joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b6380
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x7ef784]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push eax
push 1
mov dword [ebp - 0x18], eax
mov esi, ecx
lea eax, [ebp - 0x14]
push 0xe
push eax
call fcn.006585c9
add esp, 0x10
cmp eax, 1
jne 0x5b6510
mov edx, dword [ebp - 0x14]
mov di, word [ebp - 0xe]
mov bx, word [ebp - 0xc]
mov ecx, dword [ebp - 0x12]
mov eax, dword [ebp - 0xa]
mov byte [esi], dl
mov byte [esi + 1], dh
mov dword [esi + 4], ecx
mov word [esi + 8], di
mov word [esi + 0xa], bx
mov dword [esi + 0xc], eax
cmp dl, 0x42
jne 0x5b6510
cmp dh, 0x4d
jne 0x5b6510
test di, di
jne 0x5b6510
test bx, bx
jne 0x5b6510
lea eax, [ecx - 0x37]
cmp eax, 0x1e8449
ja 0x5b6510
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x5b641e
push eax
call fcn.00662a80
mov ecx, dword [esi + 4]
add esp, 4
push ecx
call fcn.00664d80
add esp, 4
mov dword [esi + 0x3c], eax
test eax, eax
jne 0x5b6446
pop edi
pop esi
mov eax, 0xfffffff9
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006391b7
mov esp, ebp
pop ebp
ret 4
xor edx, edx
nop dword [eax + eax]
mov ecx, dword [esi + 0x3c]
movzx eax, byte [ebp + edx - 0x14]
mov byte [edx + ecx], al
mov ecx, dword [esi + 0x3c]
movzx eax, byte [ebp + edx - 0x13]
mov byte [ecx + edx + 1], al
add edx, 2
cmp edx, 0xe
jl 0x5b6450
push dword [ebp - 0x18]
mov ecx, dword [esi + 0x3c]
mov eax, dword [esi + 4]
sub eax, 0xe
push 1
push eax
lea eax, [ecx + 0xe]
push eax
call fcn.006585c9
mov edx, dword [esi + 0x3c]
add esp, 0x10
cmp eax, 1
jne 0x5b6500
mov eax, dword [edx + 0xe]
mov dword [esi + 0x10], eax
mov eax, dword [edx + 0x12]
mov dword [esi + 0x14], eax
mov eax, dword [edx + 0x16]
mov dword [esi + 0x18], eax
movzx ecx, word [edx + 0x1a]
mov dword [esi + 0x1c], ecx
movzx eax, word [edx + 0x1c]
mov dword [esi + 0x20], eax
mov edi, eax
mov ebx, dword [edx + 0x1e]
mov dword [esi + 0x24], ebx
mov eax, dword [edx + 0x22]
mov dword [esi + 0x28], eax
mov eax, dword [edx + 0x26]
mov dword [esi + 0x2c], eax
mov eax, dword [edx + 0x2a]
mov dword [esi + 0x30], eax
mov eax, dword [edx + 0x2e]
mov dword [esi + 0x34], eax
mov eax, dword [edx + 0x32]
mov dword [esi + 0x38], eax
cmp ecx, 1
jne 0x5b6500
test ebx, ebx
jne 0x5b6500
cmp edi, 0x18
je 0x5b64eb
cmp edi, 0x20
jne 0x5b6500
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006391b7
mov esp, ebp
pop ebp
ret 4
push edx
call fcn.00662a80
mov dword [esi + 0x3c], 0
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, 0xfffffffe
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006391b7
mov esp, ebp
pop ebp
ret 4
Function at 0x5b6580
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x7ef784]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov ebx, ecx
push 0x738fbc
push eax
mov dword [ebp - 0x20], ebx
call fcn.004cdb50
mov esi, eax
add esp, 8
mov dword [ebp - 0x14], esi
test esi, esi
jne 0x5b65c6
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006391b7
mov esp, ebp
pop ebp
ret 8
mov esi, dword [ebx + 0x3c]
push edi
test esi, esi
jne 0x5b65da
mov esi, 0xfffffffd
mov edi, eax
jmp 0x5b66d6
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x5b65ec
mov edi, dword [ebp - 0x14]
lea esi, [eax - 4]
jmp 0x5b66d6
mov ecx, eax
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5b65f1
mov eax, dword [ebx + 0x18]
sub ecx, edx
imul eax, dword [ebx + 0x14]
inc ecx
mov dword [ebp - 0x18], ecx
lea eax, [eax + eax*2]
cmp ecx, eax
jbe 0x5b6619
mov edi, dword [ebp - 0x14]
mov esi, 0xfffffffb
jmp 0x5b66d6
mov ecx, dword [ebx + 0x20]
xor edx, edx
mov eax, dword [ebx + 0xc]
xor edi, edi
shr ecx, 3
add eax, esi
xor ebx, ebx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0x8040201
mov dword [ebp - 8], 0x80402010
cmp dword [ebp - 0x18], edx
jbe 0x5b66b7
mov esi, dword [ebp + 0xc]
mov al, byte [ebx + esi]
test byte [ebp + edi - 0xc], al
mov eax, dword [ebp - 0x10]
mov al, byte [eax + edx]
jne 0x5b6666
test al, 1
je 0x5b6675
mov ecx, dword [ebp - 0x10]
dec al
mov byte [ecx + edx], al
mov ecx, dword [ebp - 0x1c]
jmp 0x5b6675
test al, 1
jne 0x5b6675
mov esi, dword [ebp - 0x10]
inc al
mov byte [esi + edx], al
mov esi, dword [ebp + 0xc]
inc edx
cmp ecx, 4
jne 0x5b668f
mov eax, edx
and eax, 0x80000003
jns 0x5b6689
dec eax
or eax, 0xfffffffc
inc eax
cmp eax, 3
jne 0x5b668f
inc edx
cmp edi, 7
lea eax, [ebx + 1]
cmovne eax, ebx
xor ecx, ecx
cmp edi, 7
mov ebx, eax
lea eax, [edi + 1]
cmovne ecx, eax
mov edi, ecx
mov ecx, dword [ebp - 0x1c]
cmp ebx, dword [ebp - 0x18]
jb 0x5b6646
mov eax, dword [ebp - 0x20]
mov esi, dword [eax + 0x3c]
jmp 0x5b66ba
mov eax, dword [ebp - 0x20]
mov edi, dword [ebp - 0x14]
push edi
push 1
push dword [eax + 4]
push esi
call fcn.00663ab0
add esp, 0x10
lea esi, [eax - 1]
neg esi
sbb esi, esi
and esi, 0xfffffffa
push edi
call fcn.006581d4
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, esi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.006391b7
mov esp, ebp
pop ebp
ret 8

Function at 0x5b6720
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
mov esi, ecx
xor bh, bh
push edi
mov dword [esi + 0x204], 9
movq xmm0, qword [str.Adobe_ALM]
movq qword [esi + 0x102], xmm0
mov al, byte [0x7490bc]
mov byte [esi + 0x10a], al
xor eax, eax
mov word [esi + 0x100], 0
mov byte [eax + esi], al
inc eax
cmp eax, 0x100
jl 0x5b6757
xor edi, edi
mov eax, edi
mov bl, byte [edi + esi]
cdq
idiv dword [esi + 0x204]
movzx eax, byte [edx + esi + 0x102]
add al, bl
add bh, al
movzx ecx, bh
movzx eax, byte [ecx + esi]
mov byte [edi + esi], al
inc edi
mov byte [ecx + esi], bl
cmp edi, 0x100
jl 0x5b6764
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x5b67a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.005b67b0

Function at 0x5b67b0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
push edi
test ecx, ecx
je 0x5b683b
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x5b683b
mov eax, dword [ebp + 0x10]
test eax, eax
jle 0x5b683b
mov dl, byte [esi + 0x101]
sub ecx, edi
push ebx
mov bh, byte [esi + 0x100]
mov byte [ebp + 0xf], dl
mov dword [ebp + 8], ecx
dec eax
lea edi, [edi + 1]
mov dword [ebp + 0x10], eax
inc bh
mov al, byte [ebp + 0xf]
movzx edx, bh
mov bl, byte [edx + esi]
add al, bl
movzx ecx, al
mov byte [ebp + 0xf], al
movzx eax, byte [ecx + esi]
mov byte [edx + esi], al
mov byte [ecx + esi], bl
movzx eax, byte [edx + esi]
mov ecx, dword [ebp + 8]
add al, bl
movzx eax, al
movzx eax, byte [eax + esi]
xor al, byte [ecx + edi - 1]
mov byte [edi - 1], al
mov eax, dword [ebp + 0x10]
test eax, eax
jg 0x5b67e1
mov dl, byte [ebp + 0xf]
mov al, 1
mov byte [esi + 0x100], bh
pop ebx
pop edi
mov byte [esi + 0x101], dl
pop esi
pop ebp
ret 0xc
pop edi
xor al, al
pop esi
pop ebp
ret 0xc

Function at 0x5b6850
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
mov esi, ecx
xor bh, bh
push edi
xor eax, eax
mov word [esi + 0x100], 0
mov byte [eax + esi], al
inc eax
cmp eax, 0x100
jl 0x5b6862
xor edi, edi
nop
mov eax, edi
mov bl, byte [edi + esi]
cdq
idiv dword [esi + 0x204]
movzx eax, byte [edx + esi + 0x102]
add al, bl
add bh, al
movzx ecx, bh
movzx eax, byte [ecx + esi]
mov byte [edi + esi], al
inc edi
mov byte [ecx + esi], bl
cmp edi, 0x100
jl 0x5b6870
pop edi
pop esi
pop ebx
ret

Function at 0x5b68b0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x5b6938
mov eax, dword [ebp + 0xc]
test eax, eax
jle 0x5b6938
mov edx, 0x100
push ebx
cmp eax, edx
push edi
cmovge eax, edx
push eax
mov dword [esi + 0x204], eax
lea eax, [esi + 0x102]
push ecx
push eax
call fcn.0064dd50
add esp, 0xc
mov word [esi + 0x100], 0
xor bh, bh
xor eax, eax
mov byte [eax + esi], al
inc eax
cmp eax, 0x100
jl 0x5b68f4
xor edi, edi
mov eax, edi
mov bl, byte [edi + esi]
cdq
idiv dword [esi + 0x204]
movzx eax, byte [edx + esi + 0x102]
add al, bl
add bh, al
movzx ecx, bh
movzx eax, byte [ecx + esi]
mov byte [edi + esi], al
inc edi
mov byte [ecx + esi], bl
cmp edi, 0x100
jl 0x5b6901
pop edi
pop ebx
mov al, 1
pop esi
pop ebp
ret 8
xor al, al
pop esi
pop ebp
ret 8

Function at 0x5b6970
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
test edx, edx
je 0x5b69be
push ebx
push esi
mov ebx, 0x749150
mov byte [edx], 0xd0
push edi
mov esi, 0x749152
lea eax, [edx + 3]
sub ebx, edx
mov edi, 0x15
movzx ecx, byte [esi - 1]
lea esi, [esi + 3]
xor cl, byte [edx]
lea eax, [eax + 3]
mov byte [eax - 5], cl
movzx ecx, byte [edx]
xor cl, byte [esi - 3]
mov byte [eax - 4], cl
movzx ecx, byte [ebx + eax - 3]
xor cl, byte [edx]
mov byte [eax - 3], cl
sub edi, 1
jne 0x5b6994
pop edi
pop esi
pop ebx
mov eax, 0x40
pop ebp
ret 4
Function at 0x5b69d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
test edx, edx
je 0x5b6a37
push ebx
mov ebx, 0x7491d8
mov byte [edx], 0x30
push esi
mov ecx, 0x7491d9
lea eax, [edx + 3]
sub ebx, edx
mov esi, str.1e210
sub ecx, edx
push edi
mov dword [ebp + 8], ecx
mov edi, 0x56
nop
movzx ecx, byte [esi - 1]
lea esi, [esi + 4]
xor cl, byte [edx]
lea eax, [eax + 4]
mov byte [eax - 6], cl
movzx ecx, byte [esi - 4]
xor cl, byte [edx]
mov byte [eax - 5], cl
movzx ecx, byte [ebx + eax - 4]
xor cl, byte [edx]
mov byte [eax - 4], cl
mov ecx, dword [ebp + 8]
movzx ecx, byte [ecx + eax - 4]
xor cl, byte [edx]
mov byte [eax - 3], cl
sub edi, 1
jne 0x5b6a00
pop edi
pop esi
pop ebx
mov eax, 0x159
pop ebp
ret 4

Function at 0x5b6a70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
test edx, edx
je 0x5b6abe
push ebx
push esi
mov ebx, 0x749190
mov byte [edx], 0xbd
push edi
mov esi, 0x749192
lea eax, [edx + 3]
sub ebx, edx
mov edi, 0x15
movzx ecx, byte [esi - 1]
lea esi, [esi + 3]
xor cl, byte [edx]
lea eax, [eax + 3]
mov byte [eax - 5], cl
movzx ecx, byte [edx]
xor cl, byte [esi - 3]
mov byte [eax - 4], cl
movzx ecx, byte [ebx + eax - 3]
xor cl, byte [edx]
mov byte [eax - 3], cl
sub edi, 1
jne 0x5b6a94
pop edi
pop esi
pop ebx
mov eax, 0x40
pop ebp
ret 4

Function at 0x5b6f30
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6cd9f8
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push esi
mov eax, dword [0x7ef784]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
push 0x7349a4
lea ecx, [ebp - 0x70]
mov dword [ebp - 4], 0
mov dword [esi], vtable.std::codecvt_wchar_t__char__struct__Mbstatet_.0
call fcn.00488a00
lea eax, [ebp - 0x3c]
push eax
call fcn.0063b433
add esp, 4
lea ecx, [ebp - 0x70]
movups xmm0, xmmword [eax]
movups xmmword [esi + 8], xmm0
movups xmm0, xmmword [eax + 0x10]
movups xmmword [esi + 0x18], xmm0
movq xmm0, qword [eax + 0x20]
movq qword [esi + 0x28], xmm0
mov eax, dword [eax + 0x28]
mov dword [esi + 0x30], eax
call fcn.00488ac0
mov dword [esi], vtable.std::codecvt_utf8_wchar_t__1114111__0_.0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x5bcbe0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
pop ebp
ret
Function at 0x5e14e0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0
pop ebp
ret
Function at 0x5f8b00
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
push 0xc
mov esi, ecx
call fcn.006391c8
add esp, 4
mov dword [eax], esi
mov edx, dword [esi + 4]
push 0
push 4
push eax
push 0x5ed2d0
push 0
mov dword [eax + 4], edx
mov edx, dword [esi + 8]
push 0
mov dword [eax + 8], edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
jmp dword [sym.imp.KERNEL32.dll_SwitchToThread]

Function at 0x5fc570
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 8]
test edx, edx
je 0x5fc5e7
push ebx
push esi
push edi
mov esi, 0x756c7a
mov byte [edx], 0xda
mov edi, 0x756c78
mov dword [ebp + 8], 0x33
mov ebx, 0x756c79
lea eax, [edx + 3]
mov ecx, esi
sub edi, edx
sub ebx, edx
sub ecx, edx
mov dword [ebp - 4], ecx
movzx ecx, byte [esi - 1]
lea esi, [esi + 5]
xor cl, byte [edx]
lea eax, [eax + 5]
mov byte [eax - 7], cl
movzx ecx, byte [esi - 5]
xor cl, byte [edx]
mov byte [eax - 6], cl
movzx ecx, byte [edi + eax - 5]
xor cl, byte [edx]
mov byte [eax - 5], cl
movzx ecx, byte [ebx + eax - 5]
xor cl, byte [edx]
mov byte [eax - 4], cl
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + eax - 5]
xor cl, byte [edx]
sub dword [ebp + 8], 1
mov byte [eax - 3], cl
jne 0x5fc5a5
pop edi
pop esi
pop ebx
mov eax, 0x100
mov esp, ebp
pop ebp
ret
Function at 0x5fd310
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6d08de
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x7ef784]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0xf
mov byte [edi + 0x18], 0
lea esi, [edi + 0x30]
mov byte [ebp - 4], 1
push 0x154
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.006391c8
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0x38]
mov byte [ebp - 4], 2
push 0x74
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.006391c8
add esp, 8
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov eax, edi
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0xf
mov byte [edi + 0x40], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0xf
mov byte [edi + 0x58], 0
mov dword [edi + 0x70], 0
mov dword [edi + 0x74], 0
mov dword [edi + 0x78], 0
mov dword [edi + 0x8c], 0
mov dword [edi + 0x90], 0xf
mov byte [edi + 0x7c], 0
mov dword [edi + 0xa4], 0
mov dword [edi + 0xa8], 0xf
mov byte [edi + 0x94], 0
mov dword [edi + 0xbc], 0
mov dword [edi + 0xc0], 0xf
mov byte [edi + 0xac], 0
mov dword [edi + 0xd4], 0
mov dword [edi + 0xd8], 0xf
mov byte [edi + 0xc4], 0
mov dword [edi + 0xec], 0
mov dword [edi + 0xf0], 0xf
mov byte [edi + 0xdc], 0
mov dword [edi + 0x104], 0
mov dword [edi + 0x108], 0xf
mov byte [edi + 0xf4], 0
mov dword [edi + 0x11c], 0
mov dword [edi + 0x120], 0xf
mov byte [edi + 0x10c], 0
mov dword [edi + 0x134], 0
mov dword [edi + 0x138], 0xf
mov byte [edi + 0x124], 0
mov dword [edi + 0x14c], 0
mov dword [edi + 0x150], 0xf
mov byte [edi + 0x13c], 0
mov dword [edi + 0x164], 0
mov dword [edi + 0x168], 0xf
mov byte [edi + 0x154], 0
mov dword [edi + 0x17c], 0
mov dword [edi + 0x180], 0xf
mov byte [edi + 0x16c], 0
mov dword [edi + 0x194], 0
mov dword [edi + 0x198], 0xf
mov byte [edi + 0x184], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x62d2f0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6db7a0
mov eax, dword fs:[0]
push eax
sub esp, 0x13c
mov eax, dword [0x7ef784]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x12c], ecx
xor bl, bl
mov dword [ebp - 4], 0
cmp dword [ebp + 0x18], 0
je 0x62d4e1
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push 0
cmovae eax, dword [ebp + 8]
push eax
call fcn.00665134
add esp, 8
test eax, eax
jne 0x62d358
mov bl, 1
jmp 0x62d4e1
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp dword [ebp + 0x1c], 8
lea edi, [ebp + 8]
mov esi, dword [ebp + 0x18]
cmovae edi, dword [ebp + 8]
mov byte [ebp - 4], 1
test esi, esi
je 0x62d4d9
push 0x100
push eax
lea eax, [ebp - 0x128]
push eax
call fcn.0064ed10
add esp, 0xc
mov ecx, 0x75aafc
mov edx, 0x100
movzx eax, word [ecx]
cmp ax, dx
jae 0x62d3f0
movzx eax, al
add ecx, 2
mov byte [ebp + eax - 0x128], 1
cmp ecx, 0x75ab00
jne 0x62d3a5
or ecx, 0xffffffff
lea eax, [esi - 1]
cmp eax, ecx
cmovb ecx, eax
lea ecx, [edi + ecx*2]
movzx eax, word [ecx]
cmp ax, dx
jae 0x62d3e3
cmp byte [ebp + eax - 0x128], 0
jne 0x62d42b
cmp ecx, edi
je 0x62d4d9
sub ecx, 2
jmp 0x62d3d1
or ecx, 0xffffffff
lea eax, [esi - 1]
cmp eax, ecx
cmovb ecx, eax
lea ecx, [edi + ecx*2]
nop
movzx esi, word [ecx]
mov edx, 2
mov eax, 0x75aafc
nop dword [eax]
cmp word [eax], si
je 0x62d42b
add eax, 2
sub edx, 1
jne 0x62d410
cmp ecx, edi
je 0x62d426
sub ecx, 2
jmp 0x62d400
or ecx, 0xffffffff
jmp 0x62d42f
sub ecx, edi
sar ecx, 1
cmp ecx, 0xffffffff
je 0x62d4d9
push ecx
push 0
lea eax, [ebp - 0x148]
push eax
lea ecx, [ebp + 8]
call fcn.00492bb0
push eax
lea ecx, [ebp - 0x28]
call fcn.0048f6b0
lea ecx, [ebp - 0x148]
call fcn.004878f0
sub esp, 0x18
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
call fcn.004879b0
mov esi, dword [ebp - 0x12c]
mov ecx, esi
call fcn.0062d2f0
cmp al, 1
jne 0x62d4d9
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call fcn.00666f9e
add esp, 4
test eax, eax
jne 0x62d4be
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
push str.Created__S
push 0
push 4
push str.AdobeGCUpdaterCFU
push dword [esi + 4]
call fcn.00562650
add esp, 0x18
mov bl, 1
jmp 0x62d4d9
push str.Failed_to_Create__S
push 0
push 4
push str.AdobeGCUpdaterCFU
push dword [esi + 4]
call fcn.00562650
add esp, 0x14
xor bl, bl
lea ecx, [ebp - 0x28]
call fcn.004878f0
mov edx, dword [ebp + 0x1c]
cmp edx, 8
jb 0x62d517
mov ecx, dword [ebp + 8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x62d50d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x62d537
push edx
push ecx
call fcn.006391f8
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006391b7
mov esp, ebp
pop ebp
ret 0x18
call fcn.00657f14
int3
Function at 0x67122e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.006710a4

Function at 0x677d04
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00677857

Function at 0x680631
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 1
push edi
call fcn.006805db
mov esi, dword [ebp + 0xc]
pop ecx
pop ecx
test al, al
je 0x6806b6
push 1
push esi
call fcn.006805db
mov edx, dword [ebp + 0x10]
pop ecx
pop ecx
test al, al
je 0x6806b9
mov ecx, edx
mov eax, ebx
shr ecx, 2
test ecx, ecx
je 0x68068b
mov edx, edi
mov dword [ebp - 4], ecx
sub edx, esi
mov edi, esi
mov eax, dword [edx + edi]
xor eax, dword [edi]
lea edi, [edi + 4]
or ebx, eax
sub ecx, 1
jne 0x680673
mov edx, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 4]
shl eax, 2
sub edx, eax
jne 0x68069b
xor eax, eax
test ebx, ebx
sete al
jmp 0x6806d1
add edi, eax
add esi, eax
mov ecx, ebx
mov eax, ebx
shr eax, 0x10
shr ecx, 0x18
or cl, al
mov eax, ebx
shr eax, 8
or cl, al
or bl, cl
jmp 0x6806b9
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x6806cc
sub edi, esi
mov al, byte [esi + edi]
xor al, byte [esi]
or bl, al
inc esi
sub edx, 1
jne 0x6806bf
test bl, bl
sete al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x6806d8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
push ebx
call fcn.006805db
mov edi, dword [ebp + 0xc]
pop ecx
pop ecx
test al, al
je 0x68075b
push 1
push edi
call fcn.006805db
mov esi, dword [ebp + 0x10]
pop ecx
pop ecx
test al, al
je 0x68075e
push 1
push esi
call fcn.006805db
pop ecx
pop ecx
mov ecx, dword [ebp + 0x14]
test al, al
je 0x680761
mov edx, ecx
xor eax, eax
shr edx, 2
test edx, edx
je 0x68074c
mov ecx, edi
mov dword [ebp - 8], edx
mov eax, ebx
sub ecx, esi
sub eax, esi
mov ebx, esi
mov edi, eax
mov eax, dword [ecx + ebx]
xor eax, dword [ebx]
mov dword [edi + ebx], eax
lea ebx, [ebx + 4]
sub edx, 1
jne 0x680730
mov ecx, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 8]
shl eax, 2
sub ecx, eax
je 0x680777
add ebx, eax
add edi, eax
add esi, eax
jmp 0x680761
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x680777
sub edi, esi
sub ebx, esi
mov al, byte [esi + edi]
xor al, byte [esi]
mov byte [esi + ebx], al
inc esi
sub ecx, 1
jne 0x680769
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x68077e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push 1
push esi
call fcn.006805db
mov edi, dword [ebp + 0xc]
pop ecx
pop ecx
test al, al
je 0x6807e2
push 1
push edi
call fcn.006805db
pop ecx
pop ecx
mov ecx, dword [ebp + 0x10]
test al, al
je 0x6807e5
mov edx, ecx
xor eax, eax
shr edx, 2
test edx, edx
je 0x6807d5
mov eax, edi
mov dword [ebp - 8], edx
push ebx
sub eax, esi
mov ebx, esi
mov esi, eax
mov eax, dword [esi + ebx]
xor dword [ebx], eax
lea ebx, [ebx + 4]
sub edx, 1
jne 0x6807c1
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 8]
pop ebx
shl eax, 2
sub ecx, eax
je 0x6807f6
add esi, eax
add edi, eax
jmp 0x6807e5
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x6807f6
sub edi, esi
mov al, byte [esi + edi]
xor byte [esi], al
inc esi
sub ecx, 1
jne 0x6807eb
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x690e47
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
pop ebp
ret

Function at 0x690e71
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push 0x20
push 0x76a6f0
push dword [ebp + 8]
call fcn.0064dd50
add esp, 0xc
pop ebp
ret