joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6e44e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x88d380
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push esi
push edi
mov esi, ecx
call ebp
lea edi, [esi + 0x3c]
push 0x10a
push str.J:JiangzbMyProject_
push eax
mov ecx, edi
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], 2
call fcn.00629420
mov dword [esp + 0x2c], eax
xor ebx, ebx
mov dword [esp + 0x38], ebx
call ebp
push 0x23e
mov ecx, edi
push str.J:JiangzbMyProject_
push eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], 2
call fcn.00629420
mov dword [esp + 0x1c], eax
mov ecx, dword [esi + 0xc]
mov byte [esp + 0x38], 1
cmp ecx, ebx
jne 0x6e459d
cmp eax, ebx
mov byte [esp + 0x38], bl
je 0x6e45de
mov eax, dword [esp + 0x18]
dec eax
je 0x6e458b
dec eax
jne 0x6e45de
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
push eax
call fcn.006296a0
jmp 0x6e45de
mov ecx, dword [esp + 0x10]
push ebx
push ebx
push ecx
mov ecx, dword [esp + 0x20]
call fcn.00629370
jmp 0x6e45de
push 0x9b5220
lea ecx, [esi + 0x14]
mov dword [esi + 0x10], ebx
call fcn.006181a0
push 0xffffffffffffffff
push ebx
lea ecx, [esi + 0x28]
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
call fcn.006e6590
lea ecx, [esp + 0x10]
mov dword [esi + 0xc], ebx
mov dword [esi + 4], 1
mov dword [esi + 8], ebx
mov byte [esp + 0x38], bl
call fcn.0056c390
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
push eax
lea ecx, [esi + 0x14]
mov dword [esi + 0x10], edx
call fcn.006181a0
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x48]
mov ebp, 1
cmp eax, ebx
mov dword [esi + 0x18], ecx
mov dword [esi + 0xc], ebp
mov dword [esi + 4], ebp
mov dword [esi + 8], ebx
mov dword [esp + 0x38], 0xffffffff
je 0x6e4623
mov edx, dword [esp + 0x20]
mov ecx, edi
push edx
call fcn.006296a0
mov ecx, dword [esp + 0x30]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 0xc
Function at 0x6e56a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x88d4f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
lea ebx, [esi + 0x3c]
push 0x27b
push str.J:JiangzbMyProject_
push edi
mov ecx, ebx
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], 2
call fcn.00629420
mov dword [esp + 0x28], eax
mov ecx, dword [esi + 0xc]
xor ebp, ebp
cmp ecx, ebp
mov dword [esp + 0x34], ebp
jne 0x6e571f
cmp eax, ebp
mov dword [esi + 4], 0xf002
mov dword [esi + 8], 0x27e
mov dword [esp + 0x34], 0xffffffff
je 0x6e58a8
jmp 0x6e58a0
cmp dword [esp + 0x3c], ebp
je 0x6e5886
cmp dword [esp + 0x40], ebp
je 0x6e5886
mov eax, dword [esi + 0x30]
xor ebx, ebx
cmp eax, ebp
jle 0x6e5779
mov edi, dword [esi + 0x2c]
mov eax, dword [esp + 0x3c]
add edi, ebp
push eax
mov ecx, dword [edi]
push ecx
call fcn.005fc4b7
add esp, 8
test eax, eax
jne 0x6e576e
mov edx, dword [esp + 0x40]
mov eax, dword [edi + 4]
push edx
push eax
call fcn.005fc4b7
add esp, 8
test eax, eax
je 0x6e5854
mov eax, dword [esi + 0x30]
inc ebx
add ebp, 0xc
cmp ebx, eax
jl 0x6e573c
mov eax, dword [0x8ab26c]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x34], 2
call fcn.00636b60
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x10]
push eax
mov byte [esp + 0x38], 3
call fcn.006181a0
mov ecx, dword [esp + 0x40]
push ecx
lea ecx, [esp + 0x18]
call fcn.006181a0
mov edx, dword [esp + 0x44]
lea ecx, [esp + 0x18]
push edx
call fcn.00636cc0
mov edi, dword [esi + 0x30]
add esi, 0x28
push 0xffffffffffffffff
mov ecx, esi
lea eax, [edi + 1]
push eax
call fcn.006e6590
mov edx, dword [esi + 4]
lea ecx, [edi + edi*2]
lea eax, [esp + 0x10]
lea esi, [edx + ecx*4]
push eax
mov ecx, esi
call fcn.00618070
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esi + 4]
call fcn.00618070
lea edx, [esp + 0x18]
lea ecx, [esi + 8]
push edx
call fcn.00636cc0
lea ecx, [esp + 0x18]
mov byte [esp + 0x34], 5
call fcn.00636c90
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 4
call fcn.00617ec0
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], 0
call fcn.00617ec0
mov eax, dword [esp + 0x28]
mov dword [esp + 0x34], 0xffffffff
test eax, eax
je 0x6e584d
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
push eax
call fcn.006296a0
mov eax, 1
jmp 0x6e58aa
mov ecx, dword [esp + 0x44]
push ecx
lea ecx, [edi + 8]
call fcn.00636cc0
mov eax, dword [esp + 0x28]
mov dword [esp + 0x34], 0xffffffff
test eax, eax
je 0x6e587f
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
push edx
call fcn.006296a0
mov eax, 2
jmp 0x6e58aa
cmp eax, ebp
mov dword [esi + 4], 0xf000
mov dword [esi + 8], 0x284
mov dword [esp + 0x34], 0xffffffff
je 0x6e58a8
push edi
mov ecx, ebx
call fcn.006296a0
xor eax, eax
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 0xc
Function at 0x6e6860
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
mov ecx, dword [esp + 0x10]
test ecx, ecx
mov dword [esi], 0x8af620
mov dword [esi + 8], ecx
mov dword [esi + 4], 0
je 0x6e68f8
push 0x7530
call fcn.006e9440
test eax, eax
je 0x6e68de
mov ecx, dword [esi + 8]
mov eax, dword [ecx + 0x44]
test eax, eax
je 0x6e68c7
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
mov ecx, dword [esi + 8]
mov eax, dword [ecx + 0x28]
mov dx, word [ecx + 0xc]
push eax
push edx
call fcn.006e9550
test eax, eax
mov dword [esi + 4], eax
jne 0x6e690c
push 1
inc edi
call ebx
cmp edi, 3
jl 0x6e689d
mov eax, esi
pop edi
pop esi
pop ebx
ret 4
push 0x12345678
push str.result_lock_CUKeyLockEx::CUKeyLockEx_m_hUKey__NULL____m_pUKey__m_bOpen_
call fcn.006eacc0
mov eax, esi
pop edi
pop esi
pop ebx
ret 4
mov ecx, dword [esi + 8]
push 0x12345678
push str.result_lock_CUKeyLockEx::CUKeyLockEx_m_hUKey__NULL____m_pUKey___Lock_
call fcn.006eacc0
mov eax, esi
pop edi
pop esi
pop ebx
ret 4
cmp dword [0x9de994], 1
jb 0x6e690c
push str.result_lock_CUKeyLockEx::CUKeyLockEx_m_hUKey__NULL___m_pUKey__NULL_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, esi
pop edi
pop esi
pop ebx
ret 4
Function at 0x6e69b0
Capabilities:
Print debug messages

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x88d65c
push eax
mov eax, dword [0x9de968]
mov dword fs:[0], esp
sub esp, 0x114
test eax, eax
push esi
jne 0x6e6b87
push edi
call fcn.006640f0
push str.GlobalTEC_USBKEY
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x9de968], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x9de970], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x9de96c], eax
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x1c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x18]
push 0x5c
push ecx
call fcn.005fdbf0
add esp, 8
test eax, eax
pop edi
push 0x1f
je 0x6e6a51
inc eax
push eax
jmp 0x6e6a56
lea edx, [esp + 0x18]
push edx
push 0x9de974
call fcn.005fdaf0
mov eax, dword [0x9de968]
add esp, 0xc
test eax, eax
mov eax, dword [0x9de994]
je 0x6e6afb
cmp eax, 1
jb 0x6e6b87
mov eax, dword [0x98b454]
mov dword [esp + 4], eax
push 0x9de974
lea ecx, [esp + 0x10]
mov dword [esp + 0x124], 0
call fcn.00831fb4
mov ecx, dword [0x9de96c]
mov edx, dword [0x9de970]
mov eax, dword [eax]
push ecx
push edx
push eax
lea ecx, [esp + 0x10]
push str.CTUsbKey::Initialize_CreateMutex_succeed____s___d___d_
push ecx
mov byte [esp + 0x134], 1
call fcn.00826097
add esp, 0x14
lea ecx, [esp + 0xc]
mov byte [esp + 0x120], 0
call fcn.00831eeb
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [esp + 0x120], 0xffffffff
lea ecx, [esp + 4]
jmp 0x6e6b82
cmp eax, 1
jb 0x6e6b87
push 0x9b5220
lea ecx, [esp + 0xc]
call fcn.00831f5f
push 0x9de974
lea ecx, [esp + 0x14]
mov dword [esp + 0x124], 2
call fcn.00831fb4
mov ecx, dword [0x9de96c]
mov edx, dword [0x9de970]
mov eax, dword [eax]
push esi
push ecx
push edx
push eax
lea ecx, [esp + 0x18]
push str.CTUsbKey::Initialize_CreateMutex_fail____s___d___d__GetLastError_d
push ecx
mov byte [esp + 0x138], 3
call fcn.00826097
add esp, 0x18
lea ecx, [esp + 0x10]
mov byte [esp + 0x120], 2
call fcn.00831eeb
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [esp + 0x120], 0xffffffff
lea ecx, [esp + 8]
call fcn.00831eeb
mov ecx, dword [0x9de968]
xor eax, eax
test ecx, ecx
mov ecx, dword [esp + 0x118]
pop esi
setne al
mov dword fs:[0], ecx
add esp, 0x120
ret
Function at 0x6e6bb0
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x88d678
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov ecx, dword [0x9de968]
mov eax, 1
test ecx, ecx
je 0x6e6c38
cmp dword [0x9de994], eax
jb 0x6e6c21
push 0x9b5220
lea ecx, [esp + 4]
call fcn.00831f5f
lea eax, [esp]
push str.CTUsbKey::Finalize_close_handle_
push eax
mov dword [esp + 0x14], 0
call fcn.00826097
mov ecx, dword [esp + 8]
add esp, 8
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [esp]
mov dword [esp + 0xc], 0xffffffff
call fcn.00831eeb
mov edx, dword [0x9de968]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x9de968], 0
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x6e7c40
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push esi
mov ecx, 1
lea edx, [eax + 0x19]
sub eax, edx
add eax, 0x3c
mov esi, eax
mov al, byte [edx]
cmp esi, ecx
jle 0x6e7c66
push ebx
mov bl, byte [ecx + edx]
xor al, bl
inc ecx
cmp ecx, esi
jl 0x6e7c5b
pop ebx
pop esi
ret
Function at 0x6ea180
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x4c
push ebp
push esi
push edi
push 0x12345678
mov esi, ecx
push str._SetPwd
call fcn.006eacc0
mov ecx, 0xe
xor eax, eax
lea edi, [esp + 0x1e]
mov word [esp + 0x1c], 0
rep stosd dword es:[edi], eax
mov ebp, dword [esp + 0x5c]
mov ecx, esi
stosw word es:[edi], ax
lea eax, [esp + 0x1c]
push eax
push 0x3c
push 0
push ebp
call fcn.006e99c0
test eax, eax
mov dword [esi + 4], eax
je 0x6ea1f6
push 0x12345678
push str.result__ReadHeader_error_
mov ecx, esi
call fcn.006eacc0
push 0x12345678
push str.result__SetPwd__ReadHeader_Fail_
mov ecx, esi
call fcn.006eacc0
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x4c
ret 0xc
xor ecx, ecx
mov eax, dword [esp + 0x60]
mov dword [esp + 0xd], ecx
lea edx, [esp + 0xc]
mov dword [esp + 0x11], ecx
push edx
mov dword [esp + 0x19], ecx
push eax
mov word [esp + 0x21], cx
mov byte [esp + 0x14], 0
mov byte [esp + 0x23], cl
mov ecx, dword [esp + 0x6c]
push ecx
push 1
push ebp
mov ecx, esi
call fcn.006e9bd0
test eax, eax
mov dword [esi + 4], eax
je 0x6ea24e
push 0x12345678
push str.result__SetPwd__CalcHmacMd5_Fail_
mov ecx, esi
call fcn.006eacc0
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x4c
ret 0xc
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x38], edx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x3c], eax
mov al, byte [esp + 0x37]
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], edx
inc al
mov edx, 0x23
mov ecx, 1
mov byte [esp + 0x37], al
mov al, byte [esp + 0x35]
cmp edx, ecx
jle 0x6ea293
xor al, byte [esp + ecx + 0x35]
inc ecx
cmp ecx, edx
jl 0x6ea28a
mov ecx, dword [esp + 0x20]
mov byte [esp + 0x34], al
mov eax, dword [esi + 0x2c]
mov edi, 0x23
mov dword [eax], ecx
mov edx, dword [esp + 0x24]
mov dword [eax + 4], edx
mov ecx, dword [esp + 0x28]
mov dword [eax + 8], ecx
mov edx, dword [esp + 0x2c]
mov ecx, 1
mov dword [eax + 0xc], edx
mov al, byte [esp + 0x35]
cmp edi, ecx
mov dl, al
jle 0x6ea2d2
xor dl, byte [esp + ecx + 0x35]
inc ecx
cmp ecx, edi
jl 0x6ea2c9
cmp dl, byte [esp + 0x34]
je 0x6ea2e1
mov dword [esi + 0x10], 0xfe
jmp 0x6ea2f1
mov ecx, dword [esp + 0x35]
and ecx, 0xff
shr ecx, 4
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x36]
and al, 0xf
and ecx, 0xff
mov edx, ecx
and edx, 0xf
shr ecx, 4
neg al
mov dword [esi + 0x18], ecx
lea ecx, [esp + 0x1c]
sbb eax, eax
push ecx
neg eax
mov dword [esi + 0x1c], eax
mov eax, dword [esp + 0x3b]
push 0x3c
push 0
push ebp
mov ecx, esi
mov dword [esi + 0x14], edx
mov dword [esi + 0x20], eax
call fcn.006e9aa0
mov edi, eax
test edi, edi
mov dword [esi + 4], edi
je 0x6ea346
push 0x12345678
push str.result__WriteHeader_error_
mov ecx, esi
call fcn.006eacc0
xor edx, edx
test edi, edi
sete dl
mov edi, edx
test edi, edi
jne 0x6ea364
push 0x12345678
push str.result__SetPwd__WriteHeader_Fail_
mov ecx, esi
call fcn.006eacc0
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0x4c
ret 0xc
Function at 0x6eb060
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x10
test eax, eax
push ebx
push esi
push edi
jl 0x6eb129
mov ecx, dword [esp + 0x24]
test ecx, ecx
jl 0x6eb129
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x6eb129
test eax, eax
jle 0x6eb0b0
cmp eax, 0x3c
jl 0x6eb129
add eax, ecx
cmp eax, 0x3e8
jg 0x6eb129
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x10
ret
cmp ecx, 0x3c
jne 0x6eb129
cmp word [ebx], 0x5549
jne 0x6eb129
lea edi, [ebx + 4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 8
jb 0x6eb129
mov dl, byte [ebx + 0x19]
lea esi, [ebx + 0x19]
mov eax, ebx
mov ecx, 1
sub eax, esi
add eax, 0x3c
cmp eax, ecx
jle 0x6eb0ec
xor dl, byte [ecx + esi]
inc ecx
cmp ecx, eax
jl 0x6eb0e4
cmp dl, byte [ebx + 0x18]
jne 0x6eb129
xor eax, eax
mov ecx, 4
mov dword [esp + 0xd], eax
lea edi, [esp + 0xc]
mov dword [esp + 0x11], eax
lea esi, [ebx + 0x1c]
mov dword [esp + 0x15], eax
xor edx, edx
mov word [esp + 0x19], ax
mov byte [esp + 0xc], 0
mov byte [esp + 0x1b], al
mov eax, edx
repe cmpsd dword [esi], dword es:[edi]
pop edi
pop esi
setne al
pop ebx
add esp, 0x10
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret

Function at 0x6ed1e0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x88dac7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
push edi
xor edi, edi
lea ecx, [esp + 0x10]
push edi
push 8
mov dword [esp + 0x24], edi
call fcn.00636b70
mov ebp, dword [esp + 0x40]
mov ebx, 1
mov dword [esp + 0x28], ebx
cmp dword [ebp + 8], edi
jle 0x6ed28f
mov eax, dword [ebp + 4]
mov esi, dword [eax + edi*4]
lea eax, [esp + 0x40]
push eax
mov ecx, esi
mov edx, dword [esi]
call dword [edx + 4]
mov si, word [esi + 4]
lea ecx, [esp + 0x40]
mov byte [esp + 0x28], 2
mov dword [esp + 0x14], esi
call fcn.00636d30
lea ecx, [esp + 0x14]
push 2
push ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], eax
call fcn.00637070
lea edx, [esp + 0x18]
push 2
push edx
lea ecx, [esp + 0x18]
call fcn.00637070
lea eax, [esp + 0x40]
lea ecx, [esp + 0x10]
push eax
call fcn.006370b0
lea ecx, [esp + 0x40]
mov byte [esp + 0x28], bl
call fcn.00636c90
mov eax, dword [ebp + 8]
inc edi
cmp edi, eax
jl 0x6ed220
lea ecx, [esp + 0x10]
call fcn.00637450
mov cx, word [esp + 0x34]
mov dx, word [esp + 0x38]
mov esi, eax
mov ax, word [esp + 0x3c]
mov word [esi], cx
lea ecx, [esp + 0x10]
mov word [esi + 2], dx
mov word [esi + 4], ax
call fcn.00636d30
sub eax, 8
lea ecx, [esp + 0x10]
mov word [esi + 6], ax
mov esi, dword [esp + 0x30]
push ecx
mov ecx, esi
call fcn.00636c50
mov dword [esp + 0x1c], ebx
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 0
call fcn.00636c90
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x6f53a0
Capabilities:
Get user security identifier

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
lea eax, [esp + 0x18]
push edi
mov edi, dword [esp + 0x1c]
lea ecx, [esp + 0xc]
xor ebx, ebx
push eax
push ecx
lea edx, [esp + 0x18]
push ebx
push edx
push ebx
push ebp
push ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebx
mov dword [edi], ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x6f53eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x6f53eb
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x10]
push esi
push eax
call fcn.008325b4
mov ecx, dword [esp + 0x14]
mov dword [edi], eax
lea edx, [ecx + ecx]
push edx
call fcn.008325b4
mov esi, eax
mov eax, dword [edi]
add esp, 8
test eax, eax
je 0x6f5430
test esi, esi
je 0x6f5441
lea ecx, [esp + 0x20]
lea edx, [esp + 0x10]
push ecx
push edx
lea ecx, [esp + 0x1c]
push esi
push ecx
push eax
push ebp
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov ebx, eax
test esi, esi
je 0x6f543d
push esi
call fcn.008325dd
add esp, 4
test ebx, ebx
jne 0x6f5450
mov edi, dword [edi]
test edi, edi
je 0x6f5450
push edi
call fcn.008325dd
add esp, 4
pop esi
pop edi
mov eax, ebx
pop ebp
pop ebx
add esp, 8
ret

Function at 0x6f65a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x6f65ab
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp edi, 8
mov esi, edi
not eax
jb 0x6f66ad
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x8af66c]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x8af66c]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x8af66c]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x8af66c]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x8af66c]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x8af66c]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x8af66c]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x8af66c]
xor eax, edx
inc ecx
dec edi
jne 0x6f65c6
test esi, esi
je 0x6f66cf
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x8af66c]
xor eax, edx
inc ecx
dec esi
jne 0x6f66b1
pop edi
pop esi
not eax
pop ebx
ret
Function at 0x6ffc30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x88eaff
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
mov ecx, dword [0x98b454]
push ebx
xor eax, eax
push esi
push edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
mov ecx, 9
lea edi, [esp + 0x16]
mov ebx, dword [esp + 0x50]
mov word [esp + 0x14], ax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, ebx
lea edx, [esp + 0x14]
push 0xa
push edx
shr eax, 0x18
push eax
mov dword [esp + 0x50], 1
call fcn.005fe0c4
add esp, 0xc
lea ecx, [esp + 0xc]
push eax
call fcn.008322dc
push 0x9428c0
lea ecx, [esp + 0x10]
call fcn.008322dc
xor edx, edx
lea ecx, [esp + 0x14]
mov dl, byte [esp + 0x52]
push 0xa
push ecx
push edx
call fcn.005fe0c4
add esp, 0xc
lea ecx, [esp + 0xc]
push eax
call fcn.008322dc
push 0x9428c0
lea ecx, [esp + 0x10]
call fcn.008322dc
xor ecx, ecx
lea eax, [esp + 0x14]
push 0xa
mov cl, bh
push eax
push ecx
call fcn.005fe0c4
add esp, 0xc
lea ecx, [esp + 0xc]
push eax
call fcn.008322dc
push 0x9428c0
lea ecx, [esp + 0x10]
call fcn.008322dc
lea edx, [esp + 0x14]
push 0xa
and ebx, 0xff
push edx
push ebx
call fcn.005fe0c4
add esp, 0xc
lea ecx, [esp + 0xc]
push eax
call fcn.008322dc
mov esi, dword [esp + 0x4c]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.00831c58
mov dword [esp + 0x10], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x44], 0
call fcn.00831eeb
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
add esp, 0x3c
ret

Function at 0x701e20
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x8afc60
push 0x5fd778
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov ecx, dword [ebp + 8]
xor edx, edx
cmp ecx, edx
je 0x701eb2
mov dword [ebp - 4], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], ecx
cmp word [ecx], 0x5a4d
jne 0x701eab
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x20], eax
cmp dword [eax], 0x4550
jne 0x701eab
cmp word [eax + 0x14], dx
je 0x701eab
cmp dword [ebp + 0xc], edx
je 0x701e85
cmp word [eax + 4], 0x14c
jne 0x701eab
mov dword [ebp - 4], 0xffffffff
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x701fa0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
test ebx, ebx
push edi
je 0x701fed
mov edi, dword [esp + 0x18]
test edi, edi
je 0x701fed
mov eax, dword [ebx + 0x3c]
xor ecx, ecx
add eax, ebx
xor edx, edx
mov cx, word [eax + 0x14]
mov dx, word [eax + 6]
lea esi, [ecx + eax + 0x18]
xor ecx, ecx
test edx, edx
mov dword [esp + 0x14], esi
jbe 0x701fed
lea eax, [esi + 0x10]
mov esi, dword [eax - 4]
cmp edi, esi
jb 0x701fe5
mov ebp, dword [eax]
add ebp, esi
cmp edi, ebp
jb 0x701ff4
inc ecx
add eax, 0x28
cmp ecx, edx
jb 0x701fd6
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, dword [esp + 0x14]
lea edx, [ecx + ecx*4]
mov esi, dword [eax + edx*8 + 0xc]
lea ecx, [eax + edx*8]
mov eax, dword [eax + edx*8 + 0x14]
sub eax, esi
add eax, ebx
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret