joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1025aa04
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x1025aa37
push esi
call fcn.10268dc4
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x1025aa30
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x1025aabd
mov eax, dword [esi + reloc.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x1025aaa6
mov eax, dword [esi + 8]
test eax, eax
je 0x1025aa5b
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + reloc.KERNEL32.dll_GetCurrentThreadId]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x1025aaa2
cmp eax, 2
je 0x1025aaa6
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x1025aa4e
cmp eax, 3
je 0x1025aa81
cmp eax, 1
jne 0x1025aa4e
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x1025aa4e
mov edx, dword [esi + reloc.KERNEL32.dll_GetCurrentThreadId]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x1025aa4e
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.1025aae4
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x1025aacc
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.1025aae4
add esp, 4
pop esi
ret
Function at 0x1025b7d4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x1025b7df
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x1025b8e2
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + reloc.KERNEL32.dll_GetCurrentThreadId]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + reloc.KERNEL32.dll_GetCurrentThreadId]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + reloc.KERNEL32.dll_GetCurrentThreadId]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + reloc.KERNEL32.dll_GetCurrentThreadId]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + reloc.KERNEL32.dll_GetCurrentThreadId]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + reloc.KERNEL32.dll_GetCurrentThreadId]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + reloc.KERNEL32.dll_GetCurrentThreadId]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + reloc.KERNEL32.dll_GetCurrentThreadId]
xor eax, edx
inc ecx
dec edi
jne 0x1025b7fa
pop edi
test esi, esi
je 0x1025b904
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + reloc.KERNEL32.dll_GetCurrentThreadId]
xor eax, edx
inc ecx
dec esi
jne 0x1025b8e6
pop esi
pop ebx
not eax
ret
Function at 0x10289b44
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 8
xor ecx, ecx
xor eax, eax
push ebp
mov ebp, dword [esp + 0x18]
mov byte [eax + ebp], al
inc eax
cmp eax, 0x100
jl 0x10289b50
mov eax, dword [esp + 0x14]
mov byte [ebp + 0x100], cl
cmp eax, ecx
mov byte [ebp + 0x101], cl
jle 0x10289be3
push ebx
push esi
push edi
mov byte [esp + 0x24], cl
xor esi, esi
mov ebx, ebp
mov dword [esp + 0x10], pe_nt_image_headers32
mov edi, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
and edi, 0xff
xor eax, eax
xor edx, edx
mov al, byte [edi + ecx]
mov dl, byte [ebx]
add esi, eax
add edx, esi
and edx, 0x800000ff
jns 0x10289bad
dec edx
or edx, 0xffffff00
inc edx
mov byte [esp + 0x14], dl
mov esi, dword [esp + 0x14]
and esi, 0xff
lea eax, [esi + ebp]
push eax
push ebx
call fcn.10289bf4
lea eax, [edi + 1]
add esp, 8
cdq
idiv dword [esp + 0x20]
mov eax, dword [esp + 0x10]
inc ebx
dec eax
mov dword [esp + 0x10], eax
mov byte [esp + 0x24], dl
jne 0x10289b82
pop edi
pop esi
pop ebx
pop ebp
add esp, 8
ret

Function at 0x10289c14
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
mov edx, dword [esp + 0x14]
push ebx
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
mov al, byte [esi + 0x100]
mov cl, byte [esi + 0x101]
test edx, edx
mov byte [esp + 0x20], al
mov byte [esp + 8], cl
jle 0x10289d11
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x28]
and edi, 0xff
and ebp, 0xff
lea eax, [edi + 1]
and eax, 0x800000ff
jns 0x10289c66
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x28], al
xor ecx, ecx
mov edi, dword [esp + 0x28]
and edi, 0xff
mov cl, byte [edi + esi]
lea eax, [edi + esi]
add ecx, ebp
mov dword [esp + 0x18], eax
and ecx, 0x800000ff
jns 0x10289c92
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ebp, dword [esp + 0x10]
and ebp, 0xff
lea ecx, [esi + ebp]
push ecx
push eax
mov dword [esp + 0x1c], ecx
call fcn.10289bf4
mov eax, dword [esp + 0x1c]
xor edx, edx
xor ecx, ecx
add esp, 8
mov dl, byte [eax]
mov eax, dword [esp + 0x18]
mov cl, byte [eax]
add edx, ecx
and edx, 0x800000ff
jns 0x10289cd3
dec edx
or edx, 0xffffff00
inc edx
mov eax, dword [esp + 0x20]
and edx, 0xff
mov cl, byte [edx + esi]
mov dl, byte [ebx + eax]
xor dl, cl
mov byte [ebx + eax], dl
mov eax, dword [esp + 0x24]
inc ebx
cmp ebx, eax
jl 0x10289c55
mov dl, byte [esp + 0x28]
mov al, byte [esp + 0x10]
pop edi
mov byte [esi + 0x100], dl
mov byte [esi + 0x101], al
pop ebp
pop esi
pop ebx
add esp, 0xc
ret
mov byte [esi + 0x100], al
mov byte [esi + 0x101], cl
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x1028ac74
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + reloc.KERNEL32.dll_GetCurrentThreadId]
push edi
xor eax, eax
mov al, byte [ecx + 0x10355828]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x103557b8]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x1028ac87
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + reloc.KERNEL32.dll_GetCurrentThreadId], 1
je 0x1028acc8
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x10355860]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x1028acfa
mov bl, byte [esp + ecx + 0x4c]
jmp 0x1028acfe
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x1028acef
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x1028ad1c
mov bl, byte [esp + ecx + 0x4c]
jmp 0x1028ad20
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x1028ad11
xor ecx, ecx
mov eax, 0x103557c8
xor ebx, ebx
mov bl, byte [ecx + 0x10355870]
cmp byte [esp + ebx + 0x14], 0
je 0x1028ad4b
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x10355888]
cmp byte [esp + ebx + 0x14], 0
je 0x1028ad62
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, 0x10355828
jl 0x1028ad32
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x1028acbb
lea edx, [esp + 0x84]
push edx
call fcn.1028ada4
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x1028f2d4
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x103851a8]
xor edx, edx
cmp eax, edx
jne 0x1028f2fa
xor eax, eax
mov byte [eax + 0x103850a8], al
inc eax
cmp eax, 0x100
jl 0x1028f2e2
mov dword [0x103851a8], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x103850a8
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x1028f38b
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x1028f35e
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x1028f32c
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x1028f394
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x1028f3e7
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x1028f3ce
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10295d74
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x102c3a02
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.10296694
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x10337b20
call fcn.102b4ae9
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x10295e07
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.102b4ae9
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x10295e00
push 0
mov ecx, eax
call fcn.1028cf14
mov dword [esi + 0xc], eax
jmp 0x10295e09
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x10295e09
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x103ab577
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
push esp
mov ax, 0xc61f
rdtsc
mov dword [esp], edi
not edx
jmp 0x103ab595
mov dword [esp + 8], eax
rdtsc
jmp 0x103ab561
rdtsc
xchg edi, eax
mov edx, 0xd70de386
xchg ah, al
xchg di, ax
jmp 0x103ab5df
mov ax, word [esp]
mov dword [esp + 4], edi
mov dl, 0x1e
mov edi, 0x601250f5
setne ah
xchg dl, dh
jmp 0x103ab57f
rdtsc
mov dh, ch
mov eax, dword [esp + 0xc]
mov dx, 0x6e84
call fcn.103ab60e
inc esi
int1
ljmp 0x8bcb
mov edx, 0xcb43afc3
mov edi, dword [esp + 4]
xchg al, dh
not edx
rdtsc
mov ah, byte [esp]
jmp 0x103ab5c9

Function at 0x103ac96e
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x103ac38e
jmp 0x103aca42
inc dword [esp + 8]
call fcn.103acb38
call 0x103ac933
pop eax
jmp 0x103ad934
bswap eax
mov dword [esp], edx
rdtsc
rdtsc
jmp 0x103ac999
not ax
not ax
lea edx, [ebx*4]
push ebx
xchg edx, eax
mov eax, dword [esp]
jmp 0x103aca1d
lea eax, [ebx + 0xb4]
pop ebx
lea edx, reloc.KERNEL32.dll_GetCurrentThreadId
not edx
not eax
not dx
call 0x103ac9f1
jne 0x103ac925
pushal
jmp 0x103ac389
pop eax
jmp 0x103aca81
sub eax, 0x4614bf1
jmp 0x103aca8d
call 0x103aca9f
dec ebx
inc ebp
push edx
dec esi
inc ebp
dec esp
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bh, bh
nop
xchg byte [esi - 0x5a16fbc8], ch
add byte [eax], al
add byte [ecx - 0x16dbdbbc], cl
pushal
adc byte [eax], al
add dh, ah
adc dword [eax + reloc.KERNEL32.dll_GetCurrentThreadId], edx
test byte [eax + 0x852c8d], bh
add byte [eax], al
add byte [esi - 0x75], ah
insb byte es:[edi], dx
and al, 1
pop dword [ebx]
jmp 0x103ac950
sub eax, 0x103ac933
add eax, 0xb98c3b7e
pop ebx
add eax, 0x56ae9d6a
mov dword [ebx], eax
mov ebx, dword [ebx]
jmp 0x103ad914

Function at 0x103efea1
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [ecx*4]
lea esp, [esp + 1]
xchg word [esp], bx
jmp 0x103efe8b

Function at 0x438cac
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x438a14
or ebx, ebx
inc edi
add edi, 0x26219980
call fcn.00438ce6
add edi, 0x56dcb96d
or edi, ebx
xor dword [eax], edx
add edi, 0x34b67f97
add eax, 1
or edi, ebx
cmp eax, ecx
jne fcn.00438cac
inc ebx
and edi, ebx
push 0xb52864f4
pop edi
ret

Function at 0x4015a0
Capabilities:
Terminate process

Disassembly:
call fcn.00401940
jmp fcn.004012d0

Function at 0x4015b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x403008]
jne 0x4015ba
repz ret
jmp fcn.004019f0
Function at 0x667010c7
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x71c
push ebx
push esi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call section..txt2
pop ecx
test ax, ax
pop ecx
je 0x66701239
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ebx, 0x104
lea eax, [ebp - 0x414]
push ebx
push eax
push dword [ebp + 8]
call esi
xor edi, edi
lea eax, [ebp - 0x518]
push edi
push edi
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.66765131
push edi
lea eax, [ebp - 0x518]
push edi
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.667650a0
push 0x667a8240
call fcn.66719feb
add esp, 0x2c
cmp eax, edi
mov dword [ebp + 8], eax
je 0x66701239
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.66765370
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
call fcn.66765380
push dword [ebp + 8]
call fcn.66765278
add esp, 0x14
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, edi
mov dword [ebp - 4], eax
je 0x66701239
cmp dword [0x667b9678], edi
jne 0x667011b3
push str.Setup
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
mov dword [0x667b9678], eax
je 0x66701239
lea eax, [ebp - 0x71c]
push ebx
push eax
push edi
call esi
lea eax, [ebp - 0x618]
push edi
push eax
push edi
lea eax, [ebp - 0x71c]
push edi
push eax
call fcn.66765131
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x618]
push eax
call dword [0x667b9678]
add esp, 0x1c
sub eax, 0x64
je 0x66701209
dec eax
je 0x667011f7
dec eax
dec eax
je 0x66701200
mov dword [ebp + 8], 0x8000
jmp 0x66701210
mov dword [ebp + 8], 0x2000
jmp 0x66701210
mov dword [ebp + 8], 0x10000
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x20c]
push eax
call esi
push 0x667a8264
call fcn.66719feb
mov ebx, eax
pop ecx
cmp ebx, edi
jne 0x66701240
mov eax, 0x8000
jmp 0x66701275
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x310]
push eax
call fcn.66765370
lea eax, [ebp - 0x310]
push ebx
push eax
call fcn.66765380
push ebx
call fcn.66765278
add esp, 0x14
lea eax, [ebp - 0x310]
push eax
call esi
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x66701322
Capabilities:
Parse pe header

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
test edx, edx
je 0x6670134a
cmp word [edx], 0x5a4d
jne 0x6670134a
mov ecx, dword [edx + 0x3c]
add ecx, edx
cmp dword [ecx], 0x4550
jne 0x6670134a
mov ax, word [ecx + 0x16]
shr eax, 0xd
and eax, 1
ret
Function at 0x667014fe
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
lea eax, [ebp - 0x104]
push 0x104
push eax
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x66701528
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x66701561
lea eax, [ebp - 0x104]
push str.System
push eax
call fcn.66765380
lea eax, [ebp - 0x104]
push eax
call fcn.66765460
add esp, 0xc
cmp eax, dword [ebp + 0xc]
jae 0x66701561
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call fcn.66765370
pop ecx
pop ecx
push 1
pop esi
mov ax, si
pop esi
leave
ret

Function at 0x66701b8a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x6679420c]
mov ecx, dword [ebp + 8]
push esi
push edi
mov edi, dword [0x66794210]
mov esi, dword [ecx]
mov edx, dword [ecx + 4]
shl eax, 5
test edi, edi
jbe 0x66701c0b
mov ecx, dword [ebp + 0xc]
push ebx
mov dword [ebp + 0xc], edi
mov ebx, dword [ecx + 0xc]
mov dword [ebp - 8], ebx
mov ebx, dword [ecx + 8]
mov dword [ebp - 4], ebx
mov ebx, dword [ecx + 4]
mov ecx, dword [ecx]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
pop ebx
mov ecx, esi
mov edi, esi
shl ecx, 4
add ecx, dword [ebp - 4]
shr edi, 5
add edi, dword [ebp - 8]
xor ecx, edi
lea edi, [eax + esi]
xor ecx, edi
sub edx, ecx
mov ecx, edx
mov edi, edx
shl ecx, 4
add ecx, dword [ebp - 0xc]
shr edi, 5
add edi, dword [ebp - 0x10]
xor ecx, edi
lea edi, [eax + edx]
sub eax, dword [0x6679420c]
xor ecx, edi
sub esi, ecx
dec dword [ebp + 0xc]
jne 0x66701bcb
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
pop edi
mov dword [ecx + 4], edx
pop esi
leave
ret

Function at 0x66701c14
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push esi
mov esi, dword [0x66794210]
push edi
mov ecx, dword [eax]
mov edx, dword [eax + 4]
xor edi, edi
test esi, esi
jbe 0x66701c8f
mov eax, dword [ebp + 0xc]
push ebx
mov dword [ebp + 0xc], esi
mov ebx, dword [eax + 4]
mov dword [ebp - 8], ebx
mov ebx, dword [eax]
mov dword [ebp - 4], ebx
mov ebx, dword [eax + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], eax
pop ebx
add edi, dword [0x6679420c]
mov eax, edx
mov esi, edx
shl eax, 4
add eax, dword [ebp - 4]
shr esi, 5
add esi, dword [ebp - 8]
xor eax, esi
lea esi, [edi + edx]
xor eax, esi
add ecx, eax
mov eax, ecx
mov esi, ecx
shl eax, 4
add eax, dword [ebp - 0xc]
shr esi, 5
add esi, dword [ebp - 0x10]
xor eax, esi
lea esi, [edi + ecx]
xor eax, esi
add edx, eax
dec dword [ebp + 0xc]
jne 0x66701c4f
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], ecx
mov dword [eax + 4], edx
pop esi
leave
ret
Function at 0x66701ff0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x18]
cmp ax, 8
jb 0x6670204d
mov cx, ax
add eax, 0xffff
test cx, cx
je 0x6670204d
mov ecx, dword [esp + 0x1c]
push ebx
push esi
mov esi, dword [esp + 0x1c]
push edi
movzx edi, ax
mov eax, dword [0x667b97b0]
inc edi
mov edx, eax
mov ebx, eax
shr edx, 0x18
shr ebx, 0x10
xor dl, bl
mov ebx, eax
shr ebx, 8
xor dl, bl
xor dl, byte [esi]
xor dl, byte [ecx]
xor dl, al
inc ecx
mov byte [esi], dl
mov eax, dword [0x667b97b0]
movzx edx, dl
add eax, edx
inc esi
dec edi
mov dword [0x667b97b0], eax
jne 0x6670201b
pop edi
pop esi
pop ebx
ret
Function at 0x6670274d
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push ebx
push esi
push edi
or edi, 0xffffffff
xor ebx, ebx
cmp dword [ebp + 8], edi
mov dword [ebp - 8], 0x82
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
jne 0x667027b5
call fcn.6671a14f
lea ecx, [ebp - 0x118]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jbe 0x667027b5
push ebx
push 0x80
push 3
push ebx
push 1
lea eax, [ebp - 0x118]
pop esi
push esi
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, edi
mov dword [ebp + 8], eax
je 0x667027b5
mov dword [ebp - 4], esi
push 0x121
call fcn.6676550f
mov esi, eax
pop ecx
cmp esi, ebx
jne 0x667027e0
cmp word [ebp - 4], 1
jne 0x667027d6
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x84
jmp 0x66702942
cmp dword [ebp + 0xc], ebx
jne 0x66702828
push 0x11
push str.bQrFoEfEgJmFiFsF
push ebx
push dword [ebp + 8]
call fcn.66713338
add esp, 0x10
cmp eax, edi
jne 0x66702816
cmp word [ebp - 4], 1
jne 0x6670280c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x82
jmp 0x66702942
push eax
push dword [ebp + 8]
call fcn.66702cbc
pop ecx
cmp eax, edi
pop ecx
mov dword [ebp + 0xc], eax
je 0x66702839
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, edi
mov dword [ebp - 0x10], eax
jne 0x66702853
cmp word [ebp - 4], 1
jne 0x66702849
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x1f5
jmp 0x66702942
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, eax
cmp ebx, dword [ebp - 0x10]
jae 0x66702912
xor edi, edi
lea eax, [ebp - 0x14]
push edi
push eax
push 0x121
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x66702902
cmp dword [ebp - 0x14], edi
jbe 0x667028b8
imul ebx, ebx, 0x13c6a5
sub ebx, 0x27bcf213
mov eax, ebx
mov ecx, ebx
shr eax, 0x18
shr ecx, 0x10
xor al, cl
mov ecx, ebx
shr ecx, 8
xor al, cl
xor al, byte [edi + esi]
xor al, bl
mov byte [edi + esi], al
inc edi
cmp edi, dword [ebp - 0x14]
jb 0x6670288b
cmp dword [esi], 0xa8726b03
jne 0x6670290b
cmp dword [esi + 4], 0xef01996c
jne 0x6670290b
mov eax, dword [esi + 8]
cmp eax, dword [ebp + 0x10]
jne 0x667028f0
push dword [ebp + 0xc]
push esi
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.66702bcc
add esp, 0x10
cmp eax, 0x82
mov dword [ebp - 8], eax
jne 0x66702912
inc dword [ebp - 0xc]
mov eax, dword [esi + 0x10]
push 0
add eax, dword [esi + 0xc]
push 0
add dword [ebp + 0xc], eax
jmp 0x66702855
mov dword [ebp - 8], 0x1f5
jmp 0x66702912
mov dword [ebp - 8], 0x82
push esi
call fcn.66765278
cmp dword [ebp - 8], 0x82
pop ecx
jne 0x6670292f
cmp dword [ebp - 0xc], 0
jne 0x6670292f
mov dword [ebp - 8], 0x1fd
cmp word [ebp - 4], 1
jne 0x6670293f
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret