joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407338
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x8b5008], 0x8088405
inc edx
mov dword [ebx + 0x8b5008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x422270
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x4222c9
test eax, edx
je 0x4222cc
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x422287
movzx eax, word [eax]
sub eax, ecx
jmp 0x4222ae
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x4222af
add ecx, 4
js 0x42229f
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x4222ac
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x4222ae
xor eax, eax
ret
test eax, eax
je 0x4222d8
test edx, edx
jne 0x422278
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret
Function at 0x470490
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x470498
mov eax, edx
pop esi
pop ebx
ret

Function at 0x4cea84
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4cec19
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4cebee
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
je 0x4cebd1
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
mov dl, 1
call fcn.00423840
test al, al
je 0x4cebd1
push 0x20
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
mov dl, 1
mov eax, dword [0x47d34c]
call fcn.0049d0f0
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4cebca
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx]
mov ebx, eax
mov eax, dword [ebp - 0x10]
call fcn.0049c89c
sub ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x404b58]
call fcn.0040c4b4
add esp, 4
mov edx, dword [ebp - 4]
mov ecx, ebx
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 8]
lea edx, [eax + 0xc]
mov eax, dword [ebp - 4]
call fcn.0042c810
mov ebx, eax
mov dl, 1
mov eax, dword [0x47a398]
call fcn.0049c83c
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4cebad
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebp - 4]
test esi, esi
je 0x4ceb6a
sub esi, 4
mov esi, dword [esi]
sub esi, ebx
push esi
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov ecx, ebx
mov edx, dword [ebp - 4]
call fcn.0042cdc0
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.004cee90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cebb4
mov eax, dword [ebp - 0xc]
call fcn.00407f90
ret
mov eax, dword [ebp - 8]
call fcn.004ce8e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cebf5
mov eax, dword [ebp - 8]
mov byte [eax + 0x10], 0
ret

Function at 0x4dab5c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4dab62
ret

Function at 0x4f6164
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, 0x8b9960
test edx, edx
jne 0x4f6183
xor eax, eax
jmp 0x4f62a1
mov dword [ebp - 4], 1
cmp byte [ebp - 4], 0
je 0x4f61a0
push esi
push edx
push eax
call fcn.004f62a8
add esp, 0xc
jmp 0x4f62a1
push esi
push edx
push eax
call fcn.004f6568
add esp, 0xc
jmp 0x4f62a1
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x60ad64
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.00407a18
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret

Function at 0x62f0e4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
test dl, dl
je 0x62f0f7
add esp, 0xfffffff0
call fcn.00408584
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x62f170
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, esi
call fcn.00407f60
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [esi + 0x18], 0
lea edx, [ebp - 4]
mov eax, esi
call fcn.0062f334
mov edx, dword [ebp - 4]
lea eax, [esi + 0xc]
call fcn.0040a10c
mov ecx, dword [esi + 0xc]
lea eax, [esi + 0x10]
mov edx, 0x62f1a0
call fcn.0040acf0
mov ecx, esi
mov dl, 1
mov eax, dword [0x62e5f0]
call fcn.0062f97c
mov dword [esi + 0x30], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62f177
lea eax, [ebp - 4]
call fcn.00409d2c
ret

Function at 0x62f220
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
xor edx, edx
push ebp
push 0x62f2cb
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.0062f970
mov ebx, eax
lea eax, [ebx + 0x1c]
mov edx, dword [ebp - 4]
call fcn.0040a10c
lea edx, [ebp - 0xc]
mov eax, dword [ebp + 8]
call fcn.00423f80
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.0040a10c
lea eax, [ebx + 0x24]
mov edx, dword [ebp - 8]
call fcn.0040a10c
test edi, edi
je 0x62f28d
mov edx, edi
mov eax, ebx
call fcn.00630520
jmp 0x62f29a
lea eax, [ebx + 0x14]
mov edx, 0x62f2ec
call fcn.0040a10c
test esi, esi
je 0x62f2a8
lea eax, [ebx + 0x10]
mov edx, esi
call fcn.0040a10c
lea eax, [ebx + 0x18]
mov edx, 0x62f310
call fcn.0040a10c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62f2d2
lea eax, [ebp - 0xc]
call fcn.00409d2c
ret
Function at 0x62fad4
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x62fadc
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x62fc91
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x18]
mov ecx, dword [eax + 0xc]
lea eax, [ebp - 4]
mov edx, 0x62fcac
call fcn.0040acf0
push esi
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
mov eax, dword [ebx + 0x2c]
push eax
lea eax, [ebp - 0x18]
push eax
movzx ecx, word [ebx + 0x30]
mov eax, dword [ebx + 0x1c]
xor edx, edx
call fcn.0062d9f0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0x11
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x62fcc0
call fcn.005dbd24
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x62fb57
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x62fb98
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebx + 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
movzx ecx, word [ebx + 0x30]
mov eax, dword [ebx + 0xc]
xor edx, edx
call fcn.0062d9f0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x62fd28
call fcn.005dbd24
mov edx, dword [ebp - 0x1c]
mov eax, esi
call fcn.0040ac98
mov eax, esi
mov edx, 0x62fd54
call fcn.0040ac98
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x62fbb0
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x62fc1e
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x62fd68
call fcn.005dbd24
mov edx, dword [ebp - 0x2c]
mov eax, esi
call fcn.0040ac98
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x62fbe7
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x62fc12
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x62fd98
call fcn.005dbd24
mov edx, dword [ebp - 0x30]
mov eax, esi
call fcn.0040ac98
mov eax, esi
mov edx, 0x62fd54
call fcn.0040ac98
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x62fc2a
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x62fc55
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x62fdc4
call fcn.005dbd24
mov edx, dword [ebp - 0x34]
mov eax, esi
call fcn.0040ac98
mov eax, esi
mov edx, 0x62fd54
call fcn.0040ac98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62fc98
lea eax, [ebp - 0x34]
mov edx, 4
call fcn.00409d8c
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00409d8c
lea eax, [ebp - 4]
call fcn.00409d2c
ret
Function at 0x669788
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6698f8
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [0x8db70c]
push 0x669910
push dword [0x8db730]
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040ad78
lea eax, [ebp - 8]
mov edx, 0x669920
call fcn.0040a154
lea eax, [ebp - 0x10]
push eax
mov word [ebp - 0x50], 0x53
mov byte [ebp - 0x4c], 9
mov word [ebp - 0x48], 0x63
mov byte [ebp - 0x44], 9
mov word [ebp - 0x40], 0x68
mov byte [ebp - 0x3c], 9
mov word [ebp - 0x38], 0x74
mov byte [ebp - 0x34], 9
mov word [ebp - 0x30], 0x61
mov byte [ebp - 0x2c], 9
mov word [ebp - 0x28], 0x73
mov byte [ebp - 0x24], 9
mov word [ebp - 0x20], 0x6b
mov byte [ebp - 0x1c], 9
mov word [ebp - 0x18], 0x73
mov byte [ebp - 0x14], 9
lea edx, [ebp - 0x50]
mov ecx, 7
mov eax, 0x66998c
call fcn.004246d8
cmp bl, 1
jne 0x669895
push 0x6699bc
push dword [ebp - 8]
push 0x6699e4
push dword [ebp - 4]
push 0x669a04
lea eax, [ebp - 0xc]
mov edx, 5
call fcn.0040ad78
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.0040aa84
push eax
mov eax, dword [ebp - 0x10]
call fcn.0040aa84
push eax
push 0x669a44
mov eax, dword [0x8d3d98]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call fcn.004f70ac
jmp 0x6698dd
push 0x669a54
push dword [ebp - 8]
push 0x669a7c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040ad78
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.0040aa84
push eax
mov eax, dword [ebp - 0x10]
call fcn.0040aa84
push eax
push 0x669a44
mov eax, dword [0x8d3d98]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call fcn.004f70ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6698ff
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00409d8c
ret
Function at 0x68da98
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x68dcb3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x8d369c]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x68dc90
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 4]
mov eax, dword [0x8d369c]
mov eax, dword [eax]
mov edx, dword [ebp - 0x14]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea eax, [ebp - 8]
mov ecx, 0x68dcd0
mov edx, dword [ebp - 4]
call fcn.0040acf0
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.00423840
test al, al
je 0x68dc84
xor eax, eax
push ebp
push 0x68dc7a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 8]
mov ecx, 0
call fcn.0040a6c4
mov eax, dword [ebp - 0x1c]
call fcn.0040a634
push eax
call fcn.00688b78
add esp, 8
test eax, eax
jne 0x68dc70
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x68dcec
mov eax, dword [ebp - 0xc]
push eax
call fcn.00688b88
add esp, 0x14
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x68dd48
mov eax, dword [ebp - 0xc]
push eax
call fcn.00688b88
add esp, 0x14
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x68dd9c
mov eax, dword [ebp - 0xc]
push eax
call fcn.00688b88
add esp, 0x14
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x68ddec
mov eax, dword [ebp - 0xc]
push eax
call fcn.00688b88
add esp, 0x14
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x68de34
mov eax, dword [ebp - 0xc]
push eax
call fcn.00688b88
add esp, 0x14
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x68de80
mov eax, dword [ebp - 0xc]
push eax
call fcn.00688b88
add esp, 0x14
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x68decc
mov eax, dword [ebp - 0xc]
push eax
call fcn.00688b88
add esp, 0x14
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x68df30
mov eax, dword [ebp - 0xc]
push eax
call fcn.00688b88
add esp, 0x14
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x68df84
mov eax, dword [ebp - 0xc]
push eax
call fcn.00688b88
add esp, 0x14
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x68dfd0
mov eax, dword [ebp - 0xc]
push eax
call fcn.00688b88
add esp, 0x14
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x68dfe4
mov eax, dword [ebp - 0xc]
push eax
call fcn.00688b88
add esp, 0x14
mov eax, dword [ebp - 0x10]
push eax
call fcn.00688ba0
pop ecx
mov eax, dword [ebp - 0xc]
push eax
call fcn.00688b80
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x68dc84
inc dword [ebp - 0x14]
dec dword [ebp - 0x18]
jne 0x68dada
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x68dcba
lea eax, [ebp - 0x1c]
call fcn.00409d50
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409d8c
ret
Function at 0x6a4db0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x6a4dde
mov eax, ebx
call fcn.006a586c
cmp dword [ebx + 0x40], 0
je 0x6a4dd7
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x6a4e4f
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x6a4e41
cmp dword [ebx + 8], 0
je 0x6a4e00
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x6a4e12
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x6a4e41
cmp dword [ebx + 8], 0
je 0x6a4df3
cmp eax, 3
je 0x6a4e25
dec eax
jne 0x6a4df3
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x6a4df3
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x6a4df3
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x6a4e6d
cmp dword [ebx + 0x14], 0xcc
je 0x6a4e6d
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.006a4e78
pop ebx
ret

Function at 0x6b92ac
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x8dbc98], 0
jne 0x6b92c3
call fcn.006b9268
mov eax, edi
dec eax
test eax, eax
jl 0x6b92eb
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x8db898]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x6b92cd
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x6bbf80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x6bc01c.0
jmp dword [ecx*4 + 0x6bbfb5]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x6bbfe7
sub dl, 8
je 0x6bbff6
jmp case.0x6bc01c.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x6bbc4c
jmp case.0x6bc01c.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x6bbca0
jmp case.0x6bc01c.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x6bc01c.0
movzx ecx, byte [ecx + 0x6bc023]
jmp dword [ecx*4 + 0x6bc034]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x6bbd40
jmp case.0x6bc01c.0
cmp dl, 3
jne 0x6bc061
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x6bbd98
jmp case.0x6bc01c.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x6bbd54
jmp case.0x6bc01c.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x6bbddc
jmp case.0x6bc01c.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x6bc08c
sub dl, 8
je 0x6bc098
jmp case.0x6bc01c.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x6bbe08
jmp case.0x6bc01c.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x6bbe6c
jmp case.0x6bc01c.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x6bc0b7
sub dl, 8
je 0x6bc0c3
jmp case.0x6bc01c.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x6bbf1c
jmp case.0x6bc01c.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x6bbf44
mov ecx, dword [eax + 0x468]
mov edx, dword [ebx + 0x1c]
dec edx
imul ecx, edx
mov esi, ecx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
add ecx, dword [eax + 0x44c]
mov dword [ebp - 0x10], ecx
mov esi, edx
test esi, esi
jb 0x6bc165
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.006bb1a4
test eax, eax
je 0x6bc165
mov eax, ebx
call fcn.006bc170
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x6bc0fe
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x6bc170
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x6bc1a1
dec al
je 0x6bc1dc
dec al
je 0x6bc220
dec al
je 0x6bc292
jmp 0x6bc32d
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x6bc32d
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x6bc1b1
jmp 0x6bc32d
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x6bc32d
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
movzx ecx, al
mov ecx, dword [ebx + ecx*4 + 0x40]
add dl, byte [ecx + esi]
and dl, 0xff
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x6bc1ec
jmp 0x6bc32d
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x6bc32d
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
jbe 0x6bc253
xor edx, edx
mov dword [esp + 4], edx
jmp 0x6bc268
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov ebp, dword [ebx + edx*4 + 0x40]
movzx edx, byte [ebp + esi]
add eax, dword [esp + 4]
sar eax, 1
jns 0x6bc280
adc eax, 0
add dl, al
and dl, 0xff
mov byte [ebp + esi], dl
inc esi
dec edi
jne 0x6bc230
jmp 0x6bc32d
xor eax, eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x6bc32d
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
ja 0x6bc2f9
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 8], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 8]
push eax
movzx eax, byte [esp + 8]
pop edx
call fcn.006b92f4
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [esp]
and al, 0xff
mov byte [edx + esi], al
inc esi
dec edi
jne 0x6bc2ae
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x73ab9c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
test dl, dl
je 0x73abaa
add esp, 0xfffffff0
call fcn.00408584
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.00733028
mov byte [esi + 0x3c], 1
mov dword [esi + 0x24], 0xff00000d
mov dword [esi + 0x1c], 0xff00000d
mov dword [esi + 0x54], 0xff00000b
mov dword [esi + 0x58], 0xff00000b
xor eax, eax
mov dword [esi + 0x5c], eax
mov dword [esi + 0x74], 0xff00000e
mov byte [esi + 0x71], 4
mov dword [esi + 0x14], 0xff00000d
mov dword [esi + 0x20], 0xff00000d
mov dword [esi + 0x10], 0xff00000d
mov byte [esi + 0xa], 0x80
mov byte [esi + 0xb], 0x46
mov byte [esi + 0xc], 0x80
mov byte [esi + 8], 0
mov byte [esi + 0x78], 1
movzx eax, byte [0x73ac54]
mov byte [esi + 0x64], al
movzx edx, byte [0x73ac58]
mov eax, esi
call fcn.0073b5b8
mov dword [esi + 0x44], 0xfcefd5
mov dword [esi + 0x48], 0xfdf8f1
mov byte [esi + 0x18], 1
mov eax, esi
test bl, bl
je 0x73ac4f
call fcn.004085dc
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
ret
Function at 0x78ae8c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd6c
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x28c], edx
mov dword [ebp - 0x290], edx
mov dword [ebp - 0x294], edx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x78b077
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov word [ebp - 0x288], 0x2f
mov byte [ebp - 0x284], 9
mov word [ebp - 0x280], 0x76
mov byte [ebp - 0x27c], 9
mov word [ebp - 0x278], 0x65
mov byte [ebp - 0x274], 9
mov word [ebp - 0x270], 0x72
mov byte [ebp - 0x26c], 9
mov word [ebp - 0x268], 0x79
mov byte [ebp - 0x264], 9
mov word [ebp - 0x260], 0x73
mov byte [ebp - 0x25c], 9
mov word [ebp - 0x258], 0x69
mov byte [ebp - 0x254], 9
mov word [ebp - 0x250], 0x6c
mov byte [ebp - 0x24c], 9
mov word [ebp - 0x248], 0x65
mov byte [ebp - 0x244], 9
mov word [ebp - 0x240], 0x6e
mov byte [ebp - 0x23c], 9
mov word [ebp - 0x238], 0x74
mov byte [ebp - 0x234], 9
lea edx, [ebp - 0x288]
mov ecx, 0xa
mov eax, 0x78b094
call fcn.004246d8
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.0040aa84
push eax
mov eax, dword [edi + 0x408]
call fcn.0040aa84
push eax
push 0x78b0c4
push 0
call fcn.004f70ac
xor ebx, ebx
mov dword [ebp - 0x230], 0x22c
xor edx, edx
mov eax, 2
call fcn.005d5568
mov esi, eax
lea edx, [ebp - 0x230]
mov eax, esi
call fcn.005d5588
test eax, eax
je 0x78b038
lea edx, [ebp - 0x28c]
mov eax, dword [edi + 0x408]
call fcn.00422220
mov eax, dword [ebp - 0x28c]
push eax
lea eax, [ebp - 0x294]
lea edx, [ebp - 0x20c]
mov ecx, 0x104
call fcn.0040ab40
mov eax, dword [ebp - 0x294]
lea edx, [ebp - 0x290]
call fcn.00422220
mov edx, dword [ebp - 0x290]
pop eax
call fcn.0040ae88
jne 0x78b027
mov bl, 1
lea edx, [ebp - 0x230]
mov eax, esi
call fcn.005d55a8
test eax, eax
jne 0x78afd8
push esi
call fcn.0041397c
test bl, bl
jne 0x78afad
mov eax, dword [edi + 0x408]
call fcn.00423cc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x78b07e
lea eax, [ebp - 0x294]
mov edx, 3
call fcn.00409d8c
lea eax, [ebp - 4]
call fcn.00409d2c
ret