joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e59c4
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x5e5ab0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x8000000
push 3
push 0
push 3
push 0x80000000
mov eax, edi
call fcn.00405e40
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x5e5a39
push 0
push 0x8000000
push 3
push 0
push 3
push 0x80000000
lea edx, [ebp - 0xc]
mov eax, edi
call fcn.00407d58
mov eax, dword [ebp - 0xc]
call fcn.004062b8
push eax
call sub.KERNEL32.DLL_CreateFileW
mov ebx, eax
cmp ebx, 0xffffffff
je 0x5e5a92
test esi, esi
jne 0x5e5a4c
push 0
push ebx
call sub.KERNEL32.DLL_GetFileSize
mov esi, eax
test esi, esi
jbe 0x5e5a82
mov eax, dword [ebp - 4]
mov edx, esi
call fcn.00405fcc
push 0
lea eax, [ebp - 8]
push eax
push esi
mov eax, dword [ebp - 4]
call fcn.00405e98
push eax
push ebx
call sub.KERNEL32.DLL_ReadFile
cmp esi, dword [ebp - 8]
je 0x5e5a8a
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405fcc
jmp 0x5e5a8a
mov eax, dword [ebp - 4]
call fcn.00405964
push ebx
call sub.KERNEL32.DLL_CloseHandle
jmp 0x5e5a9a
mov eax, dword [ebp - 4]
call fcn.00405964
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e5ab7
lea eax, [ebp - 0xc]
call fcn.0040608c
ret

Function at 0x5e5ac0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov byte [ebp - 1], cl
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x5e5be8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 1], 0
je 0x5e5b0c
push 0
push 0x80
push 4
push 0
push 3
push 4
mov eax, esi
call fcn.00405e40
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
jmp 0x5e5b2d
push 0
push 0x80
push 2
push 0
push 3
push 0x40000000
mov eax, esi
call fcn.00405e40
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x5e5b8f
cmp byte [ebp - 1], 0
je 0x5e5b63
push 0
push 0x80
push 4
push 0
push 3
push 4
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.00407d58
mov eax, dword [ebp - 0xc]
call fcn.004062b8
push eax
call sub.KERNEL32.DLL_CreateFileW
mov ebx, eax
jmp 0x5e5b8f
push 0
push 0x80
push 2
push 0
push 3
push 0x40000000
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.00407d58
mov eax, dword [ebp - 0x10]
call fcn.004062b8
push eax
call sub.KERNEL32.DLL_CreateFileW
mov ebx, eax
cmp ebx, 0xffffffff
je 0x5e5bcb
mov eax, edi
call fcn.00405c40
mov esi, eax
test esi, esi
jbe 0x5e5bb8
push 0
lea eax, [ebp - 8]
push eax
push esi
mov eax, edi
call fcn.00405e40
push eax
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x5e5bbd
xor eax, eax
mov dword [ebp - 8], eax
push ebx
call sub.KERNEL32.DLL_CloseHandle
cmp esi, dword [ebp - 8]
sete bl
jmp 0x5e5bcd
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e5bef
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004060a4
ret
Function at 0x5e7c14
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x5e7c65
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x5e7c4c
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x5e7c3c
jmp 0x5e7c65
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x5e7c4d
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5f9838
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
xor esi, esi
mov eax, ebx
call fcn.00409230
cmp ax, 0xffff
jne 0x5f9859
neg ebx
mov eax, ebx
shr eax, 4
and eax, 0xffff
inc eax
and ebx, 0xf
push 6
push eax
push edi
call sub.KERNEL32.DLL_FindResourceA
test eax, eax
je 0x5f98e5
push eax
push edi
call sub.KERNEL32.DLL_LoadResource
mov edi, eax
test edi, edi
je 0x5f98e5
push edi
call sub.KERNEL32.DLL_LockResource
mov dword [ebp - 8], eax
mov eax, ebx
dec eax
test eax, eax
jl 0x5f98a6
inc eax
mov edx, dword [ebp - 8]
movzx edx, word [edx]
add edx, edx
add edx, dword [ebp - 8]
add edx, 2
mov dword [ebp - 8], edx
dec eax
jne 0x5f9892
mov eax, dword [ebp - 8]
movzx esi, word [eax]
add dword [ebp - 8], 2
cmp dword [ebp - 4], 0
je 0x5f98e5
cmp dword [ebp + 8], 0
jle 0x5f98e5
mov eax, dword [ebp + 8]
dec eax
mov edx, esi
call fcn.0043a268
mov esi, eax
test esi, esi
jle 0x5f98dc
mov ecx, esi
add ecx, ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00409244
mov eax, dword [ebp - 4]
mov word [eax + esi*2], 0
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x5fa564
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x5fa5c8
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00405bd4
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetACP
mov edx, eax
pop eax
call fcn.0040c7e8
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5fa5cf
lea eax, [ebp - 0xc]
call fcn.00405964
ret
Function at 0x5fa62c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, edx
lea edi, [esp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x5fa688
push esp
push 0x40
push 6
push ebx
call sub.KERNEL32.DLL_VirtualProtect
test eax, eax
jne 0x5fa657
call fcn.00411f4c
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
mov ecx, 6
call fcn.00403618
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
push 6
mov eax, dword [esp + 0x14]
push eax
call sub.KERNEL32.DLL_VirtualProtect
test eax, eax
jne 0x5fa688
call fcn.00411f4c
add esp, 0x14
pop edi
pop esi
pop ebx
ret

Function at 0x601714
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.0040608c
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
je 0x601763
push 0x200
lea edx, [ebp - 0x202]
push edx
push eax
call sub.user32.dll_GetKeyNameTextW
mov eax, ebx
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00406220
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x601768
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push 2
movzx eax, bx
push eax
call sub.user32.dll_MapVirtualKeyW
mov edi, eax
mov eax, ebx
add eax, 0xffffffd0
sub ax, 0xa
jae 0x6017a0
mov esi, ebx
sub si, 0x30
add si, 0x30
cmp si, di
je 0x6017a0
push esi
call sub.user32.dll_VkKeyScanW
cmp al, bl
jne 0x6017a0
mov edi, esi
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x60927c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x609400
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [ebx + 0x2be]
sub al, 2
jb 0x6093e5
cmp byte [ebx + 0x2b0], 0
je 0x6093e5
mov eax, dword [ebp - 4]
call fcn.006038d0
mov word [ebp - 6], ax
xor eax, eax
push ebp
push 0x6093de
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [ebp - 6]
sub ax, 8
je 0x609322
dec ax
je 0x6092f8
sub ax, 0x12
jne 0x60933c
call fcn.0040537c
jmp 0x6093e5
cmp byte [ebx + 0x2b1], 0
je 0x6093c4
mov eax, ebx
call fcn.0044633c
test al, al
je 0x6093c4
xor edx, edx
mov eax, ebx
call fcn.00446360
jmp 0x6093c4
mov eax, dword [esi]
call fcn.004062c8
mov edx, eax
mov eax, esi
mov ecx, 1
call fcn.004064b4
jmp 0x6093c4
cmp byte [ebx + 0x2b1], 0
je 0x609359
mov eax, ebx
call fcn.0044633c
test al, al
jne 0x609359
mov dl, 1
mov eax, ebx
call fcn.00446360
call sub.KERNEL32.DLL_GetTickCount
mov edx, dword [ebp + 8]
sub eax, dword [edx]
cmp eax, 0x4e2
jb 0x609371
mov eax, esi
call fcn.0040608c
call sub.KERNEL32.DLL_GetTickCount
mov edx, dword [ebp + 8]
mov dword [edx], eax
push 0
push 1
lea eax, [ebp - 0x10]
mov dx, word [ebp - 6]
call fcn.004061a4
mov ecx, dword [ebp - 0x10]
mov edx, dword [esi]
lea eax, [ebp - 0xc]
call fcn.00406334
mov ecx, dword [ebp - 0xc]
mov edx, edi
mov eax, ebx
call fcn.006090ac
test al, al
je 0x6093c4
lea eax, [ebp - 0x14]
mov dx, word [ebp - 6]
call fcn.004061a4
mov edx, dword [ebp - 0x14]
mov eax, esi
call fcn.004062d4
mov word [ebp - 6], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6093e5
mov eax, dword [ebp - 4]
mov dx, word [ebp - 6]
call fcn.00603904
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x609407
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004060a4
ret
Function at 0x60c778
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x60c7a7
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x60c826
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.0060a7ac
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x60c7f4
mov cx, word [esp]
sub cx, si
jmp 0x60c7f6
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x60c7dd
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x60c81c
mov cx, word [esp]
sub cx, si
jmp 0x60c81e
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x60c805
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x60c907
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.0060c4ec
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x60c872
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
mov eax, dword [ebx + 0x74]
cmp eax, 0x106
jae 0x60c888
mov edx, dword [ebx]
cmp dword [edx + 4], 0
jne 0x60c782
mov ecx, dword [ebx + 0x3c]
mov edx, dword [ebx + 0x16c0]
cmp ecx, edx
jbe 0x60c907
mov esi, dword [ebx + 0x6c]
add esi, eax
cmp esi, edx
jbe 0x60c8ca
mov edi, ecx
sub edi, esi
cmp edi, 0x102
jbe 0x60c8af
mov edi, 0x102
push edi
push 0
mov eax, dword [ebx + 0x38]
add eax, esi
push eax
call fcn.0060a794
add esp, 0xc
add edi, esi
mov dword [ebx + 0x16c0], edi
jmp 0x60c907
lea edx, [esi + 0x102]
mov eax, dword [ebx + 0x16c0]
cmp edx, eax
jbe 0x60c907
mov edi, edx
mov edx, dword [ebx + 0x3c]
sub edx, eax
sub edi, eax
cmp edi, edx
jbe 0x60c8f0
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x16c0]
push edi
push 0
mov edx, dword [ebx + 0x38]
add edx, eax
push edx
call fcn.0060a794
add esp, 0xc
add dword [ebx + 0x16c0], edi
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x612b04
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x644110
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x612b26
shr eax, 1
xor eax, 0xedb88320
jmp 0x612b28
shr eax, 1
dec edx
jne 0x612b14
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x612b0d
mov byte [0x644510], 1
pop esi
pop ebx
ret
Function at 0x612b44
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x644510], 0
jne 0x612b5b
call fcn.00612b04
mov eax, edi
dec eax
test eax, eax
jl 0x612b84
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x644110]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x612b65
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x6156a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x6156d1
dec al
je 0x61570d
dec al
je 0x615751
dec al
je 0x6157bc
jmp 0x615846
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x615846
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x6156e1
jmp 0x615846
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x615846
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x61571d
jmp 0x615846
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x615846
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x61577f
xor ebp, ebp
jmp 0x615790
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x615799
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x615761
jmp 0x615846
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x615846
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x615814
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.00612b8c
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x6157d0
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x61b990
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
mov edi, eax
or ebx, 0xffffffff
mov eax, edi
call fcn.00405c40
dec eax
test eax, eax
jl 0x61b9c4
inc eax
xor esi, esi
mov dl, byte [edi + esi]
xor dl, bl
and edx, 0xff
mov edx, dword [edx*4 + 0x63c5bc]
shr ebx, 8
xor edx, ebx
mov ebx, edx
inc esi
dec eax
jne 0x61b9a7
xor ebx, 0xffffffff
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x61bb50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffefc
mov esi, edx
lea edi, [esp + 0xc]
push ecx
mov ecx, 0x3e
rep movsd dword es:[edi], dword [esi]
pop ecx
mov esi, ecx
mov dword [esp], eax
lea ebp, [esp + 8]
mov eax, dword [esi]
push eax
call fcn.0061bae8
mov dword [ebp], eax
mov eax, dword [esi]
movzx ebx, word [eax + 6]
dec ebx
test ebx, ebx
jl 0x61bc4e
inc ebx
mov eax, dword [ebp]
cmp dword [eax + 0x10], 0
jne 0x61bbe4
mov edi, dword [esp + 0x44]
test edi, edi
jle 0x61bbd7
push 0x40
push 0x1000
push edi
mov eax, dword [ebp]
mov eax, dword [eax + 0xc]
xor edx, edx
push edx
push eax
mov eax, dword [esi + 4]
call fcn.0061ba38
push eax
call sub.KERNEL32.DLL_VirtualAlloc
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
mov edx, dword [ebp]
mov dword [edx + 8], eax
mov edx, edi
mov eax, dword [esp + 4]
call fcn.00409258
push 0
push 0x28
mov eax, ebp
call fcn.0061ba08
jmp 0x61bc47
push 0x40
push 0x1000
mov eax, dword [ebp]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebp]
mov eax, dword [eax + 0xc]
xor edx, edx
push edx
push eax
mov eax, dword [esi + 4]
call fcn.0061ba38
push eax
call sub.KERNEL32.DLL_VirtualAlloc
mov dword [esp + 4], eax
mov eax, dword [ebp]
mov eax, dword [eax + 0x14]
xor edx, edx
push edx
push eax
mov eax, dword [esp + 8]
call fcn.0061ba38
mov edx, eax
mov eax, dword [ebp]
mov ecx, dword [eax + 0x10]
mov eax, dword [esp + 4]
call fcn.00409244
mov eax, dword [esp + 4]
mov edx, dword [ebp]
mov dword [edx + 8], eax
push 0
push 0x28
mov eax, ebp
call fcn.0061ba08
dec ebx
jne 0x61bb8d
add esp, 0x104
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x61c058
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
test eax, 0x4000000
je 0x61c06d
or edx, 0x200
test eax, 0x20000000
je 0x61c0a0
test eax, 0x40000000
je 0x61c08c
test eax, 0x80000000
je 0x61c087
or edx, 0x40
jmp 0x61c0c7
or edx, 0x20
jmp 0x61c0c7
test eax, 0x80000000
je 0x61c09b
or edx, 0x80
jmp 0x61c0c7
or edx, 0x10
jmp 0x61c0c7
test eax, 0x40000000
je 0x61c0b8
test eax, 0x80000000
je 0x61c0b3
or edx, 4
jmp 0x61c0c7
or edx, 2
jmp 0x61c0c7
test eax, 0x80000000
je 0x61c0c4
or edx, 8
jmp 0x61c0c7
or edx, 1
mov eax, edx
pop ebp
ret 4
Function at 0x622408
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x62249b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
call sub.shell32.dll_SHGetMalloc
test eax, eax
je 0x62243d
mov eax, esi
call fcn.00405964
jmp 0x622485
lea eax, [ebp - 8]
push eax
push ebx
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.00420288
test al, al
je 0x622485
mov eax, 0x104
call fcn.00403320
mov ebx, eax
push ebx
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, esi
mov edx, ebx
call fcn.00405b5c
mov eax, ebx
call fcn.0040333c
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6224a2
lea eax, [ebp - 4]
call fcn.00407924
ret
Function at 0xedd764
Capabilities:
Encode data using xor

Disassembly:
jmp 0xedd76e
pushal
call 0xedd774
pop ebp
sub ebp, 0x10
sub ebp, 0xadd764
jmp 0xedd78a
mov eax, 0xadd764
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c2
mov edx, 0x37a809e
xor byte [eax], dl
inc eax
dec ecx
jne 0xedd7a1
jmp 0xedd7b4
xor ah, bl
push edx
adc eax, 0xa2171553
sahf
sahf
sahf
pop ds
pop edi
sahf
sahf
sahf
popfd
push ebx
cwde
sahf
sahf
sahf
and al, 0xb6
sahf
sahf
sahf
imul edi, dword [ebp + ebx*4 + 0x56], 0x9e921f15
sahf
sahf
popfd
pop ebx
adc edi, edx
mov edx, 0xba9a1762
into
neg byte [esi - 0x961400f]
cld
not byte [edx]
sahf
lahf
mov dl, 0xba
not byte [eax + 0x7690a5d2]
wait
sahf
sahf
sahf
ja 0xedd7b1
sahf
sahf
sahf
retf
Function at 0x4012f0
Capabilities:
Write file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
mov eax, 0x4048
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
call fcn.00402df8
sub esp, eax
mov ebx, ecx
mov esi, dword [ecx + 4]
mov edi, dword [ecx]
mov dword [esp], 0xfffffff5
add ebx, 8
call dword [sym.imp.kernel32.dll_GetStdHandle]
mov dword [ebp - 0x401c], 0
sub esp, 4
mov dword [ebp - 0x402c], eax
mov dword [esp + 0x18], ebx
lea ebx, [ebp - 0x4018]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], 0x2000
mov dword [esp + 8], ebx
mov dword [esp], 4
mov dword [esp + 4], 0
call dword [sym.imp.ucrtbase.dll___stdio_common_vswprintf]
mov edx, 0xffffffff
lea ecx, [ebp - 0x4020]
mov dword [esp + 4], ebx
test eax, eax
mov dword [esp + 0x10], 0
cmovns edx, eax
mov dword [esp + 0xc], ecx
mov dword [esp], edi
mov dword [esp + 8], edx
mov esi, edx
call dword [sym.imp.kernel32.dll_WriteConsoleW]
sub esp, 0x14
test eax, eax
jne 0x4013d5
cmp dword [ebp - 0x402c], edi
lea ecx, [ebp - 0x4020]
je 0x4013f0
lea eax, [esi + esi]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
mov eax, dword [ebp - 0x401c]
add eax, dword [ebp - 0x4020]
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov eax, dword [section..bss]
test eax, eax
jne 0x4013b2
lea eax, [ebp - 0x401c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 2
mov dword [esp + 4], global_bomW
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_WriteFile]
lea ecx, [ebp - 0x4020]
mov dword [section..bss], 1
sub esp, 0x14
jmp 0x4013b2
Function at 0x4023a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x4023fb
cmp byte [esi + ebx - 1], 0xa
je 0x4023cf
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x4060a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret