joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403c65
Capabilities:
Get common file path

Disassembly:
mov eax, 0x412493
call fcn.0040a2e8
sub esp, 0x128
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
mov al, byte [ebp + 0xb]
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 1
mov byte [ebp - 0x28], al
call fcn.00403c07
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.ieframe.dll
mov byte [ebp - 4], 2
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
mov dword [ebp - 0x2c], eax
je 0x403d1d
push str.IEGetWriteableFolderPath
push eax
call edi
cmp eax, esi
je 0x403d14
lea ecx, [ebp - 0x14]
push ecx
push 0x413238
call eax
cmp eax, esi
jl 0x403d14
cmp dword [ebp - 0x14], esi
je 0x403d14
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
call fcn.00403fec
mov ecx, dword [ebp - 0x18]
cmp ecx, esi
je 0x403cf3
call fcn.0040409d
mov dword [ebp - 0x10], eax
jmp 0x403cf6
mov dword [ebp - 0x10], esi
push dword [ebp - 0x10]
call fcn.00409c10
pop ecx
push eax
lea ecx, [ebp - 0x28]
push dword [ebp - 0x10]
call fcn.004041b5
push dword [ebp - 0x14]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x20], esi
jne 0x403dc2
call fcn.00403f1c
test eax, eax
je 0x403d8f
push str.shell32.dll
call ebx
cmp eax, esi
mov dword [ebp - 0x10], esi
je 0x403d56
push str.SHGetKnownFolderPath
push eax
call edi
cmp eax, esi
je 0x403d56
lea ecx, [ebp - 0x10]
push ecx
push esi
push esi
push 0x413248
call eax
push 0x104
call fcn.00409a90
pop ecx
mov edi, eax
push esi
push esi
push 0x3c
push edi
push 0xffffffffffffffff
push dword [ebp - 0x10]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push edi
call fcn.00409c10
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.004041b5
push edi
call fcn.00409631
pop ecx
jmp 0x403dc2
push 1
lea eax, [ebp - 0x134]
push 0x1a
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x403dc2
lea eax, [ebp - 0x134]
push eax
call fcn.00409c10
pop ecx
push eax
lea eax, [ebp - 0x134]
push eax
lea ecx, [ebp - 0x28]
call fcn.004041b5
mov edi, dword [ebp + 8]
mov al, byte [ebp - 0x28]
push esi
mov ecx, edi
mov byte [edi], al
call fcn.00403c07
push dword [0x413258]
lea eax, [ebp - 0x28]
mov ecx, edi
push esi
push eax
call fcn.004040e7
push 1
pop eax
mov dword [ebp - 0x30], eax
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], al
call fcn.00403c07
mov ecx, dword [ebp - 0x18]
cmp ecx, esi
je 0x403e02
call fcn.00404070
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x403e13
Capabilities:
Get common file path

Disassembly:
mov eax, 0x4124a8
call fcn.0040a2e8
sub esp, 0xc
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.ieframe.dll
mov dword [ebp - 4], esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
mov dword [ebp - 0x18], eax
je 0x403ea0
push str.IEGetWriteableFolderPath
push eax
call ebx
cmp eax, esi
je 0x403e97
lea ecx, [ebp - 0x10]
push ecx
push 0x413238
call eax
test eax, eax
jl 0x403e97
cmp dword [ebp - 0x10], esi
je 0x403e97
push dword [ebp - 0x10]
lea ecx, [ebp - 0x14]
call fcn.00403fec
mov ecx, dword [ebp - 0x14]
cmp ecx, esi
je 0x403e81
call fcn.0040409d
jmp 0x403e83
xor eax, eax
push eax
push dword [ebp + 0xc]
call fcn.004099a0
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [ebp + 0xc]
call fcn.00409c10
test eax, eax
pop ecx
jne 0x403f01
call fcn.00403f1c
test eax, eax
je 0x403ef3
push str.shell32.dll
call edi
cmp eax, esi
mov dword [ebp - 0x18], esi
je 0x403edd
push str.SHGetKnownFolderPath
push eax
call ebx
cmp eax, esi
je 0x403edd
lea ecx, [ebp - 0x18]
push ecx
push esi
push esi
push 0x413248
call eax
push esi
push esi
push 0x3c
push dword [ebp + 0xc]
push 0xffffffffffffffff
push dword [ebp - 0x18]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x403f01
push 1
push 0x1a
push dword [ebp + 0xc]
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov ecx, dword [ebp - 0x14]
pop edi
cmp ecx, esi
pop esi
pop ebx
je 0x403f10
call fcn.00404070
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret

Function at 0x403f1c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
push 0x24
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.00409aa0
push 0x9c
lea eax, [ebp - 0xc0]
push 0
push eax
call fcn.00409aa0
add esp, 0x18
lea eax, [ebp - 0xc0]
mov dword [ebp - 0xc0], 0x9c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x403f65
leave
ret
cmp dword [ebp - 0xbc], 6
sbb eax, eax
inc eax
leave
ret

Function at 0x403f71
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
push edi
xor edi, edi
push 0x24
lea eax, [ebp - 0x24]
push edi
push eax
call fcn.00409aa0
push 0x9c
lea eax, [ebp - 0xc0]
push edi
push eax
call fcn.00409aa0
add esp, 0x18
lea eax, [ebp - 0xc0]
mov dword [ebp - 0xc0], 0x9c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x403fce
cmp dword [ebp - 0xbc], 6
jb 0x403fcc
cmp word [ebp - 0x24], 9
jne 0x403fcc
push 1
pop edi
mov eax, edi
pop edi
leave
ret
Function at 0x40aa87
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40aaa7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040d1c4
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x40aac8
test byte [esp + 8], 2
je 0x40aac8
mov dword [0x41aff8], 0xd
mov dword [0x41affc], 5
jmp 0x40aaa3
xor eax, eax
ret
Function at 0x58abd6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 8
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
not esi
mov edx, 0xff
jb 0x58ac1f
mov eax, dword [ebp + 0x10]
push ebx
shr eax, 3
push edi
xor ebx, ebx
mov bl, byte [ecx]
mov edi, esi
shr edi, 8
sub dword [ebp + 0x10], 8
xor ebx, esi
and ebx, edx
mov esi, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
xor ebx, ebx
xor esi, edi
inc ecx
mov bl, byte [ecx]
xor ebx, esi
and ebx, edx
mov edi, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
xor ebx, ebx
shr esi, 8
xor edi, esi
inc ecx
mov bl, byte [ecx]
xor ebx, edi
and ebx, edx
mov esi, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
xor ebx, ebx
shr edi, 8
xor esi, edi
inc ecx
mov bl, byte [ecx]
xor ebx, esi
and ebx, edx
mov edi, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
xor ebx, ebx
shr esi, 8
xor edi, esi
inc ecx
mov bl, byte [ecx]
xor ebx, edi
and ebx, edx
mov esi, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
xor ebx, ebx
shr edi, 8
xor esi, edi
inc ecx
mov bl, byte [ecx]
xor ebx, esi
and ebx, edx
mov edi, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
shr esi, 8
xor edi, esi
xor ebx, ebx
inc ecx
mov bl, byte [ecx]
xor ebx, edi
and ebx, edx
mov esi, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
shr edi, 8
xor esi, edi
xor ebx, ebx
inc ecx
mov bl, byte [ecx]
xor ebx, esi
and ebx, edx
mov edi, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
shr esi, 8
xor esi, edi
inc ecx
dec eax
jne 0x58ab68
pop edi
pop ebx
cmp dword [ebp + 0x10], 0
je 0x58ac3f
xor eax, eax
mov al, byte [ecx]
xor eax, esi
and eax, edx
mov eax, dword [eax*4 + reloc.MSVCRT.dll___dllonexit]
shr esi, 8
xor esi, eax
inc ecx
dec dword [ebp + 0x10]
jne 0x58ac25
mov eax, esi
not eax
pop esi
pop ebp
ret 0xc

Function at 0x58ac48
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x58]
add dword [esi + 0x5c], ecx
test ecx, ecx
not eax
jbe 0x58ac8c
push ebx
push edi
mov edi, dword [esp + 0x14]
mov edx, ecx
mov ecx, dword [esp + 0x18]
mov bl, byte [ecx]
mov byte [edi], bl
xor ebx, ebx
mov bl, byte [ecx]
inc edi
xor ebx, eax
and ebx, 0xff
mov ebx, dword [ebx*4 + reloc.MSVCRT.dll___dllonexit]
shr eax, 8
xor eax, ebx
inc ecx
dec edx
jne 0x58ac69
pop edi
pop ebx
not eax
mov dword [esi + 0x58], eax
pop esi
ret 0x10
Function at 0x5ccc71
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
push esi
push edi
mov edi, eax
mov esi, edx
jne 0x5ccc80
pop edi
xor eax, eax
pop esi
ret
cmp edi, 8
not esi
jb 0x5ccd68
push ebp
mov ebp, edi
shr ebp, 3
movzx edx, byte [ecx]
xor edx, esi
and edx, 0xff
add ecx, 1
mov eax, esi
shr eax, 8
xor eax, dword [edx*4 + reloc.MSVCRT.dll___dllonexit]
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + reloc.MSVCRT.dll___dllonexit]
movzx edx, byte [ecx + 1]
xor edx, eax
and edx, 0xff
add ecx, 1
shr eax, 8
xor eax, dword [edx*4 + reloc.MSVCRT.dll___dllonexit]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + reloc.MSVCRT.dll___dllonexit]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + reloc.MSVCRT.dll___dllonexit]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + reloc.MSVCRT.dll___dllonexit]
movzx edx, byte [ecx + 1]
add ecx, 1
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + reloc.MSVCRT.dll___dllonexit]
movzx edx, byte [ecx + 1]
add ecx, 1
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + reloc.MSVCRT.dll___dllonexit]
add ecx, 1
sub edi, 8
sub ebp, 1
mov esi, eax
jne 0x5ccc91
pop ebp
test edi, edi
je 0x5ccd8d
jmp 0x5ccd71
movzx eax, byte [ecx]
xor eax, esi
and eax, 0xff
shr esi, 8
xor esi, dword [eax*4 + reloc.MSVCRT.dll___dllonexit]
add ecx, 1
sub edi, 1
jne 0x5ccd71
mov eax, esi
pop edi
not eax
pop esi
ret
Function at 0x5ce2f1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push edi
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0x5ce30f
pop edi
pop ebp
mov eax, 0xffffff9a
pop ebx
add esp, 0xc
ret
cmp dword [edi + 0x18], ebx
je 0x5ce303
cmp dword [edi + 0x7c], ebx
je 0x5ce31e
call fcn.005ce6f1
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.005ce061
add esp, 0xc
test eax, eax
je 0x5ce345
pop edi
pop ebp
mov eax, 0xffffff99
pop ebx
add esp, 0xc
ret
push esi
push 0x84
call fcn.005ec794
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x5ce386
push 0x4000
call fcn.005ec794
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
add esp, 4
cmp eax, ebx
mov dword [esi], eax
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], ebx
jne 0x5ce393
push esi
call fcn.005ec55a
add esp, 4
pop esi
pop edi
pop ebp
mov eax, 0xffffff98
pop ebx
add esp, 0xc
ret
mov dword [esi + 0x40], ebx
mov ecx, dword [edi + 0x3c]
xor eax, eax
cmp dword [edi + 0x34], ebx
mov dword [esi + 0x54], ecx
mov dword [esi + 0x50], ebx
mov edx, dword [edi + 0x34]
sete al
mov dword [esi + 0x64], edx
mov ecx, dword [edi]
mov dword [esi + 0x60], ecx
mov edx, dword [edi + 0xc]
mov dword [esi + 0x68], edx
mov dword [esi + 0x18], ebx
cmp eax, ebx
jne 0x5ce3db
lea eax, [esi + 4]
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.005cd0b1
test eax, eax
jne 0x5ce3db
mov dword [esi + 0x40], 1
mov eax, dword [edi + 0x40]
mov dword [esi + 0x58], eax
mov ecx, dword [edi + 0x44]
mov dword [esi + 0x5c], ecx
mov dl, byte [edi + 0x30]
and dl, 1
mov byte [esi + 0x6c], dl
mov eax, dword [edi + 0x30]
shr eax, 3
test al, 1
je 0x5ce405
mov cl, byte [edi + 0x39]
mov byte [esi + 0x80], cl
jmp 0x5ce40e
mov dl, byte [edi + 0x3f]
mov byte [esi + 0x80], dl
mov al, byte [esi + 0x6c]
neg al
lea edx, [esi + 0x70]
mov dword [edx], reloc.MSVCRT.dll___dllonexit
mov dword [esi + 0x74], 0x23456789
mov dword [esi + 0x78], 0x34567890
sbb eax, eax
and eax, 0xc
cmp ebp, ebx
mov dword [esi + 0x7c], eax
je 0x5ce447
mov cl, byte [ebp]
cmp cl, bl
je 0x5ce447
call fcn.005ccda1
add ebp, 1
jne 0x5ce436
mov ecx, dword [edi + 0x78]
mov edx, dword [esp + 0x18]
lea eax, [ecx + edx + 0x1e]
mov dword [esi + 0x3c], eax
mov dword [esi + 8], ebx
mov dword [edi + 0x7c], esi
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x5cfeb1
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x64
mov eax, dword [0x4493fc]
xor eax, esp
mov dword [esp + 0x60], eax
test ecx, ecx
mov eax, dword [ebp + 8]
push esi
jne 0x5cfecf
xor eax, eax
push ecx
lea esi, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
call fcn.005cfda1
add esp, 4
mov ecx, esi
call fcn.005cfe41
test edi, edi
je 0x5cff32
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [edi], eax
mov eax, dword [esp + 0x14]
mov dword [edi + 4], ecx
mov dword [edi + 8], edx
mov dword [edi + 0xc], eax
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
mov eax, 0x10
call fcn.005ec54b
mov esp, ebp
pop ebp
ret
Function at 0x6559f3
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005853b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [reloc.MSVCRT.dll___dllonexit]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], reloc.MSVCRT.dll___dllonexit
call fcn.006673d3
push 4
mov dword [ebp - 4], 0
call fcn.0065723a
mov edi, eax
add esp, 4
test edi, edi
je 0x655a73
call fcn.00666e47
mov dword [edi], eax
call fcn.00666c06
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.00666b3b
mov eax, dword [ebx + 4]
cmp eax, reloc.MSVCRT.dll___dllonexit
jae 0x655a69
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.00666b63
jmp 0x655a75
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x66e613
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
mov edx, dword [edx + 4]
push ebx
push esi
mov eax, ecx
mov esi, ecx
shr esi, 0x10
and eax, 0xff0000
or eax, esi
mov esi, ecx
and esi, 0xff00
shl ecx, 0x10
or esi, ecx
shl esi, 8
mov ecx, edx
shr eax, 8
or eax, esi
mov esi, edx
shr esi, 0x10
push edi
mov edi, dword [ebp + 0xc]
and ecx, 0xff0000
or ecx, esi
mov esi, edx
shl esi, 0x10
and edx, 0xff00
or esi, edx
shl esi, 8
shr ecx, 8
or ecx, esi
mov esi, dword [edi]
mov edi, dword [edi + 4]
mov edx, esi
mov ebx, esi
shr ebx, 0x10
and edx, 0xff0000
or edx, ebx
mov ebx, esi
shl ebx, 0x10
and esi, 0xff00
or ebx, esi
shl ebx, 8
mov esi, edi
shr edx, 8
or edx, ebx
mov ebx, edi
shr ebx, 0x10
and esi, 0xff0000
or esi, ebx
mov ebx, edi
and edi, 0xff00
shl ebx, 0x10
or ebx, edi
mov edi, dword [ebp + 0xc]
shl ebx, 8
shr esi, 8
or esi, ebx
mov ebx, dword [edi + 8]
mov edi, ebx
and edi, 0xff0000
mov dword [ebp + 8], ebx
shr ebx, 0x10
or edi, ebx
shr edi, 8
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
mov ebx, edi
and edi, 0xff00
shl ebx, 0x10
or ebx, edi
mov edi, dword [ebp - 4]
shl ebx, 8
or edi, ebx
mov dword [ebp - 4], edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [edi + 0xc]
mov edi, ebx
mov dword [ebp + 0xc], ebx
and edi, 0xff0000
shr ebx, 0x10
or edi, ebx
shr edi, 8
mov dword [ebp + 8], edi
mov edi, dword [ebp + 0xc]
mov ebx, edi
and edi, 0xff00
shl ebx, 0x10
or ebx, edi
mov edi, dword [ebp + 8]
shl ebx, 8
or edi, ebx
mov dword [ebp + 8], edi
mov edi, 0x10
mov dword [ebp + 0xc], 0
sub dword [ebp + 0xc], reloc.MSVCRT.dll___dllonexit
dec edi
mov dword [ebp - 8], edi
mov edi, ecx
shr edi, 5
add edi, esi
mov ebx, ecx
shl ebx, 4
add ebx, edx
xor edi, ebx
mov ebx, dword [ebp + 0xc]
add ebx, ecx
xor edi, ebx
add eax, edi
mov edi, eax
shr edi, 5
add edi, dword [ebp + 8]
mov ebx, eax
shl ebx, 4
add ebx, dword [ebp - 4]
xor edi, ebx
mov ebx, dword [ebp + 0xc]
add ebx, eax
xor edi, ebx
add ecx, edi
mov edi, dword [ebp - 8]
test edi, edi
jne 0x66e735
mov esi, eax
and esi, 0xff0000
mov edx, eax
shr edx, 0x10
or esi, edx
mov edx, eax
shl eax, 0x10
shr esi, 8
and edx, 0xff00
or edx, eax
shl edx, 8
or esi, edx
mov edx, dword [ebp + 0x10]
mov dword [edx], esi
mov eax, ecx
mov esi, ecx
shr esi, 0x10
and eax, 0xff0000
or eax, esi
mov esi, ecx
and esi, 0xff00
shl ecx, 0x10
or esi, ecx
shl esi, 8
shr eax, 8
pop edi
or eax, esi
pop esi
mov dword [edx + 4], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x66e7d3
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov edx, dword [edx + 4]
push ebx
push esi
mov ecx, eax
mov esi, eax
shr esi, 0x10
and ecx, 0xff0000
or ecx, esi
mov esi, eax
and esi, 0xff00
shl eax, 0x10
or esi, eax
shl esi, 8
mov eax, edx
shr ecx, 8
or ecx, esi
mov esi, edx
shr esi, 0x10
push edi
mov edi, dword [ebp + 0xc]
and eax, 0xff0000
or eax, esi
mov esi, edx
shl esi, 0x10
and edx, 0xff00
or esi, edx
shl esi, 8
shr eax, 8
or eax, esi
mov esi, dword [edi]
mov edi, dword [edi + 4]
mov edx, esi
mov ebx, esi
shr ebx, 0x10
and edx, 0xff0000
or edx, ebx
mov ebx, esi
shl ebx, 0x10
and esi, 0xff00
or ebx, esi
shl ebx, 8
mov esi, edi
shr edx, 8
or edx, ebx
mov ebx, edi
shr ebx, 0x10
and esi, 0xff0000
or esi, ebx
mov ebx, edi
and edi, 0xff00
shl ebx, 0x10
or ebx, edi
mov edi, dword [ebp + 0xc]
shl ebx, 8
shr esi, 8
or esi, ebx
mov ebx, dword [edi + 8]
mov edi, ebx
and edi, 0xff0000
mov dword [ebp + 8], ebx
shr ebx, 0x10
or edi, ebx
shr edi, 8
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
mov ebx, edi
and edi, 0xff00
shl ebx, 0x10
or ebx, edi
mov edi, dword [ebp - 4]
shl ebx, 8
or edi, ebx
mov dword [ebp - 4], edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [edi + 0xc]
mov edi, ebx
mov dword [ebp + 0xc], ebx
and edi, 0xff0000
shr ebx, 0x10
or edi, ebx
shr edi, 8
mov dword [ebp + 8], edi
mov edi, dword [ebp + 0xc]
mov ebx, edi
and edi, 0xff00
shl ebx, 0x10
or ebx, edi
mov edi, dword [ebp + 8]
shl ebx, 8
or edi, ebx
mov dword [ebp + 8], edi
mov edi, 0x10
mov dword [ebp + 0xc], 0xe3779b90
dec edi
mov dword [ebp - 8], edi
mov edi, ecx
shr edi, 5
add edi, dword [ebp + 8]
mov ebx, ecx
shl ebx, 4
add ebx, dword [ebp - 4]
xor edi, ebx
mov ebx, dword [ebp + 0xc]
add ebx, ecx
xor edi, ebx
sub eax, edi
mov edi, eax
shr edi, 5
mov ebx, eax
shl ebx, 4
add edi, esi
add ebx, edx
xor edi, ebx
mov ebx, dword [ebp + 0xc]
add dword [ebp + 0xc], 0x61c88647
add ebx, eax
xor edi, ebx
sub ecx, edi
mov edi, dword [ebp - 8]
test edi, edi
jne 0x66e8f5
mov esi, ecx
and esi, 0xff0000
mov edx, ecx
shr edx, 0x10
or esi, edx
mov edx, ecx
shl ecx, 0x10
shr esi, 8
and edx, 0xff00
or edx, ecx
shl edx, 8
or esi, edx
mov edx, dword [ebp + 0x10]
mov dword [edx], esi
mov ecx, eax
mov esi, eax
shr esi, 0x10
and ecx, 0xff0000
or ecx, esi
mov esi, eax
and esi, 0xff00
shl eax, 0x10
or esi, eax
shl esi, 8
shr ecx, 8
pop edi
or ecx, esi
pop esi
mov dword [edx + 4], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x66ee63
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
or eax, reloc.MSVCRT.dll___dllonexit
test ecx, ecx
je 0x66ee92
push esi
push edi
movzx edi, byte [edx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
xor eax, dword [esi*4 + reloc.MSVCRT.dll___dllonexit]
inc edx
dec ecx
jne 0x66ee75
pop edi
pop esi
not eax
pop ebp
ret

Function at 0x6705e3
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005853b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [reloc.MSVCRT.dll___dllonexit]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], reloc.MSVCRT.dll___dllonexit
call fcn.006673d3
push 4
mov dword [ebp - 4], 0
call fcn.0065723a
mov edi, eax
add esp, 4
test edi, edi
je 0x670663
call fcn.00666e47
mov dword [edi], eax
call fcn.00666c06
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.00666b3b
mov eax, dword [ebx + 4]
cmp eax, reloc.MSVCRT.dll___dllonexit
jae 0x670659
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.00666b63
jmp 0x670665
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x67c953
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], reloc.MSVCRT.dll___dllonexit
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x58], ecx
mov eax, 1
ret
Function at 0x696f43
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
mov ebx, dword [esp + 0x10]
cmp ecx, dword [ebx + 4]
push esi
push edi
jge 0x696f5c
mov edi, ebx
mov ebx, eax
jmp 0x696f5e
mov edi, eax
mov eax, dword [edi + 4]
mov esi, dword [esp + 0x10]
cmp eax, dword [esi + 8]
jg 0x696f6e
mov eax, esi
jmp 0x696f78
push eax
push esi
call fcn.0067aa83
add esp, 8
test eax, eax
jne 0x696f80
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [ebx + 4], eax
jle 0x696f9e
mov edx, dword [edi]
mov ecx, dword [ebx]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [esi]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, dword [ebx + 4]
jl 0x696f87
cmp eax, dword [edi + 4]
jge 0x696fb5
mov edx, dword [edi]
mov edx, dword [edx + eax*4]
mov ecx, dword [esi]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, dword [edi + 4]
jl 0x696fa3
mov edi, dword [edi + 4]
test edi, edi
mov dword [esi + 4], edi
jle 0x696fd9
mov eax, dword [esi]
lea eax, [eax + edi*4 - 4]
or ecx, reloc.MSVCRT.dll___dllonexit
mov edx, dword [eax]
sub eax, 4
test edx, edx
jne 0x696fd9
add dword [esi + 4], ecx
cmp dword [esi + 4], edx
jg 0x696fc8
pop edi
pop esi
mov eax, 1
pop ebx
ret