joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d53459e
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, edi
jne 0x6d534610
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x6d53467a
push edi
push edi
push 0x10e
lea eax, [ebp - 0x120]
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jle 0x6d53467a
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x120]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, edi
mov dword [ebp - 4], 1
je 0x6d53467a
push esi
call fcn.6d53457d
mov ebx, eax
cmp ebx, edi
je 0x6d53467a
cmp dword [ebp - 4], edi
push ebx
push esi
push edi
je 0x6d534632
lea eax, [ebp - 0x120]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
jmp 0x6d53463a
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
cmp eax, edi
je 0x6d534674
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x6d511464
push ebx
mov dword [ebp - 8], edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x6d534674
cmp dword [ebp - 8], 0x34
jne 0x6d534674
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp + 0xc]
push 0xd
pop ecx
push ebx
rep movsd dword es:[edi], dword [esi]
call fcn.6d5340e5
xor eax, eax
inc eax
jmp 0x6d53467c
push ebx
call fcn.6d5340e5
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x6d534edd
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push edi
xor edi, edi
push edi
push edi
lea eax, [ebp + 0xc]
push eax
lea eax, [ebx + 0x60]
push eax
mov dword [ebp - 4], 1
call fcn.6d534296
cmp eax, edi
mov dword [ebp - 8], eax
jne 0x6d534f0a
xor eax, eax
jmp 0x6d534f75
push esi
push eax
call fcn.6d53618b
mov esi, eax
cmp word [esi + 6], di
movzx eax, word [esi + 0x14]
lea eax, [eax + esi + 0x18]
mov dword [ebp + 0xc], edi
jbe 0x6d534f68
lea edi, [eax + 0x24]
mov eax, dword [edi]
test eax, eax
jns 0x6d534f59
test eax, 0x40000000
je 0x6d534f59
test al, 0xc0
je 0x6d534f59
mov eax, dword [edi - 0x18]
push dword [edi - 0x1c]
xor ecx, ecx
add eax, dword [ebx + 8]
adc ecx, dword [ebx + 0xc]
push ecx
push eax
push 4
push dword [ebp + 8]
call fcn.6d534b31
test eax, eax
jne 0x6d534f59
and dword [ebp - 4], eax
movzx eax, word [esi + 6]
inc dword [ebp + 0xc]
add edi, 0x28
cmp dword [ebp + 0xc], eax
jb 0x6d534f27
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 4]
pop esi
pop edi
pop ebx
leave
ret 8
Function at 0x6d534f7b
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push 0x320
call fcn.6d53457d
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jne 0x6d534f9f
mov eax, 0x8007000e
jmp 0x6d535111
mov eax, dword [ebp + 0x1c]
push edi
mov dword [eax], esi
mov eax, dword [ebp + 0x10]
push eax
push ebx
push 0x1f03ff
mov dword [esi], eax
call fcn.6d53472b
cmp eax, ebx
mov dword [esi + 4], eax
jne 0x6d535002
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
jg 0x6d534fcf
call edi
mov edi, eax
jmp 0x6d534fdf
call edi
mov edi, eax
and edi, 0xffff
or edi, 0x80070000
cmp edi, 0x80070057
je 0x6d534ffa
cmp edi, 0x80070002
je 0x6d534ffa
cmp edi, ebx
jl 0x6d535053
mov edi, 0x80004005
jmp 0x6d535053
xor edi, edi
inc edi
jmp 0x6d535108
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi], eax
jne 0x6d535011
mov dword [esi + 8], ebx
jmp 0x6d53501d
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x314], eax
lea eax, [esi + 0x24]
push eax
push dword [esi + 4]
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [eax], 0x1003f
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov edi, eax
neg edi
sbb edi, edi
and edi, 0x7fffbffb
add edi, 0x80004005
je 0x6d53505f
or dword [0x6d584014], 4
jmp 0x6d535104
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x308]
push eax
lea eax, [ebp - 8]
push eax
lea ebx, [esi + 0x2f8]
push ebx
lea eax, [esi + 0x20]
push eax
lea eax, [esi + 0x18]
push eax
push dword [esi + 4]
mov dword [esi + 0x2f0], 0x2cc
push dword [ebp + 0xc]
call fcn.6d534ab9
mov edi, eax
test edi, edi
jne 0x6d535108
mov eax, dword [esi + 0xe8]
xor ecx, ecx
add eax, 0xfffffffc
adc ecx, 0xffffffff
and dword [esi + 0x310], edi
mov edx, dword [ebp - 4]
cmp edx, ecx
mov edx, dword [ebp - 8]
ja 0x6d5350d5
jb 0x6d5350bc
cmp edx, eax
ja 0x6d5350d5
cmp ecx, dword [ebx + 4]
ja 0x6d5350d5
jb 0x6d5350c7
cmp eax, dword [ebx]
jae 0x6d5350d5
mov dword [esi + 0x300], eax
mov dword [esi + 0x304], ecx
jmp 0x6d5350e4
mov dword [esi + 0x300], edx
mov eax, dword [ebp - 4]
mov dword [esi + 0x304], eax
mov eax, dword [ebx]
mov ecx, dword [ebp + 8]
sub eax, dword [esi + 0x300]
add ecx, 0x30
cmp eax, dword [ecx]
jbe 0x6d5350f8
mov dword [ecx], eax
mov eax, dword [esi + 0x310]
cmp eax, dword [ecx]
jbe 0x6d53510e
mov dword [ecx], eax
test edi, edi
je 0x6d53510e
push esi
call fcn.6d5340e5
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x18
Function at 0x6d53618b
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [esp + 4]
xor eax, eax
test ecx, ecx
je 0x6d5361b0
cmp ecx, 0xffffffff
je 0x6d5361b0
cmp word [ecx], 0x5a4d
jne 0x6d5361b0
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
je 0x6d5361b0
xor eax, eax
ret 4

Function at 0x6d5364ae
Capabilities:
Create thread
Resume thread
Suspend thread
Terminate thread

Disassembly:
push 0x5b4
push 0x6d513b90
call fcn.6d536a6c
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x20]
push eax
push ebx
push ebx
push 0x6d5364ac
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x24], eax
cmp eax, ebx
jne 0x6d5364e3
xor eax, eax
jmp 0x6d5365a0
push dword [ebp - 0x20]
push ebx
push 0x1f03ff
call fcn.6d53645f
mov dword [ebp - 0x28], eax
cmp eax, ebx
jne 0x6d5364fd
mov dword [ebp - 0x2c], ebx
jmp 0x6d53656c
mov dword [ebp - 4], ebx
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov dword [ebp - 0x1c], eax
cmp eax, 0xffffffff
je 0x6d536565
mov edi, 0x10007
mov dword [ebp - 0x2f8], edi
lea eax, [ebp - 0x2f8]
push eax
push dword [ebp - 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_GetThreadContext]
call esi
mov dword [ebp - 0x2c], eax
cmp eax, ebx
je 0x6d536568
mov dword [ebp - 0x5c4], edi
lea eax, [ebp - 0x5c4]
push eax
push dword [ebp - 0x24]
call esi
mov dword [ebp - 0x2c], eax
cmp eax, ebx
je 0x6d536568
mov eax, dword [ebp - 0x240]
cmp eax, dword [ebp - 0x50c]
je 0x6d536568
jmp 0x6d536565
mov dword [ebp - 0x2c], ebx
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x1c], ebx
jle 0x6d53657a
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0xdead
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [ebp - 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
cmp dword [ebp - 0x28], ebx
je 0x6d53659d
push dword [ebp - 0x28]
call esi
mov eax, dword [ebp - 0x2c]
call fcn.6d536aa5
ret

Function at 0x6d5382ce
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x18]
test eax, eax
je 0x6d5382f8
push dword [ebp + 8]
mov esi, dword [ebp + 0x10]
and dword [ebp - 4], 0
mov ecx, dword [eax]
lea edx, [ebp - 4]
push edx
push esi
push 0
push dword [ebp + 0xc]
push eax
call dword [ecx + 0xc]
jmp 0x6d538317
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x6d538320
push dword [ebp + 8]
mov esi, dword [ebp + 0x10]
and dword [ebp - 4], 0
mov ecx, dword [eax]
lea edx, [ebp - 4]
push edx
push esi
push dword [ebp + 0xc]
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x6d538358
cmp esi, dword [ebp - 4]
jmp 0x6d538351
mov eax, dword [esi + 0x74]
test eax, eax
je 0x6d53835c
push 0
push dword [ebp + 0xc]
push eax
call dword [sym.imp.msvcrt.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x6d538358
push dword [esi + 0x74]
push 1
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll_fread]
add esp, 0x10
cmp eax, 1
jne 0x6d538358
xor eax, eax
inc eax
jmp 0x6d53835e
xor eax, eax
jmp 0x6d53835e
xor al, al
pop esi
leave
ret 0xc
Function at 0x6d538765
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x14], 0
jne 0x6d5387c5
push 0
push dword [esi + 0x20]
mov byte [esi + 0x14], 1
push dword [esi + 0x18]
call dword [sym.imp.msvcrt.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x6d5387c5
and dword [ebp - 4], eax
push edi
lea eax, [ebp - 4]
push eax
push dword [esi + 0x1c]
lea edi, [esi + 4]
mov ecx, edi
call fcn.6d537c93
test al, al
je 0x6d5387bd
push dword [esi + 0x18]
push 1
push dword [esi + 0x1c]
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_fread]
add esp, 0x10
cmp eax, 1
je 0x6d5387c4
mov ecx, edi
call fcn.6d5387ca
pop edi
mov al, 1
pop esi
leave
ret

Function at 0x6d539e3b
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 1
push 0x80000000
push dword [ebp + 8]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x6d539e9f
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
je 0x6d539e9f
push ebx
push eax
push ebx
push 2
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov esi, eax
cmp esi, ebx
je 0x6d539e9f
push ebx
push ebx
push ebx
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, ebx
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov byte [ebp - 1], bl
jne 0x6d539ea3
mov byte [ebp - 1], 1
cmp esi, ebx
je 0x6d539eae
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, 0xffffffff
je 0x6d539eba
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp byte [ebp - 1], bl
pop edi
pop esi
sete al
pop ebx
leave
ret

Function at 0x6d53a1e3
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x6d57afa9
call fcn.6d574b54
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
cmp ebx, edi
mov esi, ecx
mov dword [ebp - 0x10], esi
jbe 0x6d53a203
mov eax, ebx
jmp 0x6d53a206
xor eax, eax
inc eax
push eax
mov ecx, esi
call fcn.6d539edf
cmp ebx, edi
mov dword [ebp - 4], edi
ja 0x6d53a218
xor ebx, ebx
inc ebx
push ebx
lea ecx, [esi + 0xc]
call fcn.6d539edf
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x18], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x30], edi
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x6d541712
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x6d57b389
call fcn.6d574b54
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
cmp ebx, edi
mov esi, ecx
mov dword [ebp - 0x10], esi
jbe 0x6d541732
mov eax, ebx
jmp 0x6d541735
xor eax, eax
inc eax
push eax
mov ecx, esi
call fcn.6d5400c8
cmp ebx, edi
mov dword [ebp - 4], edi
ja 0x6d541747
xor ebx, ebx
inc ebx
push ebx
lea ecx, [esi + 0xc]
call fcn.6d539edf
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x18], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x30], edi
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x6d54414d
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x6d57b452
call fcn.6d574b54
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0x6d513de0
mov dword [esi + 0xc], ebx
push dword [ebp + 8]
lea ecx, [esi + 0x14]
mov dword [ebp - 4], ebx
mov dword [esi], 0x6d514a30
mov dword [esi + 4], 0x6d514a00
mov dword [esi + 8], 0x6d5149f0
mov dword [esi + 0x10], ebx
call fcn.6d53ec82
mov byte [esi + 0x18], bl
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
xor eax, eax
inc eax
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], eax
push eax
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 2
call fcn.6d541712
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x70], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x6d555f0b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
push edi
mov esi, ecx
call fcn.6d5556ab
test al, al
jne 0x6d555f25
mov ecx, dword [esi + 0x78]
test ecx, ecx
jne 0x6d555f2c
xor al, al
jmp 0x6d555fc9
and dword [ebp - 0x10], 0
mov eax, dword [ecx]
push ebx
mov ebx, dword [esi + 0x1c]
add ebx, dword [esi + 0x7c]
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0xc]
push edx
lea edx, [ebp - 4]
push edx
mov dword [ebp - 0x18], ebx
call dword [eax + 8]
movzx eax, word [ebp - 4]
cmp eax, dword [esi + 0x18]
jne 0x6d555fc6
mov eax, dword [ebp - 0xc]
cmp ebx, eax
jb 0x6d555fc6
mov ecx, dword [ebp - 0x10]
add ecx, eax
cmp ecx, ebx
jbe 0x6d555fc6
mov edi, dword [esi + 0x20]
sub ebx, eax
sub edi, dword [esi + 0x7c]
jmp 0x6d555fae
mov ecx, dword [esi + 0x78]
mov eax, dword [ecx]
lea edx, [ebp - 8]
push edx
lea edx, [ebp - 0x14]
push edx
lea edx, [ebp - 0x24]
push edx
call dword [eax + 0xc]
xor eax, eax
cmp dword [ebp - 8], eax
sete al
add eax, dword [ebp - 0x24]
add eax, dword [ebp - 8]
cmp ebx, eax
jae 0x6d555fa0
lea eax, [edi + ebx]
cmp dword [ebp - 0x24], eax
jb 0x6d555fcd
mov eax, dword [ebp - 0x18]
add eax, edi
cmp dword [ebp - 0x24], eax
jae 0x6d556092
mov ecx, dword [esi + 0x78]
mov eax, dword [ecx]
call dword [eax + 4]
test al, al
jne 0x6d555f72
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x10]
add dword [esi + 0x7c], eax
xor al, al
pop ebx
pop edi
pop esi
leave
ret
mov edx, dword [ebp - 0x1c]
lea eax, [esi + 0x80]
cmp dword [eax], edx
je 0x6d555fee
mov ecx, dword [esi + 8]
push edx
push dword [esi + 0x14]
mov dword [eax], edx
mov eax, dword [ecx]
call dword [eax + 0x5c]
mov dword [esi + 0x84], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
lea ebx, [esi + 0x28]
and eax, 0xffffff
mov dword [ebx + 0x14], eax
or dword [ebx + 0x40], 4
shr ecx, 0x18
and ecx, 0x7f
add ecx, eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x18], ecx
or dword [ebx + 0x40], 8
mov ecx, dword [ebp - 0x24]
add ecx, eax
mov dword [ebx + 0x28], ecx
or byte [ebx + 0x40], 0x80
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x24], eax
or dword [ebx + 0x40], 0x40
mov eax, dword [esi + 0x84]
mov dword [ebx + 0x10], eax
or dword [ebx + 0x40], 2
movzx eax, word [ebp - 0x14]
mov dword [ebx + 0x1c], eax
or dword [ebx + 0x40], 0x10
movzx eax, word [ebp - 0x12]
mov dword [ebx + 0x20], eax
or dword [ebx + 0x40], 0x20
mov eax, dword [ebp - 8]
mov dword [ebx + 0x38], eax
mov eax, dword [ebp - 0x20]
or byte [ebx + 0x41], 4
shr eax, 0x1f
and al, 1
mov byte [ebx + 0x3c], al
or byte [ebx + 0x41], 8
push dword [esi + 0x14]
lea eax, [ebp - 0x44]
push eax
call fcn.6d55023b
mov esi, eax
lea edi, [ebp - 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x34]
mov edi, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop ecx
movsd dword es:[edi], dword [esi]
or dword [ebx + 0x40], 1
pop ecx
mov al, 1
jmp 0x6d555fc8
add dword [esi + 0x7c], edi
jmp 0x6d555fc6
Function at 0x6d55a6a4
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x6d57bdd9
call fcn.6d574b54
push ecx
push esi
mov esi, ecx
and dword [esi + 4], 0
push edi
mov edi, dword [ebp + 8]
mov dword [esi], 0x6d514868
mov eax, dword [edi + 8]
mov dword [ebp - 0x10], esi
mov dword [esi + 8], eax
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
mov dword [esi], 0x6d5164e0
call fcn.6d55a588
lea eax, [edi + 0x28]
push eax
lea ecx, [esi + 0x28]
call fcn.6d5554d5
mov eax, dword [edi + 0x2c]
mov ecx, dword [esi + 8]
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
mov al, byte [edi + 0x3c]
mov byte [esi + 0x3c], al
mov eax, dword [ecx]
mov byte [ebp - 4], 2
call dword [eax + 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x38], eax
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x6d560417
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
xor ebx, ebx
inc ebx
push edi
push ebx
lea ecx, [esi + 0x18]
mov dword [esi + 8], edi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], ebx
call fcn.6d560373
push ebx
lea ecx, [esi + 0x48]
mov dword [esi + 0x3c], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x40], edi
call fcn.6d539edf
push ebx
lea ecx, [esi + 0x70]
call fcn.6d560236
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x20]
mov ecx, esi
mov dword [esi + 0x6c], eax
call fcn.6d560284
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x6d560f47
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jbe 0x6d560f75
mov eax, dword [ebp + 8]
push esi
movzx esi, byte [ebp + 0x10]
movzx edx, byte [eax]
xor edx, esi
mov esi, dword [ebp + 0x10]
mov edx, dword [edx*4 + 0x6d516990]
shr esi, 8
xor edx, esi
inc eax
dec ecx
mov dword [ebp + 0x10], edx
jne 0x6d560f55
pop esi
mov eax, dword [ebp + 0x10]
pop ebp
ret
Function at 0x6d5610e7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
cmp dword [ebp + 8], edx
je 0x6d561123
push edx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x6d561177
push dword [ebp + 8]
push dword [ebp + 0x14]
push 1
push dword [ebp + 0x18]
call dword [sym.imp.msvcrt.dll_fread]
sub eax, dword [ebp + 0x14]
add esp, 0x10
neg eax
sbb eax, eax
inc eax
jmp 0x6d561179
mov eax, dword [ecx + 0x82c]
cmp eax, edx
je 0x6d561144
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push edx
push dword [ebp + 0xc]
push dword [ecx + 0x804]
call eax
add esp, 0x14
jmp 0x6d56116c
mov eax, dword [ecx + 0x830]
cmp eax, edx
je 0x6d561177
cmp byte [ebp + 0x1c], dl
jne 0x6d561158
cmp dword [ebp + 0x10], edx
je 0x6d561177
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ecx + 0x804]
call eax
add esp, 0x10
xor ecx, ecx
test eax, eax
setge cl
mov al, cl
jmp 0x6d561179
xor al, al
pop ebp
ret 0x18
Function at 0x6d561b49
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x20
push 0x6d513f14
push ebx
mov esi, ecx
call fcn.6d56accc
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x6d561b7d
push eax
push 0x12
push ebx
mov ecx, esi
call fcn.6d56159a
jmp 0x6d561ca3
push edi
push 1
lea eax, [ebp - 0x54]
push 0x30
push eax
call dword [sym.imp.msvcrt.dll_fread]
add esp, 0x10
cmp eax, 1
je 0x6d561b9e
push 0
push 0xb
push ebx
jmp 0x6d561c94
cmp word [ebp - 0x54], 0x4944
jne 0x6d561b94
mov ecx, dword [ebp - 0x4c]
cmp ecx, dword [esi + 0xc60]
je 0x6d561bc5
mov eax, dword [esi + 0xc64]
test eax, eax
je 0x6d561bbf
cmp ecx, eax
je 0x6d561bc5
push 0
push 0x14
jmp 0x6d561b98
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
mov ebx, dword [sym.imp.msvcrt.dll_fseek]
lea eax, [eax + eax*4]
lea eax, [ecx + eax*8]
push 1
push eax
push edi
call ebx
add esp, 0xc
test eax, eax
jne 0x6d561c8d
push edi
call dword [sym.imp.msvcrt.dll_ftell]
pop ecx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x34]
push 0x1c
xor edx, edx
pop ecx
div ecx
test eax, eax
mov dword [ebp - 4], eax
je 0x6d561c4c
dec dword [ebp - 4]
push edi
push 1
lea eax, [ebp - 0x24]
push 0x1c
push eax
call dword [sym.imp.msvcrt.dll_fread]
add esp, 0x10
cmp eax, 1
jne 0x6d561c8d
cmp byte [esi + 0xc74], 0
jne 0x6d561c46
cmp dword [ebp - 0x18], 2
jne 0x6d561c46
mov eax, dword [ebp - 0x14]
and dword [esi + 0xc7c], 0
mov dword [esi + 0xc78], eax
mov eax, dword [ebp - 0xc]
mov dword [esi + 0xc80], eax
cmp dword [ebp - 4], 0
jne 0x6d561c04
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll__wcsdup]
pop ecx
push 0
push 0
push dword [ebp + 8]
mov ecx, esi
mov dword [esi + 0xc70], eax
mov dword [esi + 0xc6c], edi
call fcn.6d56159a
push 0
push dword [ebp - 8]
push edi
call ebx
add esp, 0xc
test eax, eax
jne 0x6d561cd0
mov eax, dword [ebp - 0x34]
push 0x1c
xor edx, edx
pop ecx
div ecx
mov ebx, eax
jmp 0x6d561ccc
push 0
push 0xb
push dword [ebp + 8]
mov ecx, esi
call fcn.6d56159a
push edi
call dword [sym.imp.msvcrt.dll_fclose]
pop ecx
xor al, al
jmp 0x6d561cd2
push edi
push 1
lea eax, [ebp - 0x24]
push 0x1c
push eax
dec ebx
call dword [sym.imp.msvcrt.dll_fread]
add esp, 0x10
cmp eax, 1
jne 0x6d561cd0
lea eax, [ebp - 0x24]
push eax
push 0
mov ecx, esi
call fcn.6d561521
test ebx, ebx
jne 0x6d561ca7
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x6d56ade2
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0xf0000000
push 1
push 0
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x6d56ae01
leave
ret
push ebx
push esi
mov esi, dword [ebp + 8]
push esi
push 0x10
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [ebp - 4]
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test ebx, ebx
jne 0x6d56ae27
xor eax, eax
jmp 0x6d56ae44
mov ax, word [esi + 6]
and ax, 0xfff
or ax, 0x4000
mov word [esi + 6], ax
mov al, byte [esi + 8]
and al, 0x3f
or al, 0x80
mov byte [esi + 8], al
xor eax, eax
inc eax
pop esi
pop ebx
leave
ret

Function at 0x6d573c63
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa10
mov eax, dword [sym.imp.msvcrt.dll__osver]
test byte [eax + 1], 0x80
push esi
je 0x6d573d18
push 0
push 0
mov esi, 0x104
push esi
lea eax, [ebp - 0x514]
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x6d573d95
push esi
lea eax, [ebp - 0x514]
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.msvcrt.dll__fullpath]
add esp, 0xc
cmp byte [ebp - 0x10c], 0x5c
jne 0x6d573cd2
cmp byte [ebp - 0x10b], 0x5c
je 0x6d573d95
lea eax, [ebp - 0x910]
push eax
lea eax, [ebp - 0xa10]
push eax
lea eax, [ebp - 0x710]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.msvcrt.dll__splitpath]
push 1
lea eax, [ebp - 4]
push 0x6d511464
push eax
call dword [sym.imp.msvcrt.dll_strncat]
add esp, 0x20
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
jmp 0x6d573d88
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.msvcrt.dll__wfullpath]
add esp, 0xc
cmp word [ebp - 0x410], 0x5c
jne 0x6d573d44
cmp word [ebp - 0x40e], 0x5c
je 0x6d573d95
lea eax, [ebp - 0x610]
push eax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.msvcrt.dll__wsplitpath]
push 1
lea eax, [ebp - 8]
push 0x6d511d74
push eax
call dword [sym.imp.msvcrt.dll_wcsncat]
add esp, 0x20
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
test eax, eax
je 0x6d573d95
cmp eax, 4
je 0x6d573d95
xor eax, eax
jmp 0x6d573d98
xor eax, eax
inc eax
pop esi
leave
ret