joyce8/EMBER2024-capa huggingface dataset:
Function at 0x594818
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x594981
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov dl, 1
mov eax, dword [0x433fc4]
call fcn.004056c8
mov ebx, eax
lea edx, [ebp - 0x14]
mov ecx, 4
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x14]
xor edx, edx
push edx
push eax
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0043f298
push 1
xor ecx, ecx
mov dl, 1
mov eax, ebx
call fcn.004e2550
mov ebx, eax
lea ecx, [ebp - 0x1c]
xor edx, edx
mov eax, ebx
call fcn.004e0e04
mov edx, dword [ebp - 0x1c]
lea eax, [esi + 0x1c]
call fcn.00407460
lea edx, [ebp - 0x18]
mov ecx, 4
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
lea edx, [esi + 0x28]
mov ecx, 4
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
lea edx, [esi + 0x2c]
mov ecx, 4
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
lea edx, [esi + 0x34]
mov ecx, 4
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
lea edx, [esi + 0x30]
mov ecx, 4
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
lea edx, [esi + 0x38]
mov ecx, 4
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
lea ecx, [ebp - 0x20]
xor edx, edx
mov eax, ebx
call fcn.004e0e04
mov edx, dword [ebp - 0x20]
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea edx, [ebp - 0xd]
mov ecx, 1
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
movzx edx, byte [ebp - 0xd]
mov eax, esi
call fcn.005938ac
movzx edi, byte [ebp - 0xd]
dec edi
test edi, edi
jl 0x594954
inc edi
mov dword [ebp - 0xc], 0
mov eax, dword [esi + 0x20]
mov edx, dword [ebp - 0xc]
mov eax, dword [eax + edx*4]
mov edx, ebx
call fcn.005927c8
test al, al
jne 0x59494e
mov eax, ebx
call fcn.004056f8
jmp 0x594966
inc dword [ebp - 0xc]
dec edi
jne 0x594931
mov eax, ebx
call fcn.004056f8
mov dword [esi + 0xc], 0xe
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x594988
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00407458
ret
Function at 0x59c864
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe8
mov dword [esp + 4], edx
mov dword [esp], eax
xor eax, eax
mov dword [esp + 8], eax
mov eax, dword [esp]
call fcn.0059c990
mov ebx, eax
cmp ebx, 0xffffffff
je 0x59c94c
mov eax, dword [esp]
call fcn.0059c070
mov eax, dword [esp]
mov eax, dword [eax + 0x1c]
mov dword [esp + 0x10], eax
mov eax, dword [esp]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 4]
mov dword [esp + 0xc], eax
xor edi, edi
xor ebp, ebp
mov esi, pe_nt_image_headers32
mov ecx, dword [esp + 0x10]
mov eax, ebx
xor edx, edx
div ecx
mov ebx, edx
mov ecx, dword [esp + 0xc]
add ecx, ebx
movsx eax, word [ecx]
cdq
xor eax, edx
sub eax, edx
add edi, eax
movsx eax, word [ecx + 2]
cdq
xor eax, edx
sub eax, edx
add ebp, eax
add ebx, 4
dec esi
jne 0x59c8b3
mov ecx, pe_nt_image_headers32
mov eax, edi
cdq
idiv ecx
mov edi, eax
mov ecx, pe_nt_image_headers32
mov eax, ebp
cdq
idiv ecx
mov ebp, eax
mov eax, dword [esp + 4]
sub eax, 1
jb 0x59c905
je 0x59c91a
jmp 0x59c92f
mov dword [esp + 0x14], edi
fild dword [esp + 0x14]
fdiv dword [0x59c958]
fstp dword [esp + 8]
wait
jmp 0x59c944
mov dword [esp + 0x14], ebp
fild dword [esp + 0x14]
fdiv dword [0x59c958]
fstp dword [esp + 8]
wait
jmp 0x59c944
add ebp, edi
mov dword [esp + 0x14], ebp
fild dword [esp + 0x14]
fdiv dword [0x59c95c]
fstp dword [esp + 8]
wait
mov eax, dword [esp]
call fcn.0059c07c
fld dword [esp + 8]
add esp, 0x18
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5de9f4
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffdc
mov ebx, eax
mov eax, ebx
xor edx, edx
call fcn.00407460
mov dword [esp], 0xf
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x5dea27
lea edx, [esp + 4]
mov eax, ebx
mov ecx, dword [esp]
call fcn.0040759c
add esp, 0x24
pop ebx
ret

Function at 0x5e2b7c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5e2d65
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.005e2ea8
push 0x7fffffff
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebx + 0xc]
xor ecx, ecx
mov edx, dword [0x5b2264]
call fcn.00408e54
mov eax, dword [ebx + 8]
push eax
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x5b2264]
call fcn.00408e48
add esp, 4
mov eax, dword [ebp - 0x10]
call fcn.00408c80
add eax, dword [ebx + 8]
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x5b2264]
call fcn.00408e48
add esp, 4
mov eax, dword [ebp - 0xc]
call fcn.00408c88
mov edx, eax
test edx, edx
jl 0x5e2c25
inc edx
xor eax, eax
mov ecx, dword [ebp - 0xc]
movzx ecx, byte [ecx + eax]
xor cl, byte [0x6f7fd4]
mov esi, dword [ebp - 4]
mov byte [esi + eax], cl
inc eax
dec edx
jne 0x5e2c0e
mov eax, dword [ebp - 0xc]
call fcn.00408c80
push eax
mov eax, dword [ebp - 0x10]
call fcn.00408c80
push eax
lea ecx, [ebp - 4]
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.005b677c
lea ecx, [ebp - 8]
mov eax, dword [ebx + 0x10]
mov edx, dword [ebp - 4]
call fcn.005e101c
push 0
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x5b2264]
call fcn.00408e48
add esp, 4
mov eax, dword [ebx + 8]
add eax, dword [ebx + 4]
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x5b2264]
call fcn.00408e48
add esp, 4
mov eax, dword [ebp - 0xc]
call fcn.00408c88
mov edx, eax
test edx, edx
jl 0x5e2caf
inc edx
xor eax, eax
mov ecx, dword [ebp - 0xc]
movzx ecx, byte [ecx + eax]
xor cl, byte [0x6f7fd8]
mov esi, dword [ebp - 4]
mov byte [esi + eax], cl
inc eax
dec edx
jne 0x5e2c98
mov eax, dword [ebp - 0xc]
call fcn.00408c80
push eax
mov eax, dword [ebp - 8]
call fcn.00408c80
push eax
lea ecx, [ebp - 4]
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.005b677c
mov ecx, dword [ebp + 8]
mov eax, dword [ebx + 0x10]
mov edx, dword [ebp - 4]
call fcn.005e101c
push 0
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x5b2264]
call fcn.00408e48
add esp, 4
push 0
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x5b2264]
call fcn.00408e48
add esp, 4
push 0
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x5b2264]
call fcn.00408e48
add esp, 4
cmp dword [ebp - 0x14], 0xffffffff
jle 0x5e2d44
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
mov ecx, 1
mov edx, dword [0x5b2264]
call fcn.00408e48
add esp, 4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e2d6c
lea eax, [ebp - 0xc]
mov edx, dword [0x5b2264]
mov ecx, 3
call fcn.004082ec
ret
Function at 0x601488
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
test dl, dl
je 0x60149b
add esp, 0xfffffff0
call fcn.00405c2c
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x601514
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, esi
call fcn.004056c8
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [esi + 0x18], 0
lea edx, [ebp - 4]
mov eax, esi
call fcn.006019e0
mov edx, dword [ebp - 4]
lea eax, [esi + 0xc]
call fcn.00407460
mov ecx, dword [esi + 0xc]
lea eax, [esi + 0x10]
mov edx, 0x601544
call fcn.00407934
mov ecx, esi
mov dl, 1
mov eax, dword [0x600a1c]
call fcn.00601f60
mov dword [esi + 0x30], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60151b
lea eax, [ebp - 4]
call fcn.00407450
ret

Function at 0x601764
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
xor edx, edx
push ebp
push 0x60180f
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.00601f54
mov ebx, eax
lea eax, [ebx + 0x1c]
mov edx, dword [ebp - 4]
call fcn.00407460
lea edx, [ebp - 0xc]
mov eax, dword [ebp + 8]
call fcn.004165d0
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00407460
lea eax, [ebx + 0x24]
mov edx, dword [ebp - 8]
call fcn.00407460
test edi, edi
je 0x6017d1
mov edx, edi
mov eax, ebx
call fcn.00602aec
jmp 0x6017de
lea eax, [ebx + 0x14]
mov edx, 0x601830
call fcn.00407460
test esi, esi
je 0x6017ec
lea eax, [ebx + 0x10]
mov edx, esi
call fcn.00407460
lea eax, [ebx + 0x18]
mov edx, 0x601854
call fcn.00407460
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x601816
lea eax, [ebp - 0xc]
call fcn.00407450
ret
Function at 0x6020c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x6020c8
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x60226d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x18]
mov ecx, dword [eax + 0xc]
lea eax, [ebp - 4]
mov edx, 0x602288
call fcn.00407934
push esi
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
mov eax, dword [ebx + 0x2c]
push eax
lea eax, [ebp - 0x18]
push eax
movzx ecx, word [ebx + 0x30]
xor edx, edx
mov eax, dword [ebx + 0x1c]
call fcn.005ffdec
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0x11
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x60229c
call fcn.005b8814
mov eax, dword [ebx + 0xc]
call fcn.004077d0
test eax, eax
jle 0x602180
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebx + 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
movzx ecx, word [ebx + 0x30]
xor edx, edx
mov eax, dword [ebx + 0xc]
call fcn.005ffdec
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x602304
call fcn.005b8814
mov edx, dword [ebp - 0x1c]
mov eax, esi
call fcn.00407874
mov eax, esi
mov edx, 0x602330
call fcn.00407874
mov eax, dword [ebx + 0x14]
call fcn.004077d0
test eax, eax
jle 0x6021fe
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x602344
call fcn.005b8814
mov edx, dword [ebp - 0x2c]
mov eax, esi
call fcn.00407874
mov eax, dword [ebx + 0x10]
call fcn.004077d0
test eax, eax
jle 0x6021f2
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x602374
call fcn.005b8814
mov edx, dword [ebp - 0x30]
mov eax, esi
call fcn.00407874
mov edx, 0x602330
mov eax, esi
call fcn.00407874
mov eax, dword [ebx + 0x18]
call fcn.004077d0
test eax, eax
jle 0x602231
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x6023a0
call fcn.005b8814
mov edx, dword [ebp - 0x34]
mov eax, esi
call fcn.00407874
mov eax, esi
mov edx, 0x602330
call fcn.00407874
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x602274
lea eax, [ebp - 0x34]
mov edx, 4
call fcn.00407458
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00407458
lea eax, [ebp - 4]
call fcn.00407450
ret
Function at 0x65cf0c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00407448
xor eax, eax
push ebp
push 0x65cf99
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
test eax, eax
je 0x65cf49
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x65cf49
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.00406b68
test eax, eax
je 0x65cf52
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x65cf76
mov edx, 1
mov ecx, ebx
add ecx, ecx
add ecx, ecx
shr ebx, 0x1e
or ecx, ebx
mov ebx, dword [ebp - 4]
movzx ebx, word [ebx + edx*2 - 2]
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x65cf5b
mov ecx, 0xf
mov eax, ebx
xor edx, edx
div ecx
mov ebx, edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65cfa0
lea eax, [ebp - 4]
call fcn.00407450
ret
Function at 0x69da94
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x69dbc0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0069da70
mov byte [ebp - 9], 1
lea edx, [esi + 0x28]
mov ecx, 4
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
lea edx, [esi + 0x2c]
mov ecx, 4
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
lea edx, [esi + 0x30]
mov ecx, 4
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
lea edx, [ebp - 0xa]
mov ecx, 1
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
lea edx, [ebp - 0xb]
mov ecx, 1
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
lea edx, [ebp - 0x10]
mov ecx, 4
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
lea ecx, [ebp - 4]
xor edx, edx
mov eax, ebx
call fcn.004e0e04
lea ecx, [ebp - 8]
xor edx, edx
mov eax, ebx
call fcn.004e0e04
movzx eax, byte [ebp - 0xa]
sub al, 1
jb 0x69db44
je 0x69db58
dec al
je 0x69db6c
jmp 0x69db91
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x696344]
call fcn.0069ce4c
mov dword [esi + 0x34], eax
jmp 0x69db95
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x696634]
call fcn.0069cfe8
mov dword [esi + 0x34], eax
jmp 0x69db95
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebp - 0xb]
push eax
lea ecx, [esi + 8]
mov dl, 1
mov eax, dword [0x696b20]
call fcn.0069d3f8
mov dword [esi + 0x34], eax
jmp 0x69db95
mov byte [ebp - 9], 0
mov edi, dword [esi + 0x34]
test edi, edi
je 0x69dba5
mov edx, ebx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x14]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x69dbc7
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407458
ret

Function at 0x6a04e4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
push eax
push ecx
mov eax, dword [ebp - 4]
mov ecx, 0x1f
xor eax, 0xe379df84
rcr eax, 5
dec ecx
jne 0x6a04f5
mov dword [ebp - 4], eax
pop ecx
pop eax
mov eax, dword [ebp - 4]
pop ecx
pop ebp
ret
Function at 0x6a51c4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov byte [ebp - 1], 0
push 0
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.0043eff4
mov dl, 1
mov eax, dword [0x433fc4]
call fcn.004056c8
mov ebx, eax
push 0
push 0
mov eax, dword [ebp + 8]
mov edx, dword [eax - 8]
mov eax, ebx
call fcn.0043f298
mov dl, 1
mov eax, dword [0x433fc4]
call fcn.004056c8
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14]
mov edx, dword [ebp - 8]
call fcn.006a5504
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx]
cmp edx, dword [esp + 4]
jne 0x6a5241
cmp eax, dword [esp]
pop edx
pop eax
jne 0x6a5275
mov esi, dword [ebx + 4]
mov eax, dword [ebp - 8]
mov edi, dword [eax + 4]
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov byte [ebp - 9], 0
dec eax
test eax, eax
jl 0x6a526b
inc eax
movzx edx, byte [esi]
xor dl, byte [edi]
or byte [ebp - 9], dl
inc esi
inc edi
dec eax
jne 0x6a525e
cmp byte [ebp - 9], 0
jne 0x6a5275
mov byte [ebp - 1], 1
mov eax, ebx
call fcn.004056f8
mov eax, dword [ebp - 8]
call fcn.004056f8
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6a5c90
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
test dl, dl
je 0x6a5ca2
add esp, 0xfffffff0
call fcn.00405c2c
mov esi, ecx
mov ebx, edx
mov edi, eax
xor edx, edx
mov eax, edi
call fcn.004056c8
lea eax, [edi + 0xc]
mov ecx, 2
mov edx, 0x9c0
call fcn.00404f60
mov dword [edi + 0x9d4], 0x9d2c5680
mov dword [edi + 0x9d8], 0xefc60000
mov dword [edi + 0x9dc], 0x6c078965
mov dword [edi + 4], esi
mov eax, dword [ebp + 8]
mov dword [edi + 8], eax
mov dword [edi + 0x9cc], 1
mov edx, 0xf84652
mov eax, edi
call fcn.006a5d20
mov eax, edi
test bl, bl
je 0x6a5d15
call fcn.00405c84
pop dword fs:[0]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x6a5dc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, eax
and edx, 0xffffffff
mov dword [ebx + 0xc], edx
mov dword [ebp - 8], 1
mov eax, dword [ebx + 4]
sub eax, dword [ebp - 8]
mov dword [ebp - 4], eax
push eax
push ecx
push edx
push esi
mov ecx, dword [ebp - 4]
mov esi, dword [ebp - 8]
lea eax, [ebx + esi*4 + 8]
mov edx, dword [eax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
mov edx, dword [ebx + 0x9dc]
mul edx
add eax, esi
lea edx, [ebx + esi*4 + 0xc]
mov dword [edx], eax
inc esi
dec ecx
jne 0x6a5de9
pop esi
pop edx
pop ecx
pop eax
mov dword [ebx + 0x9cc], 1
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x6a5e20
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
xor esi, esi
mov eax, dword [ebx + 4]
mov dword [ebx + 0x9cc], eax
lea eax, [ebx + 0xc]
mov dword [ebx + 0x9d0], eax
mov eax, dword [ebx + 8]
mov ebp, eax
mov edi, dword [ebx + 4]
sub edi, eax
inc edi
dec edi
test edi, edi
je 0x6a5e69
mov edx, dword [ebx + esi*4 + 0x10]
mov eax, dword [ebx + esi*4 + 0xc]
call fcn.006a5c70
lea edx, [ebp + esi]
xor eax, dword [ebx + edx*4 + 0xc]
mov dword [ebx + esi*4 + 0xc], eax
dec edi
inc esi
test edi, edi
jne 0x6a5e4a
mov eax, dword [ebx + 8]
mov ebp, eax
sub ebp, dword [ebx + 4]
mov edi, eax
dec edi
test edi, edi
je 0x6a5e97
mov edx, dword [ebx + esi*4 + 0x10]
mov eax, dword [ebx + esi*4 + 0xc]
call fcn.006a5c70
lea edx, [ebp + esi]
xor eax, dword [ebx + edx*4 + 0xc]
mov dword [ebx + esi*4 + 0xc], eax
dec edi
inc esi
test edi, edi
jne 0x6a5e78
mov edx, dword [ebx + 0xc]
mov eax, dword [ebx + esi*4 + 0xc]
call fcn.006a5c70
add ebp, esi
xor eax, dword [ebx + ebp*4 + 0xc]
mov dword [ebx + esi*4 + 0xc], eax
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x6a9224
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x6a9236
add esp, 0xfffffff0
call fcn.00405c2c
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00407448
xor eax, eax
push ebp
push 0x6a92af
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, esi
call fcn.004056c8
mov byte [esi + 0xc], 0
lea eax, [esi + 0x10]
mov edx, dword [ebp - 4]
call fcn.00407460
xor eax, eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
xor eax, eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
xor eax, eax
mov dword [esi + 0xb8], eax
mov dword [esi + 0xbc], eax
xor eax, eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
xor eax, eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a92b6
lea eax, [ebp - 4]
call fcn.00407450
ret
Function at 0x6cf1a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x6cf30d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
add eax, 0xfffff000
cmp eax, 4
ja case.default.0x6cf1d7
jmp dword [eax*4 + 0x6cf1de]
mov edx, dword [0x70b20c]
mov edx, dword [edx]
mov eax, dword [ebp - 8]
mov ecx, 0x6cf328
call fcn.00407934
jmp 0x6cf2f4
mov eax, dword [ebp - 8]
mov edx, dword [0x70b20c]
mov edx, dword [edx]
call fcn.00407460
jmp 0x6cf2f4
lea edx, [ebp - 0x21c]
mov eax, dword [0x70b708]
mov eax, dword [eax]
call fcn.004de920
mov eax, dword [ebp - 0x21c]
mov edx, dword [ebp - 8]
call fcn.004163bc
jmp 0x6cf2f4
mov eax, dword [ebp - 8]
mov edx, dword [0x70af38]
mov edx, dword [edx]
call fcn.00407460
jmp 0x6cf2f4
mov eax, dword [ebp - 8]
mov edx, dword [0x70b5dc]
mov edx, dword [edx]
call fcn.00407460
jmp 0x6cf2f4
lea eax, [ebp - 0x218]
xor ecx, ecx
mov edx, 0x106
call fcn.00404f60
xor eax, eax
push ebp
push 0x6cf2b6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
push ebx
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x218]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6cf2d1
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x218]
mov ecx, 0x106
call fcn.00407660
mov eax, dword [ebp - 8]
mov edx, 0x6cf348
call fcn.00407874
mov eax, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6cf314
lea eax, [ebp - 0x21c]
call fcn.00407450
ret
Function at 0x6d2e38
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov esi, dword [ebp + 8]
add esi, 0xfffffffc
xor eax, eax
push ebp
push 0x6d3023
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [esi]
cmp dword [eax + 0x30], 0x3e8
jl 0x6d2ffb
mov eax, dword [esi]
cmp dword [eax + 0x1c], 0
jge 0x6d2e8e
mov eax, dword [esi]
mov dword [eax + 0x1c], 1
lea eax, [ebp - 4]
mov edx, dword [0x70b660]
mov edx, dword [edx + 0xc]
call fcn.004074b4
lea eax, [ebp - 8]
mov edx, dword [0x70b660]
mov edx, dword [edx + 8]
call fcn.004074b4
mov eax, dword [0x70b660]
cmp dword [eax + 0x1bc], 1
jne 0x6d2edb
call fcn.006d29d4
test al, al
je 0x6d2edb
lea eax, [ebp - 4]
xor edx, edx
call fcn.004074b4
lea eax, [ebp - 8]
xor edx, edx
call fcn.004074b4
mov eax, dword [esi]
mov eax, dword [eax + 0x1c]
cmp eax, 0x64
jge 0x6d2ee9
mov ebx, eax
jmp 0x6d2eee
mov ebx, 0x64
lea eax, [ebp - 0x2c]
push eax
lea edx, [ebp - 0x30]
mov eax, ebx
call fcn.00415790
mov ecx, dword [ebp - 0x30]
mov edx, 0x6d303c
mov eax, dword [ebp - 4]
call fcn.0040f8c4
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 4]
call fcn.004074b4
lea eax, [ebp - 0x34]
push eax
lea edx, [ebp - 0x38]
mov eax, dword [0x70b660]
mov eax, dword [eax + 0x170]
call fcn.00415790
mov ecx, dword [ebp - 0x38]
mov edx, 0x6d3058
mov eax, dword [ebp - 4]
call fcn.0040f8c4
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 4]
call fcn.004074b4
mov eax, dword [esi]
fild dword [eax + 0x34]
mov eax, dword [esi]
fild dword [eax + 0x30]
fdivp st(1)
fmul dword [0x6d306c]
fstp xword [ebp - 0x18]
wait
fld xword [ebp - 0x18]
fcomp dword [0x6d306c]
wait
fnstsw ax
sahf
jae 0x6d2f84
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov ax, word [ebp - 0x10]
mov word [ebp - 0x20], ax
jmp 0x6d2f96
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 0xc8000000
mov word [ebp - 0x20], 0x4005
lea eax, [ebp - 0x3c]
push eax
fld xword [ebp - 0x28]
call fcn.00404a9c
push edx
push eax
lea eax, [ebp - 0x40]
call fcn.004159d4
mov ecx, dword [ebp - 0x40]
mov edx, 0x6d307c
mov eax, dword [ebp - 4]
call fcn.0040f8c4
mov edx, dword [ebp - 0x3c]
lea eax, [ebp - 4]
call fcn.004074b4
mov eax, dword [esi]
mov eax, dword [eax + 0x38]
mov eax, dword [eax + 0x6c]
mov edx, dword [ebp - 4]
call fcn.004ae23c
mov eax, dword [0x70b708]
mov eax, dword [eax]
mov edx, dword [ebp - 8]
call fcn.004dd8e4
mov eax, dword [esi]
xor edx, edx
mov dword [eax + 0x30], edx
mov eax, dword [esi]
xor edx, edx
mov dword [eax + 0x1c], edx
mov eax, dword [esi]
xor edx, edx
mov dword [eax + 0x34], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6d302a
lea eax, [ebp - 0x40]
mov edx, 6
call fcn.00407458
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407458
ret