joyce8/EMBER2024-capa huggingface dataset:
Function at 0x671950
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x28
call fcn.006d13f0
mov eax, dword [0x7c0ab4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
lea edx, [eax + 1]
mov dword [ebp - 0x28], eax
movzx ecx, byte [edx + 3]
movzx ebx, byte [eax]
movzx eax, byte [edx]
shl eax, 0x10
shl ebx, 0x18
or ebx, eax
shl ecx, 0x18
movzx eax, byte [edx + 1]
shl eax, 8
or ebx, eax
mov dword [ebp - 0x14], 0
movzx eax, byte [edx + 2]
or ebx, eax
movzx eax, byte [edx + 4]
shl eax, 0x10
or ecx, eax
mov dword [ebp - 0x20], ebx
movzx eax, byte [edx + 6]
mov dword [ebp - 8], ecx
movzx ecx, byte [edx + 5]
mov edx, dword [ebp - 8]
shl ecx, 8
or ecx, eax
mov byte [ebp - 9], bl
mov eax, ebx
or edx, ecx
shr eax, 0x18
mov byte [ebp - 0xc], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0xb], al
mov eax, ebx
shr eax, 8
mov byte [ebp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [ebp - 8], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 7], al
mov eax, edx
shr eax, 8
mov edi, dword [ebp + 0x1c]
mov byte [ebp - 6], al
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], edi
mov esi, dword [edi]
mov dword [ebp - 0x1c], edx
mov byte [ebp - 5], dl
test eax, eax
je 0x671ae3
mov edi, dword [ebp + 8]
sub dword [ebp - 0x10], edi
nop dword [eax]
dec eax
mov dword [ebp + 0x10], eax
test esi, esi
jne 0x671a76
push dword [ebp - 0x24]
lea eax, [ebp - 0x20]
push eax
call fcn.00671320
mov ebx, dword [ebp - 0x20]
add esp, 8
mov edx, dword [ebp - 0x1c]
mov eax, ebx
shr eax, 0x18
mov byte [ebp - 0xc], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0xb], al
mov eax, ebx
shr eax, 8
mov byte [ebp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [ebp - 8], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 7], al
mov eax, edx
shr eax, 8
inc dword [ebp - 0x14]
mov byte [ebp - 9], bl
mov byte [ebp - 6], al
mov byte [ebp - 5], dl
mov al, byte [ebp + esi - 0xc]
inc esi
mov ecx, dword [ebp - 0x10]
and esi, 7
xor al, byte [edi]
mov byte [ecx + edi], al
inc edi
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x14]
test eax, eax
jne 0x671a20
test ecx, ecx
je 0x671acd
mov edi, dword [ebp - 0x28]
mov eax, ebx
shr eax, 0x18
mov byte [edi], al
mov eax, ebx
shr eax, 0x10
mov byte [edi + 1], al
mov eax, ebx
shr eax, 8
mov byte [edi + 2], al
mov eax, edx
shr eax, 0x18
mov byte [edi + 3], bl
mov byte [edi + 4], al
mov eax, edx
shr eax, 0x10
mov byte [edi + 5], al
mov eax, edx
shr eax, 8
mov byte [edi + 6], al
mov byte [edi + 7], dl
mov eax, dword [ebp - 0x18]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006d0856
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov dword [edi], esi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.006d0856
mov esp, ebp
pop ebp
ret
Function at 0x6755e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x1c], 0
je 0x6755f6
mov dword [ebp + 0x1c], fcn.00673dd0
pop ebp
jmp fcn.00604450
mov dword [ebp + 0x1c], fcn.00673090
pop ebp
jmp fcn.006041d0
Function at 0x680890
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10
call fcn.006d13f0
mov ecx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
shr ecx, 3
mov dword [ebp - 8], ecx
cmp esi, dword [ebp + 0x14]
jb 0x680a8a
push ebx
push edi
nop word [eax + eax]
mov dword [ebp - 4], 0
test ecx, ecx
je 0x680a6a
mov esi, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
movzx eax, byte [ecx + 7]
cdq
mov edi, eax
mov ebx, edx
movzx eax, byte [ecx + 6]
shld ebx, edi, 8
cdq
shl edi, 8
or ebx, edx
or edi, eax
movzx eax, byte [ecx + 5]
shld ebx, edi, 8
cdq
shl edi, 8
or ebx, edx
or edi, eax
movzx eax, byte [ecx + 4]
shld ebx, edi, 8
cdq
shl edi, 8
or ebx, edx
or edi, eax
movzx eax, byte [ecx + 3]
cdq
shld ebx, edi, 8
shl edi, 8
or ebx, edx
or edi, eax
movzx eax, byte [ecx + 2]
cdq
shld ebx, edi, 8
shl edi, 8
or ebx, edx
or edi, eax
movzx eax, byte [ecx + 1]
cdq
shld ebx, edi, 8
shl edi, 8
or ebx, edx
or edi, eax
movzx eax, byte [ecx]
cdq
add ecx, 8
mov dword [ebp + 0xc], ecx
shld ebx, edi, 8
shl edi, 8
or ebx, edx
or edi, eax
mov eax, edi
and eax, 0x55555555
mov ecx, eax
shr ecx, 1
or ecx, eax
and ecx, 0x33333333
mov eax, ecx
shr eax, 2
or eax, ecx
and eax, 0xf0f0f0f
mov ecx, eax
shr ecx, 4
or ecx, eax
mov eax, ebx
and ecx, 0xff00ff
and eax, 0x55555555
mov dword [ebp - 0x10], ecx
mov ecx, eax
shr ecx, 1
or ecx, eax
and ecx, 0x33333333
mov eax, ecx
shr eax, 2
or eax, ecx
and eax, 0xf0f0f0f
mov ecx, eax
shr ecx, 4
or ecx, eax
and ecx, 0xff00ff
and edi, 0xaaaaaaaa
mov dword [ebp - 0xc], ecx
lea eax, [edi + edi]
or eax, edi
and ebx, 0xaaaaaaaa
and eax, 0xcccccccc
lea ecx, [eax*4]
or ecx, eax
lea eax, [ebx + ebx]
or eax, ebx
and ecx, 0xf0f0f0f0
and eax, 0xcccccccc
mov edi, ecx
shl edi, 4
or edi, ecx
and edi, 0xff00ff00
lea ecx, [eax*4]
mov ebx, edi
or ecx, eax
shr ebx, 8
and ecx, 0xf0f0f0f0
and edi, 0xffff00
mov edx, ecx
or ebx, edi
shl edx, 4
or edx, ecx
shr ebx, 8
and edx, 0xff00ff00
mov eax, edx
shl eax, 8
or eax, edx
xor edx, edx
and eax, 0xffff0000
or ebx, eax
mov eax, dword [ebp - 0xc]
mov ecx, eax
shl eax, 8
and ecx, 0xffffff00
or ecx, eax
mov eax, dword [ebp - 0x10]
shr eax, 8
or eax, dword [ebp - 0x10]
shl ecx, 8
movzx eax, ax
or ecx, eax
mov eax, dword [ebp - 4]
or edx, ecx
mov ecx, dword [ebp + 8]
xor dword [ecx + eax*8], edx
xor dword [ecx + eax*8 + 4], ebx
inc eax
mov dword [ebp - 4], eax
cmp eax, esi
jb 0x6808d2
mov esi, dword [ebp + 0x10]
jmp 0x680a6d
mov ecx, dword [ebp + 8]
push ecx
call fcn.0067fff0
sub esi, dword [ebp + 0x14]
add esp, 4
mov ecx, dword [ebp - 8]
mov dword [ebp + 0x10], esi
cmp esi, dword [ebp + 0x14]
jae 0x6808c0
pop edi
pop ebx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x680dd0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xa4
call fcn.006d13f0
mov eax, dword [0x7c0ab4]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x680fa5
push ebx
dec edi
lea ebx, [edx + 0xc]
add edx, 0x14
shr edi, 3
push esi
mov esi, dword [ebp + 0xc]
inc edi
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x90], edx
movzx eax, byte [esi + 1]
lea esi, [esi + 8]
movzx ecx, byte [esi - 8]
shl eax, 8
or ecx, eax
movzx eax, byte [esi - 6]
shl eax, 0x10
or ecx, eax
movzx eax, byte [esi - 5]
shl eax, 0x18
or ecx, eax
movzx eax, byte [esi - 3]
shl eax, 8
mov dword [ebp - 0x88], ecx
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0xa4], ecx
movzx ecx, byte [esi - 4]
or ecx, eax
movzx eax, byte [esi - 2]
shl eax, 0x10
or ecx, eax
movzx eax, byte [esi - 1]
shl eax, 0x18
or ecx, eax
movzx eax, byte [ebx]
and al, 0xdf
mov dword [ebp - 0x8c], ecx
or al, 0x40
mov dword [ebp - 0x98], ecx
mov byte [ebx], al
movzx eax, byte [edx]
and al, 0xbf
mov dword [ebp - 0xa0], ecx
or al, 0x20
push ebx
mov byte [edx], al
call fcn.0066b890
lea eax, [ebp - 0x84]
push eax
push ebx
call fcn.0066b640
push 1
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0xa4]
push eax
call fcn.0040fc00
mov ebx, dword [ebp - 0x90]
push ebx
call fcn.0066b890
lea eax, [ebp - 0x84]
push eax
push ebx
call fcn.0066b640
push 1
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x9c]
push eax
call fcn.0040fc00
mov ecx, dword [ebp - 0x8c]
add esp, 0x30
mov edx, dword [ebp - 0x98]
mov eax, dword [ebp - 0x88]
xor edx, ecx
xor ecx, dword [ebp - 0xa0]
mov ebx, dword [ebp - 0x9c]
xor ebx, eax
mov dword [ebp - 0x8c], ecx
xor eax, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0x94]
mov dword [ebp - 0x88], eax
mov byte [ecx], al
shr eax, 8
mov byte [ecx + 1], al
mov eax, dword [ebp - 0x88]
shr eax, 0x10
mov byte [ecx + 2], al
mov eax, dword [ebp - 0x88]
shr eax, 0x18
mov byte [ecx + 3], al
mov byte [ecx + 4], dl
mov eax, edx
shr eax, 8
mov byte [ecx + 5], al
mov eax, edx
shr eax, 0x10
mov byte [ecx + 6], al
mov eax, ebx
shr edx, 0x18
mov byte [ecx + 7], dl
mov ecx, dword [ebp - 0x90]
mov edx, dword [ebp - 0x8c]
shr eax, 8
mov byte [ecx], bl
mov byte [ecx + 1], al
mov eax, ebx
shr eax, 0x10
mov byte [ecx + 2], al
mov eax, edx
shr ebx, 0x18
mov byte [ecx + 3], bl
mov ebx, dword [ebp - 0x94]
mov byte [ecx + 4], dl
shr eax, 8
mov byte [ecx + 5], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [ecx + 6], al
mov byte [ecx + 7], dl
mov edx, ecx
sub edi, 1
jne 0x680e12
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.006d0856
mov esp, ebp
pop ebp
ret
Function at 0x691390
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov ecx, dword [edx + 4]
mov esi, edx
push edi
mov edi, dword [ebp + 0x10]
cmp ecx, dword [edi + 4]
cmovge esi, edi
cmovge edi, edx
mov dword [ebp + 0xc], esi
push dword [edi + 4]
push ebx
call fcn.005f7070
add esp, 8
test eax, eax
jne 0x6913c5
pop edi
pop esi
pop ebx
pop ebp
ret
xor eax, eax
cmp dword [esi + 4], eax
jle 0x6913e8
nop dword [eax]
mov ecx, dword [esi]
mov edx, dword [edi]
mov esi, dword [ecx + eax*4]
xor esi, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], esi
inc eax
mov esi, dword [ebp + 0xc]
cmp eax, dword [esi + 4]
jl 0x6913d0
mov ecx, dword [edi + 4]
cmp eax, ecx
jge 0x691402
nop
mov ecx, dword [edi]
mov edx, dword [ebx]
mov ecx, dword [ecx + eax*4]
mov dword [edx + eax*4], ecx
inc eax
mov ecx, dword [edi + 4]
cmp eax, ecx
jl 0x6913f0
push ebx
mov dword [ebx + 4], ecx
call fcn.005f6f20
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x692330
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
call fcn.006d13f0
push esi
mov esi, dword [ebp + 0x14]
push edi
push esi
xor edi, edi
call fcn.005f73f0
push esi
call fcn.005f7190
mov esi, eax
add esp, 8
test esi, esi
je 0x69251b
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx + 4]
add eax, eax
push eax
push esi
call fcn.005f7070
add esp, 8
test eax, eax
je 0x69251a
mov eax, dword [ebx + 4]
lea ecx, [eax - 1]
test ecx, ecx
js 0x6924f6
mov edi, ecx
mov eax, dword [ebx]
mov edx, dword [eax + edi*4]
mov ecx, edx
shr ecx, 1
mov eax, edx
and eax, 0x20000
and ecx, 0x8000
or ecx, eax
mov eax, edx
and eax, 0x40000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x80000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x100000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x200000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x400000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x800000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x1000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x2000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x4000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x8000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x10000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x20000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x40000000
shr ecx, 1
or ecx, eax
and edx, reloc.WS2_32.dll_accept
mov eax, dword [esi]
shr ecx, 1
or ecx, edx
shr ecx, 1
mov dword [eax + edi*8 + 4], ecx
mov eax, dword [ebx]
mov ecx, dword [eax + edi*4]
mov edx, ecx
and edx, 0x8000
mov eax, ecx
add edx, edx
and eax, 0x4000
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x2000
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x1000
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x800
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x400
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x200
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x100
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x80
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x40
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x20
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x10
or edx, eax
mov eax, ecx
add edx, edx
and eax, 8
or edx, eax
mov eax, ecx
add edx, edx
and eax, 4
or edx, eax
mov eax, ecx
add edx, edx
and eax, 2
or edx, eax
and ecx, 1
mov eax, dword [esi]
add edx, edx
or edx, ecx
mov dword [eax + edi*8], edx
sub edi, 1
jns 0x692388
mov eax, dword [ebx + 4]
xor edi, edi
add eax, eax
push esi
mov dword [esi + 4], eax
call fcn.005f6f20
push dword [ebp + 0x10]
push esi
push dword [ebp + 8]
call fcn.00691420
add esp, 0x10
mov ecx, 1
test eax, eax
cmovne edi, ecx
pop ebx
push dword [ebp + 0x14]
call fcn.005f7090
add esp, 4
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x6c2c70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xa0
call fcn.006d13f0
mov eax, dword [0x7c0ab4]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0xa0], eax
push ebx
mov eax, dword [ecx + 8]
mov ebx, dword [ebp + 0x10]
sub eax, ebx
mov ecx, dword [ecx + 0xc]
mov dword [ebp - 0x98], eax
xor eax, eax
mov dword [ebp - 0x88], eax
cmp ecx, ebx
jb 0x6c2e1a
cmp ebx, 0x40
ja 0x6c2e1a
lea eax, [ebp - 0x84]
neg eax
push esi
push edi
and eax, 0x3f
lea edi, [ebp - 0x84]
add edi, eax
lea eax, [ebx + 0x100]
mov dword [ebp - 0x9c], edi
cmp ecx, eax
jbe 0x6c2cf2
mov eax, ecx
sub eax, ebx
sub eax, 0x100
mov dword [ebp - 0x88], eax
push ebx
xor esi, esi
mov dword [ebp - 0x8c], 0
push esi
push edi
call fcn.006d4310
mov eax, dword [ebp + 0xc]
add esp, 0xc
mov ecx, dword [ebp - 0x88]
mov dword [ebp - 0x90], esi
cmp ecx, dword [eax + 0xc]
jae 0x6c2dce
mov edx, ecx
sub edx, dword [eax + 8]
mov dword [ebp - 0x94], edx
nop dword [eax]
mov ebx, dword [ebp + 0xc]
mov eax, ecx
xor eax, dword [ebp - 0x98]
lea edi, [eax - 1]
not eax
shr eax, 0x1f
shr edi, 0x1f
and edi, eax
mov eax, dword [ebp + 0xc]
neg edi
xor edx, dword [eax + 8]
mov eax, ecx
xor eax, dword [ebx + 8]
or edx, eax
mov eax, dword [ebx + 0x14]
xor edx, ecx
mov ebx, dword [ebp + 0x10]
shr edx, 0x1f
neg edx
mov cl, byte [eax + ecx]
mov eax, edi
or eax, dword [ebp - 0x8c]
and eax, edx
mov edx, dword [ebp - 0x90]
and edi, edx
mov dword [ebp - 0x8c], eax
and al, cl
or esi, edi
mov edi, dword [ebp - 0x9c]
or byte [edx + edi], al
inc edx
mov ecx, edx
mov eax, edx
sub ecx, ebx
xor eax, ebx
xor ecx, ebx
or ecx, eax
mov eax, dword [ebp + 0xc]
xor ecx, edx
shr ecx, 0x1f
neg ecx
and edx, ecx
mov ecx, dword [ebp - 0x88]
mov dword [ebp - 0x90], edx
inc ecx
mov edx, dword [ebp - 0x94]
inc edx
mov dword [ebp - 0x88], ecx
mov dword [ebp - 0x94], edx
cmp ecx, dword [eax + 0xc]
jb 0x6c2d30
xor edx, edx
test ebx, ebx
je 0x6c2e04
mov ecx, dword [ebp - 0xa0]
mov eax, esi
xor eax, 0x20
mov al, byte [eax + edi]
movzx eax, byte [esi + edi]
inc esi
mov byte [ecx + edx], al
mov ecx, esi
sub ecx, ebx
mov eax, esi
xor ecx, ebx
xor eax, ebx
or ecx, eax
inc edx
xor ecx, esi
shr ecx, 0x1f
neg ecx
and esi, ecx
cmp edx, ebx
jb 0x6c2dd4
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006d0856
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop ebx
call fcn.006d0856
mov esp, ebp
pop ebp
ret
Function at 0x6c3e40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x14
call fcn.006d13f0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
inc ebx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [esi + 4]
mov ecx, dword [edi + 8]
mov eax, dword [eax + 0x64]
test byte [eax + 0x30], 1
je 0x6c3ec7
mov edx, dword [ebp + 0x10]
lea eax, [ebx + edx]
cmp eax, ecx
ja 0x6c3ecb
add dword [edi + 0x14], edx
sub ecx, edx
add dword [edi + 0x18], edx
sub dword [edi + 0xc], edx
mov dword [edi + 8], ecx
mov eax, dword [edi + 0x14]
push dword [esi + 0x3cc]
mov al, byte [eax + ecx - 1]
movzx ebx, al
mov byte [ebp + 0x17], al
mov dword [ebp - 4], ebx
call fcn.005d9a00
push eax
call fcn.005d9c20
mov esi, dword [edi + 8]
add esp, 8
mov dword [ebp - 0x14], esi
and eax, 0x200000
je 0x6c3ed4
sub esi, ebx
mov eax, 1
dec esi
mov dword [edi + 8], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebx, ecx
jbe 0x6c3e84
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
mov edx, esi
add ecx, ebx
mov eax, esi
sub edx, ecx
xor eax, ecx
xor edx, ecx
or edx, eax
mov eax, 0x100
xor edx, esi
shr edx, 0x1f
dec edx
cmp esi, eax
mov dword [ebp + 8], edx
cmovb eax, esi
xor ebx, ebx
mov dword [ebp - 0xc], eax
test eax, eax
je 0x6c3f57
mov ecx, dword [ebp - 4]
dec esi
mov eax, dword [edi + 0x14]
mov edx, ecx
mov edi, dword [ebp + 8]
shr edx, 0x1f
add eax, esi
mov dword [ebp - 0x10], edx
mov esi, eax
sub ecx, ebx
lea esi, [esi - 1]
shr ecx, 0x1f
mov eax, ebx
shr eax, 0x1f
inc ebx
xor cl, al
xor al, dl
or cl, al
movzx eax, byte [ebp + 0x17]
dec cl
movzx edx, cl
movzx ecx, byte [esi + 1]
xor ecx, eax
and edx, ecx
mov ecx, dword [ebp - 4]
not edx
and edi, edx
mov edx, dword [ebp - 0x10]
cmp ebx, dword [ebp - 0xc]
jb 0x6c3f17
mov esi, dword [ebp - 0x14]
mov dword [ebp + 8], edi
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
not edx
movzx ecx, dl
inc eax
dec ecx
shr ecx, 0x1f
neg ecx
and eax, ecx
sub esi, eax
mov dword [edi + 8], esi
mov dword [ebp + 0x14], ecx
not ecx
mov dword [ebp + 8], ecx
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
and ecx, 1
pop edi
pop esi
or eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6f967f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.006f94f5

Function at 0x6fc706
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.006fc253
Function at 0x131528b0
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x13152a54
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xfe
call fcn.13142638
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push 0xfe
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.13147138
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
mov ecx, 0x13152a6c
call fcn.13143d80
push 0
mov eax, dword [ebp - 4]
call fcn.13143f24
push eax
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.131428ec
mov eax, dword [ebp - 0x14]
call fcn.13143f24
push eax
call sub.kernel32.dll_CopyFileA
mov dl, 1
mov eax, dword [0x1314f52c]
call fcn.13142fb4
mov ebx, eax
mov dl, 1
mov eax, dword [0x1314f52c]
call fcn.13142fb4
mov esi, eax
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.13151978
call fcn.1314294c
mov eax, pe_nt_image_headers32
call fcn.13142a5c
mov byte [ebp - 0xc], al
mov eax, pe_nt_image_headers32
call fcn.13142a5c
mov byte [ebp - 0xb], al
mov eax, pe_nt_image_headers32
call fcn.13142a5c
mov byte [ebp - 0xa], al
mov eax, pe_nt_image_headers32
call fcn.13142a5c
mov byte [ebp - 9], al
mov cx, 2
xor edx, edx
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x14]
lea edx, [ebp - 0xc]
mov ecx, 4
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x10]
xor ecx, ecx
xor edx, edx
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x14]
push 0
push 0x30
mov edx, ebx
mov eax, esi
call fcn.131514a4
xor ecx, ecx
mov edx, 0x30
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x14]
lea edx, [ebp - 0xc]
mov ecx, 1
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
xor eax, eax
mov al, byte [ebp - 0xc]
inc eax
mov byte [ebp - 0xc], al
lea edx, [ebp - 0xc]
mov ecx, 1
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x10]
xor ecx, ecx
mov edx, 0x31
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x14]
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
sub eax, 0x31
sbb edx, 0
push edx
push eax
mov edx, ebx
mov eax, esi
call fcn.131514a4
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.131518a4
mov eax, ebx
call fcn.13142fe4
mov eax, esi
call fcn.13142fe4
mov eax, dword [ebp - 8]
call fcn.13142658
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x13152a5b
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.13143abc
lea eax, [ebp - 4]
call fcn.13143a98
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0xb89058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00b891a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xb8907e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xb8906a
add dl, dl
jne 0xb89089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xb890dc
xor eax, eax
add dl, dl
jne 0xb89096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xb8917d
add dl, dl
jne 0xb890a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb890b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb890bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb890c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xb890d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xb89075
mov eax, 1
add dl, dl
jne 0xb890ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb890f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xb890e1
sub eax, ebx
mov ebx, 1
jne 0xb89128
mov ecx, 1
add dl, dl
jne 0xb8910e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xb89119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xb89105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xb89075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xb8913f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xb8914a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xb89136
cmp eax, 0x7d00
jae 0xb8916d
cmp eax, 0x500
jb 0xb89168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xb89075
cmp eax, 0x7f
ja 0xb89170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xb89075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xb8919e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xb89075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10