joyce8/EMBER2024-capa huggingface dataset:
Function at 0x63ae10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov dword [ebp - 8], esi
mov dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
call fcn.0061a238
xor eax, eax
push eax
push eax
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0xba9630], eax
test eax, eax
je 0x63af01
lea edx, [ebp - 0xc]
push edx
mov eax, 0xfffffffd
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], eax
push 0x10000
push ebx
push 0x63aa30
push dword [ebp + 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x63ae77
mov dword [ebx + 0xc], eax
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push 0x40088
lea eax, [ebp - 0x2c]
push eax
call fcn.006228f4
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.00622cc0
add esp, 0x10
mov dword [esp], 2
mov edx, dword [ebp - 0x2c]
lea eax, [esp + 4]
mov dword [eax], edx
mov ecx, dword [ebp - 0x28]
mov dword [eax + 4], ecx
mov ebx, dword [ebp - 0x24]
lea ecx, [0xba9518]
mov dword [eax + 8], ebx
lea edx, [esp + 0x14]
mov esi, dword [ebp - 0x20]
mov dword [eax + 0xc], esi
mov eax, dword [ebp - 0x1c]
mov dword [edx], eax
mov eax, dword [ebp - 0x18]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [edx + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [edx + 0xc], eax
mov edx, dword [ecx]
lea eax, [esp + 0x24]
mov dword [eax], edx
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov edx, dword [ecx + 8]
mov dword [eax + 8], edx
mov edx, dword [ecx + 0xc]
mov dword [eax + 0xc], edx
call fcn.00621a50
jmp 0x63ae6d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 0x40089
lea eax, [ebp - 0x4c]
push eax
call fcn.006228f4
lea eax, [ebp - 0x3c]
push esi
push eax
call fcn.00622cc0
add esp, 0x10
mov dword [esp], 2
mov eax, dword [ebp - 0x4c]
lea esi, [esp + 4]
mov dword [esi], eax
mov eax, dword [ebp - 0x48]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x44]
mov dword [esi + 8], eax
lea ecx, [esp + 0x14]
lea edx, [esp + 0x24]
mov eax, dword [ebp - 0x40]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0x3c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x38]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x30]
mov dword [ecx + 0xc], eax
lea eax, [0xba9518]
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov dword [edx + 0xc], eax
call fcn.00621a50
jmp 0x63ae41
Function at 0x63b0cc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov dword [ebp - 8], edi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebx + 0x14], eax
test eax, eax
jl 0x63b10b
mov edx, dword [0xba7b6c]
mov ecx, dword [edx + eax*4]
test ecx, ecx
je 0x63b10b
mov edx, dword [0xba6e80]
mov edx, dword [edx + eax*4]
test edx, edx
je 0x63b10b
cmp edx, dword [ecx + 0x14]
je 0x63b1d4
mov edx, dword [0xba7a64]
imul edx, eax
xor ecx, ecx
add edx, dword [ebp + 0x10]
lea eax, [ebp - 0x10]
mov dword [ebx + 4], edx
mov dword [ebx + 8], ecx
push eax
push 0x10000
push ebx
push 0x63afb0
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x63b14a
mov dword [ebx + 0xc], eax
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push 0x40088
lea eax, [ebp - 0x30]
push eax
call fcn.006228f4
lea eax, [ebp - 0x20]
push ebx
push eax
call fcn.00622cc0
add esp, 0x10
mov dword [esp], 2
mov eax, dword [ebp - 0x30]
lea esi, [esp + 4]
mov dword [esi], eax
mov edx, dword [ebp - 0x2c]
mov dword [esi + 4], edx
mov ecx, dword [ebp - 0x28]
mov dword [esi + 8], ecx
lea edx, [esp + 0x14]
lea ecx, [esp + 0x24]
mov ebx, dword [ebp - 0x24]
mov dword [esi + 0xc], ebx
mov edi, dword [ebp - 0x20]
mov dword [edx], edi
mov eax, dword [ebp - 0x1c]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x18]
mov dword [edx + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [edx + 0xc], eax
lea edx, [0xba9518]
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx + 8]
mov dword [ecx + 8], eax
mov eax, dword [edx + 0xc]
mov dword [ecx + 0xc], eax
call fcn.00621a50
jmp 0x63b13d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
lea ecx, [ebx + 0xc]
xor edx, edx
push edx
push edx
push ecx
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x63b218
push 0x402
push str..._.._src_z_Windows_NT_util.c
push str.assertion_failure
call fcn.0061921c
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 4], 0
push ebx
mov dword [ebx + 0x1c], eax
mov dword [ebx + 8], 1
lea eax, [ebp - 0x30]
mov dword [ebx], eax
call fcn.0061ec08
pop ecx
jmp 0x63b13d

Function at 0x63b2fc
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0xba9634]
test eax, eax
jne 0x63b311
mov eax, 0xfffffffe
mov esp, ebp
pop ebp
ret
push dword [0xba7a38]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
add eax, 0xffffffff
mov esp, ebp
pop ebp
ret
Function at 0x63b908
Capabilities:
Allocate thread local storage
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov dword [ebp - 4], edi
mov eax, dword [0xba9634]
test eax, eax
je 0x63b921
mov esp, ebp
pop ebp
ret
push 0xba9638
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x63ba40
fild qword [ebp - 0xc]
fld1
fdivrp st(1)
fstp qword [0xba9628]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x1c]
mov edx, dword [0xba7a00]
mov dword [0xba7aa8], eax
test edx, edx
jne 0x63b972
push 0xba7a00
call fcn.0064f440
pop ecx
mov eax, dword [0xba7a30]
or eax, dword [0xba7a34]
jne 0x63b9af
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x63b9a0
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
mov dword [0xba7a30], eax
mov dword [0xba7a34], edx
jmp 0x63b9af
mov eax, 0xffffffff
mov dword [0xba7a30], eax
mov dword [0xba7a34], eax
mov eax, dword [0xba7a38]
mov dword [0xb96b84], 0
test eax, eax
jne 0x63ba2a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0xba7a38], eax
cmp eax, 0xffffffff
jne 0x63ba2a
push 0x40075
lea eax, [ebp - 0x68]
push eax
call fcn.006228f4
add esp, 8
mov dword [esp], 2
mov edi, dword [ebp - 0x68]
lea ecx, [esp + 4]
mov dword [ecx], edi
mov eax, dword [ebp - 0x64]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x60]
mov dword [ecx + 8], eax
lea edx, [esp + 0x14]
mov eax, dword [ebp - 0x5c]
mov dword [ecx + 0xc], eax
lea eax, [0xba9518]
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov dword [edx + 0xc], eax
call fcn.00621a50
call fcn.0063b5f0
mov edi, dword [ebp - 4]
mov dword [0xba9634], 1
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push str.QueryPerformanceFrequency__
push 0x400b2
lea eax, [ebp - 0x58]
push eax
call fcn.006228f4
lea eax, [ebp - 0x48]
push edi
push eax
call fcn.00622cc0
add esp, 0x14
mov dword [esp], 2
mov eax, dword [ebp - 0x58]
lea edi, [esp + 4]
mov dword [edi], eax
mov eax, dword [ebp - 0x54]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x50]
mov dword [edi + 8], eax
lea ecx, [esp + 0x14]
lea edx, [esp + 0x24]
mov eax, dword [ebp - 0x4c]
mov dword [edi + 0xc], eax
mov eax, dword [ebp - 0x48]
mov dword [ecx], eax
mov eax, dword [ebp - 0x44]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x40]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x3c]
mov dword [ecx + 0xc], eax
lea eax, [0xba9518]
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov dword [edx + 0xc], eax
call fcn.00621a50
jmp 0x63b94b
Function at 0x64396c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], edi
mov dword [ebp - 4], ebx
mov eax, dword [0xba986c]
test eax, eax
jne 0x6439ec
push 0xffffffffffffffff
push 0xb98b00
call fcn.00621910
add esp, 8
mov eax, dword [0xba986c]
test eax, eax
jne 0x6439dd
mov dword [0xba9660], 0xb2337c
xor eax, eax
mov dword [0xba9664], eax
mov dword [0xba9668], eax
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp eax, 0xffffffff
je 0x643b28
test eax, eax
je 0x643b28
mov dword [0xba9870], eax
mov dword [0xba986c], 1
push 0xffffffffffffffff
push 0xb98b00
call fcn.00621708
add esp, 8
mov eax, dword [0xba9870]
test eax, eax
jne 0x643a01
mov eax, dword [ebp + 8]
cmp eax, 1
jne 0x643a01
mov esp, ebp
pop ebp
ret
mov eax, dword [0xba7b18]
test eax, eax
je 0x643ae5
mov edi, dword [0xba7b20]
test edi, edi
je 0x643ae5
mov eax, dword [0xba7b1c]
test eax, eax
jne 0x643a35
mov eax, dword [0xba7b24]
lea edx, [eax + 1]
mov dword [0xba7b24], edx
jmp 0x643a4a
push 1
push 0xba7b24
call fcn.006235e0
add esp, 8
mov edi, dword [0xba7b20]
mov ecx, dword [0xb96bb4]
mov ebx, dword [ebp + 0x10]
push ebx
cdq
idiv ecx
mov eax, dword [ebp + 0xc]
push eax
imul edx, dword [0xb96bb8]
add edi, edx
push edi
call fcn.00841274
add esp, 0xc
mov ebx, eax
mov eax, dword [0xb96bb8]
add ebx, 1
cmp ebx, eax
jle 0x643a92
cmp ebx, dword [0xba7b28]
jg 0x643a9c
mov byte [edi + eax - 2], 0xa
mov eax, dword [0xb96bb8]
mov byte [edi + eax - 1], 0
mov ebx, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
push ebx
push str.OMP_warning:_Debugging_buffer_overflow__increase_KMP_DEBUG_BUF_CHARS_to__d_n
push 0xba9660
call fcn.00642e1c
add esp, 0xc
lea eax, [ebp - 0xc]
push 0
push eax
push dword [0xba9668]
push dword [0xba9660]
push dword [0xba9870]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0xba9660
call fcn.00643618
pop ecx
mov eax, dword [0xb96bb8]
mov dword [0xba7b28], ebx
jmp 0x643a83
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push eax
push edx
push 0xba9660
call fcn.00642fd8
add esp, 0xc
lea eax, [ebp - 0xc]
push 0
push eax
push dword [0xba9668]
push dword [0xba9660]
push dword [0xba9870]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0xba9660
call fcn.00643618
pop ecx
jmp 0x643a92
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0xba9870], 0
jmp 0x6439d3
Function at 0x643b40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], edi
mov dword [ebp - 4], esi
mov esi, dword [ebp + 8]
mov eax, dword [0xba986c]
test eax, eax
jne 0x643bc3
push 0xffffffffffffffff
push 0xb98b00
call fcn.00621910
add esp, 8
mov eax, dword [0xba986c]
test eax, eax
jne 0x643bb4
mov dword [0xba9660], 0xb2337c
xor eax, eax
mov dword [0xba9664], eax
mov dword [0xba9668], eax
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp eax, 0xffffffff
je 0x643cf1
test eax, eax
je 0x643cf1
mov dword [0xba9870], eax
mov dword [0xba986c], 1
push 0xffffffffffffffff
push 0xb98b00
call fcn.00621708
add esp, 8
mov eax, dword [0xba9870]
test eax, eax
je 0x643c5e
mov eax, dword [0xba7b18]
test eax, eax
je 0x643cb1
mov edi, dword [0xba7b20]
test edi, edi
je 0x643cb1
mov eax, dword [0xba7b1c]
test eax, eax
jne 0x643c04
mov eax, dword [0xba7b24]
lea edx, [eax + 1]
mov dword [0xba7b24], edx
jmp 0x643c19
push 1
push 0xba7b24
call fcn.006235e0
add esp, 8
mov edi, dword [0xba7b20]
mov ecx, dword [0xb96bb4]
cdq
idiv ecx
imul edx, dword [0xb96bb8]
lea eax, [ebp + 0xc]
push eax
push esi
add edi, edx
push edi
call fcn.00841274
add esp, 0xc
mov esi, eax
mov eax, dword [0xb96bb8]
add esi, 1
cmp esi, eax
jle 0x643c5e
cmp esi, dword [0xba7b28]
jg 0x643c68
mov byte [edi + eax - 2], 0xa
mov eax, dword [0xb96bb8]
mov byte [edi + eax - 1], 0
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
push esi
push str.OMP_warning:_Debugging_buffer_overflow__increase_KMP_DEBUG_BUF_CHARS_to__d_n
push 0xba9660
call fcn.00642e1c
add esp, 0xc
lea eax, [ebp - 0xc]
push 0
push eax
push dword [0xba9668]
push dword [0xba9660]
push dword [0xba9870]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0xba9660
call fcn.00643618
pop ecx
mov eax, dword [0xb96bb8]
mov dword [0xba7b28], esi
jmp 0x643c4f
lea eax, [ebp + 0xc]
push eax
push esi
push 0xba9660
call fcn.00642fd8
add esp, 0xc
lea eax, [ebp - 0xc]
push 0
push eax
push dword [0xba9668]
push dword [0xba9660]
push dword [0xba9870]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0xba9660
call fcn.00643618
pop ecx
jmp 0x643c5e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0xba9870], 0
jmp 0x643baa
Function at 0x643d08
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], edi
mov dword [ebp - 4], esi
push 0xffffffffffffffff
push 0xb98a80
call fcn.00621910
add esp, 8
mov esi, dword [ebp + 8]
mov eax, dword [0xba986c]
test eax, eax
jne 0x643d9a
push 0xffffffffffffffff
push 0xb98b00
call fcn.00621910
add esp, 8
mov eax, dword [0xba986c]
test eax, eax
jne 0x643d8b
mov dword [0xba9660], 0xb2337c
xor eax, eax
mov dword [0xba9664], eax
mov dword [0xba9668], eax
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp eax, 0xffffffff
je 0x643ed7
test eax, eax
je 0x643ed7
mov dword [0xba9870], eax
mov dword [0xba986c], 1
push 0xffffffffffffffff
push 0xb98b00
call fcn.00621708
add esp, 8
mov eax, dword [0xba9870]
test eax, eax
je 0x643e35
mov eax, dword [0xba7b18]
test eax, eax
je 0x643e97
mov edi, dword [0xba7b20]
test edi, edi
je 0x643e97
mov eax, dword [0xba7b1c]
test eax, eax
jne 0x643ddb
mov eax, dword [0xba7b24]
lea edx, [eax + 1]
mov dword [0xba7b24], edx
jmp 0x643df0
push 1
push 0xba7b24
call fcn.006235e0
add esp, 8
mov edi, dword [0xba7b20]
mov ecx, dword [0xb96bb4]
cdq
idiv ecx
imul edx, dword [0xb96bb8]
lea eax, [ebp + 0xc]
push eax
push esi
add edi, edx
push edi
call fcn.00841274
add esp, 0xc
mov esi, eax
mov eax, dword [0xb96bb8]
add esi, 1
cmp esi, eax
jle 0x643e35
cmp esi, dword [0xba7b28]
jg 0x643e4e
mov byte [edi + eax - 2], 0xa
mov eax, dword [0xb96bb8]
mov byte [edi + eax - 1], 0
push 0xffffffffffffffff
push 0xb98a80
call fcn.00621708
add esp, 8
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
push esi
push str.OMP_warning:_Debugging_buffer_overflow__increase_KMP_DEBUG_BUF_CHARS_to__d_n
push 0xba9660
call fcn.00642e1c
add esp, 0xc
lea eax, [ebp - 0x10]
push 0
push eax
push dword [0xba9668]
push dword [0xba9660]
push dword [0xba9870]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0xba9660
call fcn.00643618
pop ecx
mov eax, dword [0xb96bb8]
mov dword [0xba7b28], esi
jmp 0x643e26
lea eax, [ebp + 0xc]
push eax
push esi
push 0xba9660
call fcn.00642fd8
add esp, 0xc
lea eax, [ebp - 0xc]
push 0
push eax
push dword [0xba9668]
push dword [0xba9660]
push dword [0xba9870]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0xba9660
call fcn.00643618
pop ecx
jmp 0x643e35
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0xba9870], 0
jmp 0x643d81
Function at 0x644038
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov dword [ebp - 8], esi
mov dword [ebp - 4], ebx
mov esi, dword [ebp + 8]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x64405e
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea eax, [ebp - 0x28]
push esi
push 0x40012
push eax
call fcn.006228f4
lea eax, [ebp - 0x18]
push ebx
push eax
call fcn.00622cc0
add esp, 0x14
mov dword [esp], 2
mov edx, dword [ebp - 0x28]
lea eax, [esp + 4]
mov dword [eax], edx
mov ecx, dword [ebp - 0x24]
mov dword [eax + 4], ecx
mov ebx, dword [ebp - 0x20]
lea ecx, [0xba9518]
mov dword [eax + 8], ebx
lea edx, [esp + 0x14]
mov esi, dword [ebp - 0x1c]
mov dword [eax + 0xc], esi
mov eax, dword [ebp - 0x18]
mov dword [edx], eax
mov eax, dword [ebp - 0x14]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [edx + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [edx + 0xc], eax
mov edx, dword [ecx]
lea eax, [esp + 0x24]
mov dword [eax], edx
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov edx, dword [ecx + 8]
mov dword [eax + 8], edx
mov edx, dword [ecx + 0xc]
mov dword [eax + 0xc], edx
call fcn.00621a50
jmp 0x644054
Function at 0x6440ec
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov dword [ebp - 4], edi
mov dword [ebp - 8], esi
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x644128
xor eax, eax
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x644118
mov esi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0xcb
jne 0x644144
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x6441c7
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x48]
push esi
push 0x40011
push eax
call fcn.006228f4
lea eax, [ebp - 0x38]
push edi
push eax
call fcn.00622cc0
add esp, 0x14
mov dword [esp], 2
mov eax, dword [ebp - 0x48]
lea edi, [esp + 4]
mov dword [edi], eax
mov eax, dword [ebp - 0x44]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x40]
mov dword [edi + 8], eax
lea ecx, [esp + 0x14]
lea edx, [esp + 0x24]
mov eax, dword [ebp - 0x3c]
mov dword [edi + 0xc], eax
mov eax, dword [ebp - 0x38]
mov dword [ecx], eax
mov eax, dword [ebp - 0x34]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x30]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [ecx + 0xc], eax
lea eax, [0xba9518]
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov dword [edx + 0xc], eax
call fcn.00621a50
jmp 0x644128
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea eax, [ebp - 0x28]
push esi
push 0x40012
push eax
call fcn.006228f4
lea eax, [ebp - 0x18]
push edi
push eax
call fcn.00622cc0
add esp, 0x14
mov dword [esp], 2
mov edx, dword [ebp - 0x28]
lea eax, [esp + 4]
mov dword [eax], edx
mov ecx, dword [ebp - 0x24]
mov dword [eax + 4], ecx
mov esi, dword [ebp - 0x20]
lea ecx, [0xba9518]
mov dword [eax + 8], esi
lea edx, [esp + 0x14]
mov edi, dword [ebp - 0x1c]
mov dword [eax + 0xc], edi
mov eax, dword [ebp - 0x18]
mov dword [edx], eax
mov eax, dword [ebp - 0x14]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [edx + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [edx + 0xc], eax
mov edx, dword [ecx]
lea eax, [esp + 0x24]
mov dword [eax], edx
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov edx, dword [ecx + 8]
mov dword [eax + 8], edx
mov edx, dword [ecx + 0xc]
mov dword [eax + 0xc], edx
call fcn.00621a50
jmp 0x64413a
Function at 0x6b4a00
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
push ebp
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
lea ebp, [0x6b1440]
lea esp, [esp]
movss xmm0, dword [esi]
pxor xmm0, xmmword [ebp + 0xc0]
subss xmm0, dword [ebp + 0xd0]
shufps xmm0, xmm0, 0
movaps xmm1, xmm0
addps xmm0, xmmword [ebp + 0x100]
addps xmm1, xmmword [ebp + 0x110]
pand xmm0, xmmword [ebp + 0xb0]
pand xmm1, xmmword [ebp + 0xb0]
minps xmm0, xmmword [ebp + 0xe0]
minps xmm1, xmmword [ebp + 0xe0]
mulps xmm0, xmmword [ebp + 0xf0]
mulps xmm1, xmmword [ebp + 0xf0]
cvttps2dq xmm2, xmm0
cvttps2dq xmm3, xmm1
movd eax, xmm2
movq xmm4, qword [edx + eax*4]
pshufd xmm2, xmm2, 0x39
movd eax, xmm2
movq xmm5, qword [edx + eax*4]
pshufd xmm2, xmm2, 0x39
movd eax, xmm2
movq xmm6, qword [edx + eax*4]
pshufd xmm2, xmm2, 0x39
movd eax, xmm2
movq xmm7, qword [edx + eax*4]
pshufd xmm2, xmm2, 0x39
punpckldq xmm4, xmm5
punpckldq xmm6, xmm7
cvtdq2ps xmm2, xmm2
movaps xmm5, xmm4
punpcklqdq xmm4, xmm6
punpckhqdq xmm5, xmm6
subps xmm5, xmm4
subps xmm0, xmm2
mulps xmm0, xmm5
addps xmm0, xmm4
xorps xmm7, xmm7
pshufd xmm2, xmm0, 1
pshufd xmm6, xmm0, 2
pshufd xmm4, xmm0, 3
addss xmm7, xmm0
addss xmm7, xmm2
addss xmm7, xmm4
addss xmm7, xmm6
movd eax, xmm3
movq xmm4, qword [edx + eax*4]
pshufd xmm3, xmm3, 0xe1
movd eax, xmm3
movq xmm5, qword [edx + eax*4]
pshufd xmm3, xmm3, 0xe1
punpckldq xmm4, xmm5
cvtdq2ps xmm3, xmm3
movhlps xmm5, xmm4
subps xmm1, xmm3
subps xmm5, xmm4
mulps xmm1, xmm5
addps xmm1, xmm4
pshufd xmm2, xmm1, 1
addss xmm7, xmm1
addss xmm7, xmm2
shufps xmm7, xmm7, 0
divps xmm0, xmm7
divps xmm1, xmm7
movlps qword [edi], xmm0
movhps qword [edi + 8], xmm0
movlps qword [edi + 0x10], xmm1
add esi, 4
add edi, 0x18
sub ecx, 1
jne 0x6b4a20
pop ebp
pop edi
pop esi
ret
Function at 0x6caa70
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
push ebp
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
lea ebp, [0x6c74b0]
lea esp, [esp]
movss xmm0, dword [esi]
pxor xmm0, xmmword [ebp + 0xc0]
subss xmm0, dword [ebp + 0xd0]
shufps xmm0, xmm0, 0
movaps xmm1, xmm0
addps xmm0, xmmword [ebp + 0x100]
addps xmm1, xmmword [ebp + 0x110]
pand xmm0, xmmword [ebp + 0xb0]
pand xmm1, xmmword [ebp + 0xb0]
minps xmm0, xmmword [ebp + 0xe0]
minps xmm1, xmmword [ebp + 0xe0]
mulps xmm0, xmmword [ebp + 0xf0]
mulps xmm1, xmmword [ebp + 0xf0]
cvttps2dq xmm2, xmm0
cvttps2dq xmm3, xmm1
movd eax, xmm2
movq xmm4, qword [edx + eax*4]
pshufd xmm2, xmm2, 0x39
movd eax, xmm2
movq xmm5, qword [edx + eax*4]
pshufd xmm2, xmm2, 0x39
movd eax, xmm2
movq xmm6, qword [edx + eax*4]
pshufd xmm2, xmm2, 0x39
movd eax, xmm2
movq xmm7, qword [edx + eax*4]
pshufd xmm2, xmm2, 0x39
punpckldq xmm4, xmm5
punpckldq xmm6, xmm7
cvtdq2ps xmm2, xmm2
movaps xmm5, xmm4
punpcklqdq xmm4, xmm6
punpckhqdq xmm5, xmm6
subps xmm5, xmm4
subps xmm0, xmm2
mulps xmm0, xmm5
addps xmm0, xmm4
xorps xmm7, xmm7
pshufd xmm2, xmm0, 1
pshufd xmm6, xmm0, 2
pshufd xmm4, xmm0, 3
addss xmm7, xmm0
addss xmm7, xmm2
addss xmm7, xmm4
addss xmm7, xmm6
movd eax, xmm3
movq xmm4, qword [edx + eax*4]
pshufd xmm3, xmm3, 0xe1
movd eax, xmm3
movq xmm5, qword [edx + eax*4]
pshufd xmm3, xmm3, 0xe1
punpckldq xmm4, xmm5
cvtdq2ps xmm3, xmm3
movhlps xmm5, xmm4
subps xmm1, xmm3
subps xmm5, xmm4
mulps xmm1, xmm5
addps xmm1, xmm4
pshufd xmm2, xmm1, 1
addss xmm7, xmm1
addss xmm7, xmm2
shufps xmm7, xmm7, 0
divps xmm0, xmm7
divps xmm1, xmm7
movlps qword [edi], xmm0
movhps qword [edi + 8], xmm0
movlps qword [edi + 0x10], xmm1
add esi, 4
add edi, 0x18
sub ecx, 1
jne 0x6caa90
pop ebp
pop edi
pop esi
ret