joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6587d0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd80
xor edx, edx
mov dword [ebp - 0x280], edx
mov dword [ebp - 0x27c], edx
mov dword [ebp - 0x278], edx
mov dword [ebp - 0x274], eax
lea eax, [ebp - 0x270]
mov edx, dword [0x41cb60]
call fcn.0040b634
xor eax, eax
push ebp
push 0x65898c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [ebp - 0x274]
call fcn.00425cb0
test al, al
je 0x65882e
mov eax, dword [ebp - 0x274]
call fcn.004261bc
lea edx, [ebp - 0x278]
mov eax, dword [ebp - 0x274]
call fcn.0042e2c0
lea eax, [ebp - 0x278]
mov edx, 0x6589a4
call fcn.0040b0a8
mov eax, dword [ebp - 0x278]
lea ecx, [ebp - 0x270]
mov edx, 0x1ff
call fcn.0042612c
test eax, eax
jne 0x658939
xor eax, eax
push ebp
push 0x658932
push dword fs:[eax]
mov dword fs:[eax], esp
test byte [ebp - 0x260], 0x10
jne 0x6588b3
lea edx, [ebp - 0x27c]
mov eax, dword [ebp - 0x274]
call fcn.0042e2c0
lea eax, [ebp - 0x27c]
mov edx, dword [ebp - 0x25c]
call fcn.0040b0a8
mov eax, dword [ebp - 0x27c]
call fcn.004261bc
jmp 0x658904
mov eax, dword [ebp - 0x25c]
mov edx, 0x6589b8
call fcn.0040b298
je 0x658904
mov eax, dword [ebp - 0x25c]
mov edx, 0x6589c8
call fcn.0040b298
je 0x658904
lea edx, [ebp - 0x280]
mov eax, dword [ebp - 0x274]
call fcn.0042e2c0
lea eax, [ebp - 0x280]
mov edx, dword [ebp - 0x25c]
call fcn.0040b0a8
mov eax, dword [ebp - 0x280]
call fcn.006587d0
lea eax, [ebp - 0x270]
call fcn.0042617c
test eax, eax
je 0x65887b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x658939
lea eax, [ebp - 0x270]
call fcn.004261a0
pop eax
jmp eax
mov dl, 1
mov eax, dword [ebp - 0x274]
call fcn.00425d48
test al, al
je 0x65895b
mov eax, dword [ebp - 0x274]
call fcn.0040ae9c
push eax
call sub.kernel32.dll_RemoveDirectoryW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x658993
lea eax, [ebp - 0x280]
mov edx, 3
call fcn.0040a23c
lea eax, [ebp - 0x270]
mov edx, dword [0x41cb60]
call fcn.0040ba20
pop eax
jmp eax
Function at 0x658a7c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x658bda
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x71863c]
call fcn.0040db1c
mov ebx, eax
push 0xa
push 0x658be8
push ebx
call sub.kernel32.dll_FindResourceW
mov edi, eax
test edi, edi
jne 0x658b28
mov eax, esi
call fcn.00658a14
mov eax, dword [esi]
test eax, eax
je 0x658acb
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
dec ebx
cmp ebx, 2
jl 0x658baf
lea eax, [ebp - 0x10]
mov edx, dword [esi]
movzx edx, word [edx + ebx*2 - 2]
call fcn.0040aebc
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
mov edx, dword [esi]
movzx edx, word [edx + ebx*2 - 2]
call fcn.0040aebc
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.004243ac
mov edx, dword [ebp - 0x14]
pop eax
call fcn.0040b298
jne 0x658b1d
mov edx, esi
mov ecx, ebx
mov eax, 0x658c18
call fcn.0040b374
dec ebx
cmp ebx, 1
jne 0x658ad7
jmp 0x658baf
push edi
push ebx
call sub.kernel32.dll_LoadResource
test eax, eax
je 0x658baa
push eax
call sub.kernel32.dll_LockResource
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x658ba3
push edi
push ebx
call sub.kernel32.dll_SizeofResource
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x404cf0]
call fcn.0040d280
add esp, 4
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov ecx, ebx
call fcn.004077e0
xor eax, eax
mov dword [ebp - 0xc], eax
call fcn.004320cc
mov ecx, eax
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004315c0
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x658b92
sub ebx, 4
mov ebx, dword [ebx]
push ebx
push esi
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.00431f74
jmp 0x658baf
call fcn.0042f4e8
jmp 0x658baf
call fcn.0042f4e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x658be1
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.0040a23c
lea eax, [ebp - 4]
mov edx, dword [0x404cf0]
call fcn.0040d3a4
pop eax
jmp eax
Function at 0x65b6e8
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x65b7e5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4799b4]
call fcn.004a3cdc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x65b7c6
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetEnvironmentStringsW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x65b7a3
xor eax, eax
push ebp
push 0x65b79c
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebp - 0xc]
jmp 0x65b77d
lea eax, [ebp - 4]
mov edx, esi
call fcn.0040aefc
mov edx, dword [ebp - 4]
mov eax, 0x65b800
call fcn.004bd710
mov ebx, eax
test bl, bl
jne 0x65b76d
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, esi
call fcn.0040a700
mov edi, eax
inc edi
mov eax, edi
add eax, eax
add esi, eax
cmp word [esi], 0
jne 0x65b745
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65b7a3
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FreeEnvironmentStringsW
pop eax
jmp eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65b7cd
mov eax, dword [ebp - 0x10]
call fcn.00408510
pop eax
jmp eax
Function at 0x65d644
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0x65d8b4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x71c44c
xor ecx, ecx
mov edx, 0x10
call fcn.00407e64
mov eax, dword [0x71413c]
movzx eax, byte [eax]
xor al, 1
mov byte [ebp - 9], al
mov byte [ebp - 0xa], 0
cmp byte [ebp - 9], 0
jne 0x65d768
lea eax, [ebp - 0x20]
call fcn.0065d5d0
mov eax, dword [ebp - 0x20]
call fcn.0040ae9c
push eax
push 0
push 4
call sub.kernel32.dll_OpenFileMappingW
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x65d768
xor eax, eax
push ebp
push 0x65d761
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x65d748
xor eax, eax
push ebp
push 0x65d741
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x71c44c
mov eax, dword [ebp - 8]
mov ecx, 0x10
call fcn.004077e0
cmp dword [0x71c44c], 0
je 0x65d71f
cmp dword [0x71c450], 0
je 0x65d71f
cmp dword [0x71c454], 0
je 0x65d71f
cmp dword [0x71c458], 0
jne 0x65d723
xor eax, eax
jmp 0x65d725
mov al, 1
mov byte [ebp - 0xa], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65d748
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_UnmapViewOfFile
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65d768
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle
pop eax
jmp eax
cmp byte [ebp - 0xa], 0
jne 0x65d854
mov eax, dword [0x711af4]
call fcn.00407294
mov dword [0x711b48], eax
mov eax, 0x711b54
mov edx, dword [0x714b4c]
mov edx, dword [edx]
call fcn.0040a5cc
cmp byte [ebp - 9], 0
je 0x65d854
lea eax, [ebp - 0x24]
call fcn.0065d5d0
mov eax, dword [ebp - 0x24]
call fcn.0040ae9c
push eax
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingW
mov dword [0x711b58], eax
cmp dword [0x711b58], 0
je 0x65d854
push 0
push 0
push 0
push 2
mov eax, dword [0x711b58]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x65d854
xor eax, eax
push ebp
push 0x65d84d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
xor ecx, ecx
mov edx, 0x10
call fcn.00407e64
mov dword [ebp - 0x1c], fcn.0065a094
mov dword [ebp - 0x18], 0x659e34
mov dword [ebp - 0x14], 0x659fe8
mov dword [ebp - 0x10], 0x65ab0c
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x1c]
mov ecx, 0x10
call fcn.004077e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65d854
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_UnmapViewOfFile
pop eax
jmp eax
cmp byte [ebp - 9], 0
je 0x65d87b
cmp dword [0x711b58], 0
je 0x65d86f
mov eax, 0x65d8cc
call fcn.00659e80
jmp 0x65d897
mov eax, 0x65d920
call fcn.00659e80
jmp 0x65d897
cmp byte [ebp - 0xa], 0
je 0x65d88d
mov eax, 0x65d97c
call fcn.00659e80
jmp 0x65d897
mov eax, 0x65d9d0
call fcn.00659e80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65d8bb
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.0040a23c
pop eax
jmp eax
Function at 0x662210
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push 0
call sub.ws2_32.dll_select
test eax, eax
setg byte [ebp - 9]
cmp byte [ebp - 9], 0
je 0x6622dc
mov esi, ebx
dec esi
test esi, esi
jl 0x6622dc
inc esi
xor edi, edi
mov edx, dword [ebp - 4]
add edx, edi
mov eax, dword [ebp + 0x10]
mov eax, dword [eax - 4]
call fcn.0049f5ec
mov ebx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
push ebx
call sub.ws2_32.dll___WSAFDIsSet
test eax, eax
setne al
test al, al
je 0x6622ae
push 2
push 1
lea eax, [ebp - 0xa]
push eax
push ebx
call sub.ws2_32.dll_recv
dec eax
jne 0x66229f
mov eax, dword [ebp + 0x10]
mov eax, dword [eax - 8]
mov edx, ebx
call fcn.0049f468
jmp 0x6622d4
mov eax, dword [ebp + 0x10]
mov eax, dword [eax - 0xc]
mov edx, ebx
call fcn.0049f468
jmp 0x6622d4
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
push ebx
call sub.ws2_32.dll___WSAFDIsSet
test eax, eax
setne al
test al, al
je 0x6622d4
mov eax, dword [ebp + 0x10]
mov eax, dword [eax - 0xc]
mov edx, ebx
call fcn.0049f468
inc edi
dec esi
jne 0x662254
movzx eax, byte [ebp - 9]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x662e68
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x662f31
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [esi + 0x28]
cmp eax, 0xffffffff
setne bl
test bl, bl
je 0x662f19
lea edx, [ebp - 3]
push edx
push 0
lea edx, [ebp - 2]
xor ecx, ecx
call dword [0x711b94]
test al, al
je 0x662eb1
cmp byte [ebp - 3], 0
je 0x662eb5
xor ebx, ebx
jmp 0x662eb7
mov bl, 1
test byte [ebp - 2], bl
je 0x662ed1
push 2
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [esi + 0x28]
push eax
call sub.ws2_32.dll_recv
dec eax
sete bl
test bl, bl
jne 0x662f19
lea eax, [ebp - 8]
push eax
mov eax, dword [esi + 0x2c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0x11
movzx eax, word [esi + 0x10]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x18]
mov ecx, 1
mov eax, 0x662f4c
call fcn.00426c18
mov edx, dword [ebp - 8]
mov ecx, 0x662f8c
mov eax, 7
call fcn.0065b090
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x662f38
lea eax, [ebp - 8]
call fcn.0040a1dc
pop eax
jmp eax
Function at 0x663ab4
Capabilities:
Set socket configuration

Disassembly:
push ebx
push ecx
mov ebx, eax
xor eax, eax
mov dword [ebx + 0x34], eax
mov eax, dword [ebx + 0x30]
call fcn.004072b0
xor eax, eax
mov dword [ebx + 0x30], eax
mov eax, dword [ebx + 0x28]
cmp eax, 0xffffffff
je 0x663b0f
cmp byte [ebx + 0x14], 0
je 0x663b00
mov word [esp], 1
movzx edx, word [ebx + 0x16]
mov word [esp + 2], dx
push 4
lea edx, [esp + 4]
push edx
push 0x80
push 0xffff
push eax
call sub.ws2_32.dll_setsockopt
jmp 0x663b08
push 2
push eax
call sub.ws2_32.dll_shutdown
mov eax, ebx
call fcn.00662fc8
pop edx
pop ebx
ret

Function at 0x663b14
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov esi, eax
xor eax, eax
push ebp
push 0x663bfd
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [esi + 0x34], 0
jbe 0x663b3e
mov bl, 1
jmp 0x663be5
mov eax, dword [esi + 0x28]
cmp eax, 0xffffffff
jne 0x663b4d
xor ebx, ebx
jmp 0x663be5
xor ebx, ebx
mov byte [ebp - 2], 0
lea ecx, [ebp - 4]
push ecx
push edx
lea edx, [ebp - 3]
xor ecx, ecx
call dword [0x711b94]
test al, al
je 0x663b95
cmp byte [ebp - 4], 0
jne 0x663b95
cmp byte [ebp - 3], 0
je 0x663b91
push 2
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [esi + 0x28]
push eax
call sub.ws2_32.dll_recv
dec eax
jne 0x663b8b
mov bl, 1
jmp 0x663b99
mov byte [ebp - 2], 1
jmp 0x663b99
xor ebx, ebx
jmp 0x663b99
mov byte [ebp - 2], 1
cmp byte [ebp - 2], 0
je 0x663be5
lea eax, [ebp - 8]
push eax
mov eax, dword [esi + 0x2c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0x11
movzx eax, word [esi + 0x10]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x18]
mov ecx, 1
mov eax, 0x663c18
call fcn.00426c18
mov edx, dword [ebp - 8]
mov ecx, 0x663c58
mov eax, 7
call fcn.0065b090
xor ebx, ebx
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x663c04
lea eax, [ebp - 8]
call fcn.0040a1dc
pop eax
jmp eax
Function at 0x663d54
Capabilities:
Send data
Send data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x663f05
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x18]
test al, al
je 0x663eed
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], 4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x1001
push 0xffff
mov eax, dword [esi + 0x28]
push eax
call sub.ws2_32.dll_getsockopt
test eax, eax
jne 0x663ed5
cmp edi, dword [ebp - 0x10]
jle 0x663ed5
mov dword [ebp - 0x10], edi
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x1001
push 0xffff
mov eax, dword [esi + 0x28]
push eax
call sub.ws2_32.dll_setsockopt
jmp 0x663ed5
mov byte [ebp - 0x15], 0
mov byte [ebp - 0x16], 0
mov eax, dword [esi + 0x28]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x16]
push eax
push 0x5dc
lea ecx, [ebp - 0x15]
xor edx, edx
mov eax, dword [ebp - 0x1c]
call dword [0x711b94]
mov byte [ebp - 0x1d], al
movzx ebx, byte [ebp - 0x1d]
test byte [ebp - 0x15], bl
je 0x663e66
cmp byte [ebp - 0x16], 0
jne 0x663e66
push 0
push edi
mov eax, dword [ebp - 4]
push eax
mov eax, dword [esi + 0x28]
push eax
call sub.ws2_32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x663e48
sub edi, dword [ebp - 8]
mov eax, dword [ebp - 8]
add dword [ebp - 4], eax
mov eax, dword [ebp - 8]
cdq
add dword [esi + 0x38], eax
adc dword [esi + 0x3c], edx
jmp 0x663e7b
cmp dword [ebp - 8], 0
jge 0x663e57
mov dword [ebp - 0xc], 0xb
jmp 0x663e7b
inc dword [ebp - 0xc]
push 0x5dc
call sub.kernel32.dll_Sleep
jmp 0x663e7b
xor bl, 1
or bl, byte [ebp - 0x16]
je 0x663e71
inc dword [ebp - 0xc]
push 0x5dc
call sub.kernel32.dll_Sleep
cmp dword [ebp - 0xc], 0xa
jle 0x663ed5
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0
lea eax, [ebp - 0x28]
push eax
push 0
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [esi + 0x2c]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0x11
movzx eax, word [esi + 0x10]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0
lea edx, [ebp - 0x3c]
mov ecx, 1
mov eax, 0x663f24
call fcn.00426c18
mov edx, dword [ebp - 0x2c]
mov ecx, 0x663f64
mov eax, 7
call fcn.0065b0a8
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x10]
test edi, edi
jle 0x663ee8
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x18]
test al, al
jne 0x663de3
test edi, edi
setle bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x663f0c
lea eax, [ebp - 0x2c]
call fcn.0040a1dc
pop eax
jmp eax
Function at 0x68a5b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x71c890], 0
jne 0x68a5c7
call fcn.0068a56c
mov eax, edi
dec eax
test eax, eax
jl 0x68a5ef
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x71c490]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x68a5d1
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x68d66c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x68d69d
dec al
je 0x68d6d8
dec al
je 0x68d71c
dec al
je 0x68d78e
jmp 0x68d829
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x68d829
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x68d6ad
jmp 0x68d829
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x68d829
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
movzx ecx, al
mov ecx, dword [ebx + ecx*4 + 0x40]
add dl, byte [ecx + esi]
and dl, 0xff
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x68d6e8
jmp 0x68d829
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x68d829
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
jbe 0x68d74f
xor edx, edx
mov dword [esp + 4], edx
jmp 0x68d764
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov ebp, dword [ebx + edx*4 + 0x40]
movzx edx, byte [ebp + esi]
add eax, dword [esp + 4]
sar eax, 1
jns 0x68d77c
adc eax, 0
add dl, al
and dl, 0xff
mov byte [ebp + esi], dl
inc esi
dec edi
jne 0x68d72c
jmp 0x68d829
xor eax, eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x68d829
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
ja 0x68d7f5
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 8], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 8]
push eax
movzx eax, byte [esp + 8]
pop edx
call fcn.0068a5f8
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [esp]
and al, 0xff
mov byte [edx + esi], al
inc esi
dec edi
jne 0x68d7aa
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x6985cc
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x69861d
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x698604
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x6985f4
jmp 0x69861d
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x698605
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6c9e48
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
cmp byte [eax + 0xc0], 0
je 0x6c9e82
lea eax, [ebp - 0x10]
push eax
call sub.kernel32.dll_QueryPerformanceCounter
test eax, eax
jne 0x6c9e82
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
xor edx, edx
push ebp
push 0x6c9f71
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.006c9b98
mov eax, dword [eax + 8]
mov edi, dword [eax + 8]
dec edi
test edi, edi
jl 0x6c9ef9
inc edi
xor esi, esi
mov eax, dword [ebp - 4]
call fcn.006c9b98
mov ebx, eax
mov eax, dword [ebx + 8]
mov edx, esi
call fcn.0049f5ec
mov ebx, eax
mov eax, dword [ebx + 0x10]
mov eax, dword [eax + 0x14]
call fcn.0049f740
cmp ebx, eax
sete al
test al, al
je 0x6c9ef5
mov eax, dword [ebp - 4]
call fcn.006c9b98
mov ebx, eax
mov eax, dword [ebx + 8]
mov edx, esi
call fcn.0049f5ec
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 4]
call fcn.006c9968
mov byte [ebp - 5], 1
jmp 0x6c9ef9
inc esi
dec edi
jne 0x6c9ea6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6c9f78
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
cmp byte [eax + 0xc0], 0
je 0x6c9f6e
lea eax, [ebp - 0x18]
push eax
call sub.kernel32.dll_QueryPerformanceCounter
test eax, eax
jne 0x6c9f30
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0xc], 0
jne 0x6c9f3a
cmp dword [ebp - 0x10], 0
je 0x6c9f6e
cmp dword [ebp - 0x14], 0
jne 0x6c9f46
cmp dword [ebp - 0x18], 0
je 0x6c9f6e
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
sub eax, dword [ebp - 0x10]
sbb edx, dword [ebp - 0xc]
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov edx, dword [eax + 0x40]
mov ecx, 0x6c9f90
mov eax, dword [0x6c7a50]
call fcn.006d3538
pop eax
jmp eax