joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405af4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.004039e0
mov eax, dword [ebp - 8]
call fcn.004039e0
mov eax, dword [ebp + 0xc]
call fcn.004039e0
xor eax, eax
push ebp
push 0x405bd6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, dword [ebp + 0xc]
call fcn.00403768
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 4]
call fcn.004039f0
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x405bb3
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.004039f0
mov esi, eax
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x405baa
mov eax, ebx
mov edx, dword [ebp - 0x14]
call fcn.00403b20
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebx]
call fcn.004039f0
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov edx, dword [ebp - 0x14]
dec edx
mov eax, ebx
call fcn.00403b20
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405bdd
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403738
lea eax, [ebp + 0xc]
call fcn.00403714
ret

Function at 0x406660
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4066de
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x40
push 0x3000
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403834
mov eax, dword [ebp - 8]
call fcn.0040387c
inc eax
push eax
push 0
push esi
call sub.kernel32.dll_VirtualAllocEx
mov edi, eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00403834
mov eax, dword [ebp - 0xc]
call fcn.0040387c
inc eax
push eax
push ebx
push edi
push esi
call sub.kernel32.dll_WriteProcessMemory
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4066e5
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403738
ret

Function at 0x4066f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov esi, ecx
mov ebp, edx
mov ebx, eax
push 0x40
push 0x3000
push esi
push 0
push ebx
call sub.kernel32.dll_VirtualAllocEx
mov edi, eax
push esp
push esi
push ebp
push edi
push ebx
call sub.kernel32.dll_WriteProcessMemory
mov eax, edi
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x406720
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004066f0
mov esi, eax
mov eax, edi
call fcn.00406650
mov ecx, eax
mov edx, edi
mov eax, ebx
call fcn.004066f0
lea edx, [ebp - 0xc]
push edx
push 0
push esi
push eax
push 0
push 0
push ebx
call sub.kernel32.dll_CreateRemoteThread
mov edi, eax
cmp byte [ebp + 8], 0
je 0x406786
push 0xffffffffffffffff
push edi
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push ebx
call sub.kernel32.dll_ReadProcessMemory
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x406b0c
Capabilities:
Inspect section memory permissions

Disassembly:
xor edx, edx
test eax, 0x4000000
je 0x406b1b
or edx, 0x200
test eax, 0x20000000
je 0x406b4f
test eax, 0x40000000
je 0x406b3a
test eax, 0x80000000
je 0x406b35
or edx, 0x40
jmp 0x406b76
or edx, 0x20
jmp 0x406b76
test eax, 0x80000000
je 0x406b49
or edx, 0x80
jmp 0x406b76
or edx, 0x10
mov eax, edx
ret
test eax, 0x40000000
je 0x406b67
test eax, 0x80000000
je 0x406b62
or edx, 4
jmp 0x406b76
or edx, 2
jmp 0x406b76
test eax, 0x80000000
je 0x406b73
or edx, 8
jmp 0x406b76
or edx, 1
mov eax, edx
ret

Function at 0x406f68
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
mov edx, dword [0x406630]
call fcn.00403c0c
xor eax, eax
push ebp
push 0x407079
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edi, eax
mov esi, 0x10000000
add esi, 0x10000
push 0x40
push 0x3000
mov eax, dword [edi + 0x50]
push eax
mov eax, dword [edi + 0x34]
add eax, esi
push eax
call sub.kernel32.dll_VirtualAlloc_1
mov ebx, eax
test ebx, ebx
je 0x407001
push 0x8000
push 0
push ebx
call sub.kernel32.dll_VirtualFree_1
push 0x40
push 0x3000
mov eax, dword [edi + 0x50]
push eax
mov eax, dword [edi + 0x34]
add eax, esi
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualAllocEx
mov ebx, eax
test ebx, ebx
jne 0x40700d
cmp esi, 0x30000000
jbe 0x406fb6
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 8]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00406d34
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x40705d
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x10], edx
lea edx, [ebp - 0x18]
push edx
mov edx, dword [ebp - 0x28]
push edx
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_WriteProcessMemory
push 8
push 0
lea ecx, [ebp - 0x14]
mov edx, 0x406f40
mov eax, dword [ebp - 4]
call fcn.00406720
test eax, eax
je 0x40705d
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407080
lea eax, [ebp - 0x2c]
mov edx, dword [0x406630]
call fcn.00403cd0
ret
Function at 0x407120
Capabilities:
Reference the vmware io port

Disassembly:
xor eax, eax
push 0x407148
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x564d5868
mov ebx, 0x3c6cf712
mov ecx, 0xa
mov dx, 0x5658
in eax, dx
mov eax, 1
jmp 0x40715b
xor ebx, ebx
pop dword fs:[ebx]
add esp, 4
ret

Function at 0x407164
Capabilities:
Check for vm using instruction vpcext

Disassembly:
push ebp
mov ecx, 0x4071ae
mov ebp, esp
push ebx
push ecx
push dword fs:[0]
mov dword fs:[0], esp
mov ebx, 0
mov eax, 1
invalid

Function at 0x4072e8
Capabilities:
Check for sandbox and av modules
Query or enumerate registry value

Disassembly:
push ebx
add esp, 0xfffffef4
xor ebx, ebx
push 0x407390
call sub.kernel32.dll_GetModuleHandleA_1
test eax, eax
je 0x407301
mov bl, 1
push 0x40739c
call sub.kernel32.dll_GetModuleHandleA_1
test eax, eax
je 0x407311
mov bl, 1
push esp
push 1
push 0
push 0x4073a8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x407386
mov dword [esp + 4], 0x101
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x4073d4
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
lea eax, [esp + 8]
cmp eax, 0x4073e0
jne 0x40735d
mov bl, 1
jmp 0x40737d
lea eax, [esp + 8]
cmp eax, 0x4073f8
jne 0x40736c
mov bl, 1
jmp 0x40737d
lea eax, [esp + 8]
cmp eax, 0x407410
jne 0x40737b
mov bl, 1
jmp 0x40737d
xor ebx, ebx
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
add esp, 0x10c
pop ebx
ret

Function at 0x40757c
Capabilities:
Query service status
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.004039e0
xor eax, eax
push ebp
push 0x407662
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403714
xor eax, eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x10], eax
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
test ebx, ebx
jbe 0x407642
cmp dword [ebp - 0xc], 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x4075de
mov edi, 0x10
jmp 0x4075e3
mov edi, 0x20
or edi, 4
push edi
mov eax, dword [ebp - 4]
call fcn.004039f0
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov edi, eax
test edi, edi
jbe 0x40763c
cmp dword [ebp - 8], 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x40762c
cmp dword [ebp - 0xc], 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x407620
lea eax, [ebp - 0x10]
push eax
push 0
push edi
call sub.advapi32.dll_StartServiceA
jmp 0x40762c
lea eax, [ebp - 0x2c]
push eax
push 1
push edi
call sub.advapi32.dll_ControlService
lea eax, [ebp - 0x2c]
push eax
push edi
call sub.advapi32.dll_QueryServiceStatus
push edi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
mov edx, esi
mov eax, dword [ebp - 0x28]
call fcn.004074d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407669
lea eax, [ebp - 4]
call fcn.00403714
ret
Function at 0x407754
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff54
push ebx
push esi
push edi
mov dword [ebp - 0xac], 0x94
lea eax, [ebp - 0xac]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [ebp - 0x9c], 1
je 0x407823
xor eax, eax
push ebp
push 0x407819
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
push 0x20
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov ebx, dword [ebp - 4]
lea eax, [ebp - 0x14]
push eax
push 0x40782c
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 2
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 2
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push 0
push ebx
call sub.advapi32.dll_AdjustTokenPrivileges
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x407823
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4078c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor edx, edx
push ebp
push 0x4078fb
push dword fs:[edx]
mov dword fs:[edx], esp
push eax
push 0xffffffffffffffff
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov esi, eax
push 0
push esi
call sub.kernel32.dll_TerminateProcess
test eax, eax
je 0x4078f1
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x407907
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x603089
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 8]
mov edi, eax
mov edx, eax
and edi, 7
je 0x6030b7
cmp eax, edi
jge 0x6030ab
push esi
call fcn.005fe6fb
mov eax, dword [esi + 8]
pop ecx
mov ecx, edi
shr dword [esi + 0xc], cl
sub eax, edi
mov dword [esi + 8], eax
mov edx, eax
xor ecx, ecx
test eax, eax
jle 0x6030da
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x6030c0
mov dword [esi + 8], edx
jmp 0x6030ef
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jb 0x6030e5
xor dl, dl
jmp 0x6030ea
mov dl, byte [eax]
inc eax
mov dword [esi], eax
mov byte [ebp + ecx + 8], dl
inc ecx
cmp ecx, 4
jl 0x6030da
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x603127
push 0x86ef24
call fcn.005fe620
pop ecx
jmp 0x603167
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x603137
push 0x86ef34
jmp 0x60311f
mov ecx, dword [esi + 0x10]
lea eax, [ecx + edi]
cmp eax, dword [esi + 0x18]
jbe 0x603151
push edi
push ecx
push esi
call fcn.0060635a
add esp, 0xc
test eax, eax
je 0x603167
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.006cdf50
add dword [esi], edi
xor eax, eax
add dword [esi + 0x10], edi
add esp, 0xc
inc eax
pop edi
pop esi
pop ebp
ret

Function at 0x62b3fd
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp byte [0x1816a9b], 0
jne 0x62b4ac
push esi
push 0x875bb8
call fcn.0063590f
mov dword [esp], 0x875a34
call fcn.0063590f
mov dword [esp], 0x875cb0
call fcn.0063590f
mov dword [esp], 0x875cd4
call fcn.0063590f
mov dword [esp], 0x875bdc
call fcn.0063590f
mov esi, 0x875a98
push esi
call fcn.0063faa7
push esi
call fcn.0063faa7
push 0x875ab8
call fcn.0063faa7
push 0x875ad8
call fcn.0063faa7
push 0x875c00
call fcn.0063faa7
push 0x875a58
call fcn.0063faa7
push 0x875a78
call fcn.0063faa7
push 0x875c58
call fcn.0063faa7
push 0x875c78
call fcn.0063faa7
add esp, 0x28
mov byte [0x1816a9b], 1
pop esi
jmp 0x647df7
ret
xor edx, edx
push esi
push 8
mov ecx, edx
pop esi
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor ecx, eax
sub esi, 1
jne 0x647dff
mov dword [edx*4 + 0x181d180], ecx
inc edx
cmp edx, 0x100
jb 0x647dfa
mov esi, 0x800
jmp 0x647e47
mov ecx, dword [edx*4 + 0x181cd80]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x181d180]
mov dword [edx*4 + 0x181d180], ecx
inc edx
cmp edx, esi
jb 0x647e2b
mov eax, 0x81fb90
mov esi, 0x81fab0
mov dword [0x181d17c], eax
mov dword [0x181d174], eax
mov dword [0x181d178], esi
call fcn.0065f805
mov ecx, dword [0x181d174]
test eax, eax
cmove ecx, esi
mov dword [0x181d174], ecx
pop esi
ret
Function at 0x64bfe4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
push esi
push edi
mov dword [eax + 0x34], ecx
lea esi, [eax + 0x60]
mov word [eax + 0x1e], cx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x30], 0x20
mov byte [eax + 0x1d], 1
mov dword [eax + 0x48], 4
push 8
mov edx, ecx
pop edi
mov eax, edx
shr edx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor edx, eax
sub edi, 1
jne 0x64c012
mov dword [esi], edx
inc ecx
add esi, 4
cmp ecx, 0x100
jb 0x64c00d
pop edi
pop esi
pop ebp
ret

Function at 0x64d387
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x20], 0
and dword [eax + 0x24], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
pop ebp
ret

Function at 0x65514b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov edx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [edx + 4]
mov ecx, dword [edx]
add esi, 2
lea esi, [edx + esi*4]
mov dword [ebp - 8], esi
test edi, edi
je 0x6551e9
push ebx
mov ebx, dword [ebp + 0xc]
cmp ecx, 0x10
je 0x655187
mov al, byte [esi + ecx]
xor byte [ebx], al
inc ecx
inc ebx
sub edi, 1
je 0x655184
cmp ecx, 0x10
jne 0x655173
mov dword [ebp + 0x10], edi
lea eax, [esi + 0x10]
mov dword [ebp - 4], eax
cmp edi, 0x10
jb 0x6551b4
mov esi, edi
mov edx, ebx
shr esi, 4
mov ecx, eax
push esi
call dword [0x181d168]
shl esi, 4
add ebx, esi
sub edi, esi
mov esi, dword [ebp - 8]
push 0x10
mov dword [ebp + 0x10], edi
pop ecx
jmp 0x6551b7
mov dword [ebp - 4], eax
test edi, edi
je 0x6551e3
mov ecx, dword [ebp - 4]
xor eax, eax
mov edi, esi
mov edx, esi
push 1
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [0x181d168]
mov edx, dword [ebp + 0x10]
xor ecx, ecx
sub esi, ebx
mov al, byte [esi + ebx]
xor byte [ebx], al
inc ecx
inc ebx
sub edx, 1
jne 0x6551d7
mov eax, dword [ebp + 8]
pop ebx
mov dword [eax], ecx
pop edi
pop esi
leave
ret

Function at 0x655771
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x93bf44]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, byte [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x10]
push 0x40
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.006ce4d0
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x44]
add esp, 0xc
xor edx, edx
sub esi, eax
lea ecx, [ebp - 0x44]
add ecx, edx
mov al, byte [esi + ecx]
xor byte [ecx], al
inc edx
cmp edx, 0x14
jb 0x6557a6
lea eax, [ebp - 0xa4]
push eax
call fcn.006690e5
push 0x40
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0xa4]
push eax
call fcn.00669117
lea eax, [ebp - 0xa4]
push edi
push eax
call fcn.006687cd
mov ecx, dword [ebp - 4]
add esp, 0x18
xor ecx, ebp
pop edi
pop esi
call fcn.005c22ca
leave
ret
Function at 0x6690e5
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x18], 0
and dword [eax + 0x1c], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
pop ebp
ret

Function at 0x6692e7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x93bf44]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x44]
push esi
push edi
push 5
mov esi, ecx
push eax
push esi
mov dword [ebp - 0x88], esi
call fcn.0066872e
push 5
lea ecx, [ebp - 0x84]
lea eax, [esi + 0x60]
push ecx
push eax
mov dword [ebp - 0x8c], eax
call fcn.0066872e
add esp, 0x18
lea edi, [ebp - 0x44]
mov esi, ebx
push 5
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x66938b
lea esi, [ebp - 0x44]
sub esi, ebx
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x88]
call fcn.0066885d
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x84]
push eax
push dword [ebp - 0x8c]
call fcn.0066885d
add esp, 0x18
mov ecx, ebx
push 5
pop edx
mov eax, dword [esi + ecx]
xor dword [ecx], eax
lea ecx, [ecx + 4]
sub edx, 1
jne 0x669379
sub edi, 1
jne 0x669345
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005c22ca
leave
ret 8

Function at 0x66939c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
mov eax, dword [0x93bf44]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
push 0x10
xor eax, eax
mov dword [ebp - 0xbc], ebx
pop ecx
lea edi, [ebp - 0x58]
mov dword [ebp - 0xc0], esi
rep stosd dword es:[edi], eax
mov edi, dword [ebp + 0xc]
cmp edi, 0x40
jbe 0x66941a
lea eax, [ebp - 0xb8]
push eax
call fcn.006690e5
push edi
lea eax, [ebp - 0xb8]
push esi
push eax
call fcn.00669117
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xb8]
push eax
call fcn.006687cd
add esp, 0x18
xor esi, esi
mov ecx, esi
mov eax, dword [ebp + ecx - 0x18]
bswap eax
mov dword [ebp + ecx - 0x58], eax
add ecx, 4
cmp ecx, 0x14
jb 0x669406
jmp 0x669451
xor esi, esi
mov ebx, esi
test edi, edi
je 0x66944b
mov esi, dword [ebp - 0xc0]
mov eax, ebx
mov edx, ebx
and eax, 3
shr edx, 2
push 3
pop ecx
sub ecx, eax
movzx eax, byte [esi + ebx]
shl ecx, 3
shl eax, cl
or dword [ebp + edx*4 - 0x58], eax
inc ebx
cmp ebx, edi
jb 0x669428
xor esi, esi
mov ebx, dword [ebp - 0xbc]
mov eax, esi
movups xmm0, xmmword [ebp + eax*4 - 0x58]
pxor xmm0, xmmword [0x878680]
movups xmmword [ebp + eax*4 - 0x58], xmm0
add eax, 4
cmp eax, 0x10
jb 0x669453
push ebx
call fcn.006690e5
push 0x10
lea eax, [ebp - 0x58]
push eax
push ebx
call fcn.0066877e
add esp, 0x10
movups xmm0, xmmword [ebp + esi*4 - 0x58]
pxor xmm0, xmmword [0x878690]
movups xmmword [ebp + esi*4 - 0x58], xmm0
add esi, 4
cmp esi, 0x10
jb 0x669482
lea esi, [ebx + 0x60]
push esi
call fcn.006690e5
push 0x10
lea eax, [ebp - 0x58]
push eax
push esi
call fcn.0066877e
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.005c22ca
leave
ret 8
Function at 0x6694c5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x93bf44]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
mov eax, ebx
mov esi, ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x48], ecx
push edi
mov edi, dword [ebp + 0xc]
cmp eax, 0x40
jae 0x669586
mov byte [ebp + eax - 0x44], bl
inc eax
cmp eax, 0x40
jb 0x6694f0
cmp edi, 0x40
jbe 0x66951e
push esi
call fcn.006690e5
push edi
push dword [ebp - 0x48]
push esi
call fcn.00669117
lea eax, [ebp - 0x44]
push eax
push esi
call fcn.006687cd
add esp, 0x18
jmp 0x669530
test edi, edi
je 0x669530
push edi
push ecx
lea eax, [ebp - 0x44]
push eax
call fcn.006cdf50
add esp, 0xc
mov eax, ebx
xor byte [ebp + eax - 0x44], 0x36
inc eax
cmp eax, 0x40
jb 0x669532
push esi
call fcn.006690e5
push 0x40
lea eax, [ebp - 0x44]
push eax
push esi
call fcn.00669117
add esp, 0x10
xor byte [ebp + ebx - 0x44], 0x6a
inc ebx
cmp ebx, 0x40
jb 0x669552
add esi, 0x60
push esi
call fcn.006690e5
push 0x40
lea eax, [ebp - 0x44]
push eax
push esi
call fcn.00669117
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.005c22ca
leave
ret 8
call fcn.005c23fc
int3

Function at 0x66a4a3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi + 0x18]
mov dword [esi + 8], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0xc], eax
xor eax, eax
mov word [esi], ax
cmp byte [edi + 1], al
je 0x66a520
mov bl, byte [edi + 2]
lea eax, [edi + 0x20]
push eax
lea ecx, [esi + 0x24]
call fcn.006255da
movzx eax, byte [edi + 4]
mov ecx, esi
push eax
push 0x800
call fcn.0066a585
mov eax, dword [edi + 0x10]
mov dword [esi + 0x44], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x68], eax
mov eax, dword [edi + 0x30]
mov dword [esi + 0x6c], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 0x70], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x74], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x78], eax
mov eax, dword [edi + 0x40]
mov dword [esi + 0x7c], eax
mov al, byte [edi + 3]
mov byte [esi + 0x80], al
jmp 0x66a529
mov ecx, esi
call fcn.00656000
mov bl, al
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0x38]
mov dword [esi + 0x48], ecx
mov ecx, dword [edx + 0x3c]
mov dword [esi + 0x4c], ecx
xor ecx, ecx
mov dword [esi + 0x40], 0x3f
mov byte [esi + 5], cl
test bl, bl
jne 0x66a554
mov eax, dword [ebp + 0xc]
mov byte [ebp + 0x14], 1
cmp byte [eax + 0x24], cl
jne 0x66a557
mov byte [ebp + 0x14], cl
push dword [ebp + 0x14]
mov ecx, esi
push 1
call fcn.0066a585
test bl, bl
je 0x66a580
xor eax, eax
mov byte [esi + 4], 0x14
mov word [esi + 2], ax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x1c], eax
pop edi
pop esi
pop ebx
pop ebp
ret