joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6f2d30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea edi, [ebp - 4]
mov ebx, edx
test ebx, ebx
jle 0x6f2d64
call fcn.006f2ce0
mov esi, eax
and esi, 0xff
mov eax, dword [edi]
mov al, byte [eax]
call fcn.006f2be0
mov eax, esi
mov edx, dword [edi]
xor byte [edx], al
inc dword [edi]
dec ebx
jne 0x6f2d43
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x6f2e58
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov eax, dword [ebp + 8]
call fcn.00405614
xor eax, eax
push ebp
push 0x6f2f07
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
cmp dword [ebp + 8], 0
je 0x6f2ef1
mov eax, dword [ebp + 8]
call fcn.006f2c44
test eax, eax
jne 0x6f2ef1
xor ebx, ebx
call fcn.006f2ce0
xor edx, edx
mov dl, bl
xor al, byte [esi + edx + 0xc]
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
call fcn.006f2be0
xor eax, eax
mov al, bl
mov dl, byte [ebp - 5]
mov byte [esi + eax], dl
inc ebx
cmp bl, 0xc
jne 0x6f2e94
mov bl, byte [esi + 0xb]
and di, 8
cmp di, 8
je 0x6f2edf
mov eax, dword [ebp - 4]
call fcn.00408d20
call fcn.00408d3c
cmp bl, al
sete al
mov ebx, eax
jmp 0x6f2ef1
xor eax, eax
mov al, bl
movzx edx, word [ebp + 0xc]
shr edx, 8
cmp eax, edx
sete al
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6f2f0e
lea eax, [ebp + 8]
call fcn.00405154
ret

Function at 0x6f4fbc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405614
xor eax, eax
push ebp
push 0x6f500d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00405624
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x6f4ff1
test al, 0x10
jne 0x6f4ff5
xor ebx, ebx
jmp 0x6f4ff7
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6f5014
lea eax, [ebp - 4]
call fcn.00405154
ret

Function at 0x6f52d8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push esp
push 0x103
call sub.kernel32.dll_GetTempPathA
test eax, eax
je 0x6f5300
mov eax, ebx
mov edx, esp
mov ecx, 0x104
call fcn.004053d4
jmp 0x6f5309
mov eax, ebx
xor edx, edx
call fcn.004057b0
add esp, 0x104
pop ebx
ret

Function at 0x6f5570
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405614
xor eax, eax
push ebp
push 0x6f55c8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00405624
push eax
call sub.kernel32.dll_GetFileAttributesA
test al, 0x10
jne 0x6f55ac
test al, 1
jne 0x6f55ac
test al, 4
jne 0x6f55ac
test al, 2
je 0x6f55b0
xor ebx, ebx
jmp 0x6f55b2
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6f55cf
lea eax, [ebp - 4]
call fcn.00405154
ret
Function at 0x6f592c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00405624
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x6f5945
test al, 0x10
jne 0x6f5949
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x6f5f24
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x6f5f36
add esp, 0xfffffff0
call fcn.0040457c
mov esi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov eax, dword [ebp + 0xc]
call fcn.00405614
xor eax, eax
push ebp
push 0x6f6003
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebx + 0x68], esi
mov eax, esi
mov dword [ebx + 0x34], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa0]
mov dword [ebx + 0x30], edx
mov dword [ebx + 0x3c], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa4]
mov dword [ebx + 0x38], edx
mov dword [ebx + 0x44], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa8]
mov dword [ebx + 0x40], edx
mov dword [ebx + 0x2c], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xac]
mov dword [ebx + 0x28], edx
mov eax, dword [eax + 0x558]
mov dword [ebx + 0x6c], eax
mov ax, word [ebp + 8]
and ax, 0xffff
cmp ax, 0xffff
jne 0x6f5fc5
lea eax, [ebx + 0x74]
mov edx, 0x6f6034
call fcn.004051a8
lea eax, [ebx + 0x64]
mov edx, dword [ebp + 0xc]
call fcn.004051a8
mov byte [ebx + 0x60], 1
jmp 0x6f5fdc
lea eax, [ebx + 0x74]
mov edx, dword [ebp + 0xc]
call fcn.004051a8
lea eax, [ebx + 0x64]
call fcn.00405154
mov byte [ebx + 0x60], 0
xor edx, edx
mov eax, ebx
call fcn.004041d4
mov ax, word [ebp + 8]
mov word [ebx + 0x70], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6f600a
lea eax, [ebp + 0xc]
call fcn.00405154
ret
Function at 0x6f63b4
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
test dl, dl
je 0x6f63cd
add esp, 0xfffffff0
call fcn.0040457c
mov esi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov eax, dword [ebp + 0x10]
call fcn.00405614
mov eax, dword [ebp + 0xc]
call fcn.00405614
xor eax, eax
push ebp
push 0x6f64c4
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebx + 0x58], esi
mov eax, esi
mov dword [ebx + 0x34], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa0]
mov dword [ebx + 0x30], edx
mov dword [ebx + 0x3c], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa4]
mov dword [ebx + 0x38], edx
mov dword [ebx + 0x44], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa8]
mov dword [ebx + 0x40], edx
mov dword [ebx + 0x2c], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xac]
mov dword [ebx + 0x28], edx
mov eax, dword [eax + 0x558]
mov dword [ebx + 0x5c], eax
mov ax, word [ebp + 8]
and ax, 0xffff
cmp ax, 0xffff
jne 0x6f646d
lea edx, [ebp - 8]
mov eax, dword [ebp + 0x10]
call fcn.006eb678
mov edx, dword [ebp - 8]
lea eax, [ebx + 0x64]
call fcn.004051a8
lea eax, [ebx + 0x54]
mov edx, dword [ebp + 0xc]
call fcn.004051a8
mov byte [ebx + 0x50], 1
jmp 0x6f6484
lea eax, [ebx + 0x64]
mov edx, dword [ebp + 0xc]
call fcn.004051a8
lea eax, [ebx + 0x54]
call fcn.00405154
mov byte [ebx + 0x50], 0
mov ax, word [ebp + 8]
push eax
mov ecx, dword [ebx + 0x64]
xor edx, edx
mov eax, ebx
call fcn.006f3618
mov ax, word [ebp + 8]
mov word [ebx + 0x62], ax
mov byte [ebx + 0x60], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6f64cb
lea eax, [ebp - 8]
call fcn.00405154
lea eax, [ebp + 0xc]
mov edx, 2
call fcn.00405178
ret
Function at 0x716c78
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
test dl, dl
je 0x716c87
add esp, 0xfffffff0
call fcn.0040457c
mov esi, ecx
mov ebx, edx
mov edi, eax
mov dword [edi + 4], esi
push esi
call sub.user32.dll_GetKeyState
and ax, 0xff
movzx eax, ax
mov dword [edi + 8], eax
mov eax, edi
test bl, bl
je 0x716cb5
call fcn.004045d4
pop dword fs:[0]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x71af40
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffd0
mov dword [esp], edx
mov bx, 0x22
lea edx, [esp + 0xc]
mov byte [edx], 0
inc edx
dec bx
jne 0x71af51
mov bx, 8
movzx edx, bx
mov ecx, dword [eax + edx*4 - 4]
sub dword [eax + edx*4], ecx
dec ebx
cmp bx, 1
jne 0x71af5e
mov di, 8
mov word [esp + 6], 0
xor ebx, ebx
mov edx, 0x80000000
movzx ecx, bx
test dword [eax + ecx*4], edx
je 0x71af90
mov byte [esp + 8], 1
jmp 0x71af95
mov byte [esp + 8], 0
xor esi, esi
movzx ecx, bx
test dword [eax + ecx*4], edx
je 0x71afa6
cmp byte [esp + 8], 0
je 0x71afbe
movzx ecx, bx
test dword [eax + ecx*4], edx
jne 0x71afb5
cmp byte [esp + 8], 0
jne 0x71afbe
shr edx, 1
inc esi
cmp si, 0x20
jne 0x71af97
movzx edx, si
shr edx, 2
mov cl, 7
sub cl, dl
mov byte [esp + 9], cl
xor edx, edx
mov dl, byte [esp + 9]
inc edx
shl edx, 2
mov word [esp + 4], dx
mov dl, byte [esp + 9]
add edx, edx
add dl, byte [esp + 8]
mov byte [esp + 9], dl
xor esi, esi
movzx edx, si
mov ecx, 3
sub ecx, edx
xor edx, edx
mov dl, byte [esp + 9]
shr edx, cl
and dl, 1
movzx ecx, di
dec ecx
shl dl, cl
movzx ecx, word [esp + 6]
or byte [esp + ecx + 0xc], dl
dec edi
test di, di
jne 0x71b01e
mov di, 8
inc word [esp + 6]
inc esi
cmp si, 4
jne 0x71afeb
mov dx, word [esp + 4]
dec edx
test dx, dx
jb 0x71b074
inc edx
mov word [esp + 0xa], dx
xor esi, esi
movzx ecx, word [esp + 4]
movzx edx, si
sub ecx, edx
dec ecx
movzx edx, bx
mov edx, dword [eax + edx*4]
shr edx, cl
and dl, 1
movzx ecx, di
dec ecx
shl dl, cl
movzx ecx, word [esp + 6]
or byte [esp + ecx + 0xc], dl
dec edi
test di, di
jne 0x71b06c
mov di, 8
inc word [esp + 6]
inc esi
dec word [esp + 0xa]
jne 0x71b038
inc ebx
cmp bx, 9
jne 0x71af7c
cmp di, 8
je 0x71b08a
inc word [esp + 6]
xor ebx, ebx
movzx eax, bx
mov edx, dword [esp]
mov byte [edx + eax], 0
inc ebx
cmp bx, 0x28
jne 0x71b08c
call fcn.0071af34
mov edx, dword [esp]
mov byte [edx], al
call fcn.0071af34
and eax, 0xff
movzx edx, word [esp + 6]
mov ecx, 0x26
sub ecx, edx
cdq
idiv ecx
add dl, 2
mov byte [esp + 9], dl
mov eax, dword [esp]
mov al, byte [eax]
sub al, byte [esp + 9]
mov edx, dword [esp]
mov byte [edx + 1], al
xor eax, eax
mov al, byte [esp + 9]
mov ebx, eax
add ax, word [esp + 6]
dec eax
sub ax, bx
jb 0x71b101
inc eax
mov word [esp + 0xa], ax
movzx eax, bx
mov edx, dword [esp]
mov byte [edx + eax], 1
inc ebx
dec word [esp + 0xa]
jne 0x71b0ef
mov bx, 2
movzx esi, bx
mov eax, dword [esp]
cmp byte [eax + esi], 0
jne 0x71b11c
call fcn.0071af34
mov edx, dword [esp]
mov byte [edx + esi], al
inc ebx
cmp bx, 0x28
jne 0x71b105
mov ax, word [esp + 6]
dec eax
test ax, ax
jb 0x71b157
inc eax
mov word [esp + 0xa], ax
xor ebx, ebx
lea eax, [esp + 0xc]
xor edx, edx
mov dl, byte [esp + 9]
movzx ecx, bx
add edx, ecx
mov ecx, dword [esp]
add ecx, edx
mov dl, byte [eax]
mov byte [ecx], dl
inc ebx
inc eax
dec word [esp + 0xa]
jne 0x71b13a
mov bx, 1
movzx eax, bx
mov edx, dword [esp]
mov dl, byte [edx + eax - 1]
mov ecx, dword [esp]
xor byte [ecx + eax], dl
inc ebx
cmp bx, 0x28
jne 0x71b15b
add esp, 0x30
pop edi
pop esi
pop ebx
ret
Function at 0x71b8a4
Capabilities:
Encrypt data using des

Disassembly:
push ebx
mov ecx, edx
and cl, 0x20
mov ebx, edx
and bl, 0x1e
and ebx, 0xff
shr ebx, 1
or cl, bl
and dl, 1
shl edx, 4
or cl, dl
mov edx, ecx
and edx, 0xff
and eax, 0xff
shl eax, 3
lea eax, [eax*8 + 0x74b8ac]
mov al, byte [eax + edx]
and al, 0xf
pop ebx
ret

Function at 0x71b8e0
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
test ebx, ebx
js 0x71b8f8
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x71b8f1
mov eax, esp
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 7
call fcn.004037f0
xor edx, edx
mov eax, 0x74baac
mov bl, byte [eax]
mov ecx, ebx
and cl, 7
and ecx, 0xff
push ecx
mov ecx, 7
pop esi
sub ecx, esi
mov esi, 1
shl esi, cl
xor ecx, ecx
mov cl, bl
shr ecx, 3
mov ebx, dword [ebp - 4]
movzx ecx, byte [ebx + ecx]
and esi, ecx
je 0x71b962
mov ecx, edx
and ecx, 7
push ecx
mov ecx, 7
pop ebx
sub ecx, ebx
mov bl, 1
shl bl, cl
mov ecx, edx
shr ecx, 3
mov esi, dword [ebp - 8]
or byte [esi + ecx], bl
inc edx
inc eax
cmp edx, 0x38
jne 0x71b916
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x71bba0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov ebx, dword [ebp + 0x10]
test ebx, ebx
js 0x71bbb9
shr ebx, 2
mov esi, dword [ecx + ebx*4]
dec ebx
push esi
jns 0x71bbb2
mov ecx, esp
mov ebx, edx
test ebx, ebx
js 0x71bbcb
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x71bbc4
mov eax, esp
mov dword [ebp - 4], ecx
push 5
lea ecx, [ebp - 0xa]
call fcn.0071b794
mov ebx, 6
mov eax, dword [ebp - 4]
lea edx, [ebp - 0xa]
mov cl, byte [eax]
xor byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x71bbe5
mov al, byte [ebp - 0xa]
xor edx, edx
mov dl, al
shr edx, 2
mov byte [ebp - 0x12], dl
and al, 3
shl eax, 4
mov dl, byte [ebp - 9]
xor ecx, ecx
mov cl, dl
shr ecx, 4
or al, cl
mov byte [ebp - 0x11], al
and dl, 0xf
shl edx, 2
mov al, byte [ebp - 8]
xor ecx, ecx
mov cl, al
shr ecx, 6
or dl, cl
mov byte [ebp - 0x10], dl
and al, 0x3f
mov byte [ebp - 0xf], al
mov al, byte [ebp - 7]
xor edx, edx
mov dl, al
shr edx, 2
mov byte [ebp - 0xe], dl
and al, 3
shl eax, 4
xor edx, edx
mov dl, byte [ebp - 6]
shr edx, 4
or al, dl
mov byte [ebp - 0xd], al
mov al, byte [ebp - 6]
and al, 0xf
shl eax, 2
xor edx, edx
mov dl, byte [ebp - 5]
shr edx, 6
or al, dl
mov byte [ebp - 0xc], al
mov al, byte [ebp - 5]
and al, 0x3f
mov byte [ebp - 0xb], al
xor ebx, ebx
lea esi, [ebp - 0x12]
mov eax, ebx
mov dl, byte [esi]
call fcn.0071b8a4
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 8
jne 0x71bc6a
mov ebx, 4
lea eax, [ebp - 0x12]
lea edx, [ebp - 0xa]
mov cl, byte [eax]
shl ecx, 4
or cl, byte [eax + 1]
mov byte [edx], cl
inc edx
add eax, 2
dec ebx
jne 0x71bc87
lea eax, [ebp - 0xa]
mov edx, 5
call fcn.0071b824
mov ebx, 4
lea eax, [ebp - 0xa]
mov edx, dword [ebp + 0xc]
mov cl, byte [eax]
mov byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x71bcb0
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x71bcc8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x71bce1
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x71bcda
mov edx, esp
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebp - 8], 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dl, byte [eax]
mov byte [ecx], dl
inc ecx
inc eax
dec dword [ebp - 8]
jne 0x71bcf5
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0071b68c
test bl, bl
jne 0x71bdc8
mov dword [ebp - 8], 0x10
mov dword [ebp - 0x14], 0x767e04
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x71bd2c
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x71bd40
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0071bba0
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov bl, byte [edx]
xor bl, byte [esi]
mov byte [ecx], bl
inc ecx
inc esi
inc edx
dec eax
jne 0x71bd72
add dword [ebp - 0x14], 6
dec dword [ebp - 8]
jne 0x71bd21
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ecx, [ebp - 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x71bd95
mov eax, 4
mov edx, dword [ebp + 0xc]
mov cl, byte [edx]
mov byte [edx + 4], cl
inc edx
dec eax
jne 0x71bda6
mov eax, 4
lea edx, [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x71bdba
jmp 0x71be83
cmp bl, 1
jne 0x71be83
mov dword [ebp - 8], 0xfffffff0
mov ebx, 0x767e5e
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x71bde8
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x71bdfc
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov ecx, ebx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0071bba0
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov dword [ebp - 0x18], ecx
mov cl, byte [edx]
xor cl, byte [esi]
mov edi, dword [ebp - 0x18]
mov byte [edi], cl
inc dword [ebp - 0x18]
inc esi
inc edx
dec eax
jne 0x71be2e
sub ebx, 6
inc dword [ebp - 8]
jne 0x71bddd
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ebx, [ebp - 0xc]
mov cl, byte [edx]
mov byte [ebx], cl
inc ebx
inc edx
dec eax
jne 0x71be55
mov eax, 4
mov ebx, dword [ebp + 0xc]
mov dl, byte [ebx]
mov byte [ebx + 4], dl
inc ebx
dec eax
jne 0x71be66
mov eax, 4
lea ebx, [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov cl, byte [ebx]
mov byte [edx], cl
inc edx
inc ebx
dec eax
jne 0x71be7a
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0071b710
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 8
Function at 0x71cdb0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
dec edx
test edx, edx
jl 0x71cdcb
inc edx
xor ecx, ecx
mov bx, word [eax + 0x58]
mov esi, 0x767e70
xor word [esi + ecx*2], bx
inc ecx
dec edx
jne 0x71cdba
pop esi
pop ebx
ret

Function at 0x71cdd0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
dec edx
test edx, edx
jl 0x71cdeb
inc edx
xor ecx, ecx
mov bx, word [eax + 0x58]
mov esi, 0x767e70
xor word [esi + ecx*2], bx
inc ecx
dec edx
jne 0x71cdda
pop esi
pop ebx
ret

Function at 0x71e5c4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov edi, eax
xor eax, eax
push ebp
push 0x71e698
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
xor ecx, ecx
mov edx, 0x10
call fcn.004037f0
mov ebx, 1
lea esi, [ebp - 0x10]
lea eax, [ebp - 0x14]
call fcn.0071dd8c
mov eax, dword [ebp - 0x14]
mov al, byte [eax + ebx - 1]
mov edx, dword [edi + 0x34]
xor al, byte [edx + ebx - 1]
mov byte [esi], al
lea eax, [ebp - 0x18]
call fcn.0071dd8c
mov eax, dword [ebp - 0x18]
mov al, byte [eax + ebx - 1]
mov edx, 9
sub edx, ebx
mov ecx, dword [edi + 0x34]
xor al, byte [ecx + edx - 1]
mov edx, 0x10
sub edx, ebx
mov byte [ebp + edx - 0x10], al
inc ebx
inc esi
cmp ebx, 9
jne 0x71e5ff
lea eax, [ebp - 0x1c]
call fcn.0071dd48
mov eax, dword [ebp - 0x1c]
call fcn.00405624
push eax
push 0
mov eax, dword [edi + 0x6c]
push eax
call dword [fcn.00767efc]
mov word [0x767ee0], ax
cmp word [0x767ee0], 0
je 0x71e67d
mov eax, 9
call fcn.00405098
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x71e69f
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00405178
ret
Function at 0x72133c
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x721344
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x721536
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x72154c
mov eax, esi
call fcn.0071ef24
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.004051a8
lea ecx, [ebp - 0x10]
mov edx, 0x721560
mov eax, esi
call fcn.0071ef24
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.004051a8
lea ecx, [ebp - 0x14]
mov edx, 0x721578
mov eax, esi
call fcn.0071ef24
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.004051a8
lea ecx, [ebp - 0x18]
mov edx, 0x721594
mov eax, esi
call fcn.0071ef24
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.004051a8
lea ecx, [ebp - 0x1c]
mov edx, 0x7215b0
mov eax, esi
call fcn.0071ef24
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.004051a8
lea ecx, [ebp - 0x24]
mov edx, 0x7215c8
mov eax, esi
call fcn.0071ef24
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.0040a654
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.0040ae28
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x7215e0
mov eax, esi
call fcn.0071ef24
mov eax, dword [ebp - 0x28]
call fcn.004ca230
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x7215f0
mov eax, esi
call fcn.0071ef24
mov eax, dword [ebp - 0x2c]
call fcn.004ca230
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x721608
mov eax, esi
call fcn.0071ef24
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.0040ae28
inc eax
je 0x7214d9
lea ecx, [ebp - 0x34]
mov edx, 0x721608
mov eax, esi
call fcn.0071ef24
mov eax, dword [ebp - 0x34]
call fcn.0040ade8
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040d59c
fstp qword [ebp - 0x3c]
wait
call fcn.0040da54
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x7214f4
lea ecx, [ebp - 0x40]
mov edx, 0x721608
mov eax, esi
call fcn.0071ef24
mov eax, dword [ebp - 0x40]
call fcn.004ca230
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x721618
mov eax, esi
call fcn.0071ef24
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.004051a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x72153d
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00405178
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00405178
ret
Function at 0x72c708
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x72c762
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.0072c6f8
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004c8d38
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.004c8938
mov edx, dword [esi + 0xc]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x72c769
lea eax, [ebp - 4]
call fcn.00405154
ret

Function at 0x73bd60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push ebx
xor edx, edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x73bf1e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x20]
call fcn.004c2df4
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xb
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea edx, [ebp - 0x1c]
mov ecx, 1
mov eax, 0x73bf34
call fcn.0040c6cc
xor eax, eax
push ebp
push 0x73bee7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x3c]
call fcn.004c2df4
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0xb
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0xb
call fcn.0040da54
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x40]
mov eax, 0x73bf5c
call fcn.0040e92c
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0xb
lea edx, [ebp - 0x38]
mov ecx, 2
mov eax, 0x73bf74
call fcn.0040c6cc
lea eax, [ebp - 0x44]
call fcn.004c2df4
mov edx, dword [ebp - 0x44]
lea eax, [ebp - 4]
mov ecx, 0x73bfa0
call fcn.00405470
lea eax, [ebp - 0x48]
push eax
call fcn.00733f6c
mov eax, dword [eax + 0x410]
mov dword [ebp - 0x78], eax
mov byte [ebp - 0x74], 0xb
call fcn.00733f6c
mov eax, dword [eax + 0x40c]
mov dword [ebp - 0x70], eax
mov byte [ebp - 0x6c], 0xb
call fcn.00733f6c
mov eax, dword [eax + 0x414]
mov dword [ebp - 0x68], eax
mov byte [ebp - 0x64], 0xb
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov dword [ebp - 0x60], eax
mov byte [ebp - 0x5c], 0xb
mov dword [ebp - 0x58], ebx
mov byte [ebp - 0x54], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x50], eax
mov byte [ebp - 0x4c], 0xb
lea edx, [ebp - 0x78]
mov ecx, 5
mov eax, 0x73bfb4
call fcn.0040c6cc
mov edx, dword [ebp - 0x48]
lea eax, [ebp - 4]
call fcn.0040542c
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00623264
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x73beee
mov eax, dword [ebp - 0xc]
call fcn.0040b470
cmp al, 1
jne 0x73bee6
mov eax, dword [ebp - 0xc]
call fcn.0040b794
ret