joyce8/EMBER2024-capa huggingface dataset:
Function at 0x470348
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x47034e
ret

Function at 0x47b998
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x47bb55
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x30], 0
jne 0x47bb31
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x38], 0
je 0x47bb31
mov eax, dword [ebp - 0xc]
add eax, 0x2c
push eax
mov eax, dword [ebp - 0xc]
add eax, 0x28
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x38]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax + 0x28]
add ebx, ebx
add ebx, ebx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
imul ebx
push eax
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x47b964]
call fcn.00409784
add esp, 4
lea eax, [ebp - 4]
call fcn.0040ae5c
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x38]
push eax
mov eax, dword [0x78d73c]
push eax
call fcn.00455f0c
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 8]
call fcn.004095bc
push eax
push ebx
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x1c]
lea eax, [ebp - 0x38]
xor ecx, ecx
mov edx, 0x2c
call fcn.00405008
mov dword [ebp - 0x38], 0x2c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
neg eax
mov dword [ebp - 0x30], eax
mov word [ebp - 0x2c], 1
mov word [ebp - 0x2a], 0x20
mov dl, 1
mov eax, dword [0x46ec88]
call fcn.00478324
mov ebx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x30], ebx
xor ecx, ecx
push ebp
push 0x47bb0f
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov eax, ebx
mov dl, 7
call fcn.00479fa0
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x2c]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x28]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax]
call dword [ebx + 0x6c]
push 0
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
push eax
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
mov edx, dword [eax]
call dword [edx + 0x70]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
call fcn.00478c44
call fcn.00473348
push eax
call sub.gdi32.dll_SetDIBits
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
mov dl, 1
call fcn.00478fb0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47bb31
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47bb5c
lea eax, [ebp - 8]
mov edx, dword [0x47b964]
call fcn.004098a8
lea eax, [ebp - 4]
call fcn.0040ae5c
ret
Function at 0x4f1208
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4f1330
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.004f10f4
mov eax, dword [esi]
call fcn.004095bc
add eax, 0x28
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x417ed0]
call fcn.00409784
add esp, 4
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1c]
mov ecx, 0x1c
call fcn.00404970
mov ebx, 0x1c
mov eax, dword [ebp - 4]
lea edx, [eax + ebx]
lea eax, [ebp - 0x2c]
mov ecx, 0x1c
call fcn.00404970
add ebx, 0x1c
mov eax, dword [esi]
call fcn.004095bc
mov dword [ebp - 0xc], eax
mov eax, dword [0x78e1ec]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea edx, [ebp - 4]
mov ecx, ebx
call fcn.004df7f4
add ebx, 4
mov eax, dword [ebp - 4]
add eax, ebx
xor ecx, ecx
mov edx, 3
call fcn.00405008
add ebx, 3
mov eax, dword [ebp - 4]
mov byte [eax + ebx], 0x3a
inc ebx
mov eax, dword [esi]
mov byte [eax + 2], 0
mov eax, dword [esi]
mov byte [eax + 3], 0
push ebx
mov eax, dword [esi]
call fcn.004095bc
push eax
lea ecx, [ebp - 4]
mov eax, dword [esi]
xor edx, edx
call fcn.004df6e4
mov edx, dword [ebp - 4]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x94]
mov ebx, eax
mov eax, ebx
call fcn.004df460
mov edx, esi
mov ecx, dword [ebp + 0x10]
call fcn.004df7ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f1337
lea eax, [ebp - 4]
mov edx, dword [0x417ed0]
call fcn.004098a8
ret

Function at 0x50bd80
Capabilities:
Open clipboard

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffdc
mov ebp, ecx
mov edi, edx
mov esi, eax
mov eax, esp
xor ecx, ecx
mov edx, 0x24
call fcn.00405008
mov dword [esp], 0x24
mov dword [esp + 0xc], 0x3ec
push 0
push ebp
push edi
mov eax, dword [0x7942d0]
call fcn.0050b4ac
push eax
call sub.user32.dll_MsgWaitForMultipleObjectsEx
mov ebx, eax
mov dword [esi + 0xc0], ebx
test ebx, ebx
setne al
mov ebx, eax
test bl, bl
je 0x50bdf9
mov dword [esi + 0x3c], 0x60
lea eax, [esi + 0x3c]
push eax
push 0xffffffffffffffff
mov eax, dword [esi + 0xc0]
push eax
call sub.user32.dll_OpenClipboard
push esi
push 0xffffffffffffffff
mov eax, dword [esi + 0xc0]
push eax
call sub.user32.dll_PeekMessageW
mov eax, ebx
add esp, 0x24
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x578564
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x578667
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x8000ffff
lea eax, [ebp - 4]
call fcn.0040ae5c
push eax
call sub.KERNEL32.DLL_LocalAlloc
test eax, 0x80000000
sete al
test al, al
je 0x578649
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov eax, dword [ebp + 0xc]
xor edx, edx
call fcn.004080e4
je 0x5785d3
mov eax, dword [ebp + 0xc]
call fcn.00407f0c
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x10]
mov eax, dword [ebp + 8]
xor edx, edx
call fcn.004080e4
je 0x5785f1
mov eax, dword [ebp + 8]
call fcn.00407f0c
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
mov eax, esi
xor edx, edx
call fcn.004080e4
je 0x57860d
mov eax, esi
call fcn.00407f0c
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
test edi, edi
je 0x57861b
push edi
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x1c]
cmp dword [ebp - 0xc], 0
je 0x578624
mov ebx, dword [ebp - 0xc]
lea eax, [ebp - 8]
call fcn.0040ae5c
push eax
push 0x57867c
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax]
test eax, eax
jne 0x578649
mov eax, dword [ebp - 8]
push eax
push 0
call sub.KERNEL32.DLL_WriteFile
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57866e
lea eax, [ebp - 8]
call fcn.0040ae5c
lea eax, [ebp - 4]
call fcn.0040ae5c
ret
Function at 0x58adbc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x204], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x58af0d
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x58aef2
mov eax, ebx
test eax, eax
je 0x58adf3
sub eax, 4
mov eax, dword [eax]
mov edi, eax
test ebx, ebx
je 0x58ae03
mov eax, ebx
sub eax, 0xa
movzx eax, word [eax]
jmp 0x58ae07
mov ax, 2
cmp ax, 1
jne 0x58ae84
test ebx, ebx
je 0x58ae1b
mov eax, ebx
sub eax, 0xc
movzx eax, word [eax]
jmp 0x58ae23
mov eax, dword [0x78df00]
movzx eax, word [eax]
push edi
push 0
push 0
movzx eax, ax
mov ecx, ebx
xor edx, edx
call fcn.0040b530
mov edi, eax
cmp edi, 0x100
jle 0x58ae4b
mov eax, edi
add eax, eax
call fcn.004047a4
mov esi, eax
jmp 0x58ae51
lea esi, [ebp - 0x200]
test ebx, ebx
je 0x58ae5f
mov eax, ebx
sub eax, 0xc
movzx edx, word [eax]
jmp 0x58ae68
mov edx, dword [0x78df00]
movzx edx, word [edx]
mov eax, ebx
test eax, eax
je 0x58ae73
sub eax, 4
mov eax, dword [eax]
push eax
push esi
push edi
movzx eax, dx
mov ecx, ebx
xor edx, edx
call fcn.0040b530
jmp 0x58aebd
cmp edi, 0x100
jle 0x58ae99
mov eax, edi
add eax, eax
call fcn.004047a4
mov esi, eax
jmp 0x58ae9f
lea esi, [ebp - 0x200]
lea edx, [ebp - 0x204]
mov eax, ebx
call fcn.0041e040
mov eax, dword [ebp - 0x204]
mov ecx, edi
add ecx, ecx
mov edx, esi
call fcn.00404970
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x58aedf
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x58aec9
lea eax, [ebp - 0x200]
cmp esi, eax
je 0x58aef4
mov eax, esi
call fcn.004047c0
jmp 0x58aef4
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58af14
lea eax, [ebp - 0x204]
call fcn.00407454
ret

Function at 0x598f40
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x598f5a
add esp, 0xfffffff0
call fcn.00405dcc
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x598fdb
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, esi
xor edx, edx
mov eax, edi
call fcn.00448670
xor edx, edx
mov eax, edi
call fcn.0059929c
xor edx, edx
mov eax, edi
call fcn.0059935c
xor eax, eax
mov dword [edi + 0x3c], eax
xor eax, eax
mov dword [edi + 0x28], eax
xor eax, eax
mov dword [edi + 0x2c], eax
lea eax, [ebp - 0x10]
call fcn.0042d670
lea eax, [edi + 0x18]
lea edx, [ebp - 0x10]
call fcn.0042dadc
mov byte [edi + 0x39], 0
mov byte [edi + 0x30], 1
lea eax, [edi + 0x10]
call fcn.00407454
mov eax, dword [0x586ca0]
mov dword [edi + 0x40], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x598fe2
lea eax, [ebp - 0x10]
call fcn.0042d684
ret
Function at 0x5af000
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push ecx
mov esi, edx
mov ebx, eax
mov eax, ebx
call fcn.0059c278
test al, al
je 0x5af041
mov eax, ebx
call fcn.0059fa5c
push 0
push 0x13
mov eax, dword [ebx + 0x1a4]
push eax
mov eax, dword [eax]
call dword [eax + 0x50]
push esp
mov eax, dword [ebx + 0x1a4]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
mov edx, eax
mov eax, ebx
call fcn.005ae018
jmp 0x5af053
push esp
mov eax, dword [ebx + 0x1bc]
push eax
call sub.KERNEL32.DLL_WinExec
call fcn.0042b7b0
mov edx, esi
mov eax, dword [esp]
call fcn.005a7a84
pop edx
pop esi
pop ebx
ret

Function at 0x5af064
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
mov byte [ebx + 0x295], 0
mov eax, ebx
call fcn.0059c138
mov eax, ebx
call fcn.005af254
mov eax, esi
call fcn.004352b0
test al, al
jne 0x5af0aa
lea eax, [ebx + 0x1bc]
push eax
mov eax, esi
call fcn.005a79e8
push eax
call sub.KERNEL32.DLL_WinExec
call fcn.0042b7b0
mov eax, ebx
call fcn.0059c12c
pop esi
pop ebx
ret

Function at 0x5afbfc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5afc99
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0059fa5c
lea eax, [ebp - 4]
call fcn.0040ae5c
push eax
mov eax, dword [ebx + 0x1a4]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
mov edx, eax
mov eax, ebx
call fcn.005ae018
lea eax, [ebx + 0x1c0]
call fcn.005a79cc
lea eax, [ebx + 0x1c0]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
mov edx, eax
mov eax, ebx
call fcn.005ae018
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx + 0x1c0]
push eax
call sub.KERNEL32.DLL_WinExec
call fcn.0042b7b0
mov edx, esi
mov eax, dword [ebp - 8]
call fcn.005a7a84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5afca0
lea eax, [ebp - 4]
call fcn.0040ae5c
ret
Function at 0x5b7c18
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5b7df1
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x87], 0
je 0x5b7c68
cmp dword [ebx + 0x5c], 0
je 0x5b7c68
mov eax, dword [ebx + 0x5c]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1a8]
push eax
mov eax, dword [eax]
call dword [eax + 0xb8]
mov edx, eax
mov eax, esi
call fcn.005ae018
xor eax, eax
mov dword [ebx + 0x5c], eax
mov byte [ebx + 0x87], 0
cmp dword [ebx + 0x5c], 0
jne 0x5b7ddb
cmp dword [ebx + 0x7c], 0
jne 0x5b7c8e
mov dl, 1
mov eax, dword [0x43c624]
call fcn.00405858
mov dword [ebx + 0x7c], eax
cmp dword [ebx + 0xc], 0
je 0x5b7db4
lea eax, [ebp - 8]
mov edx, dword [ebx + 0xc]
call fcn.0040843c
mov eax, dword [ebp - 8]
push eax
movzx eax, byte [0x5b7e00]
push eax
movzx eax, byte [0x5b7e04]
push eax
push 0
mov eax, dword [ebx + 0x7c]
push eax
mov eax, dword [0x78db80]
push eax
push 1
mov ecx, dword [ebx + 0x68]
mov dl, 1
mov eax, dword [0x5a12c8]
call fcn.005a4e14
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x5b7dad
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebx + 0x5c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x64]
push eax
mov eax, dword [ebx + 0x64]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1a8]
push eax
mov eax, dword [eax]
call dword [eax + 0xb4]
mov edx, eax
mov eax, esi
call fcn.005ae018
lea eax, [ebx + 0x10]
push eax
mov eax, dword [ebx + 0x5c]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1a8]
push eax
mov eax, dword [eax]
call dword [eax + 0xc0]
mov edx, eax
mov eax, esi
call fcn.005ae018
mov eax, dword [ebx + 0x40]
push eax
lea eax, [ebx + 0x70]
mov ecx, 1
mov edx, dword [0x417ed0]
call fcn.00409784
add esp, 4
mov eax, dword [ebx + 0x30]
cmp eax, 0x1b
jge 0x5b7d6a
mov edx, dword [0x78e198]
movzx eax, byte [edx + eax]
mov byte [ebx + 0x74], al
jmp 0x5b7d91
cmp eax, 0x1007
jne 0x5b7d77
mov byte [ebx + 0x74], 0x18
jmp 0x5b7d91
cmp eax, 0x24
jne 0x5b7d82
mov byte [ebx + 0x74], 0x31
jmp 0x5b7d91
cmp eax, 0x1b
jne 0x5b7d8d
mov byte [ebx + 0x74], 0x33
jmp 0x5b7d91
mov byte [ebx + 0x74], 0
mov eax, dword [ebx + 0x40]
mov dword [ebx + 0x78], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b7ddb
mov eax, dword [ebp - 4]
call fcn.00405888
ret
lea eax, [ebx + 0x5c]
push eax
push 0
push 0
mov eax, dword [ebx + 0x64]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1a8]
push eax
mov eax, dword [eax]
call dword [eax + 0xb4]
mov edx, eax
mov eax, esi
call fcn.005ae018
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b7df8
lea eax, [ebp - 8]
call fcn.0040749c
ret
Function at 0x667ce4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407538
xor eax, eax
push ebp
push 0x667e21
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
mov esi, 0x667e34
lea edi, [ebp - 0x3d]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
mov eax, 2
mov edx, dword [ebp - 4]
test edx, edx
je 0x667d2c
sub edx, 4
mov edx, dword [edx]
mov dword [ebp - 0xc], edx
xor edx, edx
mov dword [ebp - 8], edx
mov word [ebp - 0xe], si
jmp 0x667df1
mov edx, dword [ebp - 4]
movzx esi, word [edx + eax*2 - 2]
cmp si, 0x27
je 0x667d51
cmp si, word [ebp - 0xe]
jne 0x667d59
xor bl, 1
jmp 0x667df0
test bl, bl
jne 0x667df0
mov edx, esi
cmp dx, 0xff
ja 0x667d71
movzx edx, dx
bt dword [ebp - 0x3d], edx
jae 0x667df0
cmp byte [ebp + 8], 0
je 0x667da4
mov edx, 0x667e54
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0x14]
mov ecx, esi
cmp cx, 0xff
ja 0x667d93
movzx ecx, cx
bt dword [edx], ecx
setb dl
mov byte [ebp - 0x15], dl
cmp byte [ebp - 0x15], 0
jne 0x667df0
mov dword [ebp - 8], eax
jmp 0x667df0
cmp si, 0x3a
jne 0x667dde
mov edx, 0x667e74
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp - 4]
movzx edx, word [edx + eax*2 - 4]
mov ecx, dword [ebp - 0x1c]
cmp dx, 0xff
ja 0x667dca
movzx edx, dx
bt dword [ecx], edx
setb dl
mov byte [ebp - 0x1d], dl
cmp byte [ebp - 0x1d], 0
je 0x667df0
mov edx, eax
dec edx
mov dword [ebp - 8], edx
jmp 0x667df0
cmp eax, dword [ebp - 0xc]
jge 0x667df0
mov edx, dword [ebp - 4]
cmp word [edx + eax*2], 0x3a
jne 0x667df0
mov dword [ebp - 8], eax
inc eax
cmp dword [ebp - 8], 0
jne 0x667e0b
cmp eax, dword [ebp - 0xc]
jg 0x667e0b
mov edx, dword [ebp - 4]
cmp word [edx + eax*2 - 2], 0
jne 0x667d3d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x667e28
lea eax, [ebp - 4]
call fcn.00407454
ret

Function at 0x678c4c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, edx
mov esi, eax
mov eax, esi
call fcn.006789fc
mov edi, eax
shr edi, 8
and edi, 0xff
mov ebp, eax
and ebp, 0xff
xor eax, eax
mov edx, dword [esi + 0x14]
movzx edx, byte [edx + eax]
and dl, 0xff
mov ecx, ebx
and cl, 0xff
xor dl, cl
mov ecx, dword [esi + 0x14]
mov byte [ecx + eax], dl
inc eax
cmp eax, 0x10
jne 0x678c70
mov eax, edi
mov edx, ebp
xor al, dl
xor al, bl
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x678c9c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, esi
call fcn.006789fc
mov edx, eax
mov eax, edx
shr eax, 8
and eax, 0xff
mov edi, edx
and edi, 0xff
mov edx, eax
mov eax, edi
xor dl, al
xor dl, bl
xor eax, eax
mov ecx, dword [esi + 0x14]
movzx ecx, byte [ecx + eax]
and cl, 0xff
mov ebx, edx
and bl, 0xff
xor cl, bl
mov ebx, dword [esi + 0x14]
mov byte [ebx + eax], cl
inc eax
cmp eax, 0x10
jne 0x678cc8
mov eax, edx
pop edi
pop esi
pop ebx
ret
Function at 0x678cec
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x678d81
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x678d33
lea edx, [ebp - 8]
mov eax, dword [0x78ded0]
call fcn.0040b49c
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x5c9794]
call fcn.005e43d8
call fcn.00406b58
lea eax, [ebx + 0x18]
mov edx, esi
call fcn.00407834
mov eax, ebx
call fcn.00678978
mov byte [ebp - 1], al
mov byte [ebx + 4], 0
mov eax, esi
test eax, eax
je 0x678d56
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x678d6b
mov edx, 1
movzx ecx, word [esi + edx*2 - 2]
xor byte [ebx + 4], cl
inc edx
dec eax
jne 0x678d5f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x678d88
lea eax, [ebp - 8]
call fcn.00407454
ret
Function at 0x692b14
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x692ca6
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00604c80
mov dword [ebp - 8], eax
mov edx, 0x692cc4
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov dl, 1
mov eax, dword [0x5ccd4c]
call fcn.005e4a34
mov ebx, eax
mov edx, 0x692ce8
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 8]
mov edx, 0x692ce8
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov edx, 0x1a
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x14]
push 0
push 0x100
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x30]
mov dl, 1
mov eax, dword [0x5ccd4c]
call fcn.005e4a34
mov esi, eax
mov edx, 0x692d0c
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 8]
mov edx, 0x692d0c
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov edx, 0x1a
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x14]
push 0
push 0x100
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x30]
mov dl, 1
mov eax, dword [0x5ccd4c]
call fcn.005e4a34
mov edi, eax
mov edx, 0x692d2c
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 8]
mov edx, 0x692d2c
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov edx, 0x1a
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x14]
push 0
push 0x100
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0x30]
mov dl, 1
mov eax, dword [0x5ccd4c]
call fcn.005e4a34
mov dword [ebp - 0xc], eax
mov edx, 0x692d4c
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 8]
mov edx, 0x692d4c
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov edx, 0x1a
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x14]
push 0
push 0x100
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x30]
push 4
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x5cd7dc]
call fcn.00409784
add esp, 4
mov eax, dword [ebp - 4]
mov dword [eax], ebx
mov eax, dword [ebp - 4]
mov dword [eax + 4], esi
mov eax, dword [ebp - 4]
mov dword [eax + 8], edi
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0xc], edx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov ebx, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x692cad
lea eax, [ebp - 4]
mov edx, dword [0x5cd7dc]
call fcn.004098a8
ret
Function at 0x693060
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6931f2
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00604c80
mov dword [ebp - 8], eax
mov edx, 0x693210
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov dl, 1
mov eax, dword [0x5ccd4c]
call fcn.005e4a34
mov ebx, eax
mov edx, 0x69323c
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 8]
mov edx, 0x69323c
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov edx, 0x1a
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x14]
push 0
push 0x80
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x30]
mov dl, 1
mov eax, dword [0x5ccd4c]
call fcn.005e4a34
mov esi, eax
mov edx, 0x693268
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 8]
mov edx, 0x693268
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov edx, 0x1a
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x14]
push 0
push 0x800
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x30]
mov dl, 1
mov eax, dword [0x5ccd4c]
call fcn.005e4a34
mov edi, eax
mov edx, 0x6932a0
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 8]
mov edx, 0x6932a0
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov edx, 0x1a
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x14]
push 0
push 0x80
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0x30]
mov dl, 1
mov eax, dword [0x5ccd4c]
call fcn.005e4a34
mov dword [ebp - 0xc], eax
mov edx, 0x6932c4
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 8]
mov edx, 0x6932c4
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov edx, 0x1a
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x14]
push 0
push 0x800
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x30]
push 4
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x5cd7dc]
call fcn.00409784
add esp, 4
mov eax, dword [ebp - 4]
mov dword [eax], ebx
mov eax, dword [ebp - 4]
mov dword [eax + 4], esi
mov eax, dword [ebp - 4]
mov dword [eax + 8], edi
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0xc], edx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov ebx, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6931f9
lea eax, [ebp - 4]
mov edx, dword [0x5cd7dc]
call fcn.004098a8
ret