joyce8/EMBER2024-capa huggingface dataset:
Function at 0x60a620
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa4
call fcn.005679e0
mov eax, dword [0x751f00]
xor eax, esp
mov dword [esp + 0xa0], eax
mov ecx, dword [esp + 0xac]
mov eax, dword [esp + 0xa8]
push ebx
mov ebx, dword [esp + 0xb8]
push ebp
push esi
mov esi, dword [ecx + 4]
push edi
mov edi, dword [esp + 0xc0]
mov dword [esp + 0x18], esi
sub esi, edi
xor ebp, ebp
mov dword [esp + 0x28], eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebp
cmp ebx, edi
jae 0x60a68a
push str.orig_len___md_size
push 0xf8
push str.._ssl_s3_cbc.c
call fcn.005b9780
add esp, 0xc
cmp edi, 0x40
jbe 0x60a6a6
push str.md_size___EVP_MAX_MD_SIZE
push 0xf9
push str.._ssl_s3_cbc.c
call fcn.005b9780
add esp, 0xc
lea ecx, [esp + 0x30]
neg ecx
and ecx, 0x3f
lea edx, [edi + 0x100]
lea ecx, [esp + ecx + 0x30]
mov dword [esp + 0x1c], ecx
cmp ebx, edx
jbe 0x60a6d0
mov eax, ebx
sub eax, edi
sub eax, 0x100
mov dword [esp + 0x10], eax
mov ebp, eax
mov eax, edi
and eax, 0xfffffffe
shl eax, 0x17
sub eax, ebp
add eax, esi
xor edx, edx
div edi
push edi
push 0
push ecx
mov ebx, edx
mov dword [esp + 0x30], ebx
call fcn.0055e5f0
mov edx, dword [esp + 0x1c]
add esp, 0xc
xor esi, esi
cmp edx, dword [esp + 0xc4]
jae 0x60a7af
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
sub edx, ecx
mov ebx, ecx
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0xbc]
mov edx, dword [edx + 0xc]
shr eax, 0x1f
shr ebx, 0x1f
sub ecx, dword [esp + 0x14]
mov dword [esp + 0x20], eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], edx
jmp 0x60a748
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x10]
add ecx, ebx
shr ecx, 0x1f
xor cl, al
mov edx, ebp
shr edx, 0x1f
xor al, dl
or cl, al
mov eax, ebx
mov bl, byte [esp + 0x2c]
shr eax, 0x1f
xor al, bl
xor bl, dl
or al, bl
xor al, dl
dec al
xor cl, dl
mov edx, dword [esp + 0x14]
mov dl, byte [edx + ebp]
not al
inc dword [esp + 0x10]
and al, dl
dec cl
and al, cl
mov ecx, dword [esp + 0x1c]
or byte [esi + ecx], al
inc esi
mov eax, esi
sub eax, edi
xor eax, edi
mov ecx, esi
xor ecx, edi
or eax, ecx
xor eax, esi
shr eax, 0x1f
neg eax
inc ebp
and esi, eax
cmp ebp, dword [esp + 0xc4]
jb 0x60a740
mov ebx, dword [esp + 0x24]
xor eax, eax
test edi, edi
jbe 0x60a7e6
mov esi, dword [esp + 0x1c]
mov edx, ebx
xor edx, 0x20
mov cl, byte [edx + esi]
mov dl, byte [ebx + esi]
mov ecx, dword [esp + 0x28]
mov byte [ecx + eax], dl
inc ebx
mov edx, ebx
sub edx, edi
xor edx, edi
mov ecx, ebx
xor ecx, edi
or edx, ecx
xor edx, ebx
shr edx, 0x1f
neg edx
inc eax
and ebx, edx
cmp eax, edi
jb 0x60a7b5
mov ecx, dword [esp + 0xb0]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0055e7fd
add esp, 0xa4
ret
Function at 0x627270
Capabilities:
Set socket configuration

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
push esi
lea ecx, [esp + 0xc]
push ecx
push 0x8004667e
push edx
mov dword [esp + 0x18], eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov esi, eax
test esi, esi
jge 0x6272b1
push 0x248
push str..crypto_bio_b_sock.c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 5
push 2
call fcn.0059d640
add esp, 0x14
xor eax, eax
test esi, esi
sete al
pop esi
ret

Function at 0x6272c0
Capabilities:
Resolve dns

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
push edi
push esi
mov ecx, ebp
mov ebx, 1
call fcn.00626f40
mov edi, eax
add esp, 4
test edi, edi
jge 0x6272ff
push 0x88
push str..crypto_bio_b_sock.c
push 0x6c
push 0x6a
push 0x20
call fcn.0059d640
add esp, 0x14
jmp 0x6273bd
call fcn.00626e60
cmp eax, 1
jne 0x6273cd
test edi, edi
jle 0x627318
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret
push 0xa1
push str..crypto_bio_b_sock.c
push 0x16
push 9
call fcn.005b97f0
add esp, 0x10
push ebp
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x627353
push 0xa7
push str..crypto_bio_b_sock.c
push 0x66
push 0x6a
push 0x20
call fcn.0059d640
add esp, 0x14
jmp 0x6273a3
cmp word [eax + 8], 2
je 0x627374
push 0xae
push str..crypto_bio_b_sock.c
push 0x6b
push 0x6a
push 0x20
call fcn.0059d640
add esp, 0x14
jmp 0x6273a3
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
movzx ecx, byte [edx]
mov byte [esi], cl
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
mov dl, byte [ecx + 1]
mov byte [esi + 1], dl
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
movzx ecx, byte [edx + 2]
mov byte [esi + 2], cl
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
movzx ecx, byte [eax + 3]
mov byte [esi + 3], cl
xor ebx, ebx
push 0xb7
push str..crypto_bio_b_sock.c
push 0x16
push 0xa
call fcn.005b97f0
add esp, 0x10
test ebx, ebx
je 0x6273d4
push ebp
push 0x6f8380
push 2
call fcn.0059dbf0
add esp, 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x6581e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
mov ebx, dword [esp + 0x10]
cmp ecx, dword [ebx + 4]
push esi
push edi
jge 0x6581f9
mov esi, ebx
mov ebx, eax
jmp 0x6581fb
mov esi, eax
mov eax, dword [esi + 4]
mov edi, dword [esp + 0x10]
cmp eax, dword [edi + 8]
jg 0x65820b
mov eax, edi
jmp 0x658215
push eax
push edi
call fcn.005a58d0
add esp, 8
test eax, eax
jne 0x65821d
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [ebx + 4], eax
jle 0x658239
mov edx, dword [esi]
mov ecx, dword [ebx]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [edi]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [ebx + 4]
jl 0x658224
cmp eax, dword [esi + 4]
jge 0x658250
mov edi, edi
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [edi]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [esi + 4]
jl 0x658240
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
test eax, eax
jle 0x658271
mov ecx, dword [edi]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x65826e
dec eax
test eax, eax
jg 0x658260
mov dword [edi + 4], eax
cmp dword [edi + 4], 0
jne 0x65827e
mov dword [edi + 0xc], 0
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x6584f0
Capabilities:
Inspect section memory permissions

Disassembly:
mov eax, 4
call fcn.005679e0
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
xor ebp, ebp
push ebx
mov dword [esp + 0x10], ebp
call fcn.005de900
push ebx
call fcn.005de990
mov esi, eax
add esp, 8
test esi, esi
je 0x658721
push edi
mov edi, dword [esp + 0x1c]
mov eax, dword [edi + 4]
add eax, eax
cmp eax, dword [esi + 8]
jg 0x658533
mov eax, esi
jmp 0x65853d
push eax
push esi
call fcn.005a58d0
add esp, 8
test eax, eax
je 0x658720
mov ecx, dword [edi + 4]
sub ecx, 1
js 0x6586d4
mov eax, dword [edi]
mov eax, dword [eax + ecx*4]
mov edx, eax
shr edx, 1
and edx, 0x8000
mov ebp, eax
and ebp, 0x20000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x40000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x80000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x100000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x200000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x400000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x800000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x1000000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x2000000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x4000000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x8000000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x10000000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x20000000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x40000000
or edx, ebp
shr edx, 1
and eax, reloc.WS2_32.dll_accept
or edx, eax
mov eax, dword [esi]
shr edx, 1
mov dword [eax + ecx*8 + 4], edx
mov edx, dword [edi]
mov eax, dword [edx + ecx*4]
mov edx, eax
and edx, 0x8000
add edx, edx
mov ebp, eax
and ebp, 0x4000
or edx, ebp
add edx, edx
mov ebp, eax
and ebp, 0x2000
or edx, ebp
mov ebp, eax
add edx, edx
and ebp, 0x1000
or edx, ebp
add edx, edx
mov ebp, eax
and ebp, 0x800
or edx, ebp
add edx, edx
mov ebp, eax
and ebp, 0x400
or edx, ebp
add edx, edx
mov ebp, eax
and ebp, 0x200
or edx, ebp
add edx, edx
mov ebp, eax
and ebp, 0x100
or edx, ebp
add edx, edx
mov ebp, eax
and ebp, 0x80
or edx, ebp
add edx, edx
mov ebp, eax
and ebp, 0x40
or edx, ebp
add edx, edx
mov ebp, eax
and ebp, 0x20
or edx, ebp
add edx, edx
mov ebp, eax
and ebp, 0x10
or edx, ebp
add edx, edx
mov ebp, eax
and ebp, 8
or edx, ebp
add edx, edx
mov ebp, eax
and ebp, 4
or edx, ebp
mov ebp, eax
add edx, edx
and ebp, 2
or edx, ebp
and eax, 1
add edx, edx
or edx, eax
sub ecx, 1
mov eax, dword [esi]
mov dword [eax + ecx*8 + 8], edx
jns 0x658551
mov ebp, dword [esp + 0x10]
mov eax, dword [edi + 4]
add eax, eax
mov dword [esi + 4], eax
test eax, eax
jle 0x6586f7
mov ecx, dword [esi]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x6586f4
dec eax
test eax, eax
jg 0x6586e6
mov dword [esi + 4], eax
cmp dword [esi + 4], 0
jne 0x658704
mov dword [esi + 0xc], 0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
push eax
push esi
push ecx
call fcn.00658290
add esp, 0xc
test eax, eax
je 0x658720
mov ebp, 1
pop edi
push ebx
call fcn.005de950
add esp, 4
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret
Function at 0x668847
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 0xa0
call fcn.005679e0
mov eax, dword [0x751f00]
xor eax, esp
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0xa8]
push ebp
mov ebp, dword [esp + 0xa8]
push esi
mov esi, ecx
test eax, eax
jbe 0x6689b4
push ebx
dec eax
push edi
lea edi, [ebp + 0xc]
shr eax, 3
add ebp, 0x14
inc eax
mov dword [esp + 0x18], eax
movzx ebx, byte [esi]
movzx eax, byte [esi + 1]
inc esi
movzx ecx, byte [esi + 1]
inc esi
movzx edx, byte [esi + 1]
shl eax, 8
or ebx, eax
inc esi
movzx eax, byte [esi + 1]
inc esi
shl ecx, 0x10
or ebx, ecx
movzx ecx, byte [esi + 1]
shl edx, 0x18
inc esi
or ebx, edx
movzx edx, byte [esi + 1]
inc esi
shl ecx, 8
or eax, ecx
movzx ecx, byte [esi + 1]
inc esi
shl edx, 0x10
or eax, edx
mov dl, byte [edi]
shl ecx, 0x18
or eax, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
mov al, byte [ebp]
and dl, 0xdf
and al, 0xbf
or dl, 0x40
or al, 0x20
push edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebx
inc esi
mov byte [edi], dl
mov byte [ebp], al
call fcn.005b7d90
lea ecx, [esp + 0x30]
push ecx
push edi
call fcn.005b7e90
push 1
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x38]
push eax
call fcn.00601c40
push ebp
call fcn.005b7d90
lea ecx, [esp + 0x48]
push ecx
push ebp
call fcn.005b7e90
push 1
lea edx, [esp + 0x54]
push edx
lea eax, [esp + 0x48]
push eax
call fcn.00601c40
mov eax, dword [esp + 0x50]
xor eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x58]
xor dword [esp + 0x40], edx
xor ecx, ebx
xor ebx, dword [esp + 0x54]
mov dword [esp + 0x44], eax
mov eax, edi
mov byte [eax], bl
mov edx, ebx
inc eax
shr edx, 8
add esp, 0x30
mov byte [eax], dl
inc eax
inc eax
mov edx, ebx
shr edx, 0x10
mov byte [eax - 1], dl
mov edx, dword [esp + 0x14]
inc eax
shr ebx, 0x18
mov byte [eax - 1], bl
mov byte [eax], dl
mov ebx, edx
inc eax
inc eax
shr ebx, 8
mov byte [eax - 1], bl
mov ebx, edx
shr edx, 0x18
shr ebx, 0x10
mov byte [eax], bl
mov byte [eax + 1], dl
mov edx, ecx
shr edx, 8
mov eax, ebp
mov byte [eax], cl
mov byte [eax + 1], dl
inc eax
inc eax
mov edx, ecx
shr edx, 0x10
mov byte [eax], dl
inc eax
shr ecx, 0x18
mov byte [eax], cl
mov ecx, dword [esp + 0x10]
inc eax
mov byte [eax], cl
mov edx, ecx
shr edx, 8
inc eax
mov byte [eax], dl
mov edx, ecx
inc eax
shr edx, 0x10
shr ecx, 0x18
sub dword [esp + 0x18], 1
mov byte [eax], dl
mov byte [eax + 1], cl
jne 0x668863
pop edi
pop ebx
mov ecx, dword [esp + 0xa4]
pop esi
pop ebp
xor ecx, esp
call fcn.0055e7fd
add esp, 0xa0
ret
Function at 0x689ef0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6bca13
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x751f00]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov edx, 7
xor ecx, ecx
xor esi, esi
mov dword [eax + 0x18], edx
mov dword [eax + 0x14], ecx
mov word [eax + 4], si
mov dword [eax + 0x34], edx
xor edx, edx
mov dword [eax + 0x30], ecx
mov word [eax + 0x20], dx
mov dword [eax + 0x50], 0xf
mov dword [eax + 0x4c], ecx
mov byte [eax + 0x3c], cl
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x68b1f0
Capabilities:
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x6bcdd3
mov eax, dword fs:[0]
push eax
sub esp, 0x54
push ebx
push ebp
push esi
push edi
mov eax, dword [0x751f00]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov edi, dword [esp + 0x7c]
xor ebp, ebp
push ebp
push ebp
mov dword [esp + 0x1c], ebp
mov ebx, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push edi
call ebx
push eax
lea ecx, [esp + 0x1c]
call fcn.0068b120
mov esi, dword [esp + 0x28]
sub esi, dword [esp + 0x24]
mov dword [esp + 0x70], 1
sar esi, 1
je 0x68b28e
cmp esi, ebp
ja 0x68b253
call fcn.00563e1a
mov eax, dword [esp + 0x24]
push esi
push eax
push edi
call ebx
test eax, eax
je 0x68b28e
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x24]
sar ecx, 1
jne 0x68b271
call fcn.00563e1a
mov edx, dword [esp + 0x24]
push edx
lea ecx, [esp + 0x50]
call fcn.00685fe0
mov ebx, 1
mov byte [esp + 0x70], 2
lea edi, [ebx + 6]
jmp 0x68b2b3
mov edi, 7
xor eax, eax
mov dword [esp + 0x48], edi
mov dword [esp + 0x44], ebp
mov word [esp + 0x34], ax
lea eax, [esp + 0x30]
mov dword [esp + 0x70], 3
mov ebx, 2
mov esi, dword [esp + 0x78]
push 0xffffffffffffffff
xor ecx, ecx
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], ebp
push ebp
mov word [esi + 4], cx
push eax
mov ecx, esi
mov dword [esp + 0x20], ebx
call fcn.00466b20
or ebx, 4
test bl, 2
je 0x68b300
and ebx, 0xfffffffd
cmp dword [esp + 0x48], 8
jb 0x68b2f1
mov edx, dword [esp + 0x34]
push edx
call fcn.0051aa4c
add esp, 4
xor eax, eax
mov dword [esp + 0x48], edi
mov dword [esp + 0x44], ebp
mov word [esp + 0x34], ax
test bl, 1
je 0x68b328
cmp dword [esp + 0x64], 8
jb 0x68b319
mov ecx, dword [esp + 0x50]
push ecx
call fcn.0051aa4c
add esp, 4
xor edx, edx
mov dword [esp + 0x64], edi
mov dword [esp + 0x60], ebp
mov word [esp + 0x50], dx
mov eax, dword [esp + 0x24]
cmp eax, ebp
je 0x68b339
push eax
call fcn.0051aa4c
add esp, 4
mov eax, dword [esp + 0x18]
push eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
call fcn.0051aa4c
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret
Function at 0x68d160
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x6bd1b0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x751f00]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov edi, dword [esp + 0x48]
cmp dword [edi + 0x18], 8
lea esi, [edi + 4]
jb 0x68d197
mov eax, dword [esi]
jmp 0x68d199
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x68d1cf
mov eax, dword [esp + 0x4c]
mov esi, dword [esp + 0x44]
push eax
push edi
push esi
call fcn.0068bd20
add esp, 0xc
mov eax, esi
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x30
ret
test ebx, 0x400
je 0x68d2b0
cmp dword [edi + 0x18], 8
jb 0x68d1e3
mov esi, dword [esi]
push esi
lea ecx, [esp + 0x1c]
call fcn.006865f0
cmp dword [esp + 0x30], 8
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x3c], 0
jae 0x68d204
lea eax, [esp + 0x1c]
push 0
push 0x2000000
push 3
push 0
push 7
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [esp + 0x48], esi
cmp dword [esp + 0x30], 8
mov byte [esp + 0x3c], 2
jb 0x68d239
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.0051aa4c
add esp, 4
xor edx, edx
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], dx
cmp esi, 0xffffffff
je 0x68d1a7
push edi
call fcn.00689a30
add esp, 4
test al, al
jne 0x68d2a1
push ebx
push edi
call fcn.0068a370
mov edi, dword [esp + 0x4c]
add esp, 8
push esi
mov dword [edi], 9
mov dword [edi + 4], eax
mov dword [esp + 0x40], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x30
ret
push esi
mov dword [esp + 0x40], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x4c]
test esi, esi
je 0x68d2c6
mov dword [esi], 0
call fcn.00690ba0
mov dword [esi + 4], eax
push ebx
push edi
mov dword [esp + 0x18], 3
test bl, 0x10
jne 0x68d2dd
mov dword [esp + 0x18], 2
call fcn.0068a370
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], eax
mov edx, dword [ecx]
mov eax, dword [esp + 0x4c]
mov ecx, dword [ecx + 4]
add esp, 8
mov dword [eax], edx
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x30
ret
Function at 0x68d310
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [esp + 0x18]
cmp dword [esi + 0x18], 8
jb 0x68d324
mov eax, dword [esi + 4]
jmp 0x68d327
lea eax, [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x68d350
mov eax, dword [esp + 0x1c]
push eax
push esi
mov esi, dword [esp + 0x1c]
push esi
call fcn.0068bd20
add esp, 0xc
mov eax, esi
pop esi
pop ebx
add esp, 8
ret
push edi
mov edi, dword [esp + 0x20]
test edi, edi
je 0x68d367
mov dword [edi], 0
call fcn.00690ba0
mov dword [edi + 4], eax
pop edi
test ebx, 0x400
je 0x68d391
push esi
call fcn.00689a30
add esp, 4
push ebx
push esi
mov dword [esp + 0x10], 4
test al, al
jne 0x68d3a8
mov dword [esp + 0x10], 9
jmp 0x68d3a8
push ebx
push esi
mov dword [esp + 0x10], 3
test bl, 0x10
jne 0x68d3a8
mov dword [esp + 0x10], 2
call fcn.0068a370
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x10]
mov edx, dword [ecx]
mov ecx, dword [ecx + 4]
add esp, 8
pop esi
mov dword [eax + 4], ecx
mov dword [eax], edx
pop ebx
add esp, 8
ret

Function at 0x692799
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x6927ca
call fcn.0056b05b
mov dword [eax], esi
call fcn.0056b048
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00563df4
add esp, 0x14
or eax, 0xffffffff
jmp 0x692805
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x6927e7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0056b06e
pop ecx
jmp 0x6927c5
test byte [ebp + 0xc], 0x80
je 0x6927f2
and eax, 0xfffffffe
jmp 0x6927f5
or eax, 1
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x6927d8
xor eax, eax
pop esi
pop ebp
ret
Function at 0x693e07
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0056fa21
and dword [ebp - 4], 0
cmp dword [0x77e108], 0
mov ebx, eax
jne 0x693eb8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x693f69
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push edi
call esi
test eax, eax
je 0x693f69
push eax
call fcn.0056f9af
mov dword [esp], 0x6db380
push edi
mov dword [0x77e108], eax
call esi
push eax
call fcn.0056f9af
mov dword [esp], 0x6db36c
push edi
mov dword [0x77e10c], eax
call esi
push eax
call fcn.0056f9af
mov dword [esp], 0x71cde0
push edi
mov dword [0x77e110], eax
call esi
push eax
call fcn.0056f9af
pop ecx
mov dword [0x77e118], eax
test eax, eax
je 0x693eb8
push 0x6db338
push edi
call esi
push eax
call fcn.0056f9af
pop ecx
mov dword [0x77e114], eax
mov eax, dword [0x77e114]
cmp eax, ebx
je 0x693f10
cmp dword [0x77e118], ebx
je 0x693f10
push eax
call fcn.0056fa2a
push dword [0x77e118]
mov esi, eax
call fcn.0056fa2a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x693f10
test edi, edi
je 0x693f10
call esi
test eax, eax
je 0x693f07
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x693f07
test byte [ebp - 0xc], 1
jne 0x693f10
or dword [ebp + 0x10], 0x200000
jmp 0x693f49
mov eax, dword [0x77e10c]
cmp eax, ebx
je 0x693f49
push eax
call fcn.0056fa2a
pop ecx
test eax, eax
je 0x693f49
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x693f49
mov eax, dword [0x77e110]
cmp eax, ebx
je 0x693f49
push eax
call fcn.0056fa2a
pop ecx
test eax, eax
je 0x693f49
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x77e108]
call fcn.0056fa2a
pop ecx
test eax, eax
je 0x693f69
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x693f6b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40d0651c
Capabilities:
Encode data using xor

Disassembly:
call 0x40d06495
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or eax, dword [ebx - 0x178f73c]
xor esi, 0xde5af04
add eax, esi
lea esp, [esp - 0xe]
mov esi, dword [esp + 0xe]
lea esp, [esp + 0x12]
xor esi, dword [esp]
push eax
sub eax, 0xf24f2b00
mov eax, esp
or dword [eax - 0x22], ebx
pop eax
jmp 0x40d064c5
xor dword [esp], esi
xor eax, 0
mov dword [esp], esi
add esp, 4
add esi, dword [ebp + 8]
push ebp
add ebp, 0xc
mov ecx, dword [ebp]
pop ebp
ja 0x40d064e1
xor edx, 0
jmp 0x40d064ec
xor edx, edx
jmp 0x40d06503
jmp 0x40d0650f
xor eax, eax
push 0x8427d7c0
call 0x40d0651c
stc
add esp, 8
add esi, 0
cmp ecx, 0
je 0x40d06558
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0x40d06531
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
or eax, edx
xor eax, eax
add eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
xchg dword [esp], ecx
mov dword [esp], ecx
lea esp, [esp + 4]
pop edx
leave
je 0x40d0656f
add eax, 0
jno 0x40d06574
add esi, 0
ret 0x10

Function at 0x40d072dd
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp - 0x63]
mov dword [esp + 0x5f], ebx
lea esp, [esp + 0x5f]
mov ebx, 0x8dff8662
xchg dword [esp], ebx
and dword [esp], ebp
jmp 0x40d072ff
add ebx, 0
or dword [esp], ebp
mov ebp, esp
push eax
push edi
lea esp, [esp - 4]
xchg dword [esp], ecx
pop ecx
lea esp, [esp - 4]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp + 0x14]
ja 0x40d074a1
cmp edi, dword [ebp + 0x10]
jb 0x40d074a1
lea esi, [esi]
sub esi, 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
sub esp, 0x6a
mov dword [esp + 0x66], 0xc2ccbc3c
add esp, 0x66
mov dword [esp], edi
or edi, 0xffffffff
and edi, 0xcedcf875
xor edi, 0xce9c140e
xchg dword [esp], edi
push edx
mov edx, esp
xor edx, 0
add edx, 0
push ebx
lea ebx, [edx + 4]
mov dword [ebx], eax
pop ebx
pop edx
push edi
call fcn.40d06dc9
inc edi
jmp 0x40d07388
jmp 0x40d07395
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.40d06dc9
inc edi
and dword [esp - 0x4e], ecx
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.40d06dc9
inc edi
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push 0
sub esi, 0
add dword [esp], edx
xor edx, edx
je 0x40d073e9
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or edx, 0x13e27bd2
push ebx
add ebx, esi
mov ebx, esp
xor dword [ebx - 0x2a], edi
fdiv qword [ecx]
jnp 0x40d073cd
pop ebx
xor edx, 0x1b7d0cc
add edx, 0xedeb415d
xchg dword [esp], edx
push edx
mov edx, esp
call int.40d07417
add dword [eax], 0x39
jle 0x40d073f3
sub al, 0xf5
mov ch, al
call fcn.40d0742c
mov dword [edi], eax
pop ecx
pop edi
pop eax
leave
ret 0x10