joyce8/EMBER2024-capa huggingface dataset:
Function at 0x671084ba
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt

Disassembly:
sub esp, 0x40
mov eax, dword [0x6753165c]
xor eax, esp
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x48]
push ebp
push edi
mov edi, dword [esp + 0x4c]
push 0x20
pop ecx
push ecx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x20], 0x208
push eax
mov dword [esp + 0x28], 0x6610
mov dword [esp + 0x2c], ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea eax, [esp + 0x14]
xor ebp, ebp
push 0xf0000000
push 0x18
push str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x6710859c
push ebx
lea eax, [esp + 0x10]
push eax
push ebp
push ebp
push 0x2c
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
push ebp
lea eax, [esp + 0x10]
xor ebx, ebx
push eax
push 4
push dword [esp + 0x1c]
inc ebx
mov dword [esp + 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
push ebp
lea eax, [esp + 0x10]
mov dword [esp + 0x10], ebx
push eax
push 3
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
mov eax, dword [edi]
mov ecx, edi
mov eax, dword [eax + 4]
mov dword [esp + 0x14], eax
call sym.Qt5Core.dll_public:_void___thiscall_QByteArray::detach_void_
mov eax, dword [edi]
mov ecx, dword [eax + 0xc]
add ecx, eax
lea eax, [esp + 0x14]
push eax
push ecx
push ebp
push ebx
push ebp
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
pop ebx
test eax, eax
je 0x6710859c
push dword [esp + 0x10]
mov ecx, edi
call sym.Qt5Core.dll_public:_void___thiscall_QByteArray::resize_int_
mov ecx, dword [esp + 0x44]
pop edi
pop ebp
xor ecx, esp
call fcn.671a2acb
add esp, 0x40
ret 8
Function at 0x671085af
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt
Read file on windows

Disassembly:
sub esp, 0x42c
mov eax, dword [0x6753165c]
xor eax, esp
mov dword [esp + 0x428], eax
push ebx
mov ebx, dword [esp + 0x438]
xor eax, eax
push esi
mov esi, dword [esp + 0x438]
push 0xf0000000
push 0x18
push eax
push eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0xee7b0005
mov dword [esp + 0x2c], 0xe48b3c0b
mov dword [esp + 0x30], 0x17b2730
mov dword [esp + 0x34], 0xbf5a3198
mov dword [esp + 0x38], 0x6dd782ec
mov dword [esp + 0x3c], 0xba4c2fe4
mov word [esp + 0x40], 0x4a99
mov byte [esp + 0x42], 0x52
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x671086df
push ebp
lea eax, [esp + 0xc]
xor ebp, ebp
push eax
push ebp
push ebp
push 0x800c
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
push ebp
push 0x1b
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0x67298c68
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x671086b6
mov ebp, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
jmp 0x67108696
push 0
push eax
lea eax, [esp + 0x3c]
push eax
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push esi
push 0x400
lea eax, [esp + 0x3c]
push 1
push eax
call ebp
add esp, 0x10
test eax, eax
jne 0x67108684
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
pop ecx
xor ebp, ebp
push ebp
lea eax, [esp + 0x18]
push eax
push ebx
push 2
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push ebp
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop ebp
mov ecx, dword [esp + 0x430]
pop esi
pop ebx
xor ecx, esp
call fcn.671a2acb
add esp, 0x42c
ret 8
Function at 0x671088f8
Capabilities:
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x22c]
sub esp, 0x22c
push 0xffffffffffffffff
push 0x671b4af4
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x6753165c]
xor eax, ebp
mov dword [ebp + 0x228], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [ebp - 0x20]
call sym.Qt5Core.dll_public:_void___thiscall_QFile::constructor_void_
lea eax, [ebp - 0x18]
xor ebx, ebx
push eax
lea ecx, [ebp - 0xe]
mov dword [ebp - 4], ebx
mov byte [ebp - 0xe], bl
call fcn.6710822e
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call sym.Qt5Core.dll_public:_void___thiscall_QFile::setFileName_class_QString_const__
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], bl
call sym.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_
push ecx
mov eax, esp
lea ecx, [ebp - 0x20]
mov dword [eax], 1
call sym.Qt5Core.dll_public_virtual:_bool___thiscall_QFile::open_class_QFlags_enum_QIODevice::OpenModeFlag__
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x20]
call sym.Qt5Core.dll_public:_class_QByteArray___thiscall_QIODevice::readAll_void_
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call sym.Qt5Core.dll_public_virtual:_void___thiscall_QFileDevice::close_void_
push 0x104
lea eax, [ebp]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp + 0x208]
mov ecx, esi
push eax
lea eax, [ebp]
push eax
call sym.Qt5Core.dll_public:_void___thiscall_QCoreApplicationPrivate::addCacheableShaderFromSourceFile_wchar_t_const___unsigned_char__
lea eax, [ebp + 0x208]
mov ecx, esi
push eax
lea eax, [ebp - 0x14]
push eax
call sym.Qt5Core.dll_public:_void___thiscall_QCoreApplicationPrivate::activeFrameGraph_class_QByteArray___unsigned_char_const__
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0xc]
push dword [eax + 4]
add ecx, eax
push ecx
lea ecx, [ebp - 0xd]
call fcn.67130920
lea ecx, [ebp - 0x14]
mov esi, eax
call sym.Qt5Core.dll_public:_void___thiscall_QByteArray::clear_void_
push 4
push esi
lea ecx, [ebp - 0xd]
call fcn.6713083b
test eax, eax
je 0x67108a09
call eax
push esi
lea ecx, [ebp - 0xd]
call fcn.671307bc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0x14]
call sym.Qt5Core.dll_public:_void___thiscall_QByteArray::destructor_void_
lea ecx, [ebp - 0x20]
call sym.Qt5Core.dll_public_virtual:_void___thiscall_QFile::destructor_void_
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp + 0x228]
xor ecx, ebp
call fcn.671a2acb
add ebp, 0x22c
leave
ret
Function at 0x671249dd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
push ebp
mov ebp, dword [esp + 0x1c]
xor ecx, ecx
push edi
xor edi, edi
mov dword [esp + 0x10], edi
test ebp, ebp
jne 0x671249f9
xor eax, eax
jmp 0x67124b09
push esi
push ebx
mov edi, dword [esp + 0x24]
xor bh, bh
mov byte [esp + 0x28], bh
mov bh, 1
movzx eax, byte [ecx + edi]
mov esi, 0x3e8
mov edx, dword [esp + 0x20]
mov bl, 1
mov dword [esp + 0x14], eax
test al, 0x10
je 0x67124a28
push 0xa
mov eax, edx
cdq
pop esi
idiv esi
jmp 0x67124a43
test al, 0x20
je 0x67124a30
push 0x64
jmp 0x67124a20
test al, 0x40
je 0x67124a47
cmp edx, esi
jl 0x67124a47
mov eax, edx
cdq
idiv esi
mov edx, eax
cmp edx, esi
jge 0x67124a38
mov eax, dword [esp + 0x14]
movzx esi, byte [ecx + edi + 1]
and eax, 7
add ecx, 2
sub eax, 1
je 0x67124a89
sub eax, 1
je 0x67124a82
sub eax, 1
je 0x67124a7b
sub eax, 1
jne 0x67124a8e
movzx eax, byte [ecx + edi]
inc ecx
cmp edx, esi
jl 0x67124a77
cmp edx, eax
jg 0x67124a77
mov bl, 1
jmp 0x67124a8e
xor bl, bl
jmp 0x67124a8e
cmp edx, esi
setle bl
jmp 0x67124a8e
cmp edx, esi
setl bl
jmp 0x67124a8e
cmp edx, esi
sete bl
mov edx, dword [esp + 0x14]
mov al, bl
xor al, 1
and dl, 8
movzx eax, al
mov dword [esp + 0x14], eax
mov edx, eax
movzx eax, bl
cmove edx, eax
test bh, bh
je 0x67124ab4
test dl, dl
je 0x67124ab4
mov bh, 1
jmp 0x67124ab6
xor bh, bh
cmp ecx, ebp
je 0x67124ac6
cmp byte [ecx + edi], 0xfd
jne 0x67124ac6
inc ecx
jmp 0x67124a07
mov byte [esp + 0x13], bh
mov bh, byte [esp + 0x28]
test bh, bh
jne 0x67124ad8
cmp byte [esp + 0x13], bh
je 0x67124ada
mov bh, 1
mov byte [esp + 0x28], bh
cmp ecx, ebp
je 0x67124aee
cmp byte [ecx + edi], 0xfe
jne 0x67124aee
inc ecx
jmp 0x67124a05
mov edi, dword [esp + 0x18]
test bh, bh
jne 0x67124b05
inc edi
mov dword [esp + 0x18], edi
cmp ecx, ebp
je 0x67124b05
inc ecx
jmp 0x671249fb
pop ebx
mov eax, edi
pop esi
pop edi
pop ebp
add esp, 0xc
ret
Function at 0x6713066f
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x2c
push ebx
push ebp
mov ebp, dword [esp + 0x38]
mov edx, ecx
push esi
push edi
mov dword [esp + 0x14], edx
mov esi, dword [ebp]
movzx eax, word [esi + 0x14]
lea ebx, [esi + 0x18]
add ebx, eax
mov eax, dword [ebp + 0x30]
neg eax
push ebx
push ebp
mov ecx, dword [ebx + 8]
and eax, ecx
mov dword [esp + 0x48], ecx
mov dword [esp + 0x30], ecx
mov ecx, edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x34], eax
call fcn.671308f2
mov edi, dword [ebx + 0x24]
add ebx, 0x28
and dword [esp + 0x38], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x30], eax
xor eax, eax
inc eax
mov dword [esp + 0x34], edi
mov dword [esp + 0x20], eax
cmp ax, word [esi + 6]
jae 0x67130794
mov esi, dword [ebp + 0x30]
mov eax, dword [ebx + 8]
neg esi
mov ecx, dword [esp + 0x14]
and esi, eax
push ebx
push ebp
mov dword [esp + 0x24], eax
call fcn.671308f2
mov ecx, eax
mov edx, dword [esp + 0x40]
mov dword [esp + 0x24], ecx
cmp dword [esp + 0x18], esi
je 0x67130748
mov eax, dword [esp + 0x10]
add eax, edx
cmp eax, esi
ja 0x67130748
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x28]
push eax
push ebp
call fcn.671305d5
test eax, eax
je 0x671307ab
mov edx, dword [esp + 0x1c]
mov eax, esi
mov edi, dword [ebx + 0x24]
mov dword [esp + 0x18], eax
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x40], edx
mov dword [esp + 0x28], edx
mov dword [esp + 0x30], eax
mov dword [esp + 0x10], eax
jmp 0x67130772
mov eax, dword [ebx + 0x24]
mov esi, 0x2000000
test esi, eax
je 0x6713075c
test esi, edi
je 0x6713075c
or edi, eax
jmp 0x67130764
or edi, eax
and edi, 0xfdffffff
sub ecx, edx
add ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x30], ecx
mov eax, dword [ebp]
add ebx, 0x28
mov ecx, dword [esp + 0x20]
inc ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x20], ecx
movzx eax, word [eax + 6]
cmp ecx, eax
jl 0x671306d7
xor eax, eax
inc eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x38], eax
lea eax, [esp + 0x28]
push eax
push ebp
call fcn.671305d5
test eax, eax
jne 0x671307af
xor eax, eax
jmp 0x671307b2
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 4
Function at 0x6713540d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
push edi
cmp dword [esi], 0
je 0x6713546e
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 8]
push 0
push 0
push eax
push 0
push edi
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x6713546e
push 4
pop eax
cmp dword [ebp - 8], eax
jne 0x6713546e
mov dword [ebp - 0xc], eax
xor ecx, ecx
lea eax, [ebp - 0xc]
mov dword [ebp - 4], ecx
push eax
lea eax, [ebp - 4]
push eax
push ecx
push ecx
push edi
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 4]
mov edx, eax
mov eax, dword [ebp + 8]
neg edx
sbb dl, dl
inc dl
mov dword [eax], ecx
mov byte [eax + 4], dl
jmp 0x67135478
mov eax, dword [ebp + 8]
and dword [eax], 0
mov byte [eax + 4], 0
pop edi
pop esi
leave
ret 0xc

Function at 0x6713547e
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x671b78c3
call fcn.671a2b02
mov esi, ecx
mov eax, sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
mov dword [ebp - 0x14], eax
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [esi], ecx
je 0x67135559
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x1c]
push eax
push ecx
lea eax, [ebp - 0x18]
push eax
push ecx
push edi
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x67135554
cmp dword [ebp - 0x18], 1
je 0x671354cf
cmp dword [ebp - 0x18], 2
jne 0x67135554
mov eax, dword [ebp - 0x1c]
cmp eax, 2
jbe 0x67135554
push 0
shr eax, 1
lea ecx, [ebp - 0x10]
push eax
call sym.Qt5Core.dll_public:_void___thiscall_QString::constructor_int__enum_Qt::Initialization_
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call sym.Qt5Core.dll_public:_void___thiscall_QString::detach_void_
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
add ecx, eax
lea eax, [ebp - 0x1c]
push eax
push ecx
lea eax, [ebp - 0x18]
push eax
push 0
push edi
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x67135532
push 1
push ecx
mov eax, esp
xor ecx, ecx
mov word [eax], cx
lea ecx, [ebp - 0x10]
call sym.Qt5Core.dll_public:_bool___thiscall_QString::endsWith_class_QChar__enum_Qt::CaseSensitivity_const
test al, al
je 0x6713553a
push 1
lea ecx, [ebp - 0x10]
call sym.Qt5Core.dll_public:_void___thiscall_QString::chop_int_
jmp 0x6713553a
lea ecx, [ebp - 0x10]
call sym.Qt5Core.dll_public:_void___thiscall_QString::clear_void_
mov esi, dword [ebp + 8]
mov eax, sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov dword [esi], ecx
lea ecx, [ebp - 0x10]
call sym.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_
jmp 0x67135561
mov eax, sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
mov esi, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov dword [esi], eax
lea ecx, [ebp - 0x14]
call sym.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_
mov eax, esi
call fcn.671a2adc
ret 0xc
Function at 0x671560be
Capabilities:
Parse credit card information

Disassembly:
push 0xc
mov eax, 0x671b9f4f
call fcn.671a2b02
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp + 8]
mov ecx, esi
call sym.Qt5Core.dll_public:_class_QChar_const____thiscall_QStringRef::unicode_void_const
mov edx, dword [esi + 8]
xor bl, bl
sub edx, 1
mov edi, eax
js 0x671561ae
mov eax, 0x100
cmp word [edi + edx*2], ax
jae 0x67156153
mov bl, byte [edi + edx*2]
cmp bl, 0x3b
ja 0x6715611f
cmp bl, 0x3a
jae 0x6715614e
cmp bl, 0xa
je 0x6715614e
cmp bl, 0xd
je 0x6715614e
cmp bl, 0x1f
jbe 0x67156133
cmp bl, 0x25
jbe 0x6715614e
cmp bl, 0x26
jbe 0x67156133
cmp bl, 0x2f
jbe 0x6715614e
jmp 0x67156133
cmp bl, 0x3d
je 0x6715614e
cmp bl, 0x3e
jbe 0x67156133
cmp bl, 0x40
jbe 0x6715614e
cmp bl, 0x5f
je 0x6715614e
cmp bl, 0x61
jb 0x6715613d
cmp bl, 0x7a
jbe 0x6715614e
cmp bl, 0x41
jb 0x67156147
cmp bl, 0x5a
jbe 0x6715614e
lea eax, [ebx - 0x30]
cmp al, 9
ja 0x67156153
sub edx, 1
jns 0x671560e7
test edx, edx
js 0x671561ae
push 0xffffffffffffffff
push 0
push str.Unexpected_character__1_in_public_id_literal.
lea eax, [ebp + 8]
push 0x67322110
push eax
call sym.Qt5Core.dll_public:_static_class_QString___cdecl_QCoreApplication::translate_char_const___char_const___char_const___int_
and dword [ebp - 4], 0
add esp, 0x10
mov eax, esp
movzx ecx, bl
push 0x20
pop edx
push 0
mov word [eax], dx
lea eax, [ebp - 0x14]
push ecx
push eax
lea ecx, [ebp + 8]
call sym.Qt5Core.dll_public:_class_QString___thiscall_QString::arg_class_QChar__int__class_QChar_
mov ecx, dword [ebp - 0x10]
push eax
push 3
mov byte [ebp - 4], 1
call fcn.6715b29c
lea ecx, [ebp - 0x14]
call sym.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_
lea ecx, [ebp + 8]
call sym.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_
call fcn.671a2adc
ret 4
Function at 0x67156f9d
Capabilities:
Parse credit card information

Disassembly:
push ebx
push ebp
push esi
push edi
mov ebp, ecx
xor ebx, ebx
call fcn.6715751d
mov esi, dword [esp + 0x14]
mov edx, eax
cmp edx, 0xffffffff
je 0x67157041
push 0x3a
pop edi
cmp edx, edi
ja 0x67157006
je 0x67156ff6
cmp edx, 0x23
ja 0x67156fe3
cmp edx, 0x20
jae 0x67157079
cmp edx, 9
jb 0x6715701f
cmp edx, 0xa
jbe 0x67157079
cmp edx, 0xd
jmp 0x6715701d
cmp edx, 0x25
jb 0x6715701f
cmp edx, 0x2c
jbe 0x67157079
cmp edx, 0x2f
jmp 0x6715701d
test esi, esi
je 0x6715706f
cmp dword [esi], 0
jne 0x6715706f
lea eax, [ebx + 2]
mov dword [esi], eax
jmp 0x6715701f
cmp edx, 0x3f
jbe 0x67157079
cmp edx, 0x5b
je 0x67157079
cmp edx, 0x5c
jbe 0x6715701f
cmp edx, 0x5e
jbe 0x67157079
cmp edx, 0x7c
je 0x67157079
movzx eax, dx
lea ecx, [ebp + 0x198]
push eax
call sym.Qt5Core.dll_public:_class_QString____thiscall_QString::operator_class_QChar_
mov ecx, ebp
inc ebx
call fcn.6715751d
mov edx, eax
cmp edx, 0xffffffff
jne 0x67156fbc
test esi, esi
je 0x67157048
and dword [esi], 0
lea edi, [ebp + 0x198]
mov ecx, ebp
mov eax, dword [edi]
mov esi, dword [eax + 4]
sub esi, ebx
push esi
push edi
call fcn.6715b1e3
push esi
mov ecx, edi
call sym.Qt5Core.dll_public:_void___thiscall_QString::resize_int_
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 4
push edi
mov ecx, ebp
call fcn.6715b0f8
jmp 0x67157098
push edx
mov ecx, ebp
call fcn.6715b0f8
test esi, esi
je 0x67157098
lea eax, [ebx + 1]
cmp dword [esi], eax
jne 0x67157098
and dword [esi], 0
mov ecx, ebp
push edi
call fcn.6715b0f8
dec ebx
mov eax, ebx
jmp 0x67157068
Function at 0x6717cfa2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esp + 4]
push 0x76
pop edx
mov eax, dword [ecx]
cmp word [eax], dx
jne 0x6717cfb9
movzx eax, byte [0x67495946]
jmp 0x6717cfbd
movzx eax, word [eax + 6]
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
push edi
xor edi, edi
mov dword [esi], eax
cmp dword [edx + 0xb0], edi
jne 0x6717cfda
xor eax, eax
jmp 0x6717d07e
mov eax, dword [ecx + 0x50]
shr eax, 1
inc eax
push ebx
mov ebx, dword [edx + 0xa8]
push ebp
lea ebp, [ecx + 0x4c]
push 0x76
mov dword [ebx + 8], eax
mov eax, dword [ecx + 0x48]
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], ebp
mov eax, dword [edx + 0x78]
mov dword [ebx + 0x14], eax
mov eax, dword [ecx + 0x38]
sub eax, dword [edx + 0x5c]
sar eax, 1
mov dword [ebx + 0x24], eax
mov eax, dword [ecx]
pop esi
movzx eax, word [eax + 2]
mov dword [ebx + 0x28], eax
mov eax, dword [ecx]
movzx eax, word [eax + 4]
mov dword [ebx + 0x2c], eax
mov eax, dword [ecx]
cmp word [eax], si
mov esi, dword [esp + 0x1c]
jne 0x6717d039
movzx eax, word [eax + 6]
mov dword [ebx + 4], eax
mov eax, edi
mov dword [ebx + 0x30], edi
mov dword [ebx + 0x38], edi
jmp 0x6717d052
mov dword [ebx + 4], edi
mov eax, dword [ecx]
movzx eax, word [eax + 8]
mov dword [ebx + 0x30], eax
mov eax, dword [ecx]
add eax, 0xc
mov dword [ebx + 0x38], eax
mov eax, dword [esi]
sub eax, 7
mov dword [ebx + 0x34], eax
mov edi, dword [ebp]
mov esi, dword [ebp + 4]
or dword [ebp + 4], 0xffffffff
or dword [ebp], 0xffffffff
push dword [edx + 0xac]
push ebx
call dword [edx + 0xb0]
pop ecx
pop ecx
mov dword [ebp], edi
mov dword [ebp + 4], esi
and dword [ebx + 0x3c], 0
pop ebp
pop ebx
pop edi
pop esi
ret
Function at 0x67187971
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
push ebx
push ebp
mov ebp, edx
mov ebx, ecx
push esi
push edi
cmp ebx, ebp
ja 0x671879df
cmp ebx, 1
jb 0x671879df
cmp dword [0x6753941c], 0
jne 0x671879a3
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x14]
dec eax
mov dword [0x6753941c], eax
mov edi, dword [esp + 0x38]
push dword [edi + 8]
push 0x10
call dword [edi]
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x671879df
mov ecx, dword [0x6753941c]
add ebp, ecx
push 4
not ecx
push 0x2000
and ebp, ecx
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x671879eb
push dword [edi + 8]
push esi
call dword [edi + 4]
pop ecx
pop ecx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 4
lea edx, [eax + ebp]
mov dword [esi + 0xc], eax
mov dword [esi + 4], edx
mov ecx, esi
mov dword [esi + 8], edx
sub edx, ebx
call fcn.67187a3a
test eax, eax
jne 0x67187a0f
mov edx, edi
mov ecx, esi
call fcn.67187a18
jmp 0x671879df
mov eax, dword [esi + 4]
mov dword [esi], eax
mov eax, esi
jmp 0x671879e1

Function at 0x67187bf8
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [0x67539418]
test eax, eax
jne 0x67187c11
push eax
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x67539418], eax
ret
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
ret
Function at 0x6719f66e
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
call fcn.67187bf8
mov edi, dword [0x67539420]
push 0x38
pop esi
cmp dword [esp + 0x10], esi
cmovae esi, dword [esp + 0x10]
add esi, 0xf
and esi, 0xfffffff8
jmp 0x6719f69a
mov ebx, dword [edi + 0x10]
cmp ebx, esi
jae 0x6719f6d3
mov edi, dword [edi + 8]
test edi, edi
jne 0x6719f690
push 0x40
lea edi, [esi + 0x10007]
push 0x3000
and edi, 0xffff0000
push edi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
test ebx, ebx
jne 0x6719f70c
push dword [0x67539418]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
jmp 0x6719f768
lea eax, [esi + 0x40]
cmp ebx, eax
jbe 0x6719f6ea
sub ebx, esi
mov dword [edi + 0x10], ebx
add edi, ebx
mov dword [edi + 4], ebx
mov dword [edi + esi + 4], esi
jmp 0x6719f6f3
push edi
call fcn.6719f76c
pop ecx
mov esi, ebx
push dword [0x67539418]
add dword [0x67539424], esi
mov dword [edi], esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea eax, [edi + 8]
jmp 0x6719f768
and dword [ebx + 4], 0
lea eax, [esi + 0x40]
sub edi, 8
add dword [0x67539428], edi
cmp edi, eax
jbe 0x6719f73f
sub edi, esi
mov dword [ebx], esi
lea edx, [ebx + esi]
push edi
push edx
mov dword [edx + 4], esi
call fcn.6719f646
mov eax, dword [0x67539424]
pop ecx
pop ecx
lea ecx, [edi + edx]
add eax, esi
jmp 0x6719f74b
mov eax, dword [0x67539424]
lea ecx, [ebx + edi]
mov dword [ebx], edi
add eax, edi
push dword [0x67539418]
mov dword [0x67539424], eax
mov dword [ecx], 1
mov dword [ecx + 4], edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea eax, [ebx + 8]
pop edi
pop esi
pop ebx
ret
Function at 0x80010c0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x20
push ebx
push esi
mov esi, ecx
push edi
push str.KERNEL32.DLL
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, dword [ebp + 0xc]
mov dword [esi + 8], eax
test ebx, ebx
je 0x8001187
mov dword [0x8018230], 0
lea eax, [ebp - 0x20]
mov dword [ebp - 0xc], 0xc
push 1
push eax
mov dword [ebp - 4], 1
mov dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov edi, dword [esi + 4]
lea eax, [ebp - 0xc]
push ebx
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi], eax
mov eax, dword [edi]
shr eax, 0x1f
test al, al
jne 0x800117c
push ebx
push 0
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, eax
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [edi]
shr ecx, 0x1f
test cl, cl
jne 0x800116e
mov dword [edi], 0
mov eax, dword [edi]
or eax, 0x80000000
mov dword [edi], eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edi, dword [0x5501003c]

Function at 0x80014d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push esi
push dword [ebp + 8]
call fcn.080011e0
add esp, 0x10
lea ecx, [ebp - 0xb0]
invalid
call dword [ecx - 1]
ror byte [ebx - 0x727407bb], 1
push esp
invalid
invalid
push dword [ebx]
sal bh, cl
int1
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x8001509
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl

Function at 0x8001520
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.0800121b
popal
mov dword [0x458d2756], eax
rcl byte [eax - 0x18], 0xc5
cld
invalid