joyce8/EMBER2024-capa huggingface dataset:
Function at 0x66ac17
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x77766c]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x7779b0]
je 0x66ac4c
inc eax
cmp eax, 0x13
jb 0x66ac3d
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x7779b0]
jne 0x66ad72
mov eax, dword [0x783c84]
cmp eax, 1
je 0x66ad4a
cmp eax, edx
jne 0x66ac7c
cmp dword [0x777164], 1
je 0x66ad4a
cmp ecx, 0xfc
je 0x66ad72
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x66acb2
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.0065d920
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.0065c790
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x66ace6
mov eax, edi
push eax
call fcn.0065c790
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x716e7c
push edi
call fcn.0065cfb0
add esp, 0x10
push edi
call fcn.0065c790
push dword [esi + 0x7779b4]
mov ebx, eax
call fcn.0065c790
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.0065d6a0
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.0065d920
push edi
push ebx
call fcn.0065d930
push 0x708610
push ebx
call fcn.0065d930
push dword [esi + 0x7779b4]
push ebx
call fcn.0065d930
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.006766a7
add esp, 0x2c
jmp 0x66ad72
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x7779b4]
push dword [esi]
call fcn.0065c790
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.00664752
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x6724ef
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.0065d6a0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x67258a
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x783be8]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x67258a
cmp eax, 1
je 0x6725ab
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x67258a
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x672557
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x672586
xor eax, eax
inc eax
jmp 0x6725ca
cmp edi, eax
jae 0x67258e
xor eax, eax
jmp 0x6725ca
cmp eax, esi
jae 0x672595
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x783be8]
jmp 0x6725ae
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x6766a7
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x7841a0], ebx
push esi
push edi
jne 0x676727
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x676762
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x72ed08
push edi
call esi
test eax, eax
mov dword [0x7841a0], eax
je 0x676762
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x7841a4], eax
call esi
cmp dword [0x783be8], 2
mov dword [0x7841a8], eax
jne 0x676727
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x7841b0], eax
je 0x676727
push 0x72ecb0
push edi
call esi
mov dword [0x7841ac], eax
mov eax, dword [0x7841ac]
test eax, eax
je 0x67676c
call eax
test eax, eax
je 0x676753
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x7841b0]
test eax, eax
je 0x676753
test byte [ebp - 8], 1
jne 0x67676c
cmp dword [0x783bf4], 4
jb 0x676766
or byte [ebp + 0x12], 0x20
jmp 0x67678b
xor eax, eax
jmp 0x67679b
or byte [ebp + 0x12], 4
jmp 0x67678b
mov eax, dword [0x7841a4]
test eax, eax
je 0x67678b
call eax
mov ebx, eax
test ebx, ebx
je 0x67678b
mov eax, dword [0x7841a8]
test eax, eax
je 0x67678b
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x7841a0]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x676e1b
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], ebx
jne 0x676e34
or eax, 0xffffffff
jmp 0x676e95
push esi
mov esi, dword [eax]
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x676e91
push 0x3d
push esi
call fcn.00677c5c
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
je 0x676e91
cmp esi, eax
je 0x676e91
xor ecx, ecx
cmp byte [eax + 1], bl
mov eax, dword [0x783c08]
sete cl
cmp eax, dword [0x783c0c]
mov dword [ebp - 8], ecx
jne 0x676e77
mov edi, eax
call fcn.00676dba
mov dword [0x783c08], eax
cmp eax, ebx
jne 0x676ed0
cmp dword [ebp + 0xc], ebx
je 0x676e99
cmp dword [0x783c10], ebx
je 0x676e99
call fcn.00674de0
test eax, eax
je 0x676ed0
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret
cmp dword [ebp - 8], ebx
je 0x676ea2
xor eax, eax
jmp 0x676e94
push 4
call fcn.0065dc60
cmp eax, ebx
pop ecx
mov dword [0x783c08], eax
je 0x676e91
mov dword [eax], ebx
cmp dword [0x783c10], ebx
jne 0x676ed0
push 4
call fcn.0065dc60
cmp eax, ebx
pop ecx
mov dword [0x783c10], eax
je 0x676e91
mov dword [eax], ebx
mov edi, dword [ebp - 0xc]
sub edi, dword [ebp - 4]
push dword [ebp - 4]
mov esi, dword [0x783c08]
call fcn.00676d6d
mov edi, eax
cmp edi, ebx
pop ecx
jl 0x676f31
cmp dword [esi], ebx
je 0x676f31
lea esi, [esi + edi*4]
push dword [esi]
call fcn.0065db48
cmp dword [ebp - 8], ebx
pop ecx
jne 0x676f14
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x676f72
mov eax, dword [esi + 4]
mov dword [esi], eax
inc edi
add esi, 4
cmp dword [esi], ebx
jne 0x676f0b
mov eax, edi
shl eax, 2
push eax
push dword [0x783c08]
call fcn.006621f8
cmp eax, ebx
pop ecx
pop ecx
je 0x676f72
jmp 0x676f6d
cmp dword [ebp - 8], ebx
jne 0x676fdd
cmp edi, ebx
jge 0x676f40
neg edi
lea eax, [edi*4 + 8]
push eax
push dword [0x783c08]
call fcn.006621f8
cmp eax, ebx
pop ecx
pop ecx
je 0x676e91
mov edx, dword [ebp - 4]
lea ecx, [eax + edi*4]
mov dword [ecx], edx
mov dword [ecx + 4], ebx
mov ecx, dword [ebp + 8]
mov dword [ecx], ebx
mov dword [0x783c08], eax
cmp dword [ebp + 0xc], ebx
je 0x676fc7
push dword [ebp - 4]
call fcn.0065c790
inc eax
inc eax
push eax
call fcn.0065dc60
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x676fc7
push dword [ebp - 4]
push esi
call fcn.0065d920
mov eax, esi
sub eax, dword [ebp - 4]
pop ecx
add eax, dword [ebp - 0xc]
pop ecx
mov ecx, dword [ebp - 8]
mov byte [eax], bl
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x676fc0
or dword [ebp - 0x10], 0xffffffff
push esi
call fcn.0065db48
pop ecx
cmp dword [ebp - 8], ebx
je 0x676fd5
push dword [ebp - 4]
call fcn.0065db48
pop ecx
mov eax, dword [ebp - 0x10]
jmp 0x676e94
push dword [ebp - 4]
call fcn.0065db48
mov eax, dword [ebp + 8]
pop ecx
mov dword [eax], ebx
jmp 0x676e9e
Function at 0x676ff0
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x72ed20
call fcn.00663e18
xor edi, edi
xor ebx, ebx
inc ebx
cmp dword [0x7841b4], edi
jne 0x677034
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x67701f
mov dword [0x7841b4], ebx
jmp 0x677034
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x677034
mov dword [0x7841b4], 2
mov eax, dword [0x7841b4]
cmp eax, ebx
jne 0x677054
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x677117
cmp eax, 2
je 0x67705d
cmp eax, edi
jne 0x677085
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], edi
cmp dword [ebp + 0x18], edi
jne 0x677070
mov eax, dword [0x78410c]
mov dword [ebp + 0x18], eax
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov dword [ebp - 0x20], eax
cmp eax, edi
jne 0x67708c
xor eax, eax
jmp 0x677117
mov dword [ebp - 4], edi
add eax, 3
and eax, 0xfffffffc
call fcn.0065d6a0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x28], esi
or dword [ebp - 4], 0xffffffff
jmp 0x6770bf
cmp esi, edi
jne 0x6770d5
push dword [ebp - 0x20]
call fcn.0065dc60
pop ecx
mov esi, eax
cmp esi, edi
je 0x677085
mov dword [ebp - 0x24], ebx
push dword [ebp - 0x20]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x677108
cmp dword [ebp + 0x14], edi
jne 0x6770f2
push edi
push edi
jmp 0x6770f8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push esi
push ebx
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x24], edi
je 0x677114
push esi
call fcn.0065db48
pop ecx
mov eax, dword [ebp - 0x1c]
lea esp, [ebp - 0x34]
call fcn.00663e53
ret
Function at 0x677120
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x72ed30
call fcn.00663e18
xor esi, esi
cmp dword [0x7841b8], esi
jne 0x677164
push esi
push esi
xor edi, edi
inc edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x67714f
mov dword [0x7841b8], edi
jmp 0x677164
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x677164
mov dword [0x7841b8], 2
mov eax, dword [0x7841b8]
cmp eax, 2
je 0x677245
cmp eax, esi
je 0x677245
cmp eax, 1
jne 0x6771a9
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
cmp dword [ebp + 0x18], esi
jne 0x677192
mov eax, dword [0x78410c]
mov dword [ebp + 0x18], eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, esi
jne 0x6771b0
xor eax, eax
jmp 0x677257
mov dword [ebp - 4], esi
lea eax, [ebx + ebx]
add eax, 3
and eax, 0xfffffffc
call fcn.0065d6a0
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x28], edi
or dword [ebp - 4], 0xffffffff
jmp 0x6771e6
cmp edi, esi
jne 0x677201
lea eax, [ebx + ebx]
push eax
call fcn.0065dc60
pop ecx
mov edi, eax
cmp edi, esi
je 0x6771a9
mov dword [ebp - 0x20], 1
push ebx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x677234
push esi
push esi
cmp dword [ebp + 0x14], esi
jne 0x67721e
push esi
push esi
jmp 0x677224
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push edi
push esi
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], esi
je 0x677240
push edi
call fcn.0065db48
pop ecx
mov eax, dword [ebp - 0x1c]
jmp 0x677257
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea esp, [ebp - 0x34]
call fcn.00663e53
ret
Function at 0x6776a6
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.0065d6a0
mov eax, dword [0x77766c]
push ebx
push esi
push 1
xor esi, esi
push esi
push dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.00669bc7
or ebx, 0xffffffff
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 0x1008], eax
je 0x6777d9
push 2
push esi
push dword [ebp + 8]
call fcn.00669bc7
add esp, 0xc
cmp eax, ebx
je 0x6777d9
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x677779
mov ebx, 0x1000
push ebx
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.0065c670
push 0x8000
push dword [ebp + 8]
call fcn.00677cd7
add esp, 0x14
mov dword [ebp - 0x100c], eax
cmp edi, ebx
mov eax, ebx
jge 0x67772f
mov eax, edi
push eax
lea eax, [ebp - 0x1004]
push eax
push dword [ebp + 8]
call fcn.00666fa8
add esp, 0xc
cmp eax, 0xffffffff
je 0x67774f
sub edi, eax
test edi, edi
jg 0x677727
jmp 0x677767
call fcn.00662a48
cmp dword [eax], 5
jne 0x677764
call fcn.00662a3f
mov dword [eax], 0xd
or esi, 0xffffffff
push dword [ebp - 0x100c]
push dword [ebp + 8]
call fcn.00677cd7
pop ecx
pop ecx
jmp 0x6777c1
jge 0x6777c1
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00669bc7
push dword [ebp + 8]
call fcn.00675db4
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, ebx
jne 0x6777c1
call fcn.00662a3f
mov dword [eax], 0xd
call fcn.00662a48
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
push 0
push dword [ebp - 0x1008]
push dword [ebp + 8]
call fcn.00669bc7
add esp, 0xc
mov eax, esi
pop edi
jmp 0x6777db
mov eax, ebx
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.00664752
leave
ret

Function at 0x67b620
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
push 0
push eax
push edx
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
pop ebp
ret

Function at 0x67b640
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
push 0
push eax
push edx
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
ret
Function at 0x6c0ae4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x72f428
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x6c0b3c
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x6c0b3c
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x6c0b3c
xor eax, eax
inc eax
leave
ret
xor eax, eax
leave
ret

Function at 0x6c0b65
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
lea eax, [ebp - 4]
push eax
push 0x72f428
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x6c0bd3
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push str.DisableMMX
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6c0bca
cmp dword [ebp - 0xc], 4
jne 0x6c0bca
cmp dword [ebp - 0x10], edi
je 0x6c0bca
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x779280], edi
xor eax, eax
jmp 0x6c0bfb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x779280], edi
jge 0x6c0bf6
mov dword [0x779280], edi
call fcn.006c0b40
test eax, eax
je 0x6c0bf6
emms
mov dword [0x779280], 1
mov eax, dword [0x779280]
pop edi
leave
ret

Function at 0x6c0cdb
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x98
push ebx
push edi
push 0x25
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
xor bl, bl
and byte [ebp + 0x73], bl
push eax
mov dword [ebp - 0x24], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x6c0d12
inc bl
mov byte [ebp + 0x73], 1
cmp dword [ebp - 0x14], 1
jne 0x6c0d34
cmp dword [ebp - 0x20], 4
ja 0x6c0d3e
jne 0x6c0d2e
cmp dword [ebp - 0x1c], 0xa
jb 0x6c0d2e
cmp word [ebp - 0x18], 0x55d
jae 0x6c0d3e
mov byte [ebp + 0x73], 1
jmp 0x6c0d3e
cmp dword [ebp - 0x14], 2
jne 0x6c0d54
test bl, bl
je 0x6c0d6f
mov eax, dword [ebp + 0x7c]
sub eax, 6
je 0x6c0d5f
dec eax
je 0x6c0d58
sub eax, 3
jne 0x6c0d54
cmp byte [ebp + 0x73], 0
je 0x6c0d80
xor eax, eax
jmp 0x6c0d88
call fcn.006c0bfe
jmp 0x6c0d88
cmp byte [ebp + 0x73], 0
jne 0x6c0d54
call fcn.006c0c36
and eax, 4
jmp 0x6c0d88
cmp dword [ebp + 0x7c], 0xa
je 0x6c0d80
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
jmp 0x6c0d88
call fcn.006c0c36
and eax, 8
pop edi
pop ebx
add ebp, 0x74
leave
ret
Function at 0x6c3e0b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, edx
cmp edx, eax
mov dword [ebp - 0x18], eax
jae 0x6c3f2c
mov eax, dword [ebp + 0x10]
lea eax, [edx + eax*4]
push ebx
push esi
mov dword [ebp + 0x14], eax
mov esi, 0xffc03fc0
mov eax, 0xff00ff
cmp edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
jae 0x6c3f10
mov ebx, dword [ebp + 0x14]
sub ebx, edx
dec ebx
shr ebx, 3
lea ecx, [edx + 4]
inc ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ebx
mov edx, dword [ecx + edi]
mov edi, dword [edi + ecx - 4]
mov dword [ebp - 0xc], edi
shr edi, 2
and edi, esi
mov dword [ebp - 4], edx
mov edx, dword [ecx]
mov ecx, dword [ecx - 4]
mov ebx, ecx
shr ebx, 2
and ebx, esi
add ebx, edi
mov edi, dword [ebp - 4]
shr edi, 2
and edi, esi
add ebx, edi
mov edi, edx
shr edi, 2
and edi, esi
lea ebx, [ebx + edi - 0x7fff80]
mov edi, dword [ebp - 0xc]
and edi, eax
mov esi, ecx
and esi, eax
add esi, edi
mov edi, dword [ebp - 4]
and edi, eax
add esi, edi
mov edi, edx
and edi, eax
lea esi, [esi + edi + 0x20002]
mov edi, dword [ebp - 0xc]
shr ecx, 2
shr esi, 2
xor ebx, esi
shr edi, 2
mov esi, 0x3fc03fc0
and ecx, esi
and edi, esi
add ecx, edi
mov edi, dword [ebp - 4]
shr edi, 2
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x18]
shr edx, 2
and edx, esi
lea ecx, [ecx + edx + 0x800080]
and ebx, eax
xor ebx, ecx
mov ecx, dword [ebp - 8]
add dword [ebp - 8], 4
mov dword [ecx], ebx
mov ecx, dword [ebp - 0x10]
add ecx, 8
dec dword [ebp - 0x14]
mov dword [ebp - 0x10], ecx
mov esi, 0xffc03fc0
jne 0x6c3e62
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add dword [ebp + 8], ecx
lea ecx, [edi + edi]
add dword [ebp + 0x14], ecx
add edx, ecx
cmp edx, dword [ebp - 0x18]
mov dword [ebp + 0xc], edx
jb 0x6c3e40
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret
Function at 0x6c41f8
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
push esi
mov esi, dword [ecx]
mov ebp, dword [esi + 0x105c]
push edi
mov edi, dword [esi + 0x1050]
imul ebp, edi
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x18]
add ebp, eax
cmp eax, ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], ebp
jae 0x6c433f
mov edx, 0xf81f
push ebx
mov ebx, dword [esp + 0x14]
mov esi, dword [esi + 0x1058]
lea esi, [eax + esi*2]
mov dword [esp + 0x10], ebx
add edi, eax
cmp eax, esi
mov ebx, eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], esi
jae 0x6c431a
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx eax, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
mov ebx, eax
and bx, dx
and bp, dx
mov dword [esp + 0x24], ecx
and ecx, 0xffff07e0
add ebx, ebp
mov ebp, edi
and bp, dx
add ebx, ebp
mov ebp, esi
and bp, dx
lea ebx, [ebx + ebp + 0x1002]
mov ebp, eax
and ebp, 0xffff07e0
add ebp, ecx
mov ecx, edi
and ecx, 0xffff07e0
add ebp, ecx
mov ecx, esi
and ecx, 0xffff07e0
shr ebx, 2
lea ecx, [ecx + ebp + 0x40]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and eax, edx
and ecx, edx
add eax, ecx
and edi, edx
add eax, edi
mov edi, dword [esp + 0x1c]
and esi, edx
and ebx, 0xffff07e0
lea eax, [eax + esi + 0x1002]
shr eax, 2
xor ebx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [eax], bx
mov ebx, dword [esp + 0x18]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
jb 0x6c4261
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov esi, dword [ecx + 4]
mov esi, dword [esi + 0x1050]
add dword [esp + 0x14], esi
mov esi, dword [ecx]
mov edi, dword [esi + 0x1050]
lea eax, [eax + edi*2]
cmp eax, ebp
mov dword [esp + 0x20], eax
jb 0x6c4238
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x6c446c
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
push esi
mov esi, dword [ecx]
mov ebp, dword [esi + 0x105c]
mov edx, dword [esi + 0x18]
push edi
mov edi, dword [esi + 0x1050]
imul ebp, edi
add ebp, edx
cmp edx, ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x2c], ebp
jae 0x6c45b2
mov eax, 0x83e0
push ebx
mov ebx, dword [esp + 0x14]
mov esi, dword [esi + 0x1058]
lea esi, [edx + esi*2]
mov dword [esp + 0x10], ebx
add edi, edx
cmp edx, esi
mov ebx, edx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], esi
jae 0x6c458d
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx edx, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
and ebp, eax
mov ebx, edx
and ebx, eax
add ebx, ebp
mov ebp, edi
and ebp, eax
add ebx, ebp
mov dword [esp + 0x24], ecx
and ecx, 0x7c1f
mov ebp, esi
and ebp, eax
lea ebx, [ebx + ebp + 0x10040]
mov ebp, edx
and ebp, 0x7c1f
add ebp, ecx
mov ecx, edi
and ecx, 0x7c1f
add ebp, ecx
mov ecx, esi
and ecx, 0x7c1f
lea ecx, [ecx + ebp + 0x802]
shr ecx, 2
shr ebx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and ecx, eax
and edx, eax
add edx, ecx
and edi, eax
add edx, edi
mov edi, dword [esp + 0x1c]
and esi, eax
and ebx, 0xffff7c1f
lea ecx, [edx + esi + 0x10040]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [ecx], bx
mov ebx, dword [esp + 0x18]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
jb 0x6c44d5
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov esi, dword [ecx + 4]
mov esi, dword [esi + 0x1050]
add dword [esp + 0x14], esi
mov esi, dword [ecx]
mov edi, dword [esi + 0x1050]
lea edx, [edx + edi*2]
cmp edx, ebp
mov dword [esp + 0x20], edx
jb 0x6c44ac
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret