joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ab2c0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edx
add esp, 0x1c
ret

Function at 0x5ab2e0
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
push edx
push edx
setne al
and eax, 0xff
add esp, 0x1c
ret
Function at 0x5d8b50
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov edi, edx
mov ebx, eax
mov esi, ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], str.capi_ctx_set_provname__name_s__type_d_n
mov dword [esp], eax
call fcn.005d89d0
mov edx, dword [ebp + 8]
test edx, edx
je 0x5d8cd0
mov eax, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [ebp - 0x2c], eax
call eax
sub esp, 0x18
mov ecx, eax
test eax, eax
je 0x5d8c36
lea eax, [eax + eax + 0x1e]
shr eax, 4
shl eax, 4
call fcn.006b7700
sub esp, eax
lea eax, [esp + 0x27]
mov dword [esp + 0x14], ecx
and eax, 0xfffffff0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x10], eax
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [ebp - 0x30], eax
call dword [ebp - 0x2c]
sub esp, 0x18
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 0x28]
mov dword [esp + 0x10], 0xf0000000
mov dword [esp + 0xc], esi
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
sub esp, 0x14
test eax, eax
jne 0x5d8cb8
mov eax, dword [0x7bc7b8]
test eax, eax
jne 0x5d8c49
call fcn.00560110
mov dword [0x7bc7b8], eax
mov dword [esp], eax
mov dword [esp + 0x10], 0x65f
mov dword [esp + 0xc], str.engines_e_capi.c
mov dword [esp + 8], 0x67
mov dword [esp + 4], 0x66
lea ebx, [ebp - 0x22]
call fcn.0055ae30
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x77475d
mov dword [esp + 4], 0xa
call fcn.005232e0
mov dword [esp + 8], ebx
mov dword [esp + 4], str.Error_code_0x
mov dword [esp], 2
call fcn.00560d00
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x28]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push eax
push eax
nop
mov dword [esp + 8], 0x665
mov dword [esp + 4], str.engines_e_capi.c
mov dword [esp], edi
call fcn.00588c70
test eax, eax
je 0x5d8d20
mov dword [esp + 8], 0x66a
mov dword [esp + 4], str.engines_e_capi.c
mov edx, dword [ebx + 0xc]
mov dword [ebp - 0x2c], eax
mov dword [esp], edx
call fcn.0057d150
mov eax, dword [ebp - 0x2c]
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], esi
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [0x7bc7b8]
test eax, eax
jne 0x5d8d33
call fcn.00560110
mov dword [0x7bc7b8], eax
mov dword [esp], eax
mov dword [esp + 0x10], 0x667
mov dword [esp + 0xc], str.engines_e_capi.c
mov dword [esp + 8], 0x41
mov dword [esp + 4], 0x66
call fcn.0055ae30
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x5e9000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xc
mov eax, dword [esp + 0x20]
mov ebx, dword [eax + 8]
mov edi, dword [eax]
test ebx, ebx
je 0x5e9045
test edi, edi
je 0x5e9045
mov eax, dword [eax + 4]
xor edx, edx
and eax, 0x100
mov dl, byte [ebx]
jne 0x5e90c8
cmp edx, 0x7f
jbe 0x5e90c8
lea eax, [edi + 1]
xor esi, esi
mov dword [esp], eax
mov ecx, eax
mov eax, ecx
mov dword [esp + 4], ecx
jmp 0x5e905d
mov dword [esp + 4], 0
mov eax, 1
xor esi, esi
mov dword [esp], 1
xor edi, edi
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x5e90c0
mov ecx, dword [esp + 0x24]
mov ebp, dword [ecx]
test ebp, ebp
je 0x5e90c0
mov edx, esi
mov ecx, esi
and edx, 1
mov byte [ebp], cl
mov cl, dl
and ecx, 0xff
test edi, edi
mov dword [esp + 8], ecx
lea ecx, [edi - 1]
je 0x5e90b3
mov edx, dword [esp + 4]
sub edx, edi
add ebp, edx
mov edx, dword [esp + 8]
movzx edi, byte [ebx + ecx]
xor edi, esi
and edi, 0xff
add edx, edi
mov byte [ebp + ecx], dl
dec ecx
shr edx, 8
cmp ecx, 0xffffffff
jne 0x5e9098
mov esi, dword [esp + 0x24]
mov ebx, dword [esp]
mov edx, dword [esi]
add edx, ebx
mov dword [esi], edx
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
test eax, eax
je 0x5e90e6
cmp edx, 0x80
jbe 0x5e90f2
lea eax, [edi + 1]
mov esi, 0xffffffff
mov dword [esp], eax
mov ecx, eax
jmp 0x5e903d
mov dword [esp], edi
xor esi, esi
mov ecx, edi
jmp 0x5e903d
je 0x5e9103
mov dword [esp], edi
mov esi, 0xffffffff
mov ecx, edi
jmp 0x5e903d
cmp edi, 1
je 0x5e9136
lea eax, [ebx + 1]
lea esi, [ebx + edi]
xor edx, edx
xor ecx, ecx
inc eax
mov cl, byte [eax - 1]
or edx, ecx
cmp esi, eax
jne 0x5e9110
test edx, edx
setne al
mov cl, al
and eax, 1
neg ecx
add eax, edi
mov esi, ecx
mov dword [esp], eax
mov ecx, eax
jmp 0x5e903d
mov dword [esp], 1
xor esi, esi
mov ecx, dword [esp]
jmp 0x5e903d
Function at 0x60d490
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x48]
mov esi, dword [esp + 0x44]
test ebx, ebx
je 0x60d512
mov eax, dword [esp + 0x40]
test eax, eax
je 0x60d516
mov eax, dword [esp + 0x40]
lea ebp, [esp + 0x14]
test esi, esi
mov eax, dword [eax + 8]
je 0x60d4f6
lea ebp, [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 4], ebp
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], esi
call fcn.0057b010
test eax, eax
je 0x60d4e1
mov eax, dword [eax + 8]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, 0x77afcf
mov ecx, 4
repe cmpsb byte [esi], byte es:[edi]
je 0x60d526
mov eax, dword [esp + 0x40]
mov eax, dword [eax + 8]
mov dword [esp + 4], ebp
mov dword [esp], eax
mov dword [esp + 0x14], 0x77afd3
mov dword [esp + 0x18], ebx
call fcn.0057b010
test eax, eax
jne 0x60d4d6
xor eax, eax
jmp 0x60d4d9
mov dword [esp], ebx
call sub.msvcrt.dll_getenv
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebx
call sub.msvcrt.dll_getenv
test eax, eax
jne 0x60d4d9
jmp 0x60d4ef
Function at 0x64c970
Capabilities:
Encode data using base64

Disassembly:
push ebp
push edi
push esi
push ebx
push ebx
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
test ecx, ecx
jne 0x64c990
mov eax, dword [esp + 0x20]
mov dword [eax], ecx
pop eax
pop ebx
pop esi
pop edi
pop ebp
ret
lea ebx, [eax + 8]
mov edx, dword [esp + 0x1c]
test ecx, ecx
jle 0x64cad4
cmp ecx, 2
jg 0x64ca43
xor ebp, ebp
mov edi, edx
mov dword [esp], edx
nop
movzx esi, byte [ebx]
lea eax, [edi + 4]
and esi, 0xff
shl esi, 0x10
mov edi, eax
cmp ecx, 2
je 0x64cafc
mov edx, esi
shr edx, 0x12
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax - 4], dl
mov edx, esi
shr edx, 0xc
and edx, 0x3f
cmp ecx, 1
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax - 3], dl
je 0x64cae7
shr esi, 6
mov byte [eax - 1], 0x3d
and esi, 0x3f
sub ecx, 3
add ebx, 3
mov dl, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax - 2], dl
add eax, ebp
mov edx, dword [esp]
sub eax, edx
test ecx, ecx
jg 0x64c9b0
mov edx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x1c]
add edx, eax
inc eax
mov ecx, eax
mov byte [edi], 0
mov byte [edx], 0xa
mov byte [ebx + eax], 0
mov eax, dword [esp + 0x18]
mov dword [eax], 0
mov eax, dword [esp + 0x20]
mov dword [eax], ecx
pop eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ecx
mov esi, edx
movzx edi, byte [ebx]
xor eax, eax
and edi, 0xff
mov al, byte [ebx + 1]
add edx, 4
shl edi, 0x10
mov ebp, edx
shl eax, 8
sub ebp, esi
or eax, edi
add ebx, 3
movzx edi, byte [ebx - 1]
and edi, 0xff
or eax, edi
mov edi, eax
shr edi, 0x12
mov cl, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov edi, eax
shr edi, 0xc
mov byte [edx - 4], cl
and edi, 0x3f
mov cl, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov edi, eax
shr edi, 6
mov byte [edx - 3], cl
and edi, 0x3f
and eax, 0x3f
mov cl, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx - 2], cl
mov ecx, dword [esp]
sub ecx, 3
mov byte [edx - 1], al
mov dword [esp], ecx
mov eax, dword [esp]
cmp eax, 2
jg 0x64ca48
mov ecx, eax
test eax, eax
jne 0x64c9aa
mov edi, edx
mov eax, ebp
jmp 0x64ca16
mov edi, edx
mov ecx, 1
mov eax, 1
mov ebx, edx
jmp 0x64ca23
mov edx, dword [esp]
mov byte [eax - 2], 0x3d
mov byte [eax - 1], 0x3d
lea eax, [eax + ebp]
sub eax, edx
jmp 0x64ca16
xor edx, edx
mov dl, byte [ebx + 1]
shl edx, 8
or esi, edx
mov edx, esi
shr edx, 0x12
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax - 4], dl
mov edx, esi
shr edx, 0xc
and edx, 0x3f
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax - 3], dl
jmp 0x64c9f2
Function at 0x64cb30
Capabilities:
Encode data using base64

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebp, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
test ebp, ebp
jle 0x64cc70
cmp ebp, 2
jg 0x64cbec
xor eax, eax
xor ecx, ecx
mov ebx, dword [esp + 0x14]
mov cl, byte [esi]
mov edi, ecx
lea edx, [ebx + 4]
shl edi, 0x10
cmp ebp, 2
je 0x64cba0
mov ecx, edi
add eax, edx
shr ecx, 0x12
mov byte [edx - 2], 0x3d
shr edi, 0xc
mov byte [edx - 1], 0x3d
mov bl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov ecx, edi
and ecx, 0x3f
mov byte [edx - 4], bl
mov bl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov ecx, dword [esp + 0x14]
mov byte [edx - 3], bl
sub eax, ecx
mov byte [edx], 0
pop ebx
pop esi
pop edi
pop ebp
ret
xor ecx, ecx
add eax, edx
mov cl, byte [esi + 1]
mov byte [edx - 1], 0x3d
shl ecx, 8
mov byte [edx], 0
or ecx, edi
mov esi, ecx
shr esi, 0x12
mov bl, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov esi, ecx
shr esi, 0xc
mov byte [edx - 4], bl
shr ecx, 6
and esi, 0x3f
and ecx, 0x3f
mov bl, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx - 3], bl
mov bl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx - 2], bl
mov ebx, dword [esp + 0x14]
sub eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [esp + 0x14]
xor eax, eax
xor ecx, ecx
mov al, byte [esi + 1]
mov cl, byte [esi]
shl ecx, 0x10
add edx, 4
shl eax, 8
mov edi, dword [esp + 0x14]
or eax, ecx
xor ecx, ecx
mov cl, byte [esi + 2]
sub ebp, 3
or eax, ecx
add esi, 3
mov ecx, eax
shr ecx, 0x12
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx - 4], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0x3f
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx - 3], cl
mov ecx, eax
shr ecx, 6
and eax, 0x3f
and ecx, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx - 1], al
mov eax, edx
mov byte [edx - 2], cl
sub eax, edi
cmp ebp, 2
jg 0x64cbf0
mov dword [esp + 0x14], edx
test ebp, ebp
jne 0x64cb4f
jmp 0x64cb93
mov edx, dword [esp + 0x14]
xor eax, eax
jmp 0x64cb93
Function at 0x6906b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x40]
test ebx, ebx
je 0x6906e5
mov ebp, dword [ebx + 0x20]
test ebp, ebp
je 0x6906e5
mov edi, dword [ebx + 0x24]
test edi, edi
je 0x6906e5
mov esi, dword [ebx + 0x1c]
mov eax, 0xfffffffe
test esi, esi
je 0x6906dd
cmp ebx, dword [esi]
je 0x6906f2
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x2c
mov eax, 0xfffffffe
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, dword [esi + 4]
cmp edi, 0x45
mov dword [esp + 0x1c], edi
setne cl
cmp dword [esp + 0x1c], 0x2a
mov edi, ecx
setne cl
and edi, ecx
cmp dword [esp + 0x1c], 0x5b
setne cl
and edi, ecx
cmp dword [esp + 0x1c], 0x67
setne cl
and edi, ecx
cmp dword [esp + 0x1c], 0x71
setne cl
and ecx, edi
cmp dword [esp + 0x1c], 0x29a
mov ebp, ecx
mov edx, ebp
setne cl
test dl, cl
je 0x690748
mov edx, dword [esp + 0x1c]
sub edx, 0x39
and edx, 0xffffffef
jne 0x6906dd
mov eax, dword [esi + 8]
mov dword [ebx + 0x14], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x2c], 2
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x18]
test eax, eax
js 0x690880
cmp eax, 2
je 0x690895
cmp eax, 1
sbb eax, eax
and eax, 0x47
add eax, 0x2a
mov dword [esi + 4], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.0069de50
mov dword [ebx + 0x30], eax
mov dword [esi + 0x28], 0
mov dword [esp], esi
xor esi, esi
call fcn.0069ca20
mov ebx, dword [ebx + 0x1c]
mov eax, dword [ebx + 0x2c]
mov edx, dword [ebx + 0x44]
add eax, eax
mov dword [ebx + 0x3c], eax
mov eax, dword [ebx + 0x4c]
add eax, 0x7fffffff
lea ecx, [eax + eax]
mov word [edx + eax*2], si
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
call sub.msvcrt.dll_memset
mov eax, dword [ebx + 0x84]
mov dword [ebx + 0x6c], 0
mov dword [ebx + 0x5c], 0
mov dword [ebx + 0x74], 0
mov dword [ebx + 0x16b4], 0
mov dword [ebx + 0x78], 2
lea eax, [eax + eax*2]
mov dword [ebx + 0x60], 2
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x48], 0
shl eax, 2
lea edx, [eax + 0x792d40]
movzx ecx, word [eax + 0x792d42]
movzx eax, word [eax + 0x792d40]
mov dword [ebx + 0x8c], eax
movzx eax, word [edx + 4]
mov dword [ebx + 0x80], ecx
mov dword [ebx + 0x90], eax
movzx eax, word [edx + 6]
mov dword [ebx + 0x7c], eax
add esp, 0x2c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
neg eax
mov edx, eax
mov dword [esi + 0x18], eax
mov eax, 0x2a
cmp edx, 2
jne 0x690790
mov dword [esi + 4], 0x39
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.0069e410
jmp 0x6907af
Function at 0x69ee50
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x44
xor ebp, ebp
mov ecx, dword [eax + 8]
mov ebx, dword [eax + 0xc]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], edx
mov esi, dword [eax]
mov edx, dword [eax + 0x1c]
mov edi, dword [eax + 4]
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov ecx, dword [eax + 0x10]
mov ebx, dword [eax + 0x14]
mov eax, dword [eax + 0x18]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], ebp
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esi, eax
mov ebx, eax
adc edi, edx
mov ecx, dword [esp + 8]
shld eax, edx, 0xd
shld edx, ebx, 0xd
mov ebx, eax
mov eax, edx
xor eax, edi
xor ebx, esi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x10]
add ecx, eax
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], ebx
mov ebx, dword [esp + 0xc]
adc ebx, edx
mov ebp, eax
shld eax, edx, 0x10
shld edx, ebp, 0x10
mov ebp, eax
mov eax, edx
xor ebp, ecx
xor eax, ebx
mov dword [esp + 0x28], ebp
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], esi
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x30]
add esi, eax
mov edx, dword [esp + 0x2c]
mov ebp, eax
mov edi, dword [esp + 0x34]
adc edi, edx
shld eax, edx, 0x15
shld edx, ebp, 0x15
mov ebp, eax
mov eax, edx
xor eax, edi
xor ebp, esi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x20]
add ecx, eax
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ebp
mov ebp, eax
adc ebx, edx
mov dword [esp + 0xc], ecx
shld eax, edx, 0x11
shld edx, ebp, 0x11
mov ebp, eax
mov eax, edx
xor eax, ebx
xor ebp, ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
inc eax
mov dword [esp], ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 8], ebx
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x38], eax
jne 0x69ee93
mov eax, dword [esp + 0x3c]
mov ebp, dword [esp + 4]
mov ebx, dword [esp + 0x10]
mov dword [eax + 4], edi
mov edi, dword [esp]
mov dword [eax], esi
mov dword [eax + 8], edi
mov dword [eax + 0xc], ebp
mov edi, dword [esp + 8]
mov ebp, dword [esp + 0xc]
mov esi, dword [esp + 0x14]
mov dword [eax + 0x10], edi
mov dword [eax + 0x14], ebp
mov dword [eax + 0x18], ebx
mov dword [eax + 0x1c], esi
add esp, 0x44
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x69f890
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
sub esp, 0x40
mov ebx, dword [ecx + 0x1d8]
test ebx, ebx
jne 0x69f8a5
jmp 0x69f940
mov ebx, eax
mov eax, dword [ebx + 0x1d8]
test eax, eax
jne 0x69f8a3
add ebx, 0x1ec
mov ecx, dword [ebx]
mov dword [esp + 8], 0x70736575
mov eax, ecx
xor ecx, 0x79746573
xor eax, 0x6e646f6d
mov dword [esp + 0x20], ecx
mov dword [esp + 0x10], eax
lea eax, [esp + 0x28]
xor ecx, ecx
mov dword [esp + 0xc], 0x736f6d65
mov dword [esp + 0x14], 0x646f7261
mov dword [esp + 0x18], 0x6e657261
mov dword [esp + 0x1c], 0x6c796765
mov dword [esp + 0x24], 0x74656462
mov dword [esp + 0x30], eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
cmp byte [edx], 0
je 0x69f927
nop
lea esi, [esi]
inc ecx
cmp byte [edx + ecx], 0
jne 0x69f920
lea eax, [esp + 8]
call fcn.0069efa0
lea eax, [esp + 8]
call fcn.0069f080
add esp, 0x40
pop ebx
ret
lea ebx, [ecx + 0x1ec]
jmp 0x69f8b5
Function at 0x6a6a30
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, eax
mov ebp, edx
mov dword [esp], str.EXPAT_ENTROPY_DEBUG
call sub.msvcrt.dll_getenv
test eax, eax
je 0x6a6a5b
mov edi, 0x797238
mov ecx, 2
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x6a6a65
add esp, 0x2c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 0x10], ebp
add eax, 0x40
mov dword [esp + 8], ebx
mov dword [esp + 0x14], 4
mov dword [esp + 0xc], 8
mov dword [esp + 4], str.Entropy:__s_____0x_0lx___lu_bytes__n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
add esp, 0x2c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6a6aa0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push esi
push ebx
sub esp, 0x24
mov ebx, eax
mov esi, dword [eax + 0x1ec]
test esi, esi
je 0x6a6ad0
mov al, 1
cmp byte [ebx + 0xe8], 0
je 0x6a6ac8
mov edx, str.xmlhttp:__www.w3.org_XML_1998_namespace
mov eax, ebx
call fcn.006a1790
add esp, 0x24
pop ebx
pop esi
ret
mov dword [esp], str.ADVAPI32.DLL
call fcn.006b65e0
mov esi, eax
test eax, eax
je 0x6a6b1a
mov dword [esp + 4], str.SystemFunction036
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
push ecx
push ecx
je 0x6a6b77
lea edx, [esp + 0x14]
mov dword [esp + 4], 4
mov dword [esp], edx
call eax
dec al
push edx
push edx
mov dword [esp], esi
je 0x6a6b60
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ecx
lea eax, [esp + 0x18]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push eax
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
xor eax, edx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor eax, esi
mov edx, eax
mov dword [esp + 0x14], eax
shl edx, 0x1f
sub edx, eax
mov eax, str.fallback_4_
call fcn.006a6a30
mov dword [ebx + 0x1ec], eax
jmp 0x6a6ab1
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, str.RtlGenRandom
push esi
mov edx, dword [esp + 0x14]
call fcn.006a6a30
jmp 0x6a6b51
mov dword [esp], esi
jmp 0x6a6b13
Function at 0x6b65e0
Capabilities:
Get common file path

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov dword [esp], str.kernel32
mov esi, dword [esp + 0x40]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
push ebx
je 0x6b6770
mov dword [esp + 4], str.LoadLibraryExA
mov dword [esp], eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
call ebp
mov edi, eax
push ecx
push ecx
mov dword [esp + 4], 0x7a0dd8
mov dword [esp], esi
call sub.msvcrt.dll_strpbrk
test eax, eax
je 0x6b6656
test edi, edi
je 0x6b6777
mov dword [esp + 8], 8
mov dword [esp + 4], 0
mov dword [esp], esi
call edi
sub esp, 0xc
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
test edi, edi
je 0x6b6690
mov dword [esp + 4], str.AddDllDirectory
mov dword [esp], ebx
call ebp
test eax, eax
push ebp
push ebp
je 0x6b6690
mov dword [esp], esi
mov dword [esp + 8], 0x800
mov dword [esp + 4], 0
call edi
sub esp, 0xc
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 0
mov dword [esp], 0
mov ebp, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
call ebp
test eax, eax
push ebx
push ebx
mov ebx, eax
je 0x6b6770
mov dword [esp], esi
call sub.msvcrt.dll_strlen
lea eax, [ebx + eax + 1]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov edx, eax
test eax, eax
je 0x6b6755
mov dword [esp + 4], ebx
mov dword [esp], eax
mov dword [esp + 0x1c], eax
call ebp
test eax, eax
push ecx
push ecx
mov edx, dword [esp + 0x1c]
je 0x6b6755
mov ecx, edx
mov ebx, dword [ecx]
add ecx, 4
lea eax, [ebx - 0x1010101]
xor ebx, 0xffffffff
and eax, ebx
and eax, 0x80808080
je 0x6b66ea
test eax, 0x8080
jne 0x6b670e
shr eax, 0x10
add ecx, 2
mov bl, al
mov dword [esp + 0x1c], edx
add bl, al
sbb ecx, 3
sub ecx, edx
lea eax, [edx + ecx + 1]
mov byte [edx + ecx], 0x5c
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
test edi, edi
mov edx, dword [esp + 0x1c]
je 0x6b6786
mov dword [esp], edx
mov dword [esp + 8], 8
mov dword [esp + 4], 0
call edi
sub esp, 0xc
mov edx, dword [esp + 0x1c]
jmp 0x6b6757
xor eax, eax
mov dword [esp], edx
mov dword [esp + 0x1c], eax
call sub.msvcrt.dll_free
mov eax, dword [esp + 0x1c]
jmp 0x6b664e
xor eax, eax
jmp 0x6b664e
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edx
jmp 0x6b664e
mov dword [esp], edx
mov dword [esp + 0x1c], edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edx
mov edx, dword [esp + 0x1c]
jmp 0x6b6757