joyce8/EMBER2024-capa huggingface dataset:
Function at 0x65901c
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov byte [ebp - 0x11], cl
mov ebx, edx
mov dword [ebp - 0x18], eax
xor eax, eax
lea edx, [ebp - 0x10]
cmp byte [ebp - 0x11], 0
jne 0x6590aa
lea ecx, [eax]
and ecx, 0x80000003
jns 0x659047
dec ecx
or ecx, 0xfffffffc
inc ecx
movzx ecx, byte [ebx + ecx*4]
mov ecx, dword [ecx*4 + 0x6c4ba4]
lea esi, [eax + 1]
and esi, 0x80000003
jns 0x659062
dec esi
or esi, 0xfffffffc
inc esi
movzx esi, byte [ebx + esi*4 + 1]
xor ecx, dword [esi*4 + 0x6c4fa4]
lea esi, [eax + 2]
and esi, 0x80000003
jns 0x65907e
dec esi
or esi, 0xfffffffc
inc esi
movzx esi, byte [ebx + esi*4 + 2]
xor ecx, dword [esi*4 + 0x6c53a4]
lea esi, [eax + 3]
and esi, 0x80000003
jns 0x65909a
dec esi
or esi, 0xfffffffc
inc esi
movzx esi, byte [ebx + esi*4 + 3]
xor ecx, dword [esi*4 + 0x6c57a4]
mov dword [edx], ecx
jmp 0x659123
lea ecx, [eax]
and ecx, 0x80000003
jns 0x6590b9
dec ecx
or ecx, 0xfffffffc
inc ecx
movzx ecx, byte [ebx + ecx*4]
movzx ecx, byte [ecx + 0x6c496c]
mov byte [edx], cl
lea ecx, [eax + 1]
and ecx, 0x80000003
jns 0x6590d6
dec ecx
or ecx, 0xfffffffc
inc ecx
movzx ecx, byte [ebx + ecx*4 + 1]
movzx ecx, byte [ecx + 0x6c496c]
mov byte [edx + 1], cl
lea ecx, [eax + 2]
and ecx, 0x80000003
jns 0x6590f5
dec ecx
or ecx, 0xfffffffc
inc ecx
movzx ecx, byte [ebx + ecx*4 + 2]
movzx ecx, byte [ecx + 0x6c496c]
mov byte [edx + 2], cl
lea ecx, [eax + 3]
and ecx, 0x80000003
jns 0x659114
dec ecx
or ecx, 0xfffffffc
inc ecx
movzx ecx, byte [ebx + ecx*4 + 3]
movzx ecx, byte [ecx + 0x6c496c]
mov byte [edx + 3], cl
inc eax
add edx, 4
cmp eax, 4
jne 0x659032
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x10]
mov ecx, 0x10
call fcn.00659c6c
mov edi, ebx
lea esi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x659150
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
add esp, 0xfffffff8
mov dword [esp], eax
movzx eax, byte [esp]
movzx eax, byte [eax + 0x6c496c]
mov byte [esp + 4], al
movzx eax, byte [esp + 1]
movzx eax, byte [eax + 0x6c496c]
mov byte [esp + 5], al
movzx eax, byte [esp + 2]
movzx eax, byte [eax + 0x6c496c]
mov byte [esp + 6], al
movzx eax, byte [esp + 3]
movzx eax, byte [eax + 0x6c496c]
mov byte [esp + 7], al
mov eax, dword [esp + 4]
pop ecx
pop edx
ret

Function at 0x65929c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffee8
mov ebx, eax
mov edx, esp
mov eax, ebx
mov ecx, 0x118
call fcn.00407130
xor eax, eax
mov dword [esp], eax
mov esi, 0x6c3814
lea edi, [esp + 4]
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov dword [esp + 0x104], eax
mov dword [esp + 0x108], 0x55555555
mov dword [esp + 0x10c], 0x55555555
mov dword [esp + 0x110], 0x55555555
mov dword [esp + 0x114], 0x55555555
mov edx, ebx
mov eax, esp
mov ecx, 0x118
call fcn.00407130
add esp, 0x118
pop edi
pop esi
pop ebx
ret
Function at 0x659318
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffee0
mov edi, ecx
mov ebx, edx
mov dword [esp], eax
lea edx, [esp + 8]
mov eax, dword [esp]
mov ecx, 0x118
call fcn.00407130
dec edi
test edi, edi
jl 0x659438
inc edi
mov dword [esp + 4], edi
mov esi, ebx
movzx eax, byte [esi]
mov edx, dword [esp + 8]
xor byte [esp + edx + 0xc], al
inc dword [esp + 8]
cmp dword [esp + 8], 0x100
jne 0x659369
xor edx, edx
mov dword [esp + 8], edx
mov edx, dword [esp + 0x10c]
xor byte [esp + edx + 0x110], al
inc dword [esp + 0x10c]
cmp dword [esp + 0x10c], 8
jne 0x65942d
mov edx, dword [esp + 0x11c]
mov ecx, dword [esp + 0x118]
mov ebx, dword [esp + 0x114]
mov eax, dword [esp + 0x110]
mov edi, 4
add edx, eax
add eax, edx
mov ebp, edx
shr ebp, 7
xor edx, ebp
add ecx, edx
add edx, ecx
mov ebp, ecx
shl ebp, 0xd
xor ecx, ebp
add ebx, ecx
add ecx, ebx
mov ebp, ebx
shr ebp, 0x11
xor ebx, ebp
add eax, ebx
add ebx, eax
mov ebp, eax
shl ebp, 9
xor eax, ebp
add edx, eax
add eax, edx
mov ebp, edx
shr ebp, 3
xor edx, ebp
add ecx, edx
add edx, ecx
mov ebp, ecx
shl ebp, 7
xor ecx, ebp
add ebx, ecx
add ecx, ebx
mov ebp, eax
shr ebp, 0xf
xor ebx, ebp
add eax, ebx
add ebx, eax
mov ebp, eax
shl ebp, 0xb
xor eax, ebp
dec edi
jne 0x6593ad
mov dword [esp + 0x110], edx
mov dword [esp + 0x114], ecx
mov dword [esp + 0x118], ebx
mov dword [esp + 0x11c], eax
xor eax, eax
mov dword [esp + 0x10c], eax
inc esi
dec dword [esp + 4]
jne 0x65934a
mov edx, dword [esp]
lea eax, [esp + 8]
mov ecx, 0x118
call fcn.00407130
add esp, 0x120
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x659c6c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, ecx
shr eax, 2
test eax, eax
jle 0x659c86
mov ebx, dword [edx]
xor dword [esi], ebx
add esi, 4
add edx, 4
dec eax
jne 0x659c79
mov eax, ecx
and eax, 3
test eax, eax
jle 0x659c99
movzx ecx, byte [edx]
xor byte [esi], cl
inc esi
inc edx
dec eax
jne 0x659c8f
pop esi
pop ebx
ret
Function at 0x65aa28
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff88
mov dword [esp + 4], edx
mov dword [esp], eax
lea eax, [esp + 0x39]
xor ecx, ecx
mov edx, 0x3f
call fcn.00407e54
lea edx, [esp + 0xc]
mov ecx, 0x2d
mov eax, dword [esp]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x65aba9
mov edi, 1
xor esi, esi
jmp 0x65aaea
movzx eax, byte [esp + edi + 0xb]
movzx edx, al
shr edx, 2
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [esp + esi + 0x39], dl
mov edx, eax
shl edx, 4
movzx eax, byte [esp + edi + 0xc]
shr eax, 4
or dl, al
and dl, 0x3f
movzx eax, dl
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [esp + esi + 0x3a], al
movzx edx, byte [esp + edi + 0xc]
add edx, edx
add edx, edx
movzx eax, byte [esp + edi + 0xd]
shr eax, 6
or dl, al
and dl, 0x3f
movzx eax, dl
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [esp + esi + 0x3b], al
movzx edx, byte [esp + edi + 0xd]
and dl, 0x3f
movzx eax, dl
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [esp + esi + 0x3c], al
add edi, 3
add esi, 4
mov eax, dword [esp + 8]
sub eax, 2
cmp edi, eax
jle 0x65aa6e
cmp edi, dword [esp + 8]
jg 0x65ab8f
movzx eax, byte [esp + edi + 0xb]
movzx edx, al
shr edx, 2
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [esp + esi + 0x39], dl
cmp edi, dword [esp + 8]
jne 0x65ab45
mov edx, eax
shl edx, 4
and dl, 0x30
and dl, 0x3f
movzx eax, dl
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [esp + esi + 0x3a], al
mov byte [esp + esi + 0x3b], 0x3d
jmp 0x65ab87
mov edx, eax
shl edx, 4
and dl, 0x30
movzx eax, byte [esp + edi + 0xc]
shr eax, 4
and al, 0xf
or dl, al
and dl, 0x3f
movzx eax, dl
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [esp + esi + 0x3a], al
movzx edx, byte [esp + edi + 0xc]
add edx, edx
add edx, edx
and dl, 0x3c
and dl, 0x3f
movzx eax, dl
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [esp + esi + 0x3b], al
mov byte [esp + esi + 0x3c], 0x3d
add esi, 4
lea edx, [esp + 0x39]
mov ecx, esi
mov eax, dword [esp + 4]
mov ebx, dword [eax]
call dword [ebx + 0x10]
cmp dword [esp + 8], 0x2d
jge 0x65aa45
add esp, 0x78
pop edi
pop esi
pop ebx
ret
Function at 0x65c400
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
mov esi, 1
call fcn.00429fc4
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [esp + 0xe]
push eax
lea ecx, [esp + 0x10]
lea edx, [esp + 0xe]
lea eax, [esp + 0xc]
call fcn.00429c9c
mov ebp, esi
mov dword [ebx + 4], ebp
mov ecx, 0xf
and ecx, esi
mov edi, ebp
shl edi, cl
movzx eax, word [esp]
or ax, word [esp + 4]
movzx eax, ax
shl eax, 0x10
movzx edx, word [esp + 2]
or dx, word [esp + 6]
movzx edx, dx
or eax, edx
xor edi, eax
mov dword [ebx + 4], edi
mov esi, edi
inc esi
test edi, edi
je 0x65c40e
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x65db74
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
mov esi, edx
lea edi, [esp + 0x11]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, eax
lea edi, [esp + 4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ebp, ecx
lea eax, [esp + 4]
call fcn.0065d3fc
lea eax, [esp + 0x11]
call fcn.0065d3fc
mov ecx, ebp
lea edx, [esp + 0x11]
lea eax, [esp + 4]
call fcn.0065d4d0
mov eax, ebp
xor ecx, ecx
mov edx, 1
call fcn.0065d5a0
mov ecx, esp
lea edx, [esp + 0x11]
lea eax, [esp + 4]
call fcn.0065d48c
mov edi, dword [esp]
test edi, edi
jle 0x65dc04
mov esi, 1
lea eax, [esp + 4]
mov edx, esi
call fcn.0065d358
mov ebx, eax
lea eax, [esp + 0x11]
mov edx, esi
call fcn.0065d358
xor bl, al
mov eax, ebp
mov ecx, ebx
mov edx, esi
call fcn.0065d5a0
inc esi
dec edi
jne 0x65dbdb
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x660fbc
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x1010], ebx
mov dword [ebp - 0x100c], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x6610f3
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx], 0x1000
jle 0x66101b
lea edx, [ebp - 0x100c]
mov eax, dword [0x6c9f20]
call fcn.004100a8
mov ecx, dword [ebp - 0x100c]
mov dl, 1
mov eax, dword [0x41e4b8]
call fcn.0042d294
call fcn.00409ecc
xor ecx, ecx
mov eax, dword [ebx]
mov dword [ebp - 8], eax
movzx eax, byte [ebp + 8]
mov byte [ebp + ecx - 0x1008], al
inc ecx
cmp dword [ebx], 0x7f
jle 0x661073
mov eax, dword [ebx]
mov esi, 0xff
cdq
idiv esi
mov esi, eax
test esi, esi
jne 0x661048
mov esi, 1
mov eax, esi
or al, 0x80
mov byte [ebp + ecx - 0x1008], al
add ecx, esi
mov eax, esi
test eax, eax
jle 0x66106e
mov edx, dword [ebx]
and dl, 0xff
mov byte [ebp + ecx - 0x1008], dl
shr dword [ebx], 8
dec ecx
dec eax
jne 0x66105b
inc esi
add ecx, esi
jmp 0x66107d
mov eax, dword [ebx]
mov byte [ebp + ecx - 0x1008], al
inc ecx
mov eax, dword [ebp - 8]
add eax, ecx
mov dword [ebx], eax
cmp dword [ebx], 0x1000
jle 0x6610b3
lea edx, [ebp - 0x1010]
mov eax, dword [0x6c9f20]
call fcn.004100a8
mov ecx, dword [ebp - 0x1010]
mov dl, 1
mov eax, dword [0x41e4b8]
call fcn.0042d294
call fcn.00409ecc
lea edx, [ebp + ecx - 0x1008]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.00407130
mov ecx, dword [ebx]
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1008]
call fcn.00407130
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6610fa
lea eax, [ebp - 0x1010]
mov edx, 2
call fcn.0040a830
ret
Function at 0x664c44
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x664e9e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
mov edx, 0x24
call fcn.00667658
lea eax, [ebp - 0x28]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov eax, dword [ebp - 0x14]
mov dword [0x6c9524], eax
mov eax, dword [ebp - 0xc]
mov dword [0x6c9528], eax
mov eax, dword [ebp - 0x24]
mov dword [0x6c952c], eax
call fcn.0042e360
cmp eax, 2
sete byte [0x6c8d01]
push 0x664eac
call sub.KERNEL32.DLL_GetModuleHandleW
lea edx, [ebp - 4]
call fcn.00667948
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp byte [0x6c8d01], 0
jne 0x664cd3
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.00667978
test al, al
je 0x664cd3
mov eax, dword [ebp - 0x4c]
mov dword [0x6d19c0], eax
jmp 0x664cda
xor eax, eax
mov dword [0x6d19c0], eax
call fcn.00664238
and eax, 0x7f
cmp eax, 0x1a
ja case.0x664ceb.0
jmp dword [eax*4 + 0x664cf2]
mov byte [0x6c8cfc], 1
jmp case.0x664ceb.0
mov byte [0x6c8cfd], 1
jmp case.0x664ceb.0
mov byte [0x6c8cfe], 1
jmp case.0x664ceb.0
mov byte [0x6c8cff], 1
jmp case.0x664ceb.0
mov byte [0x6c8d00], 1
jmp case.0x664ceb.0
mov byte [0x6c8d02], 1
mov byte [0x6c8d03], 1
jmp case.0x664ceb.0
mov byte [0x6c8d02], 1
mov byte [0x6c8d04], 1
jmp case.0x664ceb.0
mov byte [0x6c8d02], 1
mov byte [0x6c8d04], 1
mov byte [0x6c8d05], 1
jmp case.0x664ceb.0
mov byte [0x6c8d06], 1
jmp case.0x664ceb.0
mov byte [0x6c8d07], 1
jmp case.0x664ceb.0
mov byte [0x6c8d08], 1
jmp case.0x664ceb.0
mov byte [0x6c8d09], 1
jmp case.0x664ceb.0
mov byte [0x6c8d0a], 1
jmp case.0x664ceb.0
mov byte [0x6c8d0b], 1
jmp case.0x664ceb.0
mov byte [0x6c8d0c], 1
jmp case.0x664ceb.0
mov byte [0x6c8d0d], 1
jmp case.0x664ceb.0
mov byte [0x6c8d0e], 1
jmp case.0x664ceb.0
mov byte [0x6c8d0f], 1
jmp case.0x664ceb.0
mov byte [0x6c8d10], 1
jmp case.0x664ceb.0
mov byte [0x6c8d11], 1
jmp case.0x664ceb.0
mov byte [0x6c8d12], 1
jmp case.0x664ceb.0
mov byte [0x6c8d13], 1
jmp case.0x664ceb.0
mov byte [0x6c8d14], 1
jmp case.0x664ceb.0
mov byte [0x6c8d15], 1
jmp case.0x664ceb.0
mov byte [0x6c8d16], 1
jmp case.0x664ceb.0
mov byte [0x6c8d17], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x664ea5
lea eax, [ebp - 4]
call fcn.0040a7d0
ret

Function at 0x665e88
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 0x14], edx
xor edx, edx
push ebp
push 0x665eec
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 0xe]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xe]
mov ecx, 7
call fcn.0040b3a8
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.DLL_GetACP
mov edx, eax
pop eax
call fcn.00426af0
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x665ef3
lea eax, [ebp - 0x14]
call fcn.0040a7d0
ret
Function at 0x666c68
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x666cfe
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0042e360
cmp eax, 2
jne 0x666ca8
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
push esi
push ebx
call sub.advapi32.dll_RegQueryValueExW
mov ebx, eax
jmp 0x666ce0
lea eax, [ebp - 8]
mov edx, esi
call fcn.0040b100
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0
call fcn.0040af7c
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
mov eax, dword [ebp - 4]
call fcn.0040aff0
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x666d05
lea eax, [ebp - 8]
call fcn.0040a818
lea eax, [ebp - 4]
call fcn.0040a7f4
ret

Function at 0x66709c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [ebp - 8], eax
push 0x20019
lea eax, [ebp - 8]
push eax
mov eax, edi
call fcn.0040b2ec
mov edx, eax
mov eax, ebx
call fcn.00666ad4
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.00666bb0
test eax, eax
sete al
mov ebx, eax
test bl, bl
je 0x66710e
push 0
push 0
push esi
push 0
mov eax, dword [ebp - 4]
call fcn.0040b2ec
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x6677b4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040b2ec
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x6677cd
test al, 0x10
jne 0x6677d1
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x6677d8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
test ebx, ebx
je 0x6677f6
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x6677ee
test al, 0x10
je 0x6677f2
xor eax, eax
jmp 0x6677f8
mov al, 1
pop ebx
ret
xor eax, eax
pop ebx
ret
Function at 0x667978
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x667a2a
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov eax, esi
call fcn.0040b2ec
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jbe 0x667a14
lea eax, [ebp - 4]
mov edx, edi
call fcn.0040b480
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebp - 0x10]
push eax
mov eax, esi
call fcn.0040b2ec
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x667a14
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x667a3c
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x667a14
cmp dword [ebp - 0xc], 0x34
jne 0x667a14
mov bl, 1
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 8]
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x667a31
lea eax, [ebp - 4]
call fcn.0040a7d0
ret
Function at 0x669434
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
xor edx, edx
mov dword [ebp - 0x6c], edx
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x68], edx
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x54], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x669680
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
xor edx, edx
mov eax, 0x66969c
call fcn.006681f0
lea edx, [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.00669250
lea eax, [ebp - 0x54]
mov ecx, dword [ebp - 4]
mov edx, 0x6696c4
call fcn.0040b558
mov eax, dword [ebp - 0x54]
xor edx, edx
call fcn.006681f0
cmp dword [ebp - 4], 0
je 0x6694ac
mov eax, dword [ebp - 4]
call fcn.006677d8
test al, al
jne 0x6694bd
xor edx, edx
mov eax, 0x6696e8
call fcn.006681f0
jmp 0x66964b
cmp byte [ebx + 0x3c], 0
je 0x6694cd
lea eax, [ebp - 8]
call fcn.0040a7d0
jmp 0x6694da
lea eax, [ebp - 8]
mov edx, 0x66971c
call fcn.0040abf8
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x3c
call fcn.00407e54
mov dword [ebp - 0x50], 0x3c
mov dword [ebp - 0x4c], pe_nt_image_headers32
mov eax, 0x669728
mov dword [ebp - 0x44], eax
mov eax, 0x669734
mov dword [ebp - 0x40], eax
push 0x669750
push dword [ebp - 4]
push 0x669768
push dword [ebp - 8]
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.0040b5e0
mov eax, dword [ebp - 0x58]
call fcn.0040b2ec
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], 5
lea eax, [ebp - 0x50]
push eax
call sub.shell32.dll_ShellExecuteExW
test eax, eax
je 0x66964b
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x66964b
xor edx, edx
push ebp
push 0x669644
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xffffffffffffffff
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.KERNEL32.DLL_GetExitCodeProcess
test eax, eax
jne 0x6695bb
lea eax, [ebp - 0x5c]
push eax
call sub.KERNEL32.DLL_GetLastError
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x68]
call fcn.00426744
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0x11
lea edx, [ebp - 0x64]
xor ecx, ecx
mov eax, 0x669778
call fcn.004283e0
mov eax, dword [ebp - 0x5c]
xor edx, edx
call fcn.006681f0
call fcn.00409fc0
jmp 0x66964b
xor eax, eax
push ebp
push 0x669610
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.0040a7d0
mov eax, dword [ebp - 0x14]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xc]
call fcn.00426744
lea eax, [ebp - 0x6c]
mov ecx, dword [ebp - 0xc]
mov edx, 0x6697f0
call fcn.0040b558
mov eax, dword [ebp - 0x6c]
xor edx, edx
call fcn.006681f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x669617
lea eax, [ebp - 0xc]
call fcn.0040a7d0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x669687
lea eax, [ebp - 0x6c]
mov edx, 2
call fcn.0040a830
lea eax, [ebp - 0x5c]
mov edx, 3
call fcn.0040a830
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040a830
ret
Function at 0x669eb0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
xor edx, edx
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x50], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x66a0be
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
lea ecx, [ebp - 4]
mov eax, dword [ebx]
xor edx, edx
call fcn.00668e70
cmp dword [ebp - 4], 0
jne 0x669f06
xor edx, edx
mov eax, 0x66a0dc
call fcn.006681f0
mov byte [ebp - 9], 1
jmp 0x66a089
xor edx, edx
mov eax, 0x66a114
call fcn.006681f0
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x3c
call fcn.00407e54
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x48], pe_nt_image_headers32
mov eax, 0x66a14c
mov dword [ebp - 0x40], eax
mov eax, 0x66a158
mov dword [ebp - 0x3c], eax
push 0x66a174
push dword [ebp - 4]
push 0x66a188
lea eax, [ebp - 0x50]
mov edx, 3
call fcn.0040b5e0
mov eax, dword [ebp - 0x50]
call fcn.0040b2ec
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x30], 1
lea eax, [ebp - 0x4c]
push eax
call sub.shell32.dll_ShellExecuteExW
test eax, eax
je 0x66a089
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x66a089
xor edx, edx
push ebp
push 0x66a082
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xffffffffffffffff
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.DLL_GetExitCodeProcess
test eax, eax
jne 0x669ff0
lea eax, [ebp - 0x54]
push eax
call sub.KERNEL32.DLL_GetLastError
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x60]
call fcn.00426744
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0x11
lea edx, [ebp - 0x5c]
xor ecx, ecx
mov eax, 0x66a1a0
call fcn.004283e0
mov eax, dword [ebp - 0x54]
xor edx, edx
call fcn.006681f0
call fcn.00409fc0
jmp 0x66a089
xor eax, eax
push ebp
push 0x66a045
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.0040a7d0
mov eax, dword [ebp - 0x10]
xor edx, edx
push edx
push eax
lea eax, [ebp - 8]
call fcn.00426744
lea eax, [ebp - 0x64]
mov ecx, dword [ebp - 8]
mov edx, 0x66a21c
call fcn.0040b558
mov eax, dword [ebp - 0x64]
xor edx, edx
call fcn.006681f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x66a04c
lea eax, [ebp - 8]
call fcn.0040a7d0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x66a0c5
lea eax, [ebp - 0x64]
mov edx, 2
call fcn.0040a830
lea eax, [ebp - 0x54]
mov edx, 2
call fcn.0040a830
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a830
ret

Function at 0x672930
Capabilities:
Hash data using djb2

Disassembly:
push ebx
push esi
push edi
mov edi, eax
mov ebx, 0x1505
mov esi, ebx
mov eax, edi
call fcn.0040b2ec
mov edx, eax
jmp 0x67296b
movzx eax, cx
mov ecx, ebx
shl ecx, 5
add ebx, ecx
xor eax, ebx
mov ebx, eax
movzx eax, word [edx + 2]
test eax, eax
je 0x672973
mov ecx, esi
shl ecx, 5
add esi, ecx
xor eax, esi
mov esi, eax
add edx, 4
movzx ecx, word [edx]
test cx, cx
jne 0x672947
imul eax, esi, 0x5d588b65
add eax, ebx
pop edi
pop esi
pop ebx
ret