joyce8/EMBER2024-capa huggingface dataset:
Function at 0x633840
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0xc], 0
je 0x633856
mov ecx, dword [esi]
mov eax, dword [esi + 0x10]
cmp eax, dword [ecx]
je 0x63387a
mov eax, dword [esi]
push dword [esi + 0xc]
mov eax, dword [eax + 0x18]
push eax
call dword [eax + 4]
mov eax, dword [esi]
mov ecx, dword [eax]
mov dword [esi + 0x10], ecx
mov eax, dword [eax + 0x18]
push ecx
push eax
call dword [eax]
add esp, 0x10
mov dword [esi + 0xc], eax
test eax, eax
je 0x6338d7
cmp dword [esi + 4], 0
je 0x63388a
mov ecx, dword [esi]
mov eax, dword [esi + 8]
cmp eax, dword [ecx + 4]
je 0x6338af
mov eax, dword [esi]
push dword [esi + 4]
mov eax, dword [eax + 0x18]
push eax
call dword [eax + 4]
mov eax, dword [esi]
mov ecx, dword [eax + 4]
mov dword [esi + 8], ecx
mov eax, dword [eax + 0x18]
push ecx
push eax
call dword [eax]
add esp, 0x10
mov dword [esi + 4], eax
test eax, eax
je 0x6338d7
and dword [esi + 0x34], 0
lea eax, [esi + 0x3c]
and dword [esi + 0x38], 0
push eax
call fcn.006368d0
pop ecx
test eax, eax
jne 0x6338d3
lea eax, [esi + 0x40]
push eax
call fcn.006368d0
pop ecx
test eax, eax
je 0x6338da
push 0xc
jmp 0x6338d9
push 2
pop eax
pop esi
pop ebp
ret

Function at 0x633941
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
and dword [esi + 0xc], 0
lea eax, [esi + 4]
push eax
call fcn.006368d0
pop ecx
test eax, eax
jne 0x633977
lea eax, [esi + 8]
push eax
call fcn.006368d0
pop ecx
test eax, eax
jne 0x633977
push esi
push 0x6338dd
push esi
call fcn.00636a4c
add esp, 0xc
pop esi
pop ebp
ret

Function at 0x63666c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor bl, bl
push edi
mov edi, dword [ebp + 0xc]
xor cl, cl
xor eax, eax
mov dword [ebp - 4], esi
or dword [esi], 0xffffffff
mov byte [esi + 4], 0
test edi, edi
je 0x6366e2
mov esi, dword [ebp + 8]
mov dl, byte [eax + esi]
mov ch, cl
xor cl, dl
inc eax
cmp eax, edi
jb 0x63668f
mov esi, dword [ebp - 4]
cmp dl, ch
jne 0x6366e2
test edi, edi
je 0x6366e2
mov ecx, dword [ebp + 8]
xor ebx, ebx
inc ebx
mov edx, edi
mov byte [esi + 4], bl
call fcn.0061f289
mov edx, eax
xor eax, eax
xor ecx, ecx
cmp dword [ecx + 0x84c0a4], edx
jne 0x6366cc
cmp dword [ecx + 0x84c0a0], edi
je 0x6366d8
add ecx, 0xc
inc eax
cmp ecx, 0x48
jb 0x6366bc
or eax, 0xffffffff
mov dword [esi], eax
test eax, eax
jns 0x6366e2
mov byte [esi + 4], 0
pop edi
pop esi
mov al, bl
pop ebx
leave
ret 8

Function at 0x636a4c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
push esi
call fcn.006b2724
mov ecx, dword [ebp + 8]
add esp, 0x18
mov dword [ecx], eax
test eax, eax
jne 0x636a78
call fcn.00636990
mov esi, eax
mov eax, esi
pop esi
leave
ret
Function at 0x63b179
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0x200
jb 0x63b1df
mov edx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [edx], ax
jne 0x63b1df
mov ecx, dword [edx + 0x3c]
cmp ecx, 0x1000
jae 0x63b1df
lea eax, [ecx + 0x200]
cmp eax, dword [ebp + 0xc]
ja 0x63b1df
test cl, 7
jne 0x63b1df
add ecx, edx
cmp dword [ecx], 0x4550
jne 0x63b1df
movzx eax, word [ecx + 4]
sub eax, 0x14c
je 0x63b1f8
sub eax, 0x74
je 0x63b1f1
dec eax
sub eax, 1
je 0x63b1f1
dec eax
sub eax, 1
je 0x63b1ea
sub eax, 0x3c
je 0x63b1e3
sub eax, 0x8464
je 0x63b1f8
xor eax, eax
pop ebp
ret
mov edx, 0x3030401
jmp 0x63b1fd
mov edx, 0x3030701
jmp 0x63b1fd
mov edx, 0x3030501
jmp 0x63b1fd
mov edx, 0x3030103
mov eax, 0x400
cmp word [ecx + 0x14], ax
ja 0x63b1df
movzx eax, word [ecx + 0x18]
mov ecx, 0x10b
cmp ax, cx
je 0x63b220
mov ecx, 0x20b
cmp ax, cx
jne 0x63b1df
mov eax, dword [ebp + 0x10]
mov dword [eax], edx
xor eax, eax
inc eax
pop ebp
ret
Function at 0x640589
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x18], 0
and dword [eax + 0x1c], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
pop ebp
ret

Function at 0x64078b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x90cf34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x44]
push esi
push edi
push 5
mov esi, ecx
push eax
push esi
mov dword [ebp - 0x88], esi
call fcn.0063fbd2
push 5
lea ecx, [ebp - 0x84]
lea eax, [esi + 0x60]
push ecx
push eax
mov dword [ebp - 0x8c], eax
call fcn.0063fbd2
add esp, 0x18
lea edi, [ebp - 0x44]
mov esi, ebx
push 5
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x64082f
lea esi, [ebp - 0x44]
sub esi, ebx
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x88]
call fcn.0063fd01
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x84]
push eax
push dword [ebp - 0x8c]
call fcn.0063fd01
add esp, 0x18
mov ecx, ebx
push 5
pop edx
mov eax, dword [esi + ecx]
xor dword [ecx], eax
lea ecx, [ecx + 4]
sub edx, 1
jne 0x64081d
sub edi, 1
jne 0x6407e9
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0059961f
leave
ret 8
Function at 0x640840
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
mov eax, dword [0x90cf34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
push 0x10
xor eax, eax
mov dword [ebp - 0xbc], ebx
pop ecx
lea edi, [ebp - 0x58]
mov dword [ebp - 0xc0], esi
rep stosd dword es:[edi], eax
mov edi, dword [ebp + 0xc]
cmp edi, 0x40
jbe 0x6408be
lea eax, [ebp - 0xb8]
push eax
call fcn.00640589
push edi
lea eax, [ebp - 0xb8]
push esi
push eax
call fcn.006405bb
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xb8]
push eax
call fcn.0063fc71
add esp, 0x18
xor esi, esi
mov ecx, esi
mov eax, dword [ebp + ecx - 0x18]
bswap eax
mov dword [ebp + ecx - 0x58], eax
add ecx, 4
cmp ecx, 0x14
jb 0x6408aa
jmp 0x6408f5
xor esi, esi
mov ebx, esi
test edi, edi
je 0x6408ef
mov esi, dword [ebp - 0xc0]
mov eax, ebx
mov edx, ebx
and eax, 3
shr edx, 2
push 3
pop ecx
sub ecx, eax
movzx eax, byte [esi + ebx]
shl ecx, 3
shl eax, cl
or dword [ebp + edx*4 - 0x58], eax
inc ebx
cmp ebx, edi
jb 0x6408cc
xor esi, esi
mov ebx, dword [ebp - 0xbc]
mov eax, esi
movups xmm0, xmmword [ebp + eax*4 - 0x58]
pxor xmm0, xmmword [str.6666666666666666jjjjjjjjjjjjjjjj]
movups xmmword [ebp + eax*4 - 0x58], xmm0
add eax, 4
cmp eax, 0x10
jb 0x6408f7
push ebx
call fcn.00640589
push 0x10
lea eax, [ebp - 0x58]
push eax
push ebx
call fcn.0063fc22
add esp, 0x10
movups xmm0, xmmword [ebp + esi*4 - 0x58]
pxor xmm0, xmmword [0x84c760]
movups xmmword [ebp + esi*4 - 0x58], xmm0
add esi, 4
cmp esi, 0x10
jb 0x640926
lea esi, [ebx + 0x60]
push esi
call fcn.00640589
push 0x10
lea eax, [ebp - 0x58]
push eax
push esi
call fcn.0063fc22
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0059961f
leave
ret 8

Function at 0x640969
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x90cf34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
mov eax, ebx
mov esi, ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x48], ecx
push edi
mov edi, dword [ebp + 0xc]
cmp eax, 0x40
jae 0x640a2a
mov byte [ebp + eax - 0x44], bl
inc eax
cmp eax, 0x40
jb 0x640994
cmp edi, 0x40
jbe 0x6409c2
push esi
call fcn.00640589
push edi
push dword [ebp - 0x48]
push esi
call fcn.006405bb
lea eax, [ebp - 0x44]
push eax
push esi
call fcn.0063fc71
add esp, 0x18
jmp 0x6409d4
test edi, edi
je 0x6409d4
push edi
push ecx
lea eax, [ebp - 0x44]
push eax
call fcn.006a3890
add esp, 0xc
mov eax, ebx
xor byte [ebp + eax - 0x44], 0x36
inc eax
cmp eax, 0x40
jb 0x6409d6
push esi
call fcn.00640589
push 0x40
lea eax, [ebp - 0x44]
push eax
push esi
call fcn.006405bb
add esp, 0x10
xor byte [ebp + ebx - 0x44], 0x6a
inc ebx
cmp ebx, 0x40
jb 0x6409f6
add esi, 0x60
push esi
call fcn.00640589
push 0x40
lea eax, [ebp - 0x44]
push eax
push esi
call fcn.006405bb
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0059961f
leave
ret 8
call fcn.00599751
int3
Function at 0x641947
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi + 0x18]
mov dword [esi + 8], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0xc], eax
xor eax, eax
mov word [esi], ax
cmp byte [edi + 1], al
je 0x6419c4
mov bl, byte [edi + 2]
lea eax, [edi + 0x20]
push eax
lea ecx, [esi + 0x24]
call fcn.005fca76
movzx eax, byte [edi + 4]
mov ecx, esi
push eax
push 0x800
call fcn.00641a29
mov eax, dword [edi + 0x10]
mov dword [esi + 0x44], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x68], eax
mov eax, dword [edi + 0x30]
mov dword [esi + 0x6c], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 0x70], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x74], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x78], eax
mov eax, dword [edi + 0x40]
mov dword [esi + 0x7c], eax
mov al, byte [edi + 3]
mov byte [esi + 0x80], al
jmp 0x6419cd
mov ecx, esi
call fcn.0062d4a4
mov bl, al
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0x38]
mov dword [esi + 0x48], ecx
mov ecx, dword [edx + 0x3c]
mov dword [esi + 0x4c], ecx
xor ecx, ecx
mov dword [esi + 0x40], 0x3f
mov byte [esi + 5], cl
test bl, bl
jne 0x6419f8
mov eax, dword [ebp + 0xc]
mov byte [ebp + 0x14], 1
cmp byte [eax + 0x24], cl
jne 0x6419fb
mov byte [ebp + 0x14], cl
push dword [ebp + 0x14]
mov ecx, esi
push 1
call fcn.00641a29
test bl, bl
je 0x641a24
xor eax, eax
mov byte [esi + 4], 0x14
mov word [esi + 2], ax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x1c], eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x644700
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi], 0
je 0x644713
xor eax, eax
jmp 0x64479d
lea eax, [esi + 0x30]
push edi
push eax
call fcn.006368e4
pop ecx
test eax, eax
jne 0x644799
xor edi, edi
lea eax, [esi + 0x14]
inc edi
push eax
mov dword [esi + 0x28], edi
call fcn.006368d0
pop ecx
test eax, eax
jne 0x644799
lea eax, [esi + 0x18]
push eax
call fcn.006368d0
pop ecx
test eax, eax
jne 0x644799
lea eax, [esi + 0x1c]
push eax
call fcn.006368d0
pop ecx
test eax, eax
jne 0x644799
push dword [ebp + 0x14]
lea eax, [esi + 0x20]
push dword [ebp + 0x14]
push eax
call fcn.006369ed
add esp, 0xc
test eax, eax
jne 0x644799
push dword [ebp + 0x14]
push eax
lea eax, [esi + 0x24]
push eax
call fcn.006369ed
add esp, 0xc
test eax, eax
jne 0x644799
push dword [ebp + 0x10]
lea eax, [esi + 0x10]
mov dword [esi + 4], edi
push dword [ebp + 0xc]
push eax
call fcn.00636a4c
add esp, 0xc
test eax, eax
jne 0x644799
mov dword [esi], edi
jmp 0x64479c
push 0xc
pop eax
pop edi
pop esi
pop ebp
ret
Function at 0x64494b
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 4]
cmp dword [ebx], 0
jne 0x644962
push ebx
call fcn.006368d0
pop ecx
test eax, eax
jne 0x6449a4
push edi
lea edi, [esi + 8]
cmp dword [edi], 0
jne 0x644976
push edi
call fcn.006368d0
pop ecx
test eax, eax
jne 0x6449a3
push ebx
call fcn.00636958
push edi
call fcn.00636958
lea eax, [esi + 0xc]
mov byte [esi + 0x10], 0
cmp dword [eax], 0
pop ecx
pop ecx
je 0x644994
xor eax, eax
jmp 0x6449a3
push esi
push 0x64490d
push eax
call fcn.00636a4c
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x64494c
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 4]
cmp dword [ebx], 0
jne 0x644962
push ebx
call fcn.006368d0
pop ecx
test eax, eax
jne 0x6449a4
push edi
lea edi, [esi + 8]
cmp dword [edi], 0
jne 0x644976
push edi
call fcn.006368d0
pop ecx
test eax, eax
jne 0x6449a3
push ebx
call fcn.00636958
push edi
call fcn.00636958
lea eax, [esi + 0xc]
mov byte [esi + 0x10], 0
cmp dword [eax], 0
pop ecx
pop ecx
je 0x644994
xor eax, eax
jmp 0x6449a3
push esi
push 0x64490d
push eax
call fcn.00636a4c
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x654c90
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x654d1c
push esi
call fcn.00669fd0
add esp, 4
test al, al
jne 0x654d1c
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x654cb3
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.006733c0
add esp, 0xc
test eax, eax
je 0x654ce7
sub eax, esi
push eax
push 0x2e
push esi
call fcn.006733c0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x654ce9
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
mov ebx, 0x1505
add edi, esi
cmp esi, edi
jae 0x654d15
mov al, byte [esi]
push eax
call fcn.00663dc0
movsx ecx, al
inc esi
mov eax, ebx
add esp, 4
shl eax, 5
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp esi, edi
jb 0x654cf7
pop edi
movzx eax, bl
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x65f590
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp byte [edi + 0x6f9], 0
je 0x65f627
cmp dword [edi + 0x1a8], 0
je 0x65f5e1
push esi
push 1
push edi
call fcn.0064fd40
push dword [edi + 0x14c]
mov eax, dword [edi + 0x1a8]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push edi
call eax
push 0
push edi
mov esi, eax
call fcn.0064fd40
add esp, 0x24
mov eax, esi
pop esi
pop edi
ret
mov edx, dword [esp + 0xc]
mov ecx, edx
sub ecx, 0
je 0x65f5f6
sub ecx, 1
je 0x65f5f6
sub ecx, 1
jne 0x65f627
push dword [edi + 0x148]
lea eax, [edx*2 + 0x84f828]
push 1
add eax, edx
push 2
push eax
call fcn.006ad3ae
push dword [edi + 0x148]
push 1
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call fcn.006ad3ae
add esp, 0x20
xor eax, eax
pop edi
ret
Function at 0x674470
Capabilities:
Create thread

Disassembly:
push 0
push 0
push dword [esp + 0x10]
push dword [esp + 0x10]
push 0
push 0
call fcn.006b2724
mov ecx, eax
add esp, 0x18
xor eax, eax
test ecx, ecx
je 0x674496
cmp ecx, 0xffffffff
cmovne eax, ecx
ret
Function at 0x697bf0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push dword [esp + 0x24]
call fcn.00661fd0
mov edx, dword [ebp + 0xc]
mov ebx, eax
mov ecx, dword [ebp + 0x14]
mov dword [esp + 0x14], ebx
lea ecx, [ecx + edx*2]
add ecx, 0xc
push ecx
call dword [0x90d0e8]
mov esi, eax
add esp, 8
test esi, esi
je 0x697d72
lea ecx, [esi + 0xc]
mov dword [esi], ebp
mov dword [esi + 4], ecx
mov eax, dword [ebp + 0xc]
add eax, ecx
mov dword [esi + 8], eax
push edi
lea edi, [ebp + 4]
cmp ebx, dword [ebp + 0x10]
jbe 0x697c72
mov eax, dword [ebp]
push ecx
call eax
mov eax, dword [esp + 0x28]
push ebx
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
mov eax, dword [esi + 8]
add eax, dword [ebp + 0xc]
push dword [esi + 4]
mov dword [esp + 0x38], eax
push eax
mov eax, dword [ebp + 8]
call eax
mov eax, dword [ebp + 0x14]
add esp, 0x18
mov dword [esp + 0x14], eax
push dword [esi + 4]
mov eax, dword [ebp]
call eax
push dword [esi + 8]
mov eax, dword [ebp]
call eax
mov eax, dword [esp + 0x1c]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x697ce3
mov ebp, dword [esp + 0x24]
mov ebx, eax
mov dword [esp + 0x18], eax
nop dword [eax]
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x13], al
lea eax, [esp + 0x13]
push 1
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x1f], al
lea eax, [esp + 0x1f]
push 1
push eax
push dword [esi + 8]
mov eax, dword [edi]
call eax
add esp, 0x18
sub ebx, 1
jne 0x697ca0
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x20]
cmp ebx, dword [ebp + 0x10]
jae 0x697d15
nop dword [eax + eax]
mov eax, dword [edi]
push 1
push 0x858324
push dword [esi + 4]
call eax
mov eax, dword [edi]
push 1
push 0x858325
push dword [esi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [ebp + 0x10]
jb 0x697cf0
push dword [esp + 0x30]
call fcn.00661fd0
mov ecx, dword [esi]
push eax
push dword [esp + 0x34]
push dword [esi + 4]
mov eax, dword [ecx + 4]
call eax
mov edi, dword [esp + 0x44]
add esp, 0x10
mov ebx, dword [esi]
test edi, edi
jne 0x697d40
mov edi, dword [ebx + 0xc]
add edi, dword [esi + 8]
push dword [esi + 4]
mov eax, dword [ebx + 8]
push edi
call eax
push dword [ebx + 0x14]
mov eax, dword [ebx + 4]
push edi
push dword [esi + 8]
call eax
push dword [esi + 8]
mov eax, dword [ebx + 8]
push edi
call eax
push esi
call dword [0x90d0ec]
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
pop esi
pop ebp
mov eax, 0x1b
pop ebx
add esp, 0xc
ret
Function at 0x69fee0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0069fef0
Function at 0x6c8f6b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.006c8dea
Function at 0x6ed9f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc
call fcn.0059a880
mov eax, dword [esp + 0x10]
push ebx
push esi
test byte [eax + 0x10], 4
mov esi, dword [eax + 4]
lea ebx, [esi - 1]
je 0x6eda97
mov ecx, dword [eax + 8]
xor edx, edx
push ebp
xor ebp, ebp
mov dword [esp + 0xc], 0
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], ecx
test ecx, ecx
jle 0x6eda80
mov ecx, dword [eax]
mov dword [esp + 0x10], ecx
push edi
push dword [ecx]
mov eax, ebp
xor eax, ebx
lea edi, [eax - 1]
not eax
shr edi, 0x1f
shr eax, 0x1f
and edi, eax
neg edi
mov esi, edi
or esi, dword [esp + 0x14]
call fcn.006edac0
mov ecx, dword [esp + 0x18]
mov edx, esi
not edx
mov dword [esp + 0x14], esi
and edx, 0x20
and eax, edi
add edx, dword [esp + 0x24]
inc ebp
add edx, eax
add ecx, 4
add esp, 4
mov dword [esp + 0x20], edx
mov dword [esp + 0x14], ecx
cmp ebp, dword [esp + 0x18]
jl 0x6eda33
pop edi
mov eax, ebx
shr ebx, 0x1f
not eax
dec eax
shr eax, 0x1f
and eax, ebx
pop ebp
dec eax
pop esi
and eax, edx
pop ebx
add esp, 0xc
ret
test esi, esi
jne 0x6edaa3
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret
mov eax, dword [eax]
push dword [eax + esi*4 - 4]
call fcn.006edac0
add esp, 4
shl esi, 5
add esi, 0xffffffe0
add eax, esi
pop esi
pop ebx
add esp, 0xc
ret

Function at 0x70a730
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
xor dl, dl
test esi, esi
je 0x70a757
mov eax, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
sub edi, eax
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
or dl, cl
sub esi, 1
jne 0x70a746
pop edi
movzx eax, dl
pop esi
ret
Function at 0x7f2aa0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.007f2ab0

Function at 0x7f2d30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.007f2d40
Function at 0x1000b197
Capabilities:
Parse pe header

Disassembly:
push esi
mov esi, ecx
test si, si
jne 0x1000b24c
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x1000b24c
mov edx, dword [esi + 0x3c]
test dl, 3
jne 0x1000b24c
cmp dword [edx + esi], 0x4550
jne 0x1000b24c
cmp dword [edx + esi + 0x74], 6
jb 0x1000b24c
push ebx
mov ebx, dword [edx + esi + 0x50]
push edi
mov edi, dword [edx + esi + 0xa8]
lea eax, [ebx - 1]
lea ecx, [edi - 1]
cmp ecx, eax
jae 0x1000b24a
mov eax, dword [edx + esi + 0xac]
mov ecx, ebx
sub ecx, edi
cmp eax, ecx
ja 0x1000b24a
xor edx, edx
add edi, esi
push 0x1c
pop ecx
div ecx
mov edx, eax
test edx, edx
je 0x1000b24a
imul ecx, edx, 0x1c
add ecx, 0x14
add ecx, edi
lea ecx, [ecx - 0x1c]
dec edx
cmp dword [ecx - 8], 2
lea edi, [ecx - 0x14]
jne 0x1000b228
cmp dword [ecx], ebx
jae 0x1000b228
mov eax, ebx
sub eax, dword [ecx]
cmp dword [ecx - 4], eax
jbe 0x1000b22e
test edx, edx
jne 0x1000b20e
jmp 0x1000b24a
push 0x1c
push edi
call dword [sym.imp.kernel32.dll_VirtualLock]
test eax, eax
je 0x1000b24a
mov eax, dword [edi + 0x14]
push dword [edi + 0x10]
add eax, esi
push eax
call dword [sym.imp.kernel32.dll_VirtualLock]
pop edi
pop ebx
pop esi
ret

Function at 0x1000c446
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x1000c455
pop dword [ebp - 0x3c]
mov eax, 0x1000c455
sub dword [ebp - 0x3c], eax
push 0x40
push 0x1000
push 0x33d89
push 0
mov eax, 0x99d4092a
sub eax, 0x89d2c8c6
add eax, dword [ebp - 0x3c]
call dword [eax]
mov ecx, 0x337b
mov edx, eax
mov edi, 0x10018600
add edi, dword [ebp - 0x3c]
mov esi, 0xa0407240
sub esi, 0x12126e95
sub dword [ebp - 0x30], 0x26c5f21c
mov ebx, dword [edi]
xor dword [ebp - 0x38], 0xca4c5aab
add ebx, esi
add dword [ebp - 0x18], 0xb330d6e5
mov dword [edx], ebx
add dword [ebp - 0x34], ebx
add edx, 0xcd1c4026
sub edx, 0xcd1c4022
add edi, 4
loop 0x1000c4a3
add eax, 0x3384b65e
add eax, 0xcc7c0a61
mov ebx, eax
add eax, 0x8eac57e1
sub eax, 0x8eac57dc
mov ecx, 0x3c832d57
sub ecx, 0x2c832d57
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x10001065
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x10015450]
xor eax, ebp
mov dword [ebp + 0x8c], eax
mov eax, dword [ebp + 0xa4]
push esi
mov esi, dword [ebp + 0x98]
push 0x104
lea ecx, [ebp - 0x78]
push ecx
push 0x64
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
and dword [ebp - 0x7c], 0
lea eax, [ebp - 0x7c]
push eax
push str.SoftwareCLASSESCLSID280A8F40_E382_11d2_B561_00A0C92E6848
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
cmp dword [ebp - 0x7c], 0
jne 0x100010cc
push str.SoftwareInteligfx
push esi
call fcn.100082b0
pop ecx
pop ecx
jmp 0x100010ee
mov eax, dword [ebp + 0x9c]
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x80]
push eax
push esi
push 0
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.10008140
pop ecx
test eax, eax
je 0x10001111
push 0x10011404
push esi
call fcn.100082c0
lea eax, [ebp - 0x78]
push eax
push esi
call fcn.100082c0
add esp, 0x10
push esi
call fcn.10008140
pop ecx
mov ecx, dword [ebp + 0x8c]
xor ecx, ebp
pop esi
call fcn.100083a8
add ebp, 0x90
leave
ret

Function at 0x1000112e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10015450]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push str.SoftwareCLASSESCLSID280A8F40_E382_11d2_B561_00A0C92E6848
xor edi, edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x100011a8
cmp dword [ebp - 8], edi
jne 0x10001183
push str.SoftwareInteligfx
push esi
call fcn.100082b0
push esi
call fcn.10008140
add esp, 0xc
mov edi, eax
jmp 0x100011a8
lea eax, [ebp - 0xc]
push eax
push esi
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x1000119f
push esi
call fcn.10008140
pop ecx
mov edi, eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.100083a8
leave
ret

Function at 0x1000121b
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push edi
movzx edi, word [ebp + 8]
push 0
push 0
push 3
push edi
call esi
mov ebx, eax
lea eax, [ebx + 1]
push eax
call fcn.100066fe
pop ecx
push ebx
push eax
push 3
push edi
mov dword [ebp + 8], eax
call esi
mov esi, dword [ebp + 8]
push 0x1001145c
push esi
call fcn.100083c0
pop ecx
pop ecx
test eax, eax
jne 0x1000126b
push 0x100112d8
push esi
call fcn.100082b0
pop ecx
pop ecx
push esi
push dword [ebp + 0xc]
call fcn.100082b0
push esi
call fcn.1000120e
add esp, 0xc
pop edi
pop esi
pop ebx
pop ebp
ret