joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50fb70
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0xc
push 0xf0000000
push 1
push 0
push 0
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x50fbb5
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x8002
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
push dword [esp + 0x18]
call fcn.004dd4f0
add esp, 4
push 0
push eax
push dword [esp + 0x1c]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 0
push 2
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [esp], 0x10
jne 0x50fc0c
push 0
lea eax, [esp + 4]
push eax
push dword [esp + 0x18]
push 2
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [esp + 8]
test eax, eax
je 0x50fc1b
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [esp + 4]
test eax, eax
je 0x50fc2c
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
add esp, 0xc
ret

Function at 0x50fc80
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x5c4828]
mov edi, eax
add esp, 4
test edi, edi
jne 0x50fca7
pop edi
pop esi
pop ecx
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [esp + 0x1c]
mov dword [edi + 8], eax
push ebp
cmp ebx, dword [esi + 0x10]
jbe 0x50fcf2
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [esp + 0x24]
push dword [edi + 4]
call eax
mov ebp, dword [edi + 8]
push dword [edi + 4]
add ebp, dword [esi + 0xc]
mov eax, dword [esi + 8]
push ebp
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov ecx, dword [edi + 4]
mov dword [esp + 0x20], ebx
jmp 0x50fcf6
mov ebp, dword [esp + 0x1c]
mov eax, dword [esi]
push ecx
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [esp + 0x28]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x50fd56
mov dword [esp + 0x10], eax
mov ebx, eax
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x18], al
lea eax, [esp + 0x18]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x24], al
lea eax, [esp + 0x24]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub ebx, 1
jne 0x50fd15
mov ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0x10]
jae 0x50fd87
nop dword [eax + eax]
mov eax, dword [esi + 4]
push 1
push str.6__I
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x5a478f
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x50fd60
pop ebp
pop ebx
mov eax, edi
pop edi
pop esi
pop ecx
ret
Function at 0x5118f6
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x5420b7
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00541f36

Function at 0x546e72
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00546b32

Function at 0x4064a0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x409a50]
jne 0x407826
repz ret
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x40a2b8], eax
mov dword [0x40a2b4], ecx
mov dword [0x40a2b0], edx
mov dword [0x40a2ac], ebx
mov dword [0x40a2a8], esi
mov dword [0x40a2a4], edi
mov word [0x40a2d0], ss
mov word [0x40a2c4], cs
mov word [0x40a2a0], ds
mov word [0x40a29c], es
mov word [0x40a298], fs
mov word [0x40a294], gs
pushfd
pop dword [0x40a2c8]
mov eax, dword [ebp]
mov dword [0x40a2bc], eax
mov eax, dword [ebp + 4]
mov dword [0x40a2c0], eax
lea eax, [ebp + 8]
mov dword [0x40a2cc], eax
mov eax, dword [ebp - 0x320]
mov dword [0x40a208], 0x10001
mov eax, dword [0x40a2c0]
mov dword [0x40a1bc], eax
mov dword [0x40a1b0], 0xc0000409
mov dword [0x40a1b4], 1
mov eax, dword [0x409a50]
mov dword [ebp - 0x328], eax
mov eax, dword [0x409a54]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x40a200], eax
push 1
call fcn.004068ed
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x4021d8
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x40a200], 0
jne 0x407916
push 1
call fcn.004068ed
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret

Function at 0x407b82
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x407b91
pop dword [ebp - 0x40]
mov eax, 0x407b91
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x37779
push 0
mov eax, 0x86bb95bd
add eax, 0x79847b07
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0x4a9b
xor esi, esi
add esi, eax
mov edi, 0x40c800
add edi, dword [ebp - 0x40]
mov ebx, 0x5cf3d40a
mov edx, dword [edi]
sub dword [ebp - 0x30], 0xee8cd38c
xor edx, ebx
sub dword [ebp - 0xc], ecx
mov dword [esi], edx
sub dword [ebp - 0x18], 0x949bee21
add esi, 4
add edi, 4
loop 0x407bdb
add eax, 0xca41c259
sub eax, 0xca40a51a
xor ebx, ebx
add ebx, eax
add eax, 0xaae4ae17
add eax, 0x551b51ee
mov ecx, 0x946205b3
sub ecx, 0x942205b3
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x43b654
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x43b3c1
add ecx, 1
add esi, ecx
dec ecx
call fcn.0043b68b
and esi, ecx
sub esi, 0xd8375b69
xor dword [eax], edx
add ecx, ecx
sub esi, ecx
inc eax
add ecx, ecx
sub esi, ecx
add ecx, 0x6f49e87c
cmp eax, ebx
jne fcn.0043b654
dec ecx
dec ecx
add ecx, ecx
ret
Function at 0x40110c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43e030]
jne 0x401116
repz ret
jmp fcn.00401b11

Function at 0x408edc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004047d5
and dword [ebp - 4], 0
cmp dword [0x44078c], 0
mov ebx, eax
jne 0x408f8d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40903e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40903e
push eax
call fcn.00404763
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x44078c], eax
call esi
push eax
call fcn.00404763
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x440790], eax
call esi
push eax
call fcn.00404763
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x440794], eax
call esi
push eax
call fcn.00404763
pop ecx
mov dword [0x44079c], eax
test eax, eax
je 0x408f8d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404763
pop ecx
mov dword [0x440798], eax
mov eax, dword [0x440798]
cmp eax, ebx
je 0x408fe5
cmp dword [0x44079c], ebx
je 0x408fe5
push eax
call fcn.004047de
push dword [0x44079c]
mov esi, eax
call fcn.004047de
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408fe5
test edi, edi
je 0x408fe5
call esi
test eax, eax
je 0x408fdc
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x408fdc
test byte [ebp - 0xc], 1
jne 0x408fe5
or dword [ebp + 0x10], 0x200000
jmp 0x40901e
mov eax, dword [0x440790]
cmp eax, ebx
je 0x40901e
push eax
call fcn.004047de
pop ecx
test eax, eax
je 0x40901e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40901e
mov eax, dword [0x440794]
cmp eax, ebx
je 0x40901e
push eax
call fcn.004047de
pop ecx
test eax, eax
je 0x40901e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44078c]
call fcn.004047de
pop ecx
test eax, eax
je 0x40903e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x409040
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b2d0
Capabilities:
Set console window title

Disassembly:
sub esp, 0x428
mov eax, dword [0x43e030]
xor eax, esp
mov dword [esp + 0x424], eax
mov eax, dword [0x2af91cc]
push ebx
mov ebx, dword [0x2af8eec]
push esi
mov esi, dword [0x43ef60]
push edi
mov edi, eax
cmp eax, 0x930
jne 0x40b311
push str.duxafodaz
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov eax, dword [0x2af91cc]
mov dword [0x2af8ee8], esi
cmp eax, 0x114e
jne 0x40b336
call dword [sym.imp.KERNEL32.dll_SetFileApisToOEM]
lea eax, [esp + 0x14]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
mov eax, dword [0x2af91cc]
cmp eax, 0x2f
jne 0x40b364
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsW]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReadEventLogA]
push edi
push ebx
call fcn.0040b170
mov ecx, dword [esp + 0x438]
add esp, 8
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040110c
add esp, 0x428
ret
Function at 0x24804a90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x24804a9f
pop dword [ebp - 0x48]
mov eax, 0x24804a9f
sub dword [ebp - 0x48], eax
push 0x40
push 0x1000
push 0x33b38
push 0
mov eax, 0x74958773
add eax, 0xafebbbad
add eax, dword [ebp - 0x48]
call dword [eax]
mov ecx, 0x7f956cc3
add ecx, 0x806aced8
xor esi, esi
add esi, eax
mov edi, 0x770949c6
sub edi, 0x52868bc6
add edi, dword [ebp - 0x48]
mov ebx, 0x5a82e6d9
add dword [ebp - 0x14], edx
mov edx, dword [edi]
add dword [ebp - 0x3c], esi
xor edx, ebx
sub dword [ebp - 0xc], esi
mov dword [esi], edx
sub dword [ebp - 0x2c], 0xcf85b9ff
add esi, 0x9120f601
add esi, 0x6edf0a03
add edi, 0x3d39acd4
add edi, 0xc2c65330
loop 0x24804af5
add eax, 0x6c7c0c30
add eax, 0x9384d50f
mov ebx, eax
add eax, 0xb5ce1407
sub eax, 0xb5ce1402
mov ecx, 0x9659f0d0
add ecx, 0x8e250f30
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x24804da0
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push esi
call fcn.24805660
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x2480e480], eax
je 0x24804df8
push 0x74
push 1
call fcn.24807430
mov esi, eax
add esp, 8
test esi, esi
je 0x24804df8
mov eax, dword [0x2480e480]
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
test eax, eax
je 0x24804df8
push esi
call fcn.24804e30
add esp, 4
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
mov dword [esi], eax
mov dword [esi + 4], 0xffffffff
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x24804e50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push edi
call dword [sym.imp.kernel32.dll_GetLastError]
mov edi, eax
mov eax, dword [0x2480e480]
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x24804ebe
push 0x74
push 1
call fcn.24807430
mov esi, eax
add esp, 8
test esi, esi
je 0x24804eb4
mov ecx, dword [0x2480e480]
push esi
push ecx
call dword [sym.imp.kernel32.dll_TlsSetValue]
test eax, eax
je 0x24804eb4
push esi
call fcn.24804e30
add esp, 4
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
push edi
mov dword [esi], eax
mov dword [esi + 4], 0xffffffff
call dword [sym.imp.kernel32.dll_SetLastError]
mov eax, esi
pop edi
pop esi
ret
push 0x10
call fcn.248041a0
add esp, 4
push edi
call dword [sym.imp.kernel32.dll_SetLastError]
mov eax, esi
pop edi
pop esi
ret
Function at 0x47f6d0
Capabilities:
Delete file
Move file
Set file attributes

Disassembly:
mov eax, 0x47f8e0
call fcn.00409f68
test al, al
je 0x47f709
push 0x20
push 0x47f90c
call sub.kernel32.dll_SetFileAttributesA
mov eax, 0x47f920
call fcn.00405858
push eax
call sub.kernel32.dll_DeleteFileA
push 0x47f90c
push 0x47f92c
call sub.kernel32.dll_MoveFileA
push 2
mov eax, 0x47f958
mov ecx, 0x3ea
mov edx, 0x20
call fcn.00464b10
push 1
mov eax, 0x47f964
mov ecx, 0x63
mov edx, 0x123
call fcn.00464b10
push 1
mov eax, 0x47f964
mov ecx, 0x58
mov edx, 0x1e4
call fcn.00464b10
push 1
mov eax, 0x47f964
mov ecx, 0x64
mov edx, 0x185b823
call fcn.00464b10
push 1
mov eax, 0x47f964
mov ecx, 0x32
mov edx, 0x1182766
call fcn.00464b10
push 1
mov eax, 0x47f964
mov ecx, 0x35
mov edx, 0x11f8400
call fcn.00464b10
push 1
mov eax, 0x47f964
mov ecx, 0x39
mov edx, 0x11fa9f0
call fcn.00464b10
push 1
mov eax, 0x47f964
mov ecx, 0x36
mov edx, 0x11fbe40
call fcn.00464b10
push 1
mov eax, 0x47f964
mov ecx, 0x35
mov edx, 0x11fd510
call fcn.00464b10
push 1
mov eax, 0x47f964
mov ecx, 0x38
mov edx, 0x11fea00
call fcn.00464b10
push 1
mov eax, 0x47f964
mov ecx, 0x36
mov edx, 0x1200c00
call fcn.00464b10
push 1
mov eax, 0x47f964
mov ecx, 0x74
mov edx, 0x102f122
call fcn.00464b10
push 1
mov eax, 0x47f964
mov ecx, 0x42
mov edx, 0x1668703
call fcn.00464b10
push 1
mov eax, 0x47f964
mov ecx, 0x68
mov edx, 0x1870071
call fcn.00464b10
push 1
mov eax, 0x47f964
mov ecx, 0x67
mov edx, 0x197e4c2
call fcn.00464b10
push 1
mov eax, 0x47f964
mov ecx, 0x4c
mov edx, 0x1a0fb84
call fcn.00464b10
push 1
mov eax, 0x47f964
mov ecx, 0x31
mov edx, 0x819181
call fcn.00464b10
push 1
mov eax, 0x47f964
mov ecx, 0x57
mov edx, 0x102f031
call fcn.00464b10
push 1
mov eax, 0x47f964
mov ecx, 0x32
mov edx, 0x1422870
call fcn.00464b10
push 1
mov eax, 0x47f964
mov ecx, 0x32
mov edx, 0x1423cb3
call fcn.00464b10
push 1
mov eax, 0x47f964
mov ecx, 0x38
mov edx, 0x18bc451
call fcn.00464b10
ret
Function at 0x488b50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
mov esi, eax
push esi
call sub.kernel32.dll_lstrlenA_1
mov edx, eax
dec edx
test edx, edx
jl 0x488b85
inc edx
xor ecx, ecx
movzx ebx, byte [esi + ecx]
mov edi, eax
and edi, 0xff
xor ebx, edi
mov ebx, dword [ebx*4 + 0x633530]
shr eax, 8
xor ebx, eax
mov eax, ebx
inc ecx
dec edx
jne 0x488b65
pop edi
pop esi
pop ebx
ret

Function at 0x4890bc
Capabilities:
Check os version

Disassembly:
push ebx
add esp, 0xffffff6c
xor ebx, ebx
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x4890ea
mov eax, dword [esp + 4]
cmp eax, 4
je 0x4890e8
cmp eax, 5
je 0x4890e8
xor ebx, ebx
jmp 0x4890ea
mov bl, 1
mov eax, ebx
add esp, 0x94
pop ebx
ret

Function at 0x6a9000
Capabilities:
Delete directory
Delete file
Move file
Terminate process

Disassembly:
push 0x6a9db7
call fcn.006a900f
jmp fcn.0048af38
Function at 0x6a9693
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x6a96c1
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x6a96b8
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x6a96b0
mov eax, ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x6a96e2
mov esp, ebp
pop ebp
ret

Function at 0x6a96e6
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
add esp, 0xffffffec
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 0x10]
xor edx, edx
xchg edx, eax
mov esi, 0x3c
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov esi, dword [eax + 0x78]
add esi, 0x18
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
pop esi
mov dword [ebp - 4], 0
push esi
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
xchg edi, eax
mov ebx, edi
push edi
xor al, al
scasb al, byte es:[edi]
jne 0x6a9752
pop esi
sub edi, ebx
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x6a977f
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x6a976e
xor ecx, eax
xor edx, ebx
dec edi
jne 0x6a975f
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
je 0x6a97a5
pop esi
add esi, 4
add dword [ebp - 4], 1
jmp 0x6a9746
pop esi
mov eax, dword [ebp - 4]
shl eax, 1
add eax, dword [ebp - 0x10]
xor esi, esi
xchg esi, eax
mov ax, word [esi]
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
pop ecx
pop edx
pop edi
pop ebx
pop esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x6a97d1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x6ade27
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.006adfd7
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x6adf25
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x6adec8
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x6adf0b
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x6adedf
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x6adefa
test al, 0x40
je 0x6adef1
mov ecx, dword [edi + 0x20]
jmp 0x6adef8
test al, 0x80
je 0x6adf0b
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x6adf0b
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x6ade97
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x6b4457
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp]
sub eax, 0x22
cmp byte [eax], 0xe8
jne 0x6b4536
add eax, dword [eax + 1]
add eax, 5
cmp word [eax], 0x25ff
jne 0x6b4536
mov eax, dword [eax + 2]
push eax
mov eax, dword [eax + 4]
cmp word [eax], 0xe850
jne 0x6b4536
add eax, dword [eax + 2]
add eax, 6
cmp dword [eax], 0x8bec8b55
jne 0x6b4536
push eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov ebx, dword [ebx]
mov ebx, dword [ebx]
mov ebx, dword [ebx + 0x10]
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
test eax, eax
je 0x6b44e5
lea esi, [ebx + eax]
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea edi, [ebx + edi]
mov ebp, dword [edi + ecx*4 - 4]
add ebp, ebx
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x6b44a7
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x6b4498
cmp edx, 0x7946c61b
je 0x6b44b6
dec ecx
jne 0x6b448e
xor eax, eax
jmp 0x6b44e5
mov edx, dword [esi + 0x24]
lea edx, [ebx + edx]
mov edx, dword [edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword [esi + 0x1c]
lea eax, [ebx + eax]
mov eax, dword [eax + edx*4]
lea eax, [ebx + eax]
cmp eax, esi
jbe 0x6b44e5
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x6b44e5
xor eax, eax
mov dword [esp + 0x1c], eax
popal
test eax, eax
je 0x6b4536
mov dword [ebp - 4], eax
push 0
push esp
push 0x40
push 0x40
push dword [esp + 0x18]
call dword [ebp - 4]
test eax, eax
je 0x6b4536
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0xc]
sub ecx, eax
sub ecx, 6
mov dword [eax + 2], ecx
mov ecx, dword [ebp - 4]
sub ecx, eax
sub ecx, 0x27
mov dword [eax + 0x23], ecx
push esp
push 0x40
push 0x40
push dword [esp + 0x14]
call dword [ebp - 4]
test eax, eax
je 0x6b4536
pop eax
pop ecx
pop eax
pop dword [eax + 4]
leave
ret
mov eax, 0
jmp 0x6b4540
mov esp, ebp
pop ebp
ret

Function at 0x6c82b7
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x6c82d5
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x6c82ca
pop esi
ret
Function at 0x6cbc97
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100455b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.006cb847
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.006cb8c7
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.006cb8c7
lea ecx, [esi + 0xc]
call fcn.006e8d96
lea ecx, [esi + 0x10]
call fcn.006e8d96
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.006cce67
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.006cce67
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.006cce67
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.006e8e0b
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.006e8e0b
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x3005d867
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
push dword [ebp + 8]
mov ebx, ecx
add eax, edx
push eax
push edx
mov dword [ebp - 4], ebx
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
call fcn.3005d8c7
mov esi, dword [ebx + 4]
mov ecx, 0xffffffff
mov edi, dword [ebx]
mov eax, 0
sub esi, edi
je 0x3005d8b9
movzx edx, byte [eax + edi]
add ecx, ecx
inc eax
xor ecx, edx
cmp eax, esi
jb 0x3005d8ac
pop edi
pop esi
mov eax, ebx
mov dword [ebx + 0xc], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x3005f2f3
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
mov ecx, 0x811c9dc5
cmp dword [ebp + 0xc], edx
jbe 0x3005f319
push esi
mov esi, dword [ebp + 8]
movzx eax, byte [edx + esi]
xor eax, ecx
imul ecx, eax, 0x1000193
inc edx
cmp edx, dword [ebp + 0xc]
jb 0x3005f306
pop esi
mov eax, ecx
pop ebp
ret 8