joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5be630
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x5be718
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
mov dl, 1
mov eax, dword [0x412474]
call fcn.004030f4
mov dword [esi + 0x224], eax
call fcn.00407ee4
mov dword [ebp - 8], eax
xor ebx, ebx
mov eax, ebx
cmp eax, 0x1f
ja 0x5be675
bt dword [ebp - 8], eax
jae 0x5be679
mov edi, ebx
inc ebx
cmp ebx, 0x1a
jne 0x5be66a
lea eax, [ebp - 4]
mov edx, edi
add dl, 0x42
call fcn.0040406c
lea eax, [esi + 0x218]
mov ecx, 0x5be730
mov edx, dword [ebp - 4]
call fcn.00404190
lea ebx, [edi + 1]
mov eax, dword [esi + 0x224]
call fcn.00414d54
cmp ebx, 0x19
jg 0x5be6e3
lea eax, [ebp - 4]
mov edx, ebx
add dl, 0x41
call fcn.0040406c
lea eax, [ebp - 0xc]
mov ecx, 0x5be730
mov edx, dword [ebp - 4]
call fcn.00404190
mov edx, dword [ebp - 0xc]
mov eax, dword [esi + 0x224]
mov ecx, dword [eax]
call dword [ecx + 0x34]
inc ebx
cmp ebx, 0x1a
jne 0x5be6b2
mov eax, dword [esi + 0x200]
mov eax, dword [eax + 0x1f0]
mov edx, dword [esi + 0x224]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5be71f
lea eax, [ebp - 0xc]
call fcn.00403ec4
lea eax, [ebp - 4]
call fcn.00403ec4
ret

Function at 0x5c7d38
Capabilities:
Check os version

Disassembly:
push ebx
add esp, 0xffffff6c
xor ebx, ebx
mov dword [esp], 0x94
push esp
call fcn.00407f84
cmp dword [esp + 0x10], 2
jne 0x5c7d5e
cmp dword [esp + 4], 5
jb 0x5c7d5e
mov bl, 1
mov eax, ebx
add esp, 0x94
pop ebx
ret

Function at 0x5cefb8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404308
push eax
call fcn.00407ebc
cmp eax, 0xffffffff
je 0x5cefd1
test al, 0x10
jne 0x5cefd5
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x5cefdc
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe78
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x20]
call fcn.004042f8
xor eax, eax
push ebp
push 0x5cf1b7
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 0x20]
call fcn.00402d7c
mov edi, eax
cmp dword [ebp + 0x20], 0
je 0x5cf085
cmp dword [ebp - 0x10], 0
je 0x5cf085
mov eax, dword [ebp + 0x20]
call fcn.0040a73c
test al, al
jne 0x5cf03b
mov eax, dword [ebp + 0x20]
call fcn.005cefb8
test al, al
je 0x5cf05e
push 0x4000
push 0x160
lea eax, [ebp - 0x178]
push eax
push 0
mov eax, dword [ebp + 0x20]
call fcn.00404308
push eax
call fcn.004626c0
jmp 0x5cf07f
push 0x4010
push 0x160
lea eax, [ebp - 0x178]
push eax
push 0
mov eax, dword [ebp + 0x20]
call fcn.00404308
push eax
call fcn.004626c0
mov edi, dword [ebp - 0x174]
cmp byte [ebp + 0x1c], 0
je 0x5cf0ac
push 0x4000
push 0x160
lea eax, [ebp - 0x178]
push eax
push 0
push 0x5cf1c8
call fcn.004626c0
mov esi, eax
jmp 0x5cf0cb
push 0x4001
push 0x160
lea eax, [ebp - 0x178]
push eax
push 0
push 0x5cf1c8
call fcn.004626c0
mov esi, eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
call fcn.00426418
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
call fcn.00412f64
test bl, bl
je 0x5cf10b
cmp byte [ebp + 0x14], 0
jne 0x5cf10b
push 1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0041f1fc
push eax
push edi
push esi
call fcn.004263a0
test byte [ebp + 0x14], bl
je 0x5cf1a1
mov dl, 1
mov eax, dword [0x41ce0c]
call fcn.00423aac
mov ebx, eax
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov edx, dword [ebp - 0x18]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x34]
push 0
push 0
push 0
mov eax, ebx
call fcn.00424018
call fcn.0041f1fc
push eax
push edi
push esi
call fcn.004263a0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x184], eax
fild dword [ebp - 0x14]
fmul qword [ebp + 0xc]
call fcn.00402b24
add eax, dword [ebp - 8]
mov dword [ebp - 0x180], eax
fild dword [ebp - 0x18]
fmul qword [ebp + 0xc]
call fcn.00402b24
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x17c], eax
mov ecx, ebx
lea edx, [ebp - 0x188]
mov eax, dword [ebp - 4]
call fcn.005ceed8
mov eax, ebx
call fcn.00403124
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5cf1be
lea eax, [ebp + 0x20]
call fcn.00403ec4
ret

Function at 0x5d6e50
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call fcn.00407f84
cmp dword [esp + 4], 5
ja 0x5d6e7c
cmp dword [esp + 4], 5
jne 0x5d6e78
cmp dword [esp + 8], 1
jae 0x5d6e7c
xor eax, eax
jmp 0x5d6e7e
mov al, 1
add esp, 0x94
ret

Function at 0x5e2310
Capabilities:
Log keystrokes via polling

Disassembly:
push 2
call fcn.004086a4
movsx eax, ax
test ah, 0x80
jne 0x5e2331
push 1
call fcn.004086a4
movsx eax, ax
test ah, 0x80
jne 0x5e2331
xor eax, eax
ret
mov al, 1
ret
Function at 0x5e3284
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x5e3296
add esp, 0xfffffff0
call fcn.00403464
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00406a8c
xor eax, eax
push ebp
push 0x5e3319
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, esi
call fcn.004030f4
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.005e3410
mov dl, 1
mov eax, dword [0x412474]
call fcn.004030f4
mov dword [esi + 0x28], eax
push 0
call fcn.0040896c
test eax, eax
je 0x5e3303
push 0x5e333c
call fcn.004089ac
mov dword [0x735c8c], eax
push 0x5e3350
call fcn.004089ac
mov dword [0x735c90], eax
call fcn.00408534
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e3320
lea eax, [ebp - 4]
call fcn.00406a2c
ret

Function at 0x5e6e90
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x5e6ef4
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call fcn.00407edc
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004040f4
mov eax, dword [ebp - 0xc]
push eax
call fcn.00407e74
mov edx, eax
pop eax
call fcn.0040a538
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e6efb
lea eax, [ebp - 0xc]
call fcn.00403ec4
ret

Function at 0x5e71f0
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov esi, edx
lea edi, [ebp - 0x20]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5e731a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [0x731788]
cmp dword [eax], 2
sete al
cmp dword [ebp - 0x20], 0x10f
sete dl
and al, dl
test byte [ebp - 0x17], 8
setne dl
and al, dl
je 0x5e7304
mov eax, dword [ebp - 4]
push eax
call fcn.00427410
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x5e7304
xor eax, eax
push ebp
push 0x5e72cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
push 0
push 0
push 0x800
mov eax, dword [ebp - 0xc]
push eax
call fcn.00427420
mov edx, eax
sar edx, 1
jns 0x5e7288
adc edx, 0
lea eax, [ebp - 0x10]
call fcn.0040495c
mov eax, dword [ebp - 0x10]
call fcn.00404770
add eax, eax
push eax
mov eax, dword [ebp - 0x10]
call fcn.00404760
push eax
push 0x800
mov eax, dword [ebp - 0xc]
push eax
call fcn.00427420
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e72d4
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.00427418
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e7321
lea eax, [ebp - 0x10]
call fcn.004045b4
ret
Function at 0x5e7ce8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5e7db2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0043f594
xor al, 1
push eax
mov eax, ebx
call fcn.0043f298
push eax
call fcn.004088cc
cmp eax, 1
sbb eax, eax
neg eax
pop edx
or dl, al
je 0x5e7d57
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00439024
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00404750
mov eax, dword [0x731788]
cmp dword [eax], 2
jne 0x5e7d9c
mov edx, dword [esi]
mov eax, ebx
call fcn.005e79bc
mov edx, dword [eax + 0x24]
mov eax, esi
call fcn.004045f0
jmp 0x5e7d9c
mov eax, ebx
call fcn.0043f298
push eax
call fcn.00408844
mov edx, eax
inc edx
mov eax, esi
call fcn.0040495c
mov eax, dword [esi]
call fcn.00404770
push eax
mov eax, dword [esi]
call fcn.00404760
push eax
mov eax, ebx
call fcn.0043f298
push eax
call fcn.00408834
mov eax, dword [esi]
call fcn.00404770
mov edx, eax
dec edx
mov eax, esi
call fcn.0040495c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e7db9
lea eax, [ebp - 4]
call fcn.00403ec4
ret

Function at 0x5e9198
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push 2
call fcn.004086a4
movsx eax, ax
test ah, 0x80
sete bl
push 1
call fcn.004086a4
movsx eax, ax
test ah, 0x80
sete al
and bl, al
je 0x5e91c1
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x5f4cec
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004042f8
xor eax, eax
push ebp
push 0x5f4d98
push dword fs:[eax]
mov dword fs:[eax], esp
or edi, 0xffffffff
lea eax, [ebp - 0x110]
mov edx, dword [ebp - 4]
call fcn.0040ad74
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.0040811c
mov ebx, eax
test ebx, ebx
jle 0x5f4d82
mov eax, ebx
call fcn.00402810
mov esi, eax
push esi
push ebx
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.00408114
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x5f4da8
push esi
call fcn.00408124
test eax, eax
je 0x5f4d7b
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0xfeef04bd
jne 0x5f4d7b
mov eax, dword [ebp - 0xc]
mov edi, dword [eax + 8]
mov eax, esi
call fcn.00402828
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f4d9f
lea eax, [ebp - 4]
call fcn.00403ec4
ret
Function at 0x61d5bc
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x10]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov ebx, eax
mov dl, 1
mov eax, dword [0x412720]
call fcn.004030f4
mov dword [ebp - 0x14], eax
mov dl, 1
mov eax, dword [0x4330c4]
call fcn.004030f4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
call fcn.004331d8
xor eax, eax
push ebp
push 0x61d6df
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.0061cfa4
mov eax, dword [ebp - 0x14]
call fcn.004161fc
push eax
push 0x2002
call fcn.00407f9c
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x61d6a1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
push eax
call fcn.00407fb4
mov ebx, eax
xor eax, eax
push ebp
push 0x61d690
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
call fcn.004161fc
mov ecx, eax
mov edx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 4]
call fcn.0040296c
mov eax, dword [ebp - 0x18]
push eax
movzx eax, word [0x735d20]
push eax
call fcn.00408a2c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61d697
mov eax, dword [ebp - 0x18]
push eax
call fcn.00407fdc
ret

Function at 0x61d6f0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x61d7c1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov ecx, esi
mov edx, ebx
mov eax, edi
call fcn.005daedc
mov edx, dword [ebp - 4]
mov eax, 0x61d7d8
call fcn.00404430
test eax, eax
je 0x61d7ab
mov eax, dword [ebp - 4]
call fcn.00404144
push eax
push 2
call fcn.00407f9c
mov ebx, eax
test ebx, ebx
je 0x61d7ab
push ebx
call fcn.00407fb4
mov esi, eax
test esi, esi
jne 0x61d756
push ebx
call fcn.00407fac
jmp 0x61d7ab
mov edx, 0x61d7dc
mov eax, esi
call fcn.0040ad18
mov eax, dword [ebp - 4]
call fcn.00404308
mov edx, eax
mov eax, esi
call fcn.0040adb8
push ebx
call fcn.00407fdc
mov eax, edi
call fcn.0043f298
push eax
call fcn.0040896c
test eax, eax
jne 0x61d792
push ebx
call fcn.00407fac
jmp 0x61d7ab
push 0x61d7e0
call fcn.004089ac
push ebx
movzx eax, ax
push eax
call fcn.00408a2c
call fcn.00408534
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61d7c8
lea eax, [ebp - 4]
call fcn.00403ec4
ret
Function at 0x6289e4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x34]
mov ebx, eax
test ebx, ebx
je 0x628a24
mov eax, dword [esi + 0x24]
mov edx, dword [eax + 0x20a8]
mov dword [ebx + 0x28], edx
mov edx, dword [eax + 0x20ac]
mov dword [ebx + 0x2c], edx
mov eax, ebx
call fcn.0043f594
test al, al
je 0x628a24
push 0
mov eax, ebx
call fcn.0043f298
push eax
call fcn.00408b04
pop esi
pop ebx
ret

Function at 0x635930
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x6359ea
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004045b4
mov eax, dword [0x7301f0]
cmp byte [eax], 0
je 0x63599f
push esi
call fcn.00408844
mov edx, eax
inc edx
mov eax, ebx
call fcn.0040495c
mov eax, dword [ebx]
call fcn.00404770
push eax
mov eax, dword [ebx]
call fcn.00404760
push eax
push esi
call fcn.00408834
mov eax, dword [ebx]
call fcn.00404770
mov edx, eax
dec edx
mov eax, ebx
call fcn.0040495c
jmp 0x6359d1
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call fcn.00408a04
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.0040aedc
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.00404750
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6359f1
lea eax, [ebp - 0x3f0]
call fcn.00403ec4
ret

Function at 0x640a28
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
push 0
mov eax, ebx
call fcn.0043f298
push eax
call fcn.00408b04
mov byte [ebx + 0x25c], 0
xor edx, edx
mov eax, ebx
call fcn.00438f3c
pop ebx
ret
Function at 0x646a0c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x646ac6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004045b4
mov eax, dword [0x7301f0]
cmp byte [eax], 0
je 0x646a7b
push esi
call fcn.00408844
mov edx, eax
inc edx
mov eax, ebx
call fcn.0040495c
mov eax, dword [ebx]
call fcn.00404770
push eax
mov eax, dword [ebx]
call fcn.00404760
push eax
push esi
call fcn.00408834
mov eax, dword [ebx]
call fcn.00404770
mov edx, eax
dec edx
mov eax, ebx
call fcn.0040495c
jmp 0x646aad
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call fcn.00408a04
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.0040aedc
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.00404750
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x646acd
lea eax, [ebp - 0x3f0]
call fcn.00403ec4
ret

Function at 0x646ad4
Capabilities:
Get graphical window text

Disassembly:
push ebx
add esp, 0xfffffc14
mov ebx, edx
mov edx, esp
push edx
push 0x3e8
push 0xd
push eax
call fcn.00408a04
mov edx, ebx
mov eax, esp
call fcn.0040aedc
add esp, 0x3ec
pop ebx
ret

Function at 0x64cc44
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov esi, edx
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, eax
call fcn.00407f5c
sub eax, dword [ebx + 0x70]
xor edx, edx
push edx
push eax
mov eax, dword [ebx + 0x74]
cdq
cmp edx, dword [esp + 4]
jne 0x64cc72
cmp eax, dword [esp]
pop edx
pop eax
jae 0x64ccab
jmp 0x64cc76
pop edx
pop eax
jge 0x64ccab
mov eax, dword [0x7314a0]
mov eax, dword [eax]
mov dword [eax + 0x44], 2
call fcn.00407f5c
mov dword [ebx + 0x70], eax
mov eax, ebx
call fcn.00647b14
mov eax, dword [ebx + 0xe4]
test eax, eax
je 0x64ccd0
mov ecx, dword [esp + 4]
mov edx, dword [esp]
mov ebx, dword [eax]
call dword [ebx + 0x40]
jmp 0x64ccd0
cmp dword [ebx + 0x10c], 0
je 0x64ccd0
xor edx, edx
mov eax, dword [ebx + 0x48]
call fcn.0046528c
push 0
push 0
push 0x10
mov eax, dword [ebx + 0x11c]
push eax
call fcn.0040897c
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x657584
Capabilities:
Access peb ldr_data
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6576f5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x8c], 1
mov eax, dword [ebp - 4]
test byte [eax + 0x20], 0x10
jne 0x6576da
lea eax, [ebp - 0x10d]
push eax
push pe_nt_image_headers32
call fcn.00407f44
lea edx, [ebp - 8]
lea eax, [ebp - 0x10d]
call fcn.0040aedc
mov dl, 1
mov eax, dword [0x62f344]
call fcn.0062f39c
mov edx, dword [ebp - 4]
mov dword [edx + 0x84], eax
mov dl, 1
mov eax, dword [0x412720]
call fcn.004030f4
mov edx, dword [ebp - 4]
mov dword [edx + 0x30], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x88]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
call fcn.0062f418
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x6576d7
mov dl, 1
mov eax, dword [0x630bc8]
call fcn.00630c30
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
mov edx, 0x65770c
call fcn.0062f760
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00404190
xor eax, eax
push ebp
push 0x6576d0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
xor ecx, ecx
xor edx, edx
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.00630f30
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00657714
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6576d7
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
call fcn.00403124
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.00403124
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.00403124
ret
mov bl, byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6576fc
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403ee8
ret
Function at 0x664e18
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x735e18
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x664e3a
shr eax, 1
xor eax, 0xedb88320
jmp 0x664e3c
shr eax, 1
dec edx
jne 0x664e28
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x664e21
mov byte [0x736218], 1
pop esi
pop ebx
ret

Function at 0x664e58
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x736218], 0
jne 0x664e6f
call fcn.00664e18
mov eax, edi
dec eax
test eax, eax
jl 0x664e98
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x735e18]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x664e79
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x667724
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x667755
dec al
je 0x667796
dec al
je 0x6677da
dec al
je 0x667845
jmp 0x6678cf
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x6678cf
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x667765
jmp 0x6678cf
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x6678cf
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x6677a6
jmp 0x6678cf
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x6678cf
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x667808
xor ebp, ebp
jmp 0x667819
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x667822
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x6677ea
jmp 0x6678cf
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x6678cf
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x66789d
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.00664ea0
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x667859
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret