ebp
push 0x6c97f5
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.006c941c
mov eax, dword [eax + 8]
mov edi, dword [eax + 8]
dec edi
test edi, edi
jl 0x6c977d
inc edi
xor esi, esi
mov eax, dword [ebp - 4]
call fcn.006c941c
mov ebx, eax
mov eax, dword [ebx + 8]
mov edx, esi
call fcn.0049f5f0
mov ebx, eax
mov eax, dword [ebx + 0x10]
mov eax, dword [eax + 0x14]
call fcn.0049f744
cmp ebx, eax
sete al
test al, al
je 0x6c9779
mov eax, dword [ebp - 4]
call fcn.006c941c
mov ebx, eax
mov eax, dword [ebx + 8]
mov edx, esi
call fcn.0049f5f0
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 4]
call fcn.006c91ec
mov byte [ebp - 5], 1
jmp 0x6c977d
inc esi
dec edi
jne 0x6c972a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6c97fc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
cmp byte [eax + 0xc0], 0
je 0x6c97f2
lea eax, [ebp - 0x18]
push eax
call sub.kernel32.dll_QueryPerformanceCounter
test eax, eax
jne 0x6c97b4
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0xc], 0
jne 0x6c97be
cmp dword [ebp - 0x10], 0
je 0x6c97f2
cmp dword [ebp - 0x14], 0
jne 0x6c97ca
cmp dword [ebp - 0x18], 0
je 0x6c97f2
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
sub eax, dword [ebp - 0x10]
sbb edx, dword [ebp - 0xc]
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov edx, dword [eax + 0x40]
mov ecx, 0x6c9814
mov eax, dword [0x6c72d4]
call fcn.006d2dbc
pop eax
jmp eax