joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40580e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x421890
push esi
call fcn.00405c42
push esi
call fcn.004057bf
mov edi, eax
test edi, edi
jne 0x40582f
xor eax, eax
jmp 0x405881
push edi
call fcn.00405ece
test byte [0x423e98], 0x80
je 0x405848
mov al, byte [edi]
test al, al
je 0x40582b
cmp al, 0x5c
je 0x40582b
sub edi, esi
push esi
call fcn.00405c58
cmp eax, edi
push esi
jle 0x40586b
call fcn.00405f67
test eax, eax
je 0x405863
test byte [eax], 0x10
je 0x40582b
push esi
call fcn.00405772
jmp 0x40584a
call fcn.0040572b
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x4058f8
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x405914
and al, 0xfe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret 4

Function at 0x405917
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x405946
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x63
pop edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x40598b
mov eax, edi
dec edi
test eax, eax
jne 0x405951
and byte [esi], al
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x405985
Function at 0x40598f
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 1
call fcn.00405f8e
test eax, eax
mov esi, dword [esp + 0x18]
je 0x4059b3
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x405aec
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x422618], 0x4c554e
test esi, esi
mov edi, 0x400
mov ebp, 0x422618
je 0x4059f7
push 1
push 0
push esi
call fcn.00405917
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x405af2
cmp eax, edi
jg 0x405af2
mov esi, 0x422090
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x405af2
cmp eax, edi
jg 0x405af2
push esi
push ebp
push str._s_s_r_n
push 0x421c90
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x423e90]
add esp, 0x10
push dword [eax + 0x128]
push esi
call fcn.00405c76
push 4
push 0xc0000000
push esi
call fcn.00405917
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x14], ebp
je 0x405aec
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x405ae5
lea eax, [esp + 0x18]
push 0
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x405ae5
cmp edi, dword [esp + 0x18]
jne 0x405ae5
push str._Rename__r_n
push esi
call fcn.00405886
test eax, eax
jne 0x405af9
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call fcn.00405c42
add edi, 0xa
mov eax, edi
push ebx
add eax, esi
push 0x421c90
push eax
call fcn.004058d2
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0x18]
push 0
add edi, ebx
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x423f10]
pop edi
pop esi
pop ebp
pop ebx
ret 8
add eax, 0xa
push 0x409348
push eax
call fcn.00405886
test eax, eax
je 0x405ab0
inc eax
lea ecx, [esi + edi]
cmp eax, ecx
mov ebp, eax
jae 0x405b20
mov dl, byte [ebp]
mov byte [ebx + ebp], dl
inc ebp
cmp ebp, ecx
jb 0x405b15
mov ebp, dword [esp + 0x14]
sub eax, esi
jmp 0x405ab2
Function at 0x405b28
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0x18]
push esi
push eax
mov eax, dword [ebp + 0x18]
xor ebx, ebx
neg eax
sbb eax, eax
mov esi, dword [ebp + 0x14]
and eax, 0x100
or eax, 0x20019
mov byte [esi], bl
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405b99
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0x400
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405b88
cmp dword [ebp + 0x14], 1
je 0x405b8a
cmp dword [ebp + 0x14], 2
je 0x405b8a
mov byte [esi], bl
push dword [ebp + 0x18]
mov byte [esi + 0x3ff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x406004
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp dword [0x422a1c], esi
push edi
jne 0x40603e
mov ecx, 0x422a18
push 8
mov eax, esi
pop edi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x40601a
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x422e18
jl 0x406015
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
jbe 0x406073
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a18]
xor eax, esi
inc ecx
dec edx
jne 0x406056
pop edi
pop esi
not eax
ret 0xc
Function at 0x6eff19a0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x6eff19b5
xor eax, eax
jmp 0x6eff1a2a
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
add edx, 0x10000
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
jmp 0x6eff19e2
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x38d
jae 0x6eff1a25
mov edx, dword [ebp - 4]
imul edx, edx, 0x48
mov eax, dword [ebp - 8]
cmp dword [eax + edx + 0x40], 0
je 0x6eff1a23
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0xc]
jb 0x6eff1a1f
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0x10]
jb 0x6eff1a23
xor eax, eax
jmp 0x6eff1a2a
jmp 0x6eff19d9
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x6eff62d0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, 4
shl eax, 0
mov ecx, dword [ebp - 4]
mov dword [ecx + eax + 0x10], 0
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp - 4]
mov dword [ecx + eax + 0x10], 0
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp - 4]
mov dword [ecx + eax], 0x67452301
mov edx, 4
shl edx, 0
mov eax, dword [ebp - 4]
mov dword [eax + edx], 0xefcdab89
mov ecx, 4
shl ecx, 1
mov edx, dword [ebp - 4]
mov dword [edx + ecx], 0x98badcfe
mov eax, 4
imul ecx, eax, 3
mov edx, dword [ebp - 4]
mov dword [edx + ecx], 0x10325476
mov esp, ebp
pop ebp
ret
Function at 0x6eff6350
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10093220]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], 0
jmp 0x6eff6376
mov eax, dword [ebp - 0x28]
add eax, 1
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jae 0x6eff6392
push 4
push 0
mov ecx, dword [ebp - 0x28]
lea edx, [ebp + ecx*4 - 0x14]
push edx
call fcn.6f018c00
add esp, 0xc
jmp 0x6eff636d
mov dword [ebp - 0x18], 0
jmp 0x6eff63a4
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jae 0x6eff6429
mov dword [ebp - 0x20], 0
jmp 0x6eff63bc
mov ecx, dword [ebp - 0x20]
add ecx, 1
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], 4
jae 0x6eff6424
mov dword [ebp - 0x1c], 0
jmp 0x6eff63d4
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 4
jae 0x6eff6422
mov eax, dword [ebp - 0x18]
lea ecx, [ebp + eax*4 - 0x14]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
movzx edx, byte [edx + eax*4 + 0x1006d530]
shl edx, 8
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp + 8]
lea eax, [esi + eax*4]
mov esi, dword [ebp - 0x1c]
movzx eax, byte [eax + esi]
movzx edx, byte [edx + eax + 0x1006c620]
mov eax, dword [ebp - 0x1c]
movzx ecx, byte [ecx + eax]
xor ecx, edx
mov edx, dword [ebp - 0x18]
lea eax, [ebp + edx*4 - 0x14]
mov edx, dword [ebp - 0x1c]
mov byte [eax + edx], cl
jmp 0x6eff63cb
jmp 0x6eff63b3
jmp 0x6eff639b
mov dword [ebp - 0x24], 0
jmp 0x6eff643b
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jae 0x6eff645f
push 4
mov ecx, dword [ebp - 0x24]
lea edx, [ebp + ecx*4 - 0x14]
push edx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax*4]
push edx
call fcn.6f018100
add esp, 0xc
jmp 0x6eff6432
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.6f017080
mov esp, ebp
pop ebp
ret 4
Function at 0x6f000ce0
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x28]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x2c], 0
ja 0x6f000d0b
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 0x28], 0x10
jb 0x6f000d7e
push 1
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax]
push edx
call fcn.6f000f90
add esp, 8
mov esi, eax
push 7
mov eax, 4
shl eax, 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax]
push edx
call fcn.6f000f90
add esp, 8
add esi, eax
push 0xc
mov eax, 4
shl eax, 1
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax]
push edx
call fcn.6f000f90
add esp, 8
add esi, eax
push 0x12
mov eax, 4
imul ecx, eax, 3
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx]
push eax
call fcn.6f000f90
add esp, 8
add eax, dword [ebp - 4]
add eax, esi
mov dword [ebp - 4], eax
jmp 0x6f000d98
mov ecx, 4
shl ecx, 1
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax + 0x165667b1]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
add eax, 0x10
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
add edx, dword [ecx + 0x20]
mov dword [ebp - 0x14], edx
jmp 0x6f000db8
mov eax, dword [ebp - 0xc]
add eax, 4
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
add ecx, 4
cmp ecx, dword [ebp - 0x14]
ja 0x6f000de5
push 0x11
mov edx, dword [ebp - 0xc]
imul eax, dword [edx], 0xc2b2ae3d
add eax, dword [ebp - 4]
push eax
call fcn.6f000f90
add esp, 8
imul ecx, eax, 0x27d4eb2f
mov dword [ebp - 4], ecx
jmp 0x6f000daf
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 0x14]
je 0x6f000e21
mov eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
imul edx, ecx, 0x165667b1
add edx, dword [ebp - 4]
mov dword [ebp - 0x18], edx
push 0xb
mov eax, dword [ebp - 0x18]
push eax
call fcn.6f000f90
add esp, 8
imul ecx, eax, 0x9e3779b1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
jmp 0x6f000de5
mov eax, dword [ebp - 4]
shr eax, 0xf
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
imul ecx, dword [ebp - 4], 0x85ebca77
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
shr edx, 0xd
xor edx, dword [ebp - 4]
mov dword [ebp - 4], edx
imul eax, dword [ebp - 4], 0xc2b2ae3d
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shr ecx, 0x10
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x6f003890
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.6f00ff90
add esp, 8
movzx ecx, ax
mov dword [ebp - 0x18], ecx
push 2
mov edx, dword [ebp + 8]
push edx
call fcn.6f00ff90
add esp, 8
movzx eax, ax
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0x464
jg 0x6f0038fb
cmp dword [ebp - 8], 0x464
je 0x6f003916
cmp dword [ebp - 8], 0x3f1
je 0x6f0039cd
cmp dword [ebp - 8], 0x41c
je 0x6f003a3a
jmp 0x6f003b2f
cmp dword [ebp - 8], 0x606
je 0x6f003916
cmp dword [ebp - 8], 0x271a
je 0x6f003a9f
jmp 0x6f003b2f
mov edx, dword [0x1009571c]
mov dword [edx + 0x8c], 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.6f00a280
add esp, 8
movzx edx, al
test edx, edx
je 0x6f0039c8
mov dword [0x100930a8], 0xffffff9d
mov dword [0x100930ac], 0xffffff9d
mov dword [0x1009572c], 0
mov dword [0x10095730], 0
mov dword [0x10095734], 0
mov dword [0x10095738], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x84], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x78], 0
mov edx, dword [ebp - 4]
mov byte [edx + 0xc9], 0
mov dword [0x10095750], 0
push 0x14
push 0
push 0x10095704
call fcn.6f018c00
add esp, 0xc
call fcn.6f0036a0
mov dword [0x10095748], 1
jmp 0x6f003b2f
push 0xc
mov eax, dword [ebp + 8]
push eax
call fcn.6f00ff90
add esp, 8
movzx ecx, ax
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0x1b
je 0x6f0039e9
jmp 0x6f003a35
mov edx, dword [ebp + 8]
push edx
push 0x30
mov eax, dword [0x1009571c]
movzx ecx, byte [eax + 0xec]
push ecx
call fcn.6f00ffb0
add esp, 0xc
mov edx, 1
mov eax, dword [0x1009571c]
mov word [eax + 0xec], dx
mov ecx, dword [0x1009571c]
mov dword [ecx + 0x7c], 0
mov edx, dword [ebp - 4]
cmp dword [edx + 0x88], 0
je 0x6f003a35
push 0
call fcn.6f026aa0
jmp 0x6f003b2f
mov ebx, ebx
mov esi, esi
mov eax, eax
mov eax, eax
mov ebx, ebx
mov ebp, ebp
mov edx, edx
mov eax, eax
mov ebp, ebp
movzx eax, byte [0x10ee3a84]
test eax, eax
je 0x6f003a69
mov ecx, dword [0x100941cc]
call fcn.6eff8ad0
movzx ecx, al
test ecx, ecx
je 0x6f003a78
push 0
call dword [0x1006c148]
push 0
call fcn.6f026aa0
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.6f00f410
add esp, 8
mov edx, edx
mov edx, edx
mov edi, edi
mov ebp, ebp
mov esi, esi
mov esi, esi
mov edi, edi
mov eax, eax
mov ebp, ebp
jmp 0x6f003b2f
push 0x14
mov ecx, dword [ebp + 8]
push ecx
call fcn.6f00fe60
add esp, 8
mov byte [ebp - 0xc], al
cmp byte [ebp - 0xc], 0x5e
je 0x6f003b15
cmp byte [ebp - 0xc], 0xfb
je 0x6f003abe
jmp 0x6f003b2f
mov edx, dword [ebp - 4]
mov dword [edx + 0x88], 0
push 0x1006f453
mov ecx, dword [ebp - 4]
add ecx, 0x54
call fcn.6effa480
mov eax, 1
mov ecx, dword [ebp - 4]
mov word [ecx + 0xec], ax
mov edx, dword [ebp - 4]
mov dword [edx + 0x8c], 1
mov ecx, dword [0x10ee39b0]
call fcn.6f0080b0
call fcn.6f010c20
add eax, 1
mov ecx, dword [0x100956f0]
mov dword [ecx + 0x44], eax
jmp 0x6f003b2f
mov edx, dword [ebp - 4]
mov dword [edx + 0x94], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x88], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x6f0084e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x10093220]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x38], 0
je 0x6f008507
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x6f00850e
mov al, 1
jmp 0x6f0085e2
call fcn.6eff86d0
push eax
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x3c], eax
call fcn.6eff86d0
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.6effbe40
add esp, 8
movzx eax, al
test eax, eax
je 0x6f00854a
xor al, al
jmp 0x6f0085e2
mov dword [ebp - 0x48], 0x20
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x2c]
add ecx, 0x40
push ecx
mov edx, dword [ebp - 0x2c]
mov ecx, dword [edx + 0x38]
call fcn.6f009c00
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x6f008586
cmp dword [ebp - 0x30], 1
je 0x6f00858d
cmp dword [ebp - 0x30], 3
je 0x6f0085dc
jmp 0x6f0085e0
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0x3d], 0
mov ecx, dword [ebp - 0x44]
lea edx, [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0x34], ecx
je 0x6f0085bc
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x34]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.6f035490
add esp, 0x10
cmp dword [ebp - 0x34], eax
je 0x6f0085bc
xor al, al
jmp 0x6f0085e2
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x6f0085d0
mov dword [ebp - 0x38], 1
jmp 0x6f0085d7
mov dword [ebp - 0x38], 0
mov al, byte [ebp - 0x38]
jmp 0x6f0085e2
mov al, 1
jmp 0x6f0085e2
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.6f017080
mov esp, ebp
pop ebp
ret
Function at 0x6f00cd30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov dword [0x10ee3a18], eax
push 0x100708f0
call fcn.6f00ef10
add esp, 4
mov dword [0x10ee39f0], eax
push 0x100708fc
call fcn.6f00ef10
add esp, 4
mov dword [0x10ee39f4], eax
push 0x10070908
call fcn.6f00ef10
add esp, 4
mov dword [0x10ee39f8], eax
mov ecx, dword [0x10ee39f0]
push ecx
call dword [0x1006c040]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x6f00cd94
push 0
call fcn.6f026aa0
push 0x10070918
call fcn.6f00ef10
add esp, 4
push eax
mov edx, dword [ebp - 4]
push edx
call dword [0x1006c150]
mov dword [0x10ee3a04], eax
push 0x1007092c
call fcn.6f00ef10
add esp, 4
push eax
mov eax, dword [ebp - 4]
push eax
call dword [0x1006c150]
mov dword [0x10ee39fc], eax
push 0x10070940
call fcn.6f00ef10
add esp, 4
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [0x1006c150]
mov dword [0x10ee3a00], eax
push 0x10070950
call fcn.6f00ef10
add esp, 4
push eax
mov edx, dword [ebp - 4]
push edx
call dword [0x1006c150]
mov dword [0x10ee3a08], eax
push 0x10070960
call fcn.6f00ef10
add esp, 4
push eax
mov eax, dword [ebp - 4]
push eax
call dword [0x1006c150]
mov dword [0x10ee3a0c], eax
push 0x10070974
call fcn.6f00ef10
add esp, 4
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [0x1006c150]
mov dword [0x10ee3a10], eax
push 0x1007098c
call fcn.6f00ef10
add esp, 4
push eax
mov edx, dword [ebp - 4]
push edx
call dword [0x1006c150]
mov dword [0x10ee3a1c], eax
push 6
push 0x10020380
mov eax, dword [0x10ee39fc]
push eax
call fcn.6f00fc80
add esp, 0xc
push 0
push 0
push 0
push 0x1001d040
push 0
push 0
call fcn.6f00f890
cmp dword [0x100941cc], 0
je 0x6f00cf19
cmp dword [0x100941d0], 0
je 0x6f00cf19
push 0x100709a8
call fcn.6f00ef10
add esp, 4
push eax
mov ecx, dword [0x10ee39f8]
push ecx
call dword [0x1006c040]
push eax
call dword [0x1006c150]
mov dword [0x10ee3a20], eax
call fcn.6eff2180
call dword [0x1006c144]
push eax
call fcn.6eff2660
push 0x1001d130
push 0x10ee3a20
call fcn.6eff1c30
call fcn.6eff21f0
test eax, eax
je 0x6f00cf19
push 0
call dword [0x1006c03c]
push 0
push 0
push 0x100709c0
call fcn.6f00ef10
add esp, 4
push eax
call dword [0x1006c238]
push eax
call fcn.6f00f8f0
call fcn.6f010380
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x6f00f9a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
cmp dword [0x100956f0], 0
je 0x6f00fa2c
mov eax, dword [0x100956f0]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0x2c]
jb 0x6f00f9fc
mov edx, dword [0x100956f0]
mov eax, dword [ebp + 8]
cmp eax, dword [edx + 0x30]
ja 0x6f00f9fc
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 4], esp
push 0x10070dc0
call fcn.6f00ef10
add esp, 4
push eax
mov ecx, esi
call fcn.6eff4990
push 0x10
mov ecx, dword [0x10ee39b0]
call fcn.6f007e60
mov eax, 1
jmp 0x6f00fa5c
movzx ecx, byte [0x10ee3a85]
cmp ecx, 1
jne 0x6f00fa2c
mov edx, dword [ebp + 8]
cmp edx, dword [0x10ee3a74]
je 0x6f00fa1e
mov eax, dword [ebp + 8]
cmp eax, dword [0x10ee3a78]
jne 0x6f00fa2c
push 0
call fcn.6f026aa0
mov eax, 1
jmp 0x6f00fa5c
mov ecx, dword [ebp + 8]
cmp ecx, dword [0x1006c290]
je 0x6f00fa42
mov edx, dword [ebp + 8]
cmp edx, dword [0x1006c28c]
jne 0x6f00fa46
xor eax, eax
jmp 0x6f00fa5c
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [0x10ee3b2c]
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x6f013f90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x10093220]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x408], ecx
mov ecx, dword [ebp - 0x408]
call fcn.6eff62d0
push 0x10071b58
mov eax, dword [ebp + 8]
push eax
call fcn.6f036440
add esp, 8
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 0
jne 0x6f013fdd
mov eax, 0x10071b5c
jmp 0x6f014047
mov ecx, dword [ebp - 0x40c]
push ecx
push 0x400
push 1
lea edx, [ebp - 0x404]
push edx
call fcn.6f034570
add esp, 0x10
mov dword [ebp - 0x410], eax
cmp dword [ebp - 0x410], 0
je 0x6f014024
mov eax, dword [ebp - 0x410]
push eax
lea ecx, [ebp - 0x404]
push ecx
mov ecx, dword [ebp - 0x408]
call fcn.6effed20
jmp 0x6f013fdd
mov ecx, dword [ebp - 0x408]
call fcn.6effdab0
mov edx, dword [ebp - 0x40c]
push edx
call fcn.6f033100
add esp, 4
mov eax, dword [ebp - 0x408]
add eax, 0x68
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.6f017080
mov esp, ebp
pop ebp
ret 4
Function at 0x6f04de07
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp 0x6f059790
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x40
cmp dword [0x10ee4238], 1
jge 0x6f0597ff
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
je 0x6f0597d5
mov edx, dword [ebx + 8]
movzx eax, word [edx]
movzx ecx, word [ebx + 0xc]
cmp eax, ecx
je 0x6f0597d5
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x6f0597b2
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x6f0597eb
mov eax, dword [ebx + 8]
mov dword [ebp - 4], eax
jmp 0x6f0597f2
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
jmp 0x6f0598ef
movzx ecx, word [ebx + 0xc]
movd xmm0, ecx
movaps xmmword [ebp - 0x30], xmm0
pshuflw xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
pshufd xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
mov edx, dword [ebx + 8]
and edx, 0xfff
cmp edx, 0xff0
ja 0x6f0598c0
mov eax, dword [ebx + 8]
movups xmm0, xmmword [eax]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pxor xmm0, xmmword [ebp - 0x20]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pcmpeqw xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x40]
pcmpeqw xmm0, xmmword [ebp - 0x30]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
por xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pmovmskb ecx, xmm0
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x6f0598b5
bsf edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebx + 8]
mov dword [ebx + 8], eax
mov ecx, dword [ebx + 8]
movzx edx, word [ecx]
movzx eax, word [ebx + 0xc]
cmp edx, eax
jne 0x6f0598a9
mov ecx, dword [ebx + 8]
mov dword [ebp - 0xc], ecx
jmp 0x6f0598b0
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
jmp 0x6f0598ef
mov edx, dword [ebx + 8]
add edx, 0x10
mov dword [ebx + 8], edx
jmp 0x6f0598ea
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x6f0598d3
mov eax, dword [ebx + 8]
jmp 0x6f0598ef
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x6f0598e1
xor eax, eax
jmp 0x6f0598ef
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x6f05981f
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret