joyce8/EMBER2024-capa huggingface dataset:
Function at 0x68f378
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
cmp dword [0x6d3244], eax
jbe 0x68f3b5
sub esp, 0xc
lea ecx, [esp + 0x14]
push 0
push ecx
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [eax*4 + 0x6de268]
call sub.KERNEL32.DLL_WriteFile
add esp, 0xc
cmp eax, 1
jne 0x68f3c6
mov eax, dword [esp + 8]
add esp, 0xc
ret
sub esp, 0xc
push 6
call fcn.006902f8
add esp, 0x10
add esp, 0xc
ret
call fcn.00690398
add esp, 0xc
ret

Function at 0x691278
Capabilities:
Delete file

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call sub.KERNEL32.DLL_DeleteFileA
sub esp, 4
cmp eax, 1
jne 0x691295
xor eax, eax
add esp, 0xc
ret
add esp, 0xc
jmp fcn.00690398

Function at 0x693860
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov ebx, dword [esp + 0x44]
call fcn.0068fd5c
test bh, 0xc0
jne 0x68eddb
mov eax, dword [0x6d3314]
mov ecx, 0xc000
and ecx, dword [eax]
or ebx, ecx
mov eax, ebx
and eax, 0x700
add eax, 0xffffff00
mov ecx, eax
shr ecx, 8
mov esi, 3
cmp ecx, 6
ja 0x68edff
sar eax, 6
mov esi, dword [eax + 0x6d2d70]
mov edi, dword [esp + 0x40]
test bh, 1
je 0x68ee28
lea eax, [esp + 0x4c]
mov dword [esp + 0x20], eax
mov al, byte [0x6d2d90]
and al, byte [esp + 0x48]
mov eax, 0x80
mov ecx, 1
cmovs ecx, eax
jmp 0x68ee3b
mov dword [esp], edi
call sub.KERNEL32.DLL_GetFileAttributesW
sub esp, 4
xor ecx, ecx
cmp eax, 0xffffffff
cmovne ecx, eax
mov eax, ebx
and al, 3
je 0x68ee54
cmp al, 2
je 0x68ee5b
cmp al, 1
jne 0x68ef53
mov eax, 0x40000000
jmp 0x68ee60
mov eax, 0x80000000
jmp 0x68ee60
mov eax, 0xc0000000
mov edx, ebx
and edx, 0x70
add edx, 0xfffffff0
shr edx, 4
cmp edx, 3
mov ebp, 3
cmovb ebp, edx
xor edx, edx
cmp eax, 0x80000000
sete dl
test bl, 4
cmove edx, ebp
mov dword [esp + 0x20], 0xc
mov dword [esp + 0x24], 0
mov ebp, ebx
shr ebp, 7
not ebp
and ebp, 1
mov dword [esp + 0x28], ebp
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], esi
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], edi
mov dword [esp + 0x18], 0
call sub.KERNEL32.DLL_CreateFileW
sub esp, 0x1c
mov esi, eax
cmp esi, 0xffffffff
je 0x68ef30
mov edi, ebx
shr edi, 1
not edi
and edi, 0x4000
or edi, ebx
mov dword [esp], esi
call fcn.0068e97c
mov ecx, edi
or ecx, 0x2000
test eax, eax
cmove ecx, edi
and ecx, 0xfffff8ff
mov dword [esp], esi
mov dword [esp + 4], ecx
call fcn.0068ff1c
mov edi, eax
cmp edi, 0xffffffff
jne 0x68ef61
mov dword [esp], 4
call fcn.006902f8
mov dword [esp], esi
call sub.KERNEL32.DLL_CloseHandle
sub esp, 4
mov edi, 0xffffffff
jmp 0x68ef61
call sub.KERNEL32.DLL_GetLastError
movzx eax, ax
test bh, 1
mov ecx, 0x50
mov edx, 2
cmovne edx, ecx
cmp eax, 0x6e
cmovne edx, eax
mov dword [esp], edx
jmp 0x68ef5a
mov dword [esp], 1
call fcn.006902f8
mov edi, eax
call fcn.0068fdac
mov eax, edi
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
jmp 0x68edb8
Function at 0x69503c
Capabilities:
Get geographical location

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x21c
mov dword [esp + 0x18], edx
mov esi, ecx
mov eax, dword [esi + 4]
lea ebp, [esp + 0x1c]
mov dword [esp + 8], ebp
mov dword [esp], eax
mov dword [esp + 0xc], pe_nt_image_headers32
mov dword [esp + 4], 0x1001
call sub.KERNEL32.DLL_GetLocaleInfoA
sub esp, 0x10
mov dword [esp], ebp
call fcn.0068e594
mov word [esp + eax + 0x1c], 0x5f
mov edi, dword [esi + 4]
mov dword [esp], ebp
call fcn.0068e594
lea ecx, [esp + eax + 0x1c]
mov edx, pe_nt_image_headers32
sub edx, eax
mov dword [esp + 0xc], edx
mov dword [esp + 8], ecx
mov dword [esp], edi
mov dword [esp + 4], 0x1002
call sub.KERNEL32.DLL_GetLocaleInfoA
sub esp, 0x10
mov dword [esp], ebp
call fcn.0068e594
mov word [esp + eax + 0x1c], 0x2e
mov edi, dword [esi]
mov dword [esp], ebp
call fcn.0068e594
lea eax, [esp + eax + 0x1c]
mov dword [esp + 4], eax
mov dword [esp], edi
mov dword [esp + 8], 0xa
call fcn.00698538
mov edi, dword [esi + 0x24]
test edi, edi
je 0x695130
mov dword [esp], edi
call fcn.0068e594
mov ebx, eax
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.0068e594
mov ecx, ebp
mov ebp, eax
mov dword [esp], ecx
call fcn.0068e594
add ebp, ebx
lea eax, [eax + ebp + 3]
lea ebp, [esp + 0x1c]
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.0068d884
mov ebx, eax
mov dword [esi + 0x24], ebx
test ebx, ebx
jne 0x695185
jmp 0x6951cd
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.0068e594
mov ebx, eax
mov edi, ebp
mov dword [esp], ebp
call fcn.0068e594
mov ebp, eax
lea eax, [ebx + ebp + 3]
mov dword [esp], eax
call fcn.0068d86c
mov ebx, eax
mov dword [esi + 0x24], ebx
test ebx, ebx
je 0x6951cd
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.0068e594
lea eax, [ebp + eax + 3]
mov dword [esp + 8], eax
mov dword [esp], ebx
mov dword [esp + 4], 0
call fcn.0068e42f
mov ebp, edi
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.0068e448
mov edi, dword [esi + 0x24]
mov dword [esp], edi
call fcn.0068e594
mov word [edi + eax], 0x3d
mov eax, dword [esi + 0x24]
mov dword [esp + 4], ebp
mov dword [esp], eax
call fcn.0068e448
mov esi, dword [esi + 0x24]
mov dword [esp], esi
call fcn.0068e594
mov word [esi + eax], 0xa
mov eax, 1
jmp 0x6951cf
xor eax, eax
add esp, 0x21c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x696c28
Capabilities:
Get geographical location

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
push 0
push dword [edi + 4]
push 0xe
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
mov esi, eax
inc esi
sub esp, 0xc
push esi
call fcn.0068d86c
add esp, 0x10
mov dword [edi + 4], eax
push esi
push eax
push 0xe
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
xor ebx, ebx
test eax, eax
setne bl
push 0
push dword [edi]
push 0xf
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
mov esi, eax
inc esi
sub esp, 0xc
push esi
call fcn.0068d86c
add esp, 0x10
mov dword [edi], eax
test edi, edi
je 0x696c9b
push esi
push eax
push 0xf
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
xor ecx, ecx
test eax, eax
setne cl
jmp 0x696caa
sub esp, 0xc
push 0xe
call sub.KERNEL32.DLL_SetLastError
add esp, 0xc
xor ecx, ecx
and ecx, ebx
mov dword [esp + 8], ecx
push 0
push dword [edi + 8]
push 0x10
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
mov esi, eax
inc esi
sub esp, 0xc
push esi
call fcn.0068d86c
add esp, 0x10
mov dword [edi + 8], eax
push esi
push eax
push 0x10
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
xor ebx, ebx
test eax, eax
setne bl
push 0
push dword [edi + 0xc]
push 0x50
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
mov esi, eax
inc esi
sub esp, 0xc
push esi
call fcn.0068d86c
add esp, 0x10
mov dword [edi + 0xc], eax
push esi
push eax
push 0x50
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
xor ecx, ecx
test eax, eax
setne cl
and ecx, ebx
mov ebx, ebp
mov ebp, ecx
push 0
push dword [edi + 0x10]
push 0x51
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoA
mov esi, eax
inc esi
sub esp, 0xc
push esi
call fcn.0068d86c
add esp, 0x10
mov dword [edi + 0x10], eax
push esi
push eax
push 0x51
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoA
xor ebx, ebx
test eax, eax
setne bl
and ebx, ebp
and ebx, dword [esp + 8]
sub esp, 0xc
push 4
call fcn.0068d86c
add esp, 0x10
mov esi, eax
test esi, esi
je 0x696d94
push 4
push esi
push 0x11
push dword [esp + 0x2c]
call sub.KERNEL32.DLL_GetLocaleInfoA
sub esp, 0xc
test eax, eax
je 0x696da3
push esi
call fcn.00697dbc
add esp, 0x10
mov word [edi + 0x14], ax
sub esp, 0xc
push esi
call fcn.0068d87c
add esp, 0x10
mov eax, 1
jmp 0x696dae
sub esp, 0xc
push 0xe
call sub.KERNEL32.DLL_SetLastError
add esp, 0xc
jmp 0x696dac
push esi
call fcn.0068d87c
add esp, 0x10
xor eax, eax
and ebx, eax
mov eax, ebx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x69ab1c
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push dword [esp + 0x4c]
call sub.KERNEL32.DLL_CreateFileA
add esp, 4
mov edi, eax
test edi, edi
je 0x69abe2
sub esp, 0xc
lea eax, [esp + 0x14]
push eax
call sub.KERNEL32.DLL_GetLocalTime
add esp, 0xc
movzx eax, word [esp + 0xa]
mov dword [esp + 0x18], eax
movzx ecx, word [esp + 0xe]
movzx edx, word [esp + 8]
movzx ebp, word [esp + 0x10]
movzx eax, word [esp + 0x12]
movzx esi, word [esp + 0x14]
movzx ebx, word [esp + 0x16]
sub esp, 0xc
push ebx
push esi
push eax
push ebp
push edx
push ecx
push dword [esp + 0x3c]
push str._02d__02d__04d__02d:_02d:_02d._03d
push 0x6de570
call fcn.006c50ac
add esp, 0x24
push 0x6de570
call fcn.0068e594
add esp, 4
push 0
lea ebx, [esp + 0x18]
push ebx
push eax
push 0x6de570
push edi
call sub.KERNEL32.DLL_WriteFile
mov esi, dword [esp + 0x40]
push esi
call fcn.0068e594
add esp, 4
push 0
push ebx
push eax
push esi
push edi
call sub.KERNEL32.DLL_WriteFile
push edi
call sub.KERNEL32.DLL_CloseHandle
add esp, 0xc
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x69ac14
Capabilities:
Write file on windows

Disassembly:
push ebx
push edi
push esi
sub esp, 0x90
mov edi, dword [esp + 0xa0]
mov eax, dword [0x6de590]
test eax, eax
mov ecx, dword [0x6de58c]
jne 0x69acd9
test ecx, ecx
jne 0x69acd9
cmp dword [0x6d483c], 0
je 0x69ad0f
sub esp, 4
lea esi, [esp + 0x14]
push 0x80
push esi
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
sub esp, 4
push 0x5c
push esi
call fcn.0069a3b8
add esp, 0x10
test eax, eax
jne 0x69ac84
sub esp, 8
push 0x3a
push esi
call fcn.0069a3b8
add esp, 0x10
test eax, eax
je 0x69ac87
inc eax
mov esi, eax
mov dword [esp + 0xc], 0
call sub.KERNEL32.DLL_GetVersion
mov ecx, 0x12010
test eax, eax
jns 0x69acca
call sub.KERNEL32.DLL_GetCurrentThreadId
sub esp, 4
lea ecx, [esp + 0x10]
push ecx
push 0x69ada4
push eax
call fcn.006c4d1c
add esp, 4
cmp dword [esp + 0xc], 0
mov eax, 0x11010
mov ecx, 0x12010
cmove ecx, eax
push ecx
push esi
push edi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x69ad5c
cmp ecx, 0xffffffff
je 0x69ad5c
test ecx, ecx
je 0x69acf0
sub esp, 0xc
push edi
call ecx
add esp, 0x10
mov eax, dword [0x6de590]
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x69ad5c
cmp byte [eax], 0
je 0x69ad5c
sub esp, 8
push edi
push eax
call fcn.0069ab1c
add esp, 0xa0
jmp 0x69ad62
sub esp, 0xc
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
add esp, 0xc
mov esi, eax
sub esp, 0xc
lea ebx, [esp + 0x1c]
push 0
push ebx
push 2
push 0x6d457c
push esi
call sub.KERNEL32.DLL_WriteFile
push edi
call fcn.0068e594
add esp, 4
push 0
push ebx
push eax
push edi
push esi
call sub.KERNEL32.DLL_WriteFile
push 0
push ebx
push 2
push 0x6d457c
push esi
call sub.KERNEL32.DLL_WriteFile
add esp, 0xc
add esp, 0x90
pop esi
pop edi
pop ebx
ret
Function at 0x69beec
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x6e65cc]
test eax, eax
je 0x69bf21
mov ecx, dword [eax]
test ecx, ecx
je 0x69bf84
add eax, 4
xor edi, edi
nop
cmp byte [ecx], 1
sbb edi, 0
inc edi
mov ecx, dword [eax]
add eax, 4
test ecx, ecx
jne 0x69bf0c
jmp 0x69bfb0
mov esi, dword [0x6e6618]
test esi, esi
jne 0x69bf4e
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov esi, eax
mov dword [0x6e6618], esi
test esi, esi
jne 0x69bf4e
mov dword [esp], 0x6d46d8
call fcn.0069ad84
mov esi, dword [0x6e6618]
mov dword [esp], esi
call fcn.0068e594
test eax, eax
je 0x69bf88
xor ebx, ebx
xor edi, edi
mov ebp, esi
nop word cs:[eax + eax]
lea ebx, [eax + ebx + 1]
inc edi
lea ebp, [ebp + eax + 1]
mov dword [esp], ebp
call fcn.0068e594
test eax, eax
jne 0x69bf6c
inc ebx
jmp 0x69bf8f
xor edi, edi
jmp 0x69bfb0
mov ebx, 1
xor edi, edi
mov dword [esp], ebx
call fcn.0068d86c
mov dword [0x6e65c8], eax
test eax, eax
je 0x69c009
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.0068e264
lea eax, [edi + 4]
mov dword [0x6e65d0], eax
add edi, 5
mov dword [esp], edi
mov dword [esp + 4], 4
call fcn.0068d850
mov esi, eax
test esi, esi
je 0x69c009
mov edi, dword [0x6e65cc]
test edi, edi
je 0x69c00d
mov edx, dword [edi]
test edx, edx
je 0x69c046
lea eax, [edi + 4]
xor ecx, ecx
nop word [eax + eax]
cmp byte [edx], 0
je 0x69bffc
mov edx, dword [eax - 4]
mov dword [esi + ecx*4], edx
jmp 0x69bffd
dec ecx
inc ecx
mov edx, dword [eax]
add eax, 4
test edx, edx
jne 0x69bfec
jmp 0x69c042
xor eax, eax
jmp 0x69c059
mov ebx, dword [0x6e65c8]
mov dword [esp], ebx
call fcn.0068e594
test eax, eax
je 0x69c04e
mov ebp, esi
nop word cs:[eax + eax]
mov dword [ebp], ebx
lea ebx, [ebx + eax + 1]
mov dword [esp], ebx
call fcn.0068e594
add ebp, 4
test eax, eax
jne 0x69c02c
test edi, edi
je 0x69c04e
mov dword [esp], edi
call fcn.0068d87c
mov dword [0x6e65cc], esi
mov eax, 1
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x69c15c
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x6e65e0]
test eax, eax
je 0x69c192
mov ecx, dword [eax]
test ecx, ecx
je 0x69c1f7
add eax, 4
xor edi, edi
nop
cmp word [ecx], 1
sbb edi, 0
inc edi
mov ecx, dword [eax]
add eax, 4
test ecx, ecx
jne 0x69c17c
jmp 0x69c223
mov esi, dword [0x6e661c]
test esi, esi
jne 0x69c1bf
call sub.KERNEL32.DLL_GetEnvironmentStringsW
mov esi, eax
mov dword [0x6e661c], esi
test esi, esi
jne 0x69c1bf
mov dword [esp], str.GetEnvironmentStrings_failed
call fcn.0069ad84
mov esi, dword [0x6e661c]
mov dword [esp], esi
call fcn.0068e14c
test eax, eax
je 0x69c1fb
xor ebx, ebx
xor edi, edi
mov ebp, esi
nop word cs:[eax + eax]
lea ebx, [eax + ebx + 1]
inc edi
lea ebp, [ebp + eax*2 + 2]
mov dword [esp], ebp
call fcn.0068e14c
test eax, eax
jne 0x69c1dc
lea ebx, [ebx + ebx + 2]
jmp 0x69c202
xor edi, edi
jmp 0x69c223
mov ebx, 2
xor edi, edi
mov dword [esp], ebx
call fcn.0068d86c
mov dword [0x6e65dc], eax
test eax, eax
je 0x69c279
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.0068e264
lea eax, [edi + 4]
mov dword [0x6e65e4], eax
add edi, 5
mov dword [esp], edi
mov dword [esp + 4], 4
call fcn.0068d850
mov esi, eax
test esi, esi
je 0x69c279
mov edi, dword [0x6e65e0]
test edi, edi
je 0x69c27d
mov edx, dword [edi]
test edx, edx
je 0x69c2b6
lea eax, [edi + 4]
xor ecx, ecx
nop dword [eax]
cmp word [edx], 0
je 0x69c26c
mov edx, dword [eax - 4]
mov dword [esi + ecx*4], edx
jmp 0x69c26d
dec ecx
inc ecx
mov edx, dword [eax]
add eax, 4
test edx, edx
jne 0x69c25c
jmp 0x69c2b2
xor eax, eax
jmp 0x69c2c9
mov ebx, dword [0x6e65dc]
mov dword [esp], ebx
call fcn.0068e14c
test eax, eax
je 0x69c2be
mov ebp, esi
nop word cs:[eax + eax]
mov dword [ebp], ebx
lea ebx, [ebx + eax*2 + 2]
mov dword [esp], ebx
call fcn.0068e14c
add ebp, 4
test eax, eax
jne 0x69c29c
test edi, edi
je 0x69c2be
mov dword [esp], edi
call fcn.0068d87c
mov dword [0x6e65e0], esi
mov eax, 1
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x69d20c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push edi
push esi
sub esp, 0x64
mov esi, dword [esp + 0x70]
mov dword [esp], 0x6e6664
call sub.KERNEL32.DLL_EnterCriticalSection
sub esp, 4
mov eax, dword [0x6e9b14]
cmp eax, 0x232
jl 0x69d276
mov eax, dword [esp + 0x74]
mov byte [esp + 0x24], 0
mov dword [esp + 0x20], 0x20726f72
mov dword [esp + 0x1c], 0x72652065
mov dword [esp + 0x18], 0x726f6870
mov dword [esp + 0x14], 0x616d6553
mov dword [esp + 4], eax
lea edi, [esp + 0x14]
mov dword [esp], edi
call fcn.0068e448
mov dword [esp], edi
call fcn.0069ad84
mov eax, dword [0x6e9b14]
lea eax, [eax + eax*2]
lea eax, [eax*8 + 0x6e6664]
mov dword [esp], eax
call sub.KERNEL32.DLL_InitializeCriticalSection
sub esp, 4
mov eax, dword [0x6e9b14]
lea ecx, [eax + 1]
mov dword [0x6e9b14], ecx
lea eax, [eax + eax*2]
lea eax, [eax*8 + 0x6e6664]
mov dword [esi], eax
mov dword [esp], 0x6e6664
call sub.KERNEL32.DLL_LeaveCriticalSection
add esp, 0x60
pop esi
pop edi
ret
Function at 0x69d2bc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push esi
sub esp, 0x58
mov eax, dword [esp + 0x60]
mov byte [esp + 0x18], 0
mov dword [esp + 0x14], 0x20726f72
mov dword [esp + 0x10], 0x72652065
mov dword [esp + 0xc], 0x726f6870
mov dword [esp + 8], 0x616d6553
mov dword [esp + 4], eax
lea esi, [esp + 8]
mov dword [esp], esi
call fcn.0068e448
mov dword [esp], esi
call fcn.0069ad84
add esp, 0x58
pop esi
ret

Function at 0x6a1520
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x6e9f44]
mov dword [esp], eax
call fcn.006c47be
sub esp, 4
mov esi, eax
test esi, esi
je 0x6a1587
xor edi, edi
nop
cmp edi, 3
ja 0x6a1587
inc edi
xor ebx, ebx
xor eax, eax
nop word [eax + eax]
cmp byte [ebx*8 + 0x6e9f48], 0
je 0x6a157d
mov ecx, dword [ebx*8 + 0x6e9f4c]
test ecx, ecx
je 0x6a157d
mov edx, dword [esi + ebx*4]
test edx, edx
je 0x6a157d
mov dword [esi + ebx*4], 0
mov dword [esp], edx
call ecx
mov eax, 1
inc ebx
cmp ebx, 0x32
jne 0x6a1550
test eax, eax
jne 0x6a1540
add esp, 0x10
pop esi
pop edi
pop ebx
ret

Function at 0x6a8a78
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x6ea744], 0
jne 0x6a8a8f
call fcn.006a8a34
mov eax, edi
dec eax
test eax, eax
jl 0x6a8ab7
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x6ea344]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x6a8a99
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x6abb90
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x6abbc1
dec al
je 0x6abbfc
dec al
je 0x6abc40
dec al
je 0x6abcb2
jmp 0x6abd4d
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x6abd4d
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x6abbd1
jmp 0x6abd4d
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x6abd4d
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
movzx ecx, al
mov ecx, dword [ebx + ecx*4 + 0x40]
add dl, byte [ecx + esi]
and dl, 0xff
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x6abc0c
jmp 0x6abd4d
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x6abd4d
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
jbe 0x6abc73
xor edx, edx
mov dword [esp + 4], edx
jmp 0x6abc88
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov ebp, dword [ebx + edx*4 + 0x40]
movzx edx, byte [ebp + esi]
add eax, dword [esp + 4]
sar eax, 1
jns 0x6abca0
adc eax, 0
add dl, al
and dl, 0xff
mov byte [ebp + esi], dl
inc esi
dec edi
jne 0x6abc50
jmp 0x6abd4d
xor eax, eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x6abd4d
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
ja 0x6abd19
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 8], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 8]
push eax
movzx eax, byte [esp + 8]
pop edx
call fcn.006a8ac0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [esp]
and al, 0xff
mov byte [edx + esi], al
inc esi
dec edi
jne 0x6abcce
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x6b1b9c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x6b1bca
mov eax, ebx
call fcn.006b2658
cmp dword [ebx + 0x40], 0
je 0x6b1bc3
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x6b1c3b
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x6b1c2d
cmp dword [ebx + 8], 0
je 0x6b1bec
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x6b1bfe
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x6b1c2d
cmp dword [ebx + 8], 0
je 0x6b1bdf
cmp eax, 3
je 0x6b1c11
dec eax
jne 0x6b1bdf
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x6b1bdf
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x6b1bdf
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x6b1c59
cmp dword [ebx + 0x14], 0xcc
je 0x6b1c59
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.006b1c64
pop ebx
ret
Function at 0x4486ac
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
add ecx, 0xf8
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x78]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
add edx, dword [ecx + 0x20]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x1c]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
jmp 0x448718
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
cmp eax, dword [edx + 0x18]
jae 0x448761
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.0046baa0
add esp, 8
test eax, eax
jne 0x44875f
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov dx, word [ecx + eax*2]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0x448763
jmp 0x44870f
xor eax, eax
mov esp, ebp
pop ebp
ret