joyce8/EMBER2024-capa huggingface dataset:
Function at 0x61a0d0
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffb8
mov dword [esp], 0
mov dword [esp + 4], 0
lea eax, [esp + 8]
xor ecx, ecx
mov edx, 0x40
call fcn.00408458
mov dword [esp + 8], 0x40
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GlobalMemoryStatusEx
test eax, eax
je 0x61a117
mov eax, dword [esp + 0x18]
mov dword [esp], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], eax
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 0x48
ret

Function at 0x61a124
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffb8
mov dword [esp], 0
mov dword [esp + 4], 0
lea eax, [esp + 8]
xor ecx, ecx
mov edx, 0x40
call fcn.00408458
mov dword [esp + 8], 0x40
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GlobalMemoryStatusEx
test eax, eax
je 0x61a173
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub eax, dword [esp + 0x18]
sbb edx, dword [esp + 0x1c]
mov dword [esp], eax
mov dword [esp + 4], edx
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 0x48
ret

Function at 0x61a180
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffb8
mov dword [esp], 0
mov dword [esp + 4], 0
lea eax, [esp + 8]
xor ecx, ecx
mov edx, 0x40
call fcn.00408458
mov dword [esp + 8], 0x40
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GlobalMemoryStatusEx
test eax, eax
je 0x61a1c7
mov eax, dword [esp + 0x10]
mov dword [esp], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 4], eax
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 0x48
ret
Function at 0x61a62c
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040b418
mov eax, dword [ebp - 8]
call fcn.0040b418
mov eax, dword [ebp - 0xc]
call fcn.0040b418
xor eax, eax
push ebp
push 0x61a759
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x54]
xor ecx, ecx
mov edx, 0x44
call fcn.00408458
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x28], 0x101
mov word [ebp - 0x24], 0
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xc], 0
je 0x61a6aa
mov esi, dword [ebp - 0xc]
jmp 0x61a6b5
lea eax, [ebp - 0x68]
call fcn.0042778c
mov esi, dword [ebp - 0x68]
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push 0
push 0
push 0
push 0
push 0
push 0x61a774
push dword [ebp - 4]
push 0x61a784
push dword [ebp - 8]
lea eax, [ebp - 0x6c]
mov edx, 4
call fcn.0040c2b8
mov eax, dword [ebp - 0x6c]
call fcn.0040bfcc
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x61a72a
lea eax, [ebp - 0x60]
call fcn.0061a53c
push 0xffffffffffffffff
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_GetExitCodeProcess
lea eax, [ebp - 0x64]
call fcn.0061a53c
cmp dword [ebp - 0x10], 0
sete bl
jmp 0x61a72f
call fcn.0042fc88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61a760
lea eax, [ebp - 0x6c]
mov edx, 2
call fcn.0040b384
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040b384
pop eax
jmp eax
Function at 0x61a78c
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040b418
mov eax, dword [ebp - 8]
call fcn.0040b418
mov eax, dword [ebp - 0xc]
call fcn.0040b418
xor eax, eax
push ebp
push 0x61a93d
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
push 0x68e938
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
call sub.kernel32.dll_CreatePipe
push 0
push 1
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_SetHandleInformation
lea eax, [ebp - 0x5c]
xor ecx, ecx
mov edx, 0x44
call fcn.00408458
mov dword [ebp - 0x5c], 0x44
mov dword [ebp - 0x30], 0x101
mov word [ebp - 0x2c], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x6c]
xor ecx, ecx
mov edx, 0x10
call fcn.00408458
cmp dword [ebp - 0xc], 0
je 0x61a83b
mov esi, dword [ebp - 0xc]
jmp 0x61a846
lea eax, [ebp - 0x70]
call fcn.0042778c
mov esi, dword [ebp - 0x70]
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x5c]
push eax
push esi
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0x61a95c
push dword [ebp - 4]
push 0x61a96c
push dword [ebp - 8]
lea eax, [ebp - 0x74]
mov edx, 4
call fcn.0040c2b8
mov eax, dword [ebp - 0x74]
call fcn.0040bfcc
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x61a8fe
lea eax, [ebp - 0x68]
call fcn.0061a53c
lea eax, [ebp - 0x10]
call fcn.0061a53c
xor eax, eax
push ebp
push 0x61a8ce
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
call fcn.0061a4c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61a8d5
lea eax, [ebp - 0x14]
call fcn.0061a53c
pop eax
jmp eax
lea eax, [ebp - 0x10]
call fcn.0061a53c
lea eax, [ebp - 0x14]
call fcn.0061a53c
call fcn.0042fc88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61a944
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.0040b384
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040b384
pop eax
jmp eax
Function at 0x61a974
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x61a97d
mov eax, dword [ebp - 4]
add esp, 0xffffff90
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10074], ebx
mov dword [ebp - 0x10070], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.0040b418
mov eax, dword [ebp - 8]
call fcn.0040b418
mov eax, dword [ebp - 0xc]
call fcn.0040b418
xor eax, eax
push ebp
push 0x61ab87
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
push 0x68e944
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
call sub.kernel32.dll_CreatePipe
push 0
push 1
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_SetHandleInformation
lea eax, [ebp - 0x5c]
xor ecx, ecx
mov edx, 0x44
call fcn.00408458
mov dword [ebp - 0x5c], 0x44
mov dword [ebp - 0x30], 0x101
mov word [ebp - 0x2c], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x6c]
xor ecx, ecx
mov edx, 0x10
call fcn.00408458
cmp dword [ebp - 0xc], 0
je 0x61aa40
mov edi, dword [ebp - 0xc]
jmp 0x61aa51
lea eax, [ebp - 0x10070]
call fcn.0042778c
mov edi, dword [ebp - 0x10070]
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x5c]
push eax
push edi
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0x61aba8
push dword [ebp - 4]
push 0x61abb8
push dword [ebp - 8]
lea eax, [ebp - 0x10074]
mov edx, 4
call fcn.0040c2b8
mov eax, dword [ebp - 0x10074]
call fcn.0040bfcc
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x61ab45
lea eax, [ebp - 0x68]
call fcn.0061a53c
lea eax, [ebp - 0x10]
call fcn.0061a53c
xor eax, eax
push ebp
push 0x61ab15
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x1006c]
mov ecx, 0x10000
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
test ebx, ebx
jle 0x61aafd
lea edx, [ebp - 0x1006c]
mov ecx, ebx
mov eax, dword [ebp - 0x14]
call fcn.0061a4c8
lea edx, [ebp - 0x1006c]
mov ecx, 0x10000
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
test ebx, ebx
jg 0x61aad5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61ab1c
lea eax, [ebp - 0x14]
call fcn.0061a53c
pop eax
jmp eax
lea eax, [ebp - 0x10]
call fcn.0061a53c
lea eax, [ebp - 0x14]
call fcn.0061a53c
call fcn.0042fc88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61ab8e
lea eax, [ebp - 0x10074]
mov edx, 2
call fcn.0040b384
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040b384
pop eax
jmp eax
Function at 0x61abc0
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create process suspended
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x61abc9
mov eax, dword [ebp - 4]
add esp, 0xffffff8c
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x10078], ebx
mov dword [ebp - 0x10074], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040b418
mov eax, dword [ebp - 8]
call fcn.0040b418
mov eax, dword [ebp - 0xc]
call fcn.0040b418
mov eax, dword [ebp + 8]
call fcn.004105cc
xor eax, eax
push ebp
push 0x61add7
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
push 0x68e950
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
call sub.kernel32.dll_CreatePipe
push 0
push 1
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_SetHandleInformation
lea eax, [ebp - 0x60]
xor ecx, ecx
mov edx, 0x44
call fcn.00408458
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x34], 0x101
mov word [ebp - 0x30], 0
xor eax, eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x70]
xor ecx, ecx
mov edx, 0x10
call fcn.00408458
cmp dword [ebp - 0xc], 0
je 0x61ac90
mov esi, dword [ebp - 0xc]
jmp 0x61aca1
lea eax, [ebp - 0x10074]
call fcn.0042778c
mov esi, dword [ebp - 0x10074]
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x60]
push eax
push esi
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0x61adf4
push dword [ebp - 4]
push 0x61ae04
push dword [ebp - 8]
lea eax, [ebp - 0x10078]
mov edx, 4
call fcn.0040c2b8
mov eax, dword [ebp - 0x10078]
call fcn.0040bfcc
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x61ad8d
lea eax, [ebp - 0x6c]
call fcn.0061a53c
lea eax, [ebp - 0x14]
call fcn.0061a53c
xor eax, eax
push ebp
push 0x61ad5d
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x61ad20
lea edx, [ebp - 0x10070]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
lea eax, [ebp - 0x1c]
push eax
push 0x10000
lea eax, [ebp - 0x10070]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x61ad45
cmp dword [ebp - 0x1c], 0
ja 0x61ad0f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61ad64
lea eax, [ebp - 0x10]
call fcn.0061a53c
pop eax
jmp eax
lea eax, [ebp - 0x10]
call fcn.0061a53c
lea eax, [ebp - 0x14]
call fcn.0061a53c
call fcn.0042fc88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61adde
lea eax, [ebp - 0x10078]
mov edx, 2
call fcn.0040b384
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040b384
lea eax, [ebp + 8]
call fcn.00410558
pop eax
jmp eax
Function at 0x61ae0c
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x61ae16
mov eax, dword [esp + 0x10000]
mov edi, ecx
mov esi, edx
mov ebx, eax
mov byte [edi], 0
jmp 0x61ae40
lea edx, [esp + 4]
mov eax, dword [esi]
mov ecx, dword [esp]
mov ebp, dword [eax]
call dword [ebp + 0xc]
push 0
lea eax, [esp + 4]
push eax
push 0x10000
lea eax, [esp + 0x10]
push eax
push ebx
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x61ae61
cmp dword [esp], 0
ja 0x61ae32
cmp dword [esp], 0
sete al
mov byte [edi], al
add esp, 0x10004
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x61b340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040b418
xor eax, eax
push ebp
push 0x61b516
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.0040b324
mov byte [ebp - 0x11], 0
xor eax, eax
mov dword [ebp - 0x10], eax
mov ebx, 1
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 8]
jg 0x61b4d9
mov byte [ebp - 0x11], 0
jmp 0x61b391
inc ebx
mov esi, dword [ebp - 4]
test esi, esi
je 0x61b39d
sub esi, 4
mov esi, dword [esi]
cmp esi, ebx
jl 0x61b3b7
mov eax, dword [ebp - 4]
cmp word [eax + ebx*2 - 2], 0x20
je 0x61b390
mov eax, dword [ebp - 4]
cmp word [eax + ebx*2 - 2], 9
je 0x61b390
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x61b3ce
mov eax, dword [ebp - 0x18]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
cmp ebx, dword [ebp - 0x18]
jg 0x61b4d9
mov eax, dword [ebp - 4]
cmp word [eax + ebx*2 - 2], 0x22
sete byte [ebp - 0x11]
lea edi, [ebx + 1]
cmp byte [ebp - 0x11], 0
je 0x61b3ee
inc ebx
cmp byte [ebp - 0x11], 0
je 0x61b421
jmp 0x61b3f7
inc edi
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x61b40e
mov eax, dword [ebp - 0x1c]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
cmp edi, dword [ebp - 0x1c]
jg 0x61b470
mov eax, dword [ebp - 4]
cmp word [eax + edi*2 - 2], 0x22
jne 0x61b3f6
jmp 0x61b470
inc edi
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x61b438
mov eax, dword [ebp - 0x20]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
cmp edi, dword [ebp - 0x20]
jg 0x61b466
mov eax, dword [ebp - 4]
movzx eax, word [eax + edi*2 - 2]
mov word [ebp - 0x22], ax
movzx eax, word [ebp - 0x22]
sub ax, 0x20
je 0x61b45d
sub ax, 2
je 0x61b45d
xor eax, eax
jmp 0x61b45f
mov al, 1
xor al, 1
mov byte [ebp - 0x23], al
jmp 0x61b46a
mov byte [ebp - 0x23], 0
cmp byte [ebp - 0x23], 0
jne 0x61b420
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 8]
jne 0x61b4b2
mov eax, dword [ebp - 4]
cmp word [eax + ebx*2 - 2], 0x22
jne 0x61b49e
mov eax, dword [ebp - 4]
movzx eax, word [eax + ebx*2 - 2]
mov edx, dword [ebp - 4]
cmp ax, word [edx + ebx*2]
jne 0x61b49e
mov eax, dword [ebp + 8]
call fcn.0040b324
jmp 0x61b4b2
mov eax, dword [ebp + 8]
push eax
mov ecx, edi
sub ecx, ebx
mov edx, ebx
dec edx
inc edx
mov eax, dword [ebp - 4]
call fcn.0040c400
cmp byte [ebp - 0x11], 0
jne 0x61b4c7
mov eax, dword [ebp - 4]
cmp word [eax + edi*2 - 2], 0x22
jne 0x61b4c7
mov ebx, edi
jmp 0x61b4ca
lea ebx, [edi + 1]
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 8]
jle 0x61b38a
movzx eax, byte [ebp - 9]
and al, byte [ebp - 0x11]
je 0x61b4fe
push 0x61b534
mov eax, dword [ebp + 8]
push dword [eax]
push 0x61b534
mov eax, dword [ebp + 8]
mov edx, 3
call fcn.0040c2b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61b51d
lea eax, [ebp - 4]
call fcn.0040b324
pop eax
jmp eax
Function at 0x61bc60
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [esp + 8]
mov edi, dword [eax + 4]
mov eax, dword [esp + 8]
mov eax, dword [eax]
mov ebx, eax
xor edx, edx
add edx, 0x18
add ebx, edx
movzx eax, word [eax + 0x14]
add ebx, eax
mov eax, dword [esp + 8]
mov eax, dword [eax]
movzx ebp, word [eax + 6]
dec ebp
test ebp, ebp
jl 0x61bd39
inc ebp
cmp dword [ebx + 0x10], 0
jne 0x61bcf5
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x38]
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 0
jle 0x61bcf0
push 4
push 0x1000
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [ebx + 0xc]
add eax, edi
push eax
call sub.kernel32.dll_VirtualAlloc
mov esi, eax
test esi, esi
jne 0x61bcdb
xor eax, eax
jmp 0x61bd3b
mov esi, dword [ebx + 0xc]
add esi, edi
mov dword [ebx + 8], esi
mov eax, esi
xor ecx, ecx
mov edx, dword [esp + 0xc]
call fcn.00408458
add ebx, 0x28
jmp 0x61bd32
push 4
push 0x1000
mov eax, dword [ebx + 0x10]
push eax
mov eax, dword [ebx + 0xc]
add eax, edi
push eax
call sub.kernel32.dll_VirtualAlloc
mov esi, eax
test esi, esi
jne 0x61bd15
xor eax, eax
jmp 0x61bd3b
mov esi, dword [ebx + 0xc]
add esi, edi
mov eax, dword [ebx + 0x14]
add eax, dword [esp]
mov edx, dword [ebx + 0x10]
mov ecx, esi
xchg edx, ecx
call fcn.00407830
mov dword [ebx + 8], esi
add ebx, 0x28
dec ebp
jne 0x61bca2
mov al, 1
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x61be1c
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffdc
mov esi, eax
lea ebp, [esp + 0x10]
mov eax, dword [esi]
mov ebx, eax
xor edx, edx
add edx, 0x18
add ebx, edx
movzx eax, word [eax + 0x14]
add ebx, eax
xor eax, eax
mov dword [esp], eax
mov edi, dword [ebx + 8]
or edi, dword [esp]
mov dword [ebp], edi
mov edx, dword [esi + 0x14]
mov eax, edi
call fcn.0061bc58
mov dword [ebp + 4], eax
mov edx, ebx
mov eax, esi
call fcn.0061bd44
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x24]
mov dword [ebp + 0xc], eax
mov byte [ebp + 0x10], 0
add ebx, 0x28
mov eax, dword [esi]
movzx eax, word [eax + 6]
dec eax
test eax, eax
jle 0x61bf1c
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 8]
or eax, dword [esp]
mov dword [esp + 4], eax
mov edx, dword [esi + 0x14]
mov eax, dword [ebp]
call fcn.0061bc58
mov edi, eax
mov edx, ebx
mov eax, esi
call fcn.0061bd44
mov dword [esp + 8], eax
cmp edi, dword [ebp + 4]
je 0x61beb4
mov eax, dword [ebp]
add eax, dword [ebp + 8]
cmp eax, edi
jbe 0x61bee7
mov eax, dword [ebx + 0x24]
test eax, 0x2000000
je 0x61bec4
test byte [ebp + 0xf], 2
jne 0x61bed1
or eax, dword [ebp + 0xc]
and eax, 0xfdffffff
mov dword [ebp + 0xc], eax
jmp 0x61bed4
or dword [ebp + 0xc], eax
mov eax, dword [esp + 4]
add eax, dword [esp + 8]
sub eax, dword [ebp]
mov dword [ebp + 8], eax
add ebx, 0x28
jmp 0x61bf12
mov edx, ebp
mov eax, esi
call fcn.0061bd6c
test al, al
jne 0x61bef8
xor eax, eax
jmp 0x61bf33
mov eax, dword [esp + 4]
mov dword [ebp], eax
mov dword [ebp + 4], edi
mov eax, dword [esp + 8]
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x24]
mov dword [ebp + 0xc], eax
add ebx, 0x28
dec dword [esp + 0xc]
jne 0x61be81
mov byte [ebp + 0x10], 1
mov edx, ebp
mov eax, esi
call fcn.0061bd6c
test al, al
jne 0x61bf31
xor eax, eax
jmp 0x61bf33
mov al, 1
add esp, 0x24
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x61d1d8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 4], edx
mov byte [ebp - 5], al
mov eax, dword [ebp - 4]
cmp byte [eax + 0x18], 0
je 0x61d1fa
push ebp
call fcn.0061d1b8
pop ecx
mov esi, eax
jmp 0x61d200
mov esi, dword [ebp - 4]
mov esi, dword [esi + 0xc]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
push esi
call sub.kernel32.dll_VirtualProtect
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x61d2ba
cmp byte [ebp - 5], 0
je 0x61d25f
mov eax, dword [ebp - 4]
cmp byte [eax + 0x18], 0
jne 0x61d23a
push ebp
call fcn.0061d1b8
pop ecx
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
jmp 0x61d242
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 4]
mov edx, dword [esi]
mov dword [eax], edx
mov dl, byte [esi + 4]
mov byte [eax + 4], dl
mov eax, dword [ebp - 4]
mov edx, dword [eax + 5]
mov dword [esi], edx
mov dl, byte [eax + 9]
mov byte [esi + 4], dl
jmp 0x61d29c
mov edx, esi
mov eax, dword [ebp - 4]
add eax, 5
call fcn.0061d16c
test al, al
je 0x61d29a
mov eax, dword [ebp - 4]
mov edx, dword [eax]
mov dword [esi], edx
mov dl, byte [eax + 4]
mov byte [esi + 4], dl
mov eax, dword [ebp - 4]
mov edx, dword [0x68e9b8]
mov dword [eax], edx
mov dl, byte [0x68e9bc]
mov byte [eax + 4], dl
mov eax, dword [ebp - 4]
mov byte [eax + 0x18], 0
jmp 0x61d29c
xor ebx, ebx
push 5
push esi
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 5
push esi
call sub.kernel32.dll_VirtualProtect
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x620268
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm1, xmmword [edx]
movups xmm5, xmmword [0x6202fd]
cmp al, 0x80
je 0x62039c
cmp al, 0xc0
je 0x62040d
movups xmm3, xmmword [edx + 0x10]
add edx, 0x20
aeskeygenassist xmm2, xmm3, 1
call fcn.0062030d
aeskeygenassist xmm2, xmm3, 2
call fcn.0062030d
aeskeygenassist xmm2, xmm3, 4
call fcn.0062030d
aeskeygenassist xmm2, xmm3, 8
call fcn.0062030d
aeskeygenassist xmm2, xmm3, 0x10
call fcn.0062030d
aeskeygenassist xmm2, xmm3, 0x20
call fcn.0062030d
aeskeygenassist xmm2, xmm3, 0x40
pshufd xmm2, xmm2, 0xff
movups xmm4, xmm1
pshufb xmm4, xmm5
pxor xmm1, xmm4
pshufb xmm4, xmm5
pxor xmm1, xmm4
pshufb xmm4, xmm5
pxor xmm1, xmm4
pxor xmm1, xmm2
movups xmmword [edx], xmm1
repz ret
add edx, 0x10
aeskeygenassist xmm2, xmm1, 1
call fcn.0062036e
aeskeygenassist xmm2, xmm1, 2
call fcn.0062036e
aeskeygenassist xmm2, xmm1, 4
call fcn.0062036e
aeskeygenassist xmm2, xmm1, 8
call fcn.0062036e
aeskeygenassist xmm2, xmm1, 0x10
call fcn.0062036e
aeskeygenassist xmm2, xmm1, 0x20
call fcn.0062036e
aeskeygenassist xmm2, xmm1, 0x40
call fcn.0062036e
aeskeygenassist xmm2, xmm1, 0x80
call fcn.0062036e
aeskeygenassist xmm2, xmm1, 0x1b
call fcn.0062036e
aeskeygenassist xmm2, xmm1, 0x36
call fcn.0062036e
repz ret
Function at 0x62030d
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
pshufd xmm2, xmm2, 0xff
movups xmm4, xmm1
pshufb xmm4, xmm5
pxor xmm1, xmm4
pshufb xmm4, xmm5
pxor xmm1, xmm4
pshufb xmm4, xmm5
pxor xmm1, xmm4
pxor xmm1, xmm2
movups xmmword [edx], xmm1
add edx, 0x10
aeskeygenassist xmm4, xmm1, 0
pshufd xmm2, xmm4, 0xaa
movups xmm4, xmm3
pshufb xmm4, xmm5
pxor xmm3, xmm4
pshufb xmm4, xmm5
pxor xmm3, xmm4
pshufb xmm4, xmm5
pxor xmm3, xmm4
pxor xmm3, xmm2
movups xmmword [edx], xmm3
add edx, 0x10
ret
Function at 0x620c18
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], eax
mov ebx, 0x69e0d8
mov eax, 0x6a00d8
add edx, 0x10
dec dword [esp]
mov ecx, dword [edx]
mov esi, ecx
shr esi, 0x18
movzx esi, byte [eax + esi]
add esi, 0x300
mov esi, dword [ebx + esi*4]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
movzx edi, byte [eax + edi]
add edi, 0x200
xor esi, dword [ebx + edi*4]
mov edi, ecx
shr edi, 8
and edi, 0xff
movzx edi, byte [eax + edi]
add edi, 0x100
xor esi, dword [ebx + edi*4]
and ecx, 0xff
movzx ecx, byte [eax + ecx]
xor esi, dword [ebx + ecx*4]
mov dword [edx], esi
mov ecx, dword [edx + 4]
mov esi, ecx
shr esi, 0x18
movzx esi, byte [eax + esi]
add esi, 0x300
mov esi, dword [ebx + esi*4]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
movzx edi, byte [eax + edi]
add edi, 0x200
xor esi, dword [ebx + edi*4]
mov edi, ecx
shr edi, 8
and edi, 0xff
movzx edi, byte [eax + edi]
add edi, 0x100
xor esi, dword [ebx + edi*4]
and ecx, 0xff
movzx ecx, byte [eax + ecx]
xor esi, dword [ebx + ecx*4]
mov dword [edx + 4], esi
mov ecx, dword [edx + 8]
mov esi, ecx
shr esi, 0x18
movzx esi, byte [eax + esi]
add esi, 0x300
mov esi, dword [ebx + esi*4]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
movzx edi, byte [eax + edi]
add edi, 0x200
xor esi, dword [ebx + edi*4]
mov edi, ecx
shr edi, 8
and edi, 0xff
movzx edi, byte [eax + edi]
add edi, 0x100
xor esi, dword [ebx + edi*4]
and ecx, 0xff
movzx ecx, byte [eax + ecx]
xor esi, dword [ebx + ecx*4]
mov dword [edx + 8], esi
mov ecx, dword [edx + 0xc]
mov esi, ecx
shr esi, 0x18
movzx esi, byte [eax + esi]
add esi, 0x300
mov esi, dword [ebx + esi*4]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
movzx edi, byte [eax + edi]
add edi, 0x200
xor esi, dword [ebx + edi*4]
mov edi, ecx
shr edi, 8
and edi, 0xff
movzx edi, byte [eax + edi]
add edi, 0x100
xor esi, dword [ebx + edi*4]
and ecx, 0xff
movzx ecx, byte [eax + ecx]
xor esi, dword [ebx + ecx*4]
mov dword [edx + 0xc], esi
cmp dword [esp], 1
jne 0x620c29
pop edx
pop edi
pop esi
pop ebx
ret