joyce8/EMBER2024-capa huggingface dataset:
Function at 0x659ce4
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0065a898
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret

Function at 0x65a794
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff20
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x40
jle 0x65a7d9
lea eax, [ebp - 0x60]
call fcn.00659ce4
mov edx, ebx
lea eax, [ebp - 0x60]
mov ecx, dword [ebp + 0xc]
call fcn.00659d0c
lea edx, [ebp - 0x60]
mov eax, dword [ebp + 8]
call fcn.00659de0
mov dword [ebp + 0xc], 0x10
mov esi, dword [ebp + 8]
jmp 0x65a7db
mov esi, ebx
xor ecx, ecx
lea eax, [ebp - 0xa0]
lea edx, [ebp - 0xe0]
lea ebx, [ecx + 1]
cmp ebx, dword [ebp + 0xc]
jg 0x65a804
movzx ebx, byte [esi]
xor bl, 0x36
mov byte [eax], bl
movzx ebx, byte [esi]
xor bl, 0x5c
mov byte [edx], bl
inc esi
jmp 0x65a80a
mov byte [eax], 0x36
mov byte [edx], 0x5c
inc ecx
inc edx
inc eax
cmp ecx, 0x40
jne 0x65a7e9
lea eax, [ebp - 0x60]
call fcn.00659ce4
lea edx, [ebp - 0xa0]
lea eax, [ebp - 0x60]
mov ecx, 0x40
call fcn.00659d0c
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x60]
mov ecx, dword [ebp - 8]
call fcn.0065a684
lea edx, [ebp - 0x60]
mov eax, dword [ebp + 8]
call fcn.00659de0
lea eax, [ebp - 0x60]
call fcn.00659ce4
lea edx, [ebp - 0xe0]
lea eax, [ebp - 0x60]
mov ecx, 0x40
call fcn.00659d0c
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x60]
mov ecx, 0x10
call fcn.00659d0c
lea edx, [ebp - 0x60]
mov eax, dword [ebp + 8]
call fcn.00659de0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x65fe38
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x65fe41
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov byte [ebp - 5], cl
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x660007
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.006601b0
xor eax, eax
push ebp
push 0x65ffd8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 8
je 0x65fe91
call fcn.004091dc
jmp 0x65ffdf
mov eax, dword [ebp - 4]
test byte [eax + 0x40], 8
je 0x65ff66
mov eax, dword [ebp - 4]
test byte [eax + 0x40], 1
je 0x65fee6
mov eax, dword [ebp - 4]
cmp word [eax + 0x4a], 0
je 0x65fee6
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0065fd74
push dword [ebp - 0x10]
mov eax, dword [ebp - 4]
push dword [eax + 0x60]
push ebx
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040aac0
mov eax, dword [ebp - 0xc]
push eax
movzx ecx, byte [ebp - 5]
mov edi, dword [ebp - 4]
mov edx, esi
mov eax, dword [edi + 0x4c]
call dword [edi + 0x48]
mov eax, dword [ebp - 4]
test byte [eax + 0x40], 4
je 0x65ff25
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0065fd74
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
push dword [eax + 0x60]
push ebx
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.0040aac0
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x1c]
call fcn.0040a7cc
push eax
call sub.kernel32.dll_OutputDebugStringW
mov eax, dword [ebp - 4]
test byte [eax + 0x40], 2
je 0x65ffc2
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.0065fd74
push dword [ebp - 0x24]
mov eax, dword [ebp - 4]
push dword [eax + 0x60]
push ebx
push 0x660024
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.0040aac0
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.0065fdac
jmp 0x65ffc2
mov eax, dword [ebp - 4]
test byte [eax + 0x40], 1
je 0x65ff89
mov eax, dword [ebp - 4]
cmp word [eax + 0x4a], 0
je 0x65ff89
push ebx
movzx ecx, byte [ebp - 5]
mov edi, dword [ebp - 4]
mov edx, esi
mov eax, dword [edi + 0x4c]
call dword [edi + 0x48]
mov eax, dword [ebp - 4]
test byte [eax + 0x40], 4
je 0x65ff9f
mov eax, ebx
call fcn.0040a7cc
push eax
call sub.kernel32.dll_OutputDebugStringW
mov eax, dword [ebp - 4]
test byte [eax + 0x40], 2
je 0x65ffc2
lea eax, [ebp - 0x28]
mov ecx, 0x660038
mov edx, ebx
call fcn.0040aa38
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.0065fdac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65ffdf
mov eax, dword [ebp - 4]
call fcn.006601b8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x66000e
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.00409a88
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00409a88
ret
Function at 0x664f64
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, ecx
mov dword [esp], edx
mov ebp, eax
xor esi, esi
mov ebx, dword [esp]
jmp 0x664f78
inc ebx
mov eax, ebx
mov ecx, 3
cdq
idiv ecx
test edx, edx
jg 0x664f77
mov eax, ebx
mov ecx, 3
cdq
idiv ecx
add eax, eax
add eax, eax
mov ebx, eax
mov eax, edi
xor ecx, ecx
mov edx, ebx
call fcn.0040a4e8
xor ebx, ebx
cmp esi, dword [esp]
jge 0x6650dc
inc ebx
mov eax, edi
call fcn.00409fe8
movzx edx, byte [ebp + esi]
and dl, 0xfc
movzx edx, dl
shr edx, 2
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ebx - 1], dl
lea eax, [esi + 1]
cmp eax, dword [esp]
jge 0x665095
inc ebx
mov eax, edi
call fcn.00409fe8
movzx edx, byte [ebp + esi]
and dl, 3
movzx edx, dl
shl edx, 4
movzx ecx, byte [ebp + esi + 1]
and cl, 0xf0
movzx ecx, cl
shr ecx, 4
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ebx - 1], dl
lea eax, [esi + 2]
cmp eax, dword [esp]
jge 0x665064
inc ebx
mov eax, edi
call fcn.00409fe8
movzx edx, byte [ebp + esi + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx ecx, byte [ebp + esi + 2]
and cl, 0xc0
movzx ecx, cl
shr ecx, 6
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ebx - 1], dl
inc ebx
mov eax, edi
call fcn.00409fe8
movzx edx, byte [ebp + esi + 2]
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ebx - 1], dl
jmp 0x6650d0
inc ebx
mov eax, edi
call fcn.00409fe8
movzx edx, byte [ebp + esi + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ebx - 1], dl
inc ebx
mov eax, edi
call fcn.00409fe8
mov byte [eax + ebx - 1], 0x3d
jmp 0x6650d0
inc ebx
mov eax, edi
call fcn.00409fe8
movzx edx, byte [ebp + esi]
and dl, 3
movzx edx, dl
shl edx, 4
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ebx - 1], dl
inc ebx
mov eax, edi
call fcn.00409fe8
mov byte [eax + ebx - 1], 0x3d
inc ebx
mov eax, edi
call fcn.00409fe8
mov byte [eax + ebx - 1], 0x3d
add esi, 3
cmp esi, dword [esp]
jl 0x664fac
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x666458
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa4
mov dword [esp + 4], ecx
mov dword [esp], edx
mov esi, 0x30
mov edi, 0x6fdb18
mov ecx, dword [esp]
lea edx, [esp + 0xc]
movzx ebx, byte [edi]
movzx ebx, byte [eax + ebx - 1]
xor bl, byte [ecx]
mov byte [edx], bl
inc edx
inc ecx
inc edi
dec esi
jne 0x666477
mov esi, 1
mov edx, 0x6fdc20
mov ecx, esi
dec ecx
mov eax, ecx
add eax, eax
lea eax, [eax + eax*2]
add ecx, ecx
add ecx, ecx
movzx ebx, byte [esp + eax + 0xc]
mov edi, ebx
add edi, edi
movzx ebx, byte [esp + eax + 0x11]
add edi, ebx
movzx ebx, byte [esp + eax + 0xd]
add ebx, ebx
add ebx, ebx
add ebx, ebx
movzx ebp, byte [esp + eax + 0xe]
add ebp, ebp
add ebp, ebp
add ebx, ebp
movzx ebp, byte [esp + eax + 0xf]
add ebp, ebp
add ebx, ebp
movzx eax, byte [esp + eax + 0x10]
add ebx, eax
mov dword [esp + 8], ebx
mov eax, 1
mov ebx, eax
dec ebx
je 0x6664f0
dec ebx
je 0x666512
dec ebx
je 0x666534
dec ebx
je 0x666555
jmp 0x66656f
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 8
movzx ebx, bl
shr ebx, 3
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x66656f
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 4
movzx ebx, bl
shr ebx, 2
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x66656f
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 2
movzx ebx, bl
shr ebx, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x66656f
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
inc eax
cmp eax, 5
jne 0x6664e0
inc esi
add edx, 0x40
cmp esi, 9
jne 0x666493
mov esi, 0x20
mov eax, 0x6fdb48
mov edx, dword [esp + 4]
movzx ecx, byte [eax]
movzx ecx, byte [esp + ecx + 0x3b]
mov byte [edx], cl
inc edx
inc eax
dec esi
jne 0x666594
add esp, 0x5c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x6665d0
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], ecx
mov esi, eax
movzx eax, dl
movzx ebx, byte [eax + 0x6fdbcf]
test bl, bl
jbe 0x666601
lea eax, [esi + 0x3e0]
call fcn.006665ac
lea eax, [esi + 0x3fc]
call fcn.006665ac
dec bl
jne 0x6665e7
mov cl, 0x30
mov edi, 0x6fdba0
mov eax, dword [esp]
movzx edx, byte [edi]
cmp dl, 0x1c
ja 0x666622
movzx edx, dl
movzx edx, byte [esi + edx + 0x3df]
mov byte [eax], dl
jmp 0x66662f
movzx edx, dl
movzx edx, byte [esi + edx + 0x3df]
mov byte [eax], dl
inc eax
inc edi
dec cl
jne 0x66660b
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x66663c
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbdc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov bl, 1
lea esi, [ebp - 0x421]
mov eax, edi
mov edx, ebx
call fcn.006663f0
mov byte [esi], al
inc ebx
inc esi
cmp bl, 0x41
jne 0x666658
mov bl, 0x1c
mov esi, str.91__
lea edi, [ebp - 0x41]
movzx edx, byte [esi]
mov eax, dword [ebp - 8]
call fcn.006663f0
mov byte [edi], al
movzx edx, byte [esi + 0x1c]
mov eax, dword [ebp - 8]
call fcn.006663f0
mov byte [edi + 0x1c], al
inc edi
inc esi
dec bl
jne 0x666674
mov bl, 1
lea esi, [ebp - 0x3a1]
mov ecx, esi
lea eax, [ebp - 0x421]
mov edx, ebx
call fcn.006665d0
inc ebx
add esi, 0x30
cmp bl, 0x11
jne 0x66669e
mov bl, 1
mov eax, 0x6fda98
lea edx, [ebp - 0xa1]
cmp bl, 0x20
ja 0x6666d7
movzx ecx, byte [eax]
movzx ecx, byte [ebp + ecx - 0x422]
mov byte [edx], cl
jmp 0x6666e4
movzx ecx, byte [eax]
movzx ecx, byte [ebp + ecx - 0x422]
mov byte [edx], cl
inc ebx
inc edx
inc eax
cmp bl, 0x41
jne 0x6666c3
mov byte [ebp - 9], 1
lea esi, [ebp - 0x3a1]
cmp byte [ebp + 8], 0
je 0x66670e
lea ecx, [ebp - 0x61]
mov edx, esi
lea eax, [ebp - 0x81]
call fcn.00666458
jmp 0x666735
movzx eax, byte [ebp - 9]
mov edx, 0x11
sub edx, eax
mov eax, edx
add eax, eax
lea eax, [eax + eax*2]
lea edx, [ebp + eax*8 - 0x3d1]
lea ecx, [ebp - 0x61]
lea eax, [ebp - 0x81]
call fcn.00666458
mov bl, 0x20
lea eax, [ebp - 0xa1]
movzx edx, byte [eax]
xor byte [eax + 0x40], dl
inc eax
dec bl
jne 0x66673d
push esi
lea esi, [ebp - 0x81]
lea edi, [ebp - 0xa1]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
push esi
lea esi, [ebp - 0x61]
lea edi, [ebp - 0x81]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
inc byte [ebp - 9]
add esi, 0x30
cmp byte [ebp - 9], 0x11
jne 0x6666f6
mov bl, 0x40
mov esi, 0x6fdad8
lea eax, [ebp - 0x3e1]
movzx edx, byte [esi]
cmp dl, 0x20
ja 0x6667a3
movzx edx, dl
movzx edx, byte [ebp + edx - 0x82]
mov byte [eax], dl
jmp 0x6667b0
movzx edx, dl
movzx edx, byte [ebp + edx - 0xc2]
mov byte [eax], dl
inc eax
inc esi
dec bl
jne 0x66678c
mov bl, 1
lea esi, [ebp - 0x3e1]
movzx ecx, byte [esi]
mov eax, dword [ebp - 4]
mov edx, ebx
call fcn.00666418
inc ebx
inc esi
cmp bl, 0x41
jne 0x6667be
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x6672c4
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, ecx
mov dword [esp], edx
mov esi, eax
movzx edx, byte [esi]
mov byte [esp + 4], dl
shl edx, 7
and dl, 0xff
movzx eax, byte [esi + 1]
movzx ecx, al
shr ecx, 1
or dl, cl
mov byte [esp + 5], dl
shl eax, 6
and al, 0xff
movzx edx, byte [esi + 2]
movzx ecx, dl
shr ecx, 2
or al, cl
mov byte [esp + 6], al
shl edx, 5
and dl, 0xff
movzx eax, byte [esi + 3]
movzx ecx, al
shr ecx, 3
or dl, cl
mov byte [esp + 7], dl
shl eax, 4
and al, 0xff
movzx edx, byte [esi + 4]
shr edx, 4
or al, dl
mov byte [esp + 8], al
movzx eax, byte [esi + 4]
add eax, eax
add eax, eax
add eax, eax
and al, 0xff
movzx edx, byte [esi + 5]
shr edx, 5
or al, dl
mov byte [esp + 9], al
movzx eax, byte [esi + 5]
add eax, eax
add eax, eax
and al, 0xff
movzx edx, byte [esi + 6]
shr edx, 6
or al, dl
mov byte [esp + 0xa], al
movzx eax, byte [esi + 6]
add eax, eax
and al, 0xff
mov byte [esp + 0xb], al
mov ebp, 8
lea eax, [esp + 4]
mov edx, 1
xor esi, esi
mov ecx, edx
movzx ebx, byte [eax]
shl ebx, cl
mov ecx, ebx
xor esi, ecx
and esi, 1
inc edx
cmp edx, 8
jne 0x667375
movzx edx, byte [eax]
and dl, 0xfe
mov ecx, esi
or dl, cl
mov byte [eax], dl
inc eax
dec ebp
jne 0x667370
mov eax, edi
xor ecx, ecx
mov edx, 8
call fcn.0040a4e8
push 1
mov eax, edi
call fcn.00409fe8
mov edx, eax
lea ecx, [esp + 8]
mov eax, dword [esp + 4]
call fcn.0066663c
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x6701ec
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov esi, eax
mov byte [esp], 0
xor eax, eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov edi, 1
jmp 0x67020d
inc edi
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x10]
call fcn.00409f24
cmp edi, eax
jg 0x670225
cmp byte [esi + edi - 1], 0x20
je 0x67020c
mov eax, esi
test eax, eax
je 0x670230
sub eax, 4
mov eax, dword [eax]
cmp eax, edi
jl 0x6702fc
cmp byte [esi + edi - 1], 0x2e
je 0x670326
jmp 0x6702fc
cmp byte [esi + edi - 1], 0x2e
jne 0x67029e
inc dword [esp + 4]
cmp dword [esp + 4], 3
jg 0x670326
cmp dword [esp + 8], 0xff
jg 0x670326
xor eax, eax
mov dword [esp + 8], eax
mov ebp, esi
test ebp, ebp
je 0x67027e
sub ebp, 4
mov ebp, dword [ebp]
cmp ebp, edi
jg 0x670286
mov bl, 1
jmp 0x670294
movzx eax, byte [esi + edi]
add al, 0xd0
sub al, 0xa
setb bl
xor bl, 1
test bl, bl
jne 0x670326
jmp 0x6702fb
movzx eax, byte [esi + edi - 1]
add al, 0xd0
sub al, 0xa
jae 0x6702c3
mov eax, dword [esp + 8]
add eax, eax
lea eax, [eax + eax*4]
movzx edx, byte [esi + edi - 1]
add eax, edx
sub eax, 0x30
mov dword [esp + 8], eax
jmp 0x6702fb
inc edi
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x10]
call fcn.00409f24
cmp edi, eax
jg 0x6702db
cmp byte [esi + edi - 1], 0x20
je 0x6702c2
mov dword [esp + 0xc], esi
cmp dword [esp + 0xc], 0
je 0x6702f3
mov eax, dword [esp + 0xc]
sub eax, 4
mov eax, dword [eax]
mov dword [esp + 0xc], eax
cmp edi, dword [esp + 0xc]
jle 0x670326
jmp 0x670311
inc edi
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x10]
call fcn.00409f24
cmp edi, eax
jle 0x670248
cmp dword [esp + 4], 3
jne 0x670326
cmp dword [esp + 8], 0xff
jg 0x670326
mov byte [esp], 1
movzx eax, byte [esp]
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x69007c
Capabilities:
Encode data using base64
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
add eax, eax
add eax, eax
mov ecx, 3
cdq
idiv ecx
mov edx, eax
add edx, 4
mov ecx, esi
xor eax, eax
call fcn.0040af60
cmp byte [ebp - 1], 0
jne 0x6900dc
mov eax, esi
call fcn.00409fe8
movzx edx, byte [ebp - 0xc]
dec edx
and dl, 0x3f
add dl, 0x21
mov byte [eax], dl
mov eax, dword [ebp - 0xc]
add eax, 2
mov ecx, 3
cdq
idiv ecx
lea eax, [eax + eax*2]
mov dword [ebp - 0xc], eax
mov edi, 2
xor eax, eax
mov dword [ebp - 0x10], eax
xor ebx, ebx
movzx eax, byte [ebp - 1]
sub al, 1
jb 0x6900f6
sub al, 2
jb 0x6900fd
jmp 0x690102
mov ebx, 2
jmp 0x690102
mov ebx, 1
mov eax, esi
call fcn.00409fe8
mov byte [eax + ebx - 1], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jge 0x6901e9
test edi, edi
jle 0x69015e
mov eax, esi
call fcn.00409fe8
lea eax, [eax + ebx - 1]
push eax
mov ecx, edi
mov eax, 0x3f
shl eax, cl
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
movzx edx, byte [edx + ecx]
and eax, edx
mov ecx, edi
shr eax, cl
mov edx, dword [esi]
or al, byte [edx + ebx - 1]
pop edx
mov byte [edx], al
sub edi, 6
inc ebx
mov eax, esi
call fcn.00409fe8
mov byte [eax + ebx - 1], 0
jmp 0x6901dd
test edi, edi
jge 0x6901a7
mov eax, edi
cdq
xor eax, edx
sub eax, edx
mov edi, eax
mov eax, esi
call fcn.00409fe8
lea eax, [eax + ebx - 1]
push eax
mov ecx, edi
mov eax, 0x3f
shr eax, cl
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
movzx edx, byte [edx + ecx]
and eax, edx
mov ecx, edi
shl eax, cl
mov edx, dword [esi]
or al, byte [edx + ebx - 1]
pop edx
mov byte [edx], al
mov eax, 8
sub eax, edi
mov edi, eax
inc dword [ebp - 0x10]
jmp 0x6901dd
mov eax, esi
call fcn.00409fe8
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
movzx edx, byte [edx + ecx]
and dl, 0x3f
mov ecx, dword [esi]
movzx ecx, byte [ecx + ebx - 1]
or dl, cl
mov byte [eax + ebx - 1], dl
inc ebx
inc dword [ebp - 0x10]
mov eax, esi
call fcn.00409fe8
mov byte [eax + ebx - 1], 0
mov edi, 2
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jl 0x69011a
movzx eax, byte [ebp - 1]
sub al, 1
jb 0x6901fa
sub al, 2
jb 0x690234
jmp 0x69027c
cmp edi, 2
jne 0x690200
dec ebx
mov eax, ebx
sub eax, 2
jl 0x69027c
inc eax
mov dword [ebp - 0x14], eax
mov edi, 2
mov eax, esi
call fcn.00409fe8
mov edx, dword [esi]
movzx edx, byte [edx + edi - 1]
mov ecx, dword [0x6fde24]
movzx edx, byte [ecx + edx]
mov byte [eax + edi - 1], dl
inc edi
dec dword [ebp - 0x14]
jne 0x690210
jmp 0x69027c
cmp edi, 2
jne 0x69023a
dec ebx
test ebx, ebx
jle 0x690277
mov dword [ebp - 0x14], ebx
mov edi, 1
mov eax, esi
call fcn.00409fe8
mov edx, dword [esi]
movzx edx, byte [edx + edi - 1]
mov ecx, dword [0x6fde28]
movzx edx, byte [ecx + edx]
mov byte [eax + edi - 1], dl
inc edi
dec dword [ebp - 0x14]
jne 0x690246
jmp 0x690277
inc ebx
mov eax, esi
call fcn.00409fe8
mov byte [eax + ebx - 1], 0x3d
test bl, 3
jne 0x69026a
mov eax, esi
xor ecx, ecx
mov edx, ebx
call fcn.0040a4e8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x6b7214
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, 0x6fe218
test edx, edx
jne 0x6b7233
xor eax, eax
jmp 0x6b7351
mov dword [ebp - 4], 1
cmp byte [ebp - 4], 0
je 0x6b7250
push esi
push edx
push eax
call fcn.006b7358
add esp, 0xc
jmp 0x6b7351
push esi
push edx
push eax
call fcn.006b7618
add esp, 0xc
jmp 0x6b7351
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x6c0b60
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7fc
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x804], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6c0be9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x801
lea eax, [ebp - 0x800]
push eax
mov eax, ebx
call fcn.0040a7cc
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsW
test eax, eax
jne 0x6c0bad
mov eax, esi
mov edx, ebx
call fcn.00409e08
jmp 0x6c0bd0
lea eax, [ebp - 0x804]
lea edx, [ebp - 0x800]
mov ecx, 0x400
call fcn.0040a888
mov eax, dword [ebp - 0x804]
mov edx, esi
call fcn.00422fa0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6c0bf0
lea eax, [ebp - 0x804]
call fcn.00409a28
ret

Function at 0x6c0bf8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x6c0d17
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00409a28
push 0x104
lea eax, [ebp - 0x20e]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
lea edx, [ebp - 0x218]
lea eax, [ebp - 0x20e]
call fcn.00424ff4
mov eax, dword [ebp - 0x218]
lea edx, [ebp - 0x214]
call fcn.0042b874
mov edx, dword [ebp - 0x214]
lea eax, [ebp - 4]
mov ecx, esi
call fcn.0040aa38
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.004242e0
test al, al
je 0x6c0c96
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00409e08
jmp 0x6c0cf1
push 0x104
lea eax, [ebp - 0x20e]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
lea edx, [ebp - 0x220]
lea eax, [ebp - 0x20e]
call fcn.00424ff4
mov eax, dword [ebp - 0x220]
lea edx, [ebp - 0x21c]
call fcn.0042b874
mov edx, dword [ebp - 0x21c]
lea eax, [ebp - 4]
mov ecx, esi
call fcn.0040aa38
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.004242e0
test al, al
je 0x6c0cf1
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00409e08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6c0d1e
lea eax, [ebp - 0x220]
mov edx, 4
call fcn.00409a88
lea eax, [ebp - 4]
call fcn.00409a28
ret
Function at 0x6c26d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00409b0c
xor eax, eax
push ebp
push 0x6c2772
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 8]
call fcn.00409a28
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0xc]
lea edx, [ebp - 8]
mov eax, 0x6c278c
call fcn.006c1fd0
test al, al
je 0x6c2757
cmp dword [ebp - 8], 0
je 0x6c2757
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.006c221c
push 5
push 0
mov eax, dword [ebp - 0x14]
call fcn.0040a7cc
push eax
mov eax, dword [ebp - 0x10]
call fcn.0040a7cc
push eax
push 0x6c2798
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
seta bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6c2779
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00409a88
ret

Function at 0x6c27a4
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffeec
mov dword [esp], 0x114
push esp
call sub.kernel32.dll_GetVersionExW
cmp dword [esp + 4], 6
setae al
add esp, 0x114
ret