joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401426
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
xor eax, eax
mov edi, eax
mov dword [ebp - 0x4c], 0x30
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], 3
mov dword [0x4041b0], eax
mov eax, edi
mov dword [ebp - 0x44], 0x40132e
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], str.Hall
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
test eax, eax
je 0x4014f0
mov eax, 0x80000000
push edi
push dword [ebp - 0x38]
push edi
push edi
push eax
push eax
push eax
push eax
push 0
push str.moossi
push str.Hall
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0
push eax
mov dword [0x4041b8], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x4041b8]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push edi
push edi
push edi
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
je 0x4014f0
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
lea eax, [ebp - 0x1c]
push eax
call edi
lea ecx, [ebp - 0x1c]
push ecx
call ebx
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
jne 0x4014d5
mov esp, ebp
pop ebp
ret 0x10
Function at 0x684430
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
xor eax, eax
cmp dword [esp + 0x20], 0
je 0x684510
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x684510
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x68447a
mov ecx, 0x1505
xor edi, edi
nop
movzx edx, byte [ebx + edi]
test edx, edx
je 0x684481
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x684460
jmp 0x684483
mov esi, 0x1505
jmp 0x684483
mov esi, ecx
mov ecx, dword [esp + 0x20]
mov ebx, dword [ecx + 0x20]
lea edx, [ebx - 1]
mov ecx, ebx
sub ecx, 1
mov dword [esp + 8], ecx
jb 0x684510
mov ecx, esi
not ecx
or edx, ecx
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
lea ebp, [esi + edx]
inc ebp
jmp 0x6844b4
inc ebp
dec ebx
je 0x68450e
mov eax, ebp
and eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x68450e
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x6844b0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp], eax
push eax
call fcn.0068c690
mov ecx, dword [esp + 0x24]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x6844b0
push dword [esp + 0x28]
push dword [esp + 4]
push dword [esp + 0x2c]
call fcn.0068c6b0
mov ecx, dword [esp + 0x2c]
add esp, 0xc
test eax, eax
jne 0x6844b0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
jmp 0x684510
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x684c90
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, 0xffffffff
cmp dword [esp + 0x24], 0
je 0x684daa
mov esi, dword [esp + 0x28]
test esi, esi
je 0x684daa
cmp dword [esp + 0x2c], 0
je 0x684daa
push esi
call fcn.0068c690
add esp, 4
test eax, eax
je 0x684cfa
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x684d01
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x684ce0
jmp 0x684d03
mov ebx, 0x1505
jmp 0x684d03
mov ebx, ecx
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea edx, [esi - 1]
mov edi, ebx
not edi
mov ebp, esi
sub ebp, 1
mov dword [esp + 0xc], ebp
mov dword [esp + 4], edi
jae 0x684db2
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x684d6f
call fcn.00685a30
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov ecx, dword [esp + 0x28]
jne 0x684daa
push ecx
call fcn.0068c690
add esp, 4
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx + 0x20]
lea eax, [esi - 1]
mov edx, esi
sub edx, 1
mov dword [esp + 0xc], edx
jae 0x684e30
mov ebp, 0xffffffff
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [esp + 0x28]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov dword [eax + ebp*4], edx
mov eax, dword [ecx + 0x10]
mov esi, dword [esp + 0x2c]
mov dword [eax + edx*4], esi
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebp
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [eax + edx*4], ebx
inc dword [ecx + 0x18]
mov eax, dword [ecx]
mov dword [esi], eax
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp], eax
or edx, edi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
lea edi, [ebx + edx]
inc edi
jmp 0x684dd8
inc edi
dec esi
je 0x684d24
mov ebp, edi
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x684d29
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x684dd0
mov ecx, dword [ecx + 0xc]
mov ebp, dword [ecx + eax*4]
push ebp
call fcn.0068c690
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x684dd0
push dword [esp]
push ebp
push dword [esp + 0x30]
call fcn.0068c6b0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x684dd0
mov eax, 0xffffffff
jmp 0x684daa
or eax, dword [esp + 4]
mov edx, dword [ecx + 4]
mov dword [esp + 8], edx
lea edi, [ebx + eax]
inc edi
jmp 0x684e58
inc edi
dec esi
je 0x684d6a
mov ebp, edi
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov eax, dword [eax + ebp*4]
cmp eax, 0xffffffff
je 0x684d6f
mov edx, dword [ecx + 8]
cmp dword [edx + eax*4], ebx
jne 0x684e50
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*4]
mov dword [esp + 4], eax
push eax
call fcn.0068c690
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x684e50
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.0068c6b0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x684e50
jmp 0x684d6f
Function at 0x685770
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, 0xffffffff
cmp dword [esp + 0x28], 0
je 0x68595a
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x68595a
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x68595a
cmp dword [ecx], 0
jne 0x68595a
push esi
call fcn.0068c690
add esp, 4
test eax, eax
je 0x6857da
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [esi + ebx]
test edx, edx
je 0x6857e1
mov edi, ecx
shl edi, 5
add edi, ecx
add edi, edx
inc ebx
mov ecx, edi
cmp eax, ebx
jne 0x6857c0
jmp 0x6857e3
mov edi, 0x1505
jmp 0x6857e3
mov edi, ecx
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + 0x20]
lea esi, [edx - 1]
mov ebx, edx
sub ebx, 1
mov dword [esp + 0xc], ebx
jae 0x6858b4
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x685841
call fcn.00685a30
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov esi, dword [esp + 0x2c]
jne 0x68595a
push esi
call fcn.0068c690
add esp, 4
mov edx, esi
lea esi, [esp + 0x10]
mov ecx, dword [esp + 0x28]
push esi
push edi
push eax
call fcn.00685970
add esp, 0xc
mov ebp, eax
mov esi, dword [esp + 0x2c]
push esi
call fcn.0068c690
add esp, 4
mov ebx, eax
inc eax
push eax
call dword [0x6c8008]
add esp, 4
test eax, eax
je 0x685955
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.0068c5b0
add esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x30]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], edi
inc dword [edx + 0x18]
mov eax, dword [edx]
mov dword [esi], eax
xor eax, eax
jmp 0x68595a
mov dword [esp], eax
mov eax, edx
mov edx, edi
not edx
or esi, edx
mov edx, eax
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
lea ebx, [edi + esi]
inc ebx
jmp 0x6858d8
inc ebx
dec edx
je 0x6857fc
mov ebp, ebx
and ebp, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov esi, dword [eax + ebp*4]
cmp esi, 0xffffffff
je 0x685801
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], edi
jne 0x6858d0
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + esi*4]
push ebp
mov dword [esp + 8], edx
call fcn.0068c690
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x2c]
add esp, 4
cmp eax, dword [esp]
jne 0x6858d0
push dword [esp]
push ebp
push dword [esp + 0x34]
call fcn.0068c6b0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
add esp, 0xc
test eax, eax
jne 0x6858d0
mov eax, dword [ecx + 0x10]
push dword [eax + esi*4]
call fcn.00684840
mov edx, dword [esp + 0x2c]
add esp, 4
mov eax, dword [edx + 0x10]
mov ecx, dword [esp + 0x30]
mov dword [eax + esi*4], ecx
mov esi, ecx
jmp 0x6858a9
mov eax, 0xffffffff
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6869f0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x686b96
mov ebx, dword [esp + 0x2c]
mov esi, dword [esp + 0x24]
movzx edi, si
shr esi, 0x10
test ebx, ebx
je 0x686b8f
mov ecx, 0x5e6ea9af
mov eax, ebx
mul ecx
shr edx, 0xb
imul eax, edx, 0x15b0
mov ecx, ebx
sub ecx, eax
jmp 0x686a86
mov ecx, dword [esp + 4]
mov eax, ecx
sub eax, dword [esp]
add ebp, eax
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, esi
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub esi, eax
mov ebx, dword [esp + 0xc]
sub ebx, ecx
mov ecx, 0x15b0
je 0x686b8f
xor edx, edx
cmp ecx, 8
mov dword [esp + 4], ecx
mov dword [esp + 0xc], ebx
jb 0x686aff
and ecx, 0x1ff8
mov dword [esp], ecx
xor eax, eax
mov edx, eax
movzx ebx, byte [ebp + eax]
add ebx, edi
movzx eax, byte [ebp + eax + 1]
add eax, ebx
add ebx, esi
movzx ecx, byte [ebp + edx + 2]
add ecx, eax
add ebx, eax
movzx eax, byte [ebp + edx + 3]
add eax, ecx
add ebx, ecx
movzx ecx, byte [ebp + edx + 4]
add ecx, eax
add ebx, eax
movzx eax, byte [ebp + edx + 5]
add eax, ecx
add ebx, ecx
movzx ecx, byte [ebp + edx + 6]
add ecx, eax
add ebx, eax
movzx edi, byte [ebp + edx + 7]
add edi, ecx
add ebx, ecx
mov ecx, dword [esp + 4]
lea eax, [edx + 8]
mov esi, ebx
add esi, edi
add edx, 0xf
cmp edx, ecx
jb 0x686aa0
add ebp, eax
mov edx, dword [esp]
mov ebx, edx
sub ebx, ecx
jae 0x686a4b
mov eax, ecx
and eax, 3
mov dword [esp], edx
je 0x686b41
mov dword [esp + 8], ebx
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
movzx ecx, byte [edx]
inc edx
add edi, ecx
add esi, edi
dec ebx
cmp eax, ebx
jne 0x686b20
mov eax, dword [esp]
sub eax, ebx
mov ebx, dword [esp + 8]
cmp ebx, 0xfffffffc
ja 0x686a40
jmp 0x686b4e
mov eax, edx
mov edx, ebp
cmp ebx, 0xfffffffc
ja 0x686a40
mov ebx, dword [esp + 4]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [edx + eax]
add ecx, edi
add esi, ecx
movzx edi, byte [edx + eax + 1]
add edi, ecx
add esi, edi
movzx ecx, byte [edx + eax + 2]
add ecx, edi
add esi, ecx
movzx edi, byte [edx + eax + 3]
add edi, ecx
add esi, edi
add eax, 4
cmp ebx, eax
jne 0x686b60
jmp 0x686a40
shl esi, 0x10
or esi, edi
jmp 0x686b9b
mov esi, 1
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x686bb0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x686bde
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebx, ebx
je 0x686c7c
not eax
test bl, 1
jne 0x686be5
mov edx, ebx
cmp ebx, 1
jne 0x686c16
jmp 0x686c7a
xor eax, eax
jmp 0x686c7c
lea edx, [ebx - 1]
movzx esi, byte [ecx]
mov edi, eax
shr edi, 4
xor eax, esi
and eax, 0xf
xor edi, dword [eax*4 + 0x6c5c50]
inc ecx
mov eax, edi
shr eax, 4
and edi, 0xf
shr esi, 4
xor esi, edi
xor eax, dword [esi*4 + 0x6c5c50]
cmp ebx, 1
je 0x686c7a
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x6c5c50]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x6c5c50]
movzx edi, byte [ecx + esi + 1]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x6c5c50]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x6c5c50]
add esi, 2
cmp edx, esi
jne 0x686c20
not eax
pop esi
pop edi
pop ebx
ret
Function at 0x68c460
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
mov ebx, dword [edx + 8]
mov esi, 1
cmp ebx, eax
jae 0x68c4cc
mov edi, edx
cmp dword [esp + 0x18], 0
je 0x68c4ae
cmp ebx, 1
adc ebx, 0
cmp ebx, eax
jae 0x68c4b0
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ebx
and edx, 0xfffffffd
mov ebp, ebx
and ebp, 2
or ebx, 2
imul ebx, ebp
xor ebp, 2
imul ebp, edx
add ebx, ebp
cmp ebx, eax
jb 0x68c490
jmp 0x68c4b0
mov ebx, eax
push ebx
push dword [edi + 0xc]
push dword [edi]
push dword [ecx + 0x34]
call dword [ecx + 0x30]
add esp, 0x10
test eax, eax
je 0x68c4ca
mov dword [edi], eax
mov dword [edi + 8], ebx
jmp 0x68c4cc
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x68cc70
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push esi
sub esp, 0x14
call fcn.006be390
test al, al
je 0x68cec1
call dword [sym.imp.USER32.dll_GetInputState]
mov esi, eax
call fcn.006b5b60
test al, al
je 0x68cebc
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 8], 0x62a5106d
mov dword [esp + 0xc], 0x16184216
mov word [esp + 0x10], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 9
ja 0x68ccfe
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
add eax, 0xfec6412d
xor eax, ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0x1f
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xa
jb 0x68ccd0
mov dword [esp + 8], 0x2fbad6d
mov dword [esp + 0xc], 0x10e3467f
mov word [esp + 0x10], 0
mov byte [esp + 0x12], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xa
ja 0x68cd7a
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
mov edx, eax
xor edx, 0xc9be6ac6
and eax, 0xc9be6ac6
lea eax, [edx + eax*2]
lea edx, [eax + ecx]
and eax, ecx
mov ecx, edx
xor ecx, eax
add ecx, eax
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0x22
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xb
jb 0x68cd30
test esi, esi
je 0x68ce49
mov dword [esp + 8], 0x131211f1
mov word [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 5
ja 0x68cde6
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
mov edx, eax
xor edx, 0xc2c952fc
and eax, 0xc2c952fc
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
mov ecx, eax
xor ecx, 0xec
and eax, 0x13
add eax, eax
sub eax, ecx
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 6
jb 0x68cda0
mov dword [esp + 8], 0xe10bb5df
mov dword [esp + 0xc], 0x4750448e
mov byte [esp + 0x10], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 8
ja 0x68ce49
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
mov edx, eax
xor edx, 0xb63be722
and eax, 0x363be722
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0x56
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 9
jb 0x68ce10
mov dword [esp + 8], 0x42454447
mov dword [esp + 0xc], 0x4e414043
mov word [esp + 0x10], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 9
ja 0x68cea9
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
mov edx, eax
xor edx, 0x80119cf1
and eax, 0x119cf1
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0x4b
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xa
jb 0x68ce70
call fcn.0068df60
test al, al
je 0x68cebc
call fcn.00690be0
call fcn.0068f7b0
call fcn.006bf4f0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x68ddb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebp, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov bl, byte [esp + 0x14]
call fcn.0068df50
test ebp, ebp
sets al
mov ecx, ebp
sub ecx, 1
sete cl
or al, cl
mov ecx, ebp
sub ecx, 0x25
setge cl
or al, cl
test al, 1
jne 0x68dde8
jmp 0x68dded
jmp 0x68df40
movzx eax, bl
mov ecx, edi
mov edi, esi
add edi, ecx
add edi, 0xffffffff
mov byte [esi + ecx - 1], 0
cmp eax, 0
jne 0x68de11
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], 0x30
jmp 0x68df3e
cmp ebp, 0xa
jne 0x68deb9
jmp 0x68de1c
movzx ecx, bl
cmp ecx, 0x64
jb 0x68de5e
mov esi, 0x64
mov eax, ecx
xor edx, edx
div esi
shl edx, 1
mov al, byte [edx + 0x6c6761]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], al
mov al, byte [edx + 0x6c6760]
add esi, 0xffffffff
mov byte [edi - 2], al
mov edi, 0x64
mov eax, ecx
xor edx, edx
div edi
mov ebx, eax
mov edi, esi
jmp 0x68de1c
cmp ecx, 0xa
setb al
test al, 1
jne 0x68de6a
jmp 0x68de7b
mov al, byte [ecx + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], al
jmp 0x68deb4
mov eax, ecx
and eax, 0xfffffffd
mov edx, ecx
or edx, 0xfffffffd
xor edx, 0xffffffff
imul edx, eax
mov eax, ecx
and eax, 2
or ecx, 2
imul ecx, eax
add ecx, edx
mov al, byte [ecx + 0x6c6761]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], al
mov al, byte [ecx + 0x6c6760]
add esi, 0xffffffff
mov byte [edi - 2], al
jmp 0x68df3e
cmp ebp, 0x10
je 0x68dec0
jmp 0x68df03
movzx eax, bl
jmp 0x68dec5
cmp eax, 0x10
setl cl
test cl, 1
jne 0x68ded2
jmp 0x68dee3
mov al, byte [eax + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], al
jmp 0x68df3e
shl eax, 1
mov cl, byte [eax + 0x6c682a]
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], cl
mov al, byte [eax + str.000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF]
add esi, 0xffffffff
mov byte [edi - 2], al
jmp 0x68df3e
movzx ecx, bl
cmp ecx, 0
seta al
test al, 1
jne 0x68df12
jmp 0x68df3a
mov eax, ecx
xor edx, edx
div ebp
lea eax, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ
add eax, edx
mov al, byte [eax]
jmp 0x68df24
jmp 0x68df26
mov esi, edi
add esi, 0xffffffff
mov byte [edi - 1], al
mov eax, ecx
xor edx, edx
div ebp
mov ebx, eax
mov edi, esi
jmp 0x68df03
mov esi, edi
jmp 0x68df3e
jmp 0x68df40
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x68df60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1a4
push eax
sub esp, 0x7c
mov dword [ebp - 0x24], esp
mov esi, dword [0x6ce43c]
mov dword [ebp - 0x1b0], 0x4f4e7148
mov word [ebp - 0x1ac], 0
mov byte [ebp - 0x1aa], 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
cmp eax, 6
ja 0x68e011
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
movzx eax, byte [ebp + eax - 0x1b0]
mov edx, ecx
xor edx, 0x1903de92
add ecx, ecx
and ecx, 0x3207bd24
mov edi, ecx
and edi, edx
xor ecx, edx
lea ecx, [ecx + edi*2]
mov edx, ecx
and edx, eax
add ecx, eax
add edx, edx
sub ecx, edx
mov dword [ebp - 0x130], ecx
mov eax, dword [ebp - 0x130]
mov ecx, eax
xor ecx, 0xda
and eax, 0x25
add eax, eax
sub eax, ecx
mov ecx, dword [ebp - 0x10]
mov byte [ebp + ecx - 0x1b0], al
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, 7
jb 0x68dfb0
mov ebx, dword [ebp - 0x1b0]
mov dword [ebp - 0x130], 0xe17de76d
mov dword [ebp - 0x12c], 0xdd7ae376
mov dword [ebp - 0x128], 0xd952df50
mov dword [ebp - 0x124], 0xd58cdb48
mov dword [ebp - 0x120], 0xd142d748
mov dword [ebp - 0x11c], 0xcdd2d344
mov word [ebp - 0x118], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
cmp eax, 0x19
ja 0x68e0ad
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
movzx ecx, byte [ebp + ecx - 0x130]
mov edx, eax
xor edx, 0x7665659
and eax, 0x7665659
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add al, 0x43
mov ecx, dword [ebp - 0x14]
mov byte [ebp + ecx - 0x130], al
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, 0x1a
jb 0x68e070
mov eax, dword [0x6c8a3c]
mov ecx, 0x77098a0e
xor ecx, dword [0x6c8a40]
add eax, ecx
inc eax
jmp eax
Function at 0x690be0
Capabilities:
Encode data using xor
Get common file path
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x118
mov esi, esp
push eax
push eax
mov dword [esi + 0x18], esp
sub esp, 0x24
mov dword [esi + 0x10], esp
push eax
mov dword [esi + 0x64], esp
push eax
mov dword [esi + 0x8c], esp
sub esp, 0x68
mov dword [esi + 0x14], esp
sub esp, 0x10
mov dword [esi + 0x88], esp
sub esp, 0x208
mov dword [esi + 0x84], esp
sub esp, 8
mov dword [esi + 0x24], esp
sub esp, 8
mov dword [esi + 0x6c], esp
sub esp, 8
mov dword [esi + 0x70], esp
sub esp, 8
mov edx, esp
sub esp, 0x68
mov edi, esp
and edi, 0xfffffff8
mov esp, edi
push eax
sub esp, 0x64
mov ebx, esp
and ebx, 0xfffffff8
mov esp, ebx
push eax
sub esp, 0x64
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x60], eax
mov esp, eax
push eax
sub esp, 0x64
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x5c], eax
mov esp, eax
push eax
sub esp, 0x64
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x58], eax
mov esp, eax
push eax
sub esp, 0x64
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x54], eax
mov esp, eax
push eax
sub esp, 0xfc
mov dword [esi + 0x20], esp
sub esp, 8
mov dword [esi + 0x30], esp
sub esp, 8
mov dword [esi + 0x50], esp
sub esp, 0x24
mov dword [esi + 0x28], esp
push eax
mov dword [esi + 0x40], esp
push eax
mov dword [esi + 0x3c], esp
sub esp, 0x68
mov dword [esi + 0x34], esp
sub esp, 0x10
mov ecx, esp
sub esp, 0x68
mov eax, esp
and eax, 0xfffffff8
mov dword [esi + 0x4c], eax
mov esp, eax
push eax
sub esp, 8
mov eax, esp
sub esp, 0x800
mov dword [esi + 0x2c], esp
sub esp, 0x80
mov dword [esi + 0x68], esp
mov dword [esi + 0x74], edx
mov dword [esi + 0x80], ecx
mov dword [esi + 0x7c], eax
sub esp, 0x44
mov dword [esi + 0x78], esp
sub esp, 0x10
mov dword [esi + 0x38], esp
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
shr eax, 0x1f
jmp dword [eax*4 + 0x6c9640]