joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4114b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov ecx, dword [0x42d088]
test ecx, ecx
je 0x4114ff
mov edx, dword [0x42d06c]
test edx, edx
jne 0x4114ff
mov edx, dword [eax + 4]
cmp edx, 0x44bf18
je 0x4114d9
mov ecx, dword [0x42d304]
test ecx, ecx
je 0x411500
cmp eax, 0x44bf60
jne 0x4114f0
ret
mov edx, dword [0x42d304]
and eax, 0xfffff000
test edx, edx
je 0x411570
ret
push ebx
mov ebx, eax
mov eax, edx
xor ecx, ecx
and eax, 0xfffff000
mov edx, 1
sub esp, 8
call fcn.004113c0
cmp ebx, 0x44bf60
je 0x411560
mov eax, dword [0x42d088]
test eax, eax
je 0x411560
mov eax, ebx
mov ebx, dword [0x42d06c]
and eax, 0xfffff000
test ebx, ebx
jne 0x411560
mov ecx, dword [0x42d304]
test ecx, ecx
jne 0x411560
add esp, 8
xor ecx, ecx
mov edx, 1
pop ebx
jmp fcn.004113c0
add esp, 8
pop ebx
ret
xor ecx, ecx
mov edx, 1
jmp fcn.004113c0
Function at 0x412e80
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
push edi
push esi
xor esi, esi
push ebx
mov ebx, eax
sub esp, 0x2ec
call fcn.004114b0
mov edi, dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
lea ebp, [esp + 0x10]
lea esi, [esi]
mov eax, dword [ebx + 0xc]
mov dword [esp + 4], ebp
mov dword [esp], eax
call edi
sub esp, 8
test eax, eax
je 0x412ec1
cmp dword [esp + 0x10], 0x103
jne 0x412f70
mov eax, dword [ebx + 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
sub esp, 4
cmp eax, 0xffffffff
je 0x412f31
cmp dword [0x44c3a4], 1
sbb eax, eax
and eax, 0xbffffffc
add eax, 0x40010007
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
sub esp, 8
test eax, eax
jne 0x412f90
mov eax, dword [ebx + 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
sub esp, 4
cmp eax, 0xffffffff
jne 0x412f31
mov dword [esp], str.ResumeThread_failed_in_suspend_loop
call fcn.00410de0
call dword [sym.imp.KERNEL32.dll_DebugBreak]
cmp esi, 1
jle 0x412f46
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
add esi, 1
cmp esi, 0xf423f
jle 0x412ea0
mov dword [esp], str.SuspendThread_loop_failed
call fcn.00410de0
call dword [sym.imp.KERNEL32.dll_DebugBreak]
jmp 0x412ea0
mov eax, ebx
call fcn.00412d70
add esp, 0x2ec
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x14]
or byte [ebx + 0x10], 0x40
mov dword [ebx + 0x18], eax
mov eax, dword [esp + 0xa4]
mov dword [ebx + 0x1c], eax
mov eax, dword [esp + 0xb0]
mov dword [ebx + 0x20], eax
mov eax, dword [esp + 0xb4]
mov dword [ebx + 0x24], eax
mov eax, dword [esp + 0xb8]
mov dword [ebx + 0x28], eax
mov eax, dword [esp + 0xbc]
mov dword [ebx + 0x2c], eax
mov eax, dword [esp + 0xc0]
mov dword [ebx + 0x30], eax
mov eax, dword [esp + 0xc4]
mov dword [ebx + 0x34], eax
mov eax, dword [esp + 0xc8]
mov dword [ebx + 0x38], eax
mov eax, dword [esp + 0xd8]
mov dword [ebx + 0x14], eax
add esp, 0x2ec
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x413000
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xbc
mov eax, dword [0x42d064]
test eax, eax
jne 0x413030
mov eax, dword [0x44be54]
test eax, eax
je 0x41304d
add esp, 0xbc
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0x42d04c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x44be54]
sub esp, 4
test eax, eax
jne 0x4130d6
mov eax, dword [0x42d048]
mov edi, dword [0x44bf00]
mov dword [0x44be54], 1
test edi, edi
jne 0x413100
mov edx, dword [0x42d064]
test edx, edx
jne 0x413200
mov dword [0x44be54], 0
add esp, 0xbc
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.GC_ABORT_ON_LEAK
call sub.msvcrt.dll_getenv
test eax, eax
je 0x4130b2
mov dword [esp], str.Leaked_or_smashed_objects_encountered
call fcn.00410de0
call dword [sym.imp.KERNEL32.dll_DebugBreak]
mov ebx, dword [0x42d064]
test ebx, ebx
je 0x413078
mov dword [esp], 0x42d04c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [0x44be54], 0
sub esp, 4
mov ecx, dword [0x42d064]
test ecx, ecx
je 0x41301c
mov dword [esp], 0x42d04c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0xbc
pop ebx
pop esi
pop edi
pop ebp
ret
lea esi, [edi*4]
lea ebx, [esp + 0x10]
mov dword [esp + 4], 0x44be60
mov dword [esp + 8], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 0x44be60
mov dword [0x44bf00], 0
call sub.msvcrt.dll_memset
mov eax, dword [0x42d064]
test eax, eax
jne 0x413220
mov dword [esp + 4], edi
add esi, ebx
mov dword [esp], str.Found__u_leaked_objects:_n
call fcn.00412270
jmp 0x413193
mov ecx, dword [ebp + 0x10]
movzx edx, byte [ebp + 0xc]
mov eax, edi
call fcn.00412c80
mov edi, dword [0x42d064]
test edi, edi
jne 0x4131e0
add ebx, 4
cmp esi, ebx
je 0x413090
mov edi, dword [ebx]
mov dword [esp], edi
call fcn.004122f0
test edi, edi
je 0x413188
mov edx, edi
mov eax, dword [0x42d064]
shr edx, 0x16
mov ecx, dword [edx*4 + 0x448d14]
mov edx, edi
shr edx, 0xc
and edx, 0x3ff
mov ebp, dword [ecx + edx*4]
test eax, eax
je 0x413170
mov dword [esp], 0x42d04c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub esp, 4
jmp 0x413170
mov dword [esp], 0x42d04c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
jmp 0x413188
mov dword [esp], 0x42d04c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
jmp 0x4130b2
mov dword [esp], 0x42d04c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
jmp 0x41314e
Function at 0x413670
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push esi
push ebx
sub esp, 0x14
mov ebx, dword [0x42d360]
mov edx, dword [0x42d368]
sub edx, ebx
cmp eax, 0xfffffff7
ja 0x413840
lea esi, [eax + 7]
and esi, 0xfffffff8
cmp esi, edx
jbe 0x413735
cmp esi, 0xffff
ja 0x4137d1
mov ecx, dword [0x42d30c]
test ecx, ecx
je 0x413750
mov dword [esp + 4], 0x11000
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea ebx, [eax + 0xfff]
sub esp, 8
and ebx, 0xfffff000
cmp dword [0x42d3ac], 0x1ff
jbe 0x4136f6
mov dword [esp], str.Too_many_heap_sections
call fcn.00410de0
call dword [sym.imp.KERNEL32.dll_DebugBreak]
test ebx, ebx
je 0x4137c0
mov eax, dword [0x42d3ac]
add dword [0x42d340], 0x10000
cmp dword [0x42d310], 2
lea edx, [eax + 1]
mov dword [eax*4 + 0x441514], ebx
mov dword [0x42d3ac], edx
je 0x413810
lea eax, [ebx + 0x10000]
mov dword [0x42d368], eax
add esi, ebx
mov dword [0x42d360], esi
add esp, 0x14
mov eax, ebx
pop ebx
pop esi
ret
cmp dword [0x42480c], 1
mov edx, dword [0x42d304]
mov dword [esp], 0
sbb eax, eax
and eax, 0xffffffc4
add eax, 0x40
mov dword [esp + 0xc], eax
mov eax, dword [0x42d308]
or ah, 0x30
mov dword [esp + 8], eax
xor eax, eax
test edx, edx
sete al
add eax, 0x10000
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
sub esp, 0x10
mov ebx, eax
test eax, 0xfff
je 0x4136d8
mov dword [esp], str.Bad_VirtualAlloc_result
call fcn.00410de0
call dword [sym.imp.KERNEL32.dll_DebugBreak]
jmp 0x4136d8
mov dword [esp + 4], esi
mov dword [esp], str.GC_Warning:_Out_of_memory___trying_to_allocate_requested_amount___lu_bytes_..._n
call dword [0x424810]
mov eax, esi
call fcn.00411110
mov ebx, eax
test eax, eax
je 0x413850
add dword [0x42d340], esi
cmp dword [0x42d310], 2
jne 0x41373d
mov dword [esp + 4], esi
mov dword [esp], str.Got__lu_bytes_from_OS_n
call fcn.00411220
jmp 0x41373d
mov dword [esp + 4], 0x10000
mov dword [esp], str.Got__lu_bytes_from_OS_n
call fcn.00411220
lea eax, [ebx + 0x10000]
mov dword [0x42d368], eax
jmp 0x413735
mov esi, 0xfffffff8
cmp edx, 0xfffffff7
jbe 0x4137d1
jmp 0x413735
xor ebx, ebx
jmp 0x41373d
Function at 0x418390
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
push ebx
sub esp, 0x14
mov ecx, dword [0x42d088]
test ecx, ecx
je 0x418440
mov edx, dword [0x42d3a0]
test edx, edx
je 0x418440
lea esi, [eax + eax*4]
mov ebx, dword [0x44be28]
add esi, esi
cmp esi, ebx
jg 0x4183d7
jmp 0x418426
add ebx, 1
cmp esi, ebx
je 0x418420
call fcn.00403170
test eax, eax
je 0x4183d0
mov eax, dword [0x42d084]
test eax, eax
jne 0x418420
cmp dword [0x42482c], 0xf423f
mov eax, dword [0x44be38]
je 0x41854a
cmp eax, 2
jle 0x41853a
mov eax, fcn.00410460
call fcn.00416490
test eax, eax
jne 0x41858a
add dword [0x44be38], 1
mov ebx, dword [0x44be28]
test ebx, ebx
jle 0x418449
sub ebx, esi
mov eax, 0
cmovs ebx, eax
mov dword [0x44be28], ebx
add esp, 0x14
pop ebx
pop esi
ret
mov eax, dword [0x42d084]
test eax, eax
je 0x418450
add esp, 0x14
pop ebx
pop esi
ret
call fcn.00412610
test eax, eax
je 0x418449
mov eax, dword [0x42d088]
test eax, eax
je 0x418570
mov ebx, dword [0x44be3c]
test ebx, ebx
jne 0x418481
mov eax, dword [0x449df8]
cmp eax, dword [0x424828]
jl 0x418530
mov ecx, dword [0x42d310]
test ecx, ecx
jne 0x41859a
call fcn.004120d0
mov edx, 1
xor eax, eax
call fcn.00411840
mov dword [esp + 4], 0
mov dword [esp], 0x410870
call fcn.00402c60
mov dword [0x42d37c], 0
mov dword [0x42d3a0], 5
mov dword [0x42d398], 0
mov dword [0x449df8], 0
mov dword [0x44c3a0], 1
cmp dword [0x42482c], 0xf423f
je 0x4184fd
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x449df4], eax
mov eax, 0x412040
call fcn.00416490
test eax, eax
jne 0x418560
mov edx, dword [0x44c3a0]
test edx, edx
jne 0x418449
add dword [0x44be38], 1
jmp 0x418449
add eax, 1
mov dword [0x449df8], eax
jmp 0x4184e6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x449df4], eax
mov eax, dword [0x44be38]
cmp eax, 2
jg 0x418407
mov eax, 0x412040
jmp 0x41840c
add esp, 0x14
pop ebx
pop esi
jmp fcn.00416fe0
mov esi, dword [0x42d084]
test esi, esi
jne 0x418449
add esp, 0x14
mov eax, fcn.00410460
pop ebx
pop esi
jmp fcn.004185c0
call fcn.00416fe0
mov ebx, dword [0x44be28]
jmp 0x418426
mov eax, dword [0x42d344]
mov dword [esp], str._Full_mark_for_collection__lu_after__lu_allocd_bytes_n
mov dword [esp + 8], eax
mov eax, dword [0x42d2ac]
add eax, 1
mov dword [esp + 4], eax
call fcn.00411220
jmp 0x41848f
Function at 0x419dd0
Capabilities:
Get system information on windows
Query environment variable

Disassembly:
mov eax, dword [0x42d068]
test eax, eax
je 0x419de0
ret
sub esp, 0x1c
mov dword [esp], str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
sub esp, 4
test eax, eax
je 0x419e30
mov dword [esp + 4], str.InitializeCriticalSectionAndSpinCount
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
sub esp, 8
test eax, eax
je 0x419e30
mov dword [esp + 4], 0xfa0
mov dword [esp], 0x42d04c
call eax
sub esp, 8
jmp 0x419e40
mov dword [esp], 0x42d04c
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
sub esp, 4
add esp, 0x1c
jmp fcn.00419360

Function at 0x41a858
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call fcn.00421784
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call fcn.00421784
mov edx, eax
mov dword [esp + 8], ebx
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort

Function at 0x41b360
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x41b37f
mov eax, 0
jmp 0x41b3c3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x41b3a2
mov eax, 0
jmp 0x41b3c3
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x41b3be
mov eax, 0
jmp 0x41b3c3
mov eax, 1
leave
ret

Function at 0x41b3c5
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x41b424
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x41b41c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x41b41c
mov eax, dword [ebp - 4]
jmp 0x41b438
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x41b3f9
mov eax, 0
leave
ret
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x4052f2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x405301
pop dword [ebp - 0x2c]
mov eax, 0xd5214546
add eax, 0x2b1f0dbb
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x749453e2
sub dword [ebp - 0x3c], 0x26420e97
mov dword [ebp - 0x38], 0x5a117fe3
add dword [ebp - 0x38], 0xd821cc62
mov dword [ebp - 0x34], 0xe0ac83e4
add dword [ebp - 0x34], 0x6b9fc04a
mov dword [ebp - 0x30], 0xade02f29
add dword [ebp - 0x30], 0x521fd0d7
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x22af0a26
add dword [ebp - 0x3c], 0x51c35f30
mov dword [ebp - 0x38], 0xac917d32
sub dword [ebp - 0x38], 0x6b251bbd
mov dword [ebp - 0x34], 0xdde87af9
add dword [ebp - 0x34], 0x8586f173
mov dword [ebp - 0x30], 0x346dde65
sub dword [ebp - 0x30], 0x346dde65
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x5899dfe8
sub eax, 0x58590f9c
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x36d5e
push 0
call eax
mov ecx, 0xa0c44120
add ecx, 0x5f3bfc10
mov ebx, eax
mov edx, 0xefcb8b1f
sub edx, 0xef89db1f
add edx, dword [ebp - 0x2c]
mov edi, 0xd001a8e2
add dword [ebp - 0x14], eax
mov esi, dword [edx]
sub dword [ebp - 0x18], ecx
add esi, edi
sub dword [ebp - 0x20], 0x668c7b41
mov dword [ebx], esi
xor dword [ebp - 4], 0x6b161b64
add ebx, 0x30a57c18
sub ebx, 0x30a57c14
add edx, 4
loop 0x405418
add eax, 0xed82870d
add eax, 0x127e6086
mov ebx, eax
add eax, 5
mov ecx, 0xb01d84ff
add ecx, 0x50227b01
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x7ad384
Capabilities:
Encode data using xor

Disassembly:
jmp 0x7ad38e
pushal
call 0x7ad394
pop ebp
sub ebp, 0x10
sub ebp, 0x3ad384
jmp 0x7ad3aa
mov eax, 0x3ad384
add eax, ebp
add eax, 0x4c
mov ecx, 0x5e4
mov edx, 0xaf2b6bc0
xor byte [eax], dl
inc eax
dec ecx
jne 0x7ad3c1
jmp 0x7ad3d4
dec ebx
or eax, 0xc0fc494b
rol al, 0x41
add dword [eax], edi
rol al, 0xc0
ret
Function at 0x5f8868
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push edi
jmp 0x5f887b

Function at 0x61f7b7
Capabilities:
Encode data using xor

Disassembly:
pushal
xchg dx, si
popal
push bx
lea esp, [esp]
mov word [esp], dx
mov byte [esp], al
mov word [esp], si
lea esp, [esp + 1]
jmp 0x61f80d
lea esp, [esp]
lea esp, [esp + 1]
lea esp, [esp + 4]
jmp 0x61fa1b
ret
pushal
mov di, bp
popal
pushfd
mov byte [esp + 2], ah
mov word [esp], bx
mov byte [esp + 2], dl
mov byte [esp + 1], ch
lea esp, [esp + 2]
mov word [esp], ax
mov word [esp], dx
lea esp, [esp]
lea esp, [esp + 2]
xor ecx, ecx
cmp dword [esp + 8], ecx
jbe 0x61f8f3
mov edx, dword [esp + 4]
movzx edx, byte [ecx + edx]
rol eax, 7
xor eax, edx
inc ecx
cmp ecx, dword [esp + 8]
jb 0x61fa50
jae 0x61f8f3
ror dword [ebx - 0x25], 1
mov esi, 0xfa6ffc4d
push 0xdf4afa0f
dec ebx
fstp xword [esi - 0xd5e02b3]
salc
dec edi
arpl word [esi + 0xf], sp
retf

Function at 0x671368
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
test esi, esi
je 0x6713a8
mov edi, dword [esp + 0x14]
cmp edi, 2
jl 0x6713a8
xor ecx, ecx
test edi, edi
jle 0x6713a3
mov dl, byte [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x1c]
mov eax, ecx
and eax, 3
mov al, byte [eax + ebx]
xor al, byte [ecx + esi]
inc ecx
xor al, dl
cmp ecx, edi
mov byte [ecx + esi - 1], al
mov dl, al
jl 0x67138a
pop ebx
pop edi
mov al, 1
pop esi
ret
pop edi
xor al, al
pop esi
ret

Function at 0x6713b8
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
test esi, esi
je 0x6713fb
mov edi, dword [esp + 0x14]
cmp edi, 2
jl 0x6713fb
xor eax, eax
test edi, edi
jle 0x6713f6
mov dl, byte [esp + 0xc]
push ebx
push ebp
mov ebp, dword [esp + 0x20]
mov cl, byte [eax + esi]
mov ebx, eax
and ebx, 3
mov bl, byte [ebx + ebp]
xor bl, cl
xor bl, dl
mov byte [eax + esi], bl
inc eax
cmp eax, edi
mov dl, cl
jl 0x6713db
pop ebp
pop ebx
pop edi
mov al, 1
pop esi
ret
pop edi
xor al, al
pop esi
ret

Function at 0x671408
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
xor al, al
test esi, esi
je 0x671434
mov edx, dword [esp + 0xc]
cmp edx, 2
jl 0x671434
xor ecx, ecx
test edx, edx
jle 0x671430
lea ebx, [ebx]
xor al, byte [ecx + esi]
inc ecx
cmp ecx, edx
jl 0x671428
not al
pop esi
ret
xor al, al
pop esi
ret
Function at 0x6b13b6
Capabilities:
Encode data using xor

Disassembly:
pushal
xchg ah, dh
setne bl
mov ah, byte [esp]
popal
pushfd
lea esp, [esp + 2]
pushal
pushfd
mov word [esp + 0xb], di
jmp 0x6b1479
call 0x6b1444
pop eax
jmp 0x6b157b
lea esp, [esp]
push dword [esp + 6]
lea esp, [esp + 6]
mov byte [esp], bh
lea esp, [esp + 1]
lea esp, [esp + 4]
pushal
jmp 0x6b143f
pop word [esp + 9]
mov word [esp + 0x1d], di
push dword [esp + 0x11]
lea esp, [esp + 0x28]
push 0x348f1d36
pushfd
add dword [esp + 4], 0x3dda19d7
pushal
lea esi, [ecx*4]
mov ah, 0x7f
lea ebx, [eax + ebp]
popal
push di
lea esp, [esp]
mov byte [esp], ah
push word [esp + 1]
pop word [esp]
lea esp, [esp + 1]
pushfd
push word [esp + 1]
jmp 0x6b1455
call 0x6b1561
inc edi
inc esp
dec ecx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bh, bh
nop
jg 0x6b1582
std
mov dl, 0xeb
jno 0x6b1552
add byte [eax], al
add byte [eax], al
pop eax
jmp 0x6b15b4
sub eax, 0xb308e63b
jmp 0x6b1552
iretd
mov edi, dword [0x549a73d3]
lea esp, [esp - 4]
ret
sub eax, 0x6b156e
add eax, 0x5fa54ffa
pop ebx
mov dword [ebx], eax
add dword [ebx], 0xa0c5c599
jmp 0x6b15fe
mov ebx, dword [ebx]
pop dword [ebx]
jmp 0x6b22d0
add dword [esp + 8], 1
pushal
xchg ch, dl
lea esi, [ecx + edi]
jmp 0x6b1a57
lea edi, [ecx + 0xfa56fa3]
popal
push cx
mov word [esp], cx
push word [esp]
mov byte [esp], dh
mov word [esp], ax
pop word [esp]
mov word [esp], sp
mov byte [esp], cl
lea esp, [esp]
lea esp, [esp + 2]
popfd
lea esp, [esp + 4]
push dword [esp]
lea esp, [esp + 8]
jmp 0x6b1597
call 0x6b22d5
pop ecx
sub ecx, 0x6b22d5
mov byte [ecx + 0x6b1491], 0xe9
mov dword [ecx + 0x6b1492], 0x183
popal
jmp 0x6b1619
Function at 0x401450
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [0x42a008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 0x425908
mov edi, edx
mov esi, ecx
call fcn.004023b0
push 0
push 0x425908
mov ecx, edi
call fcn.004023b0
push 0x11c
lea eax, [ebp - 0x130]
push 0
push eax
call fcn.00411350
add esp, 0xc
mov dword [ebp - 0x130], 0x11c
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
js 0x401533
cmp dword [ebp - 0x12c], 6
jne 0x4014f1
cmp dword [ebp - 0x128], 2
jne 0x4014f1
push ecx
call fcn.00406860
mov ecx, dword [ebp - 0x128]
add esp, 4
test al, al
mov edx, 3
cmovne ecx, edx
mov dword [ebp - 0x128], ecx
lea ecx, [ebp - 0x10]
call fcn.00406930
push dword [ebp - 0x128]
push dword [ebp - 0x12c]
push str._d._d
push esi
call fcn.00402650
movzx eax, word [ebp - 0x1c]
push eax
push 0x425918
push edi
call fcn.00402650
mov eax, dword [ebp - 0x10]
add esp, 0x1c
test eax, eax
je 0x401533
push eax
call fcn.0041089a
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040f9cf
mov esp, ebp
pop ebp
ret
Function at 0x401560
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41f510
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x42a008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
mov edi, dword [ebp + 0xc]
mov esi, 0x80070057
mov ebx, dword [ebp + 8]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
lea edx, [eax - 0x10]
mov ecx, dword [edx]
mov dword [ebp - 0x18], ecx
je 0x4015ef
cmp dword [edx + 0xc], 0
lea ecx, [edx + 0xc]
jge 0x4015ce
cmp dword [eax - 8], 0
jge 0x4015be
push esi
call fcn.00401070
mov dword [eax - 0xc], 0
xor ecx, ecx
mov eax, dword [edi]
mov word [eax], cx
jmp 0x4015ef
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4015e2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
test ebx, ebx
je 0x4016df
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4016df
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push eax
push 0x420358
push 1
push 0
push 0x420368
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
js 0x4016cb
push ebx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x18], 0
call fcn.004010e0
mov byte [ebp - 4], 1
lea edx, [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
movdqu xmm0, xmmword [eax]
push edx
sub esp, 0x10
mov esi, dword [ecx]
mov edx, esp
push ecx
movdqu xmmword [edx], xmm0
call dword [esi + 0xe8]
mov esi, eax
mov byte [ebp - 4], 0
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test esi, esi
js 0x4016cb
cmp word [ebp - 0x18], 0xffff
jne 0x4016c6
mov eax, dword [ebp - 0x14]
push ecx
mov ecx, esp
mov dword [ecx], eax
test eax, eax
je 0x401694
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov ebx, dword [ebp - 0x1c]
mov ecx, ebx
call fcn.00401710
mov esi, eax
test esi, esi
js 0x4016cb
cmp byte [ebx + 1], 0
je 0x4016cb
mov eax, dword [ebp - 0x14]
push edi
push ecx
mov ecx, esp
mov dword [ecx], eax
test eax, eax
je 0x4016bd
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
call fcn.004019c0
mov esi, eax
jmp 0x4016cb
mov esi, 0x80004005
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4016df
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040f9cf
mov esp, ebp
pop ebp
ret 8