joyce8/EMBER2024-capa huggingface dataset:
Function at 0x65c41c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0xc], 0
je 0x65c432
mov ecx, dword [esi]
mov eax, dword [esi + 0x10]
cmp eax, dword [ecx]
je 0x65c456
mov eax, dword [esi]
push dword [esi + 0xc]
mov eax, dword [eax + 0x18]
push eax
call dword [eax + 4]
mov eax, dword [esi]
mov ecx, dword [eax]
mov dword [esi + 0x10], ecx
mov eax, dword [eax + 0x18]
push ecx
push eax
call dword [eax]
add esp, 0x10
mov dword [esi + 0xc], eax
test eax, eax
je 0x65c4b3
cmp dword [esi + 4], 0
je 0x65c466
mov ecx, dword [esi]
mov eax, dword [esi + 8]
cmp eax, dword [ecx + 4]
je 0x65c48b
mov eax, dword [esi]
push dword [esi + 4]
mov eax, dword [eax + 0x18]
push eax
call dword [eax + 4]
mov eax, dword [esi]
mov ecx, dword [eax + 4]
mov dword [esi + 8], ecx
mov eax, dword [eax + 0x18]
push ecx
push eax
call dword [eax]
add esp, 0x10
mov dword [esi + 4], eax
test eax, eax
je 0x65c4b3
and dword [esi + 0x34], 0
lea eax, [esi + 0x3c]
and dword [esi + 0x38], 0
push eax
call fcn.0065f4ac
pop ecx
test eax, eax
jne 0x65c4af
lea eax, [esi + 0x40]
push eax
call fcn.0065f4ac
pop ecx
test eax, eax
je 0x65c4b6
push 0xc
jmp 0x65c4b5
push 2
pop eax
pop esi
pop ebp
ret

Function at 0x65c51d
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
and dword [esi + 0xc], 0
lea eax, [esi + 4]
push eax
call fcn.0065f4ac
pop ecx
test eax, eax
jne 0x65c553
lea eax, [esi + 8]
push eax
call fcn.0065f4ac
pop ecx
test eax, eax
jne 0x65c553
push esi
push 0x65c4b9
push esi
call fcn.0065f628
add esp, 0xc
pop esi
pop ebp
ret

Function at 0x65f248
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor bl, bl
push edi
mov edi, dword [ebp + 0xc]
xor cl, cl
xor eax, eax
mov dword [ebp - 4], esi
or dword [esi], 0xffffffff
mov byte [esi + 4], 0
test edi, edi
je 0x65f2be
mov esi, dword [ebp + 8]
mov dl, byte [eax + esi]
mov ch, cl
xor cl, dl
inc eax
cmp eax, edi
jb 0x65f26b
mov esi, dword [ebp - 4]
cmp dl, ch
jne 0x65f2be
test edi, edi
je 0x65f2be
mov ecx, dword [ebp + 8]
xor ebx, ebx
inc ebx
mov edx, edi
mov byte [esi + 4], bl
call fcn.00647e63
mov edx, eax
xor eax, eax
xor ecx, ecx
cmp dword [ecx + 0x877fd4], edx
jne 0x65f2a8
cmp dword [ecx + 0x877fd0], edi
je 0x65f2b4
add ecx, 0xc
inc eax
cmp ecx, 0x48
jb 0x65f298
or eax, 0xffffffff
mov dword [esi], eax
test eax, eax
jns 0x65f2be
mov byte [esi + 4], 0
pop edi
pop esi
mov al, bl
pop ebx
leave
ret 8

Function at 0x65f628
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
push esi
call fcn.006e2490
mov ecx, dword [ebp + 8]
add esp, 0x18
mov dword [ecx], eax
test eax, eax
jne 0x65f654
call fcn.0065f56c
mov esi, eax
mov eax, esi
pop esi
leave
ret
Function at 0x663d55
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0x200
jb 0x663dbb
mov edx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [edx], ax
jne 0x663dbb
mov ecx, dword [edx + 0x3c]
cmp ecx, 0x1000
jae 0x663dbb
lea eax, [ecx + 0x200]
cmp eax, dword [ebp + 0xc]
ja 0x663dbb
test cl, 7
jne 0x663dbb
add ecx, edx
cmp dword [ecx], 0x4550
jne 0x663dbb
movzx eax, word [ecx + 4]
sub eax, 0x14c
je 0x663dd4
sub eax, 0x74
je 0x663dcd
dec eax
sub eax, 1
je 0x663dcd
dec eax
sub eax, 1
je 0x663dc6
sub eax, 0x3c
je 0x663dbf
sub eax, 0x8464
je 0x663dd4
xor eax, eax
pop ebp
ret
mov edx, 0x3030401
jmp 0x663dd9
mov edx, 0x3030701
jmp 0x663dd9
mov edx, 0x3030501
jmp 0x663dd9
mov edx, 0x3030103
mov eax, 0x400
cmp word [ecx + 0x14], ax
ja 0x663dbb
movzx eax, word [ecx + 0x18]
mov ecx, 0x10b
cmp ax, cx
je 0x663dfc
mov ecx, 0x20b
cmp ax, cx
jne 0x663dbb
mov eax, dword [ebp + 0x10]
mov dword [eax], edx
xor eax, eax
inc eax
pop ebp
ret
Function at 0x669165
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x18], 0
and dword [eax + 0x1c], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
pop ebp
ret

Function at 0x669367
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x93bf44]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x44]
push esi
push edi
push 5
mov esi, ecx
push eax
push esi
mov dword [ebp - 0x88], esi
call fcn.006687ae
push 5
lea ecx, [ebp - 0x84]
lea eax, [esi + 0x60]
push ecx
push eax
mov dword [ebp - 0x8c], eax
call fcn.006687ae
add esp, 0x18
lea edi, [ebp - 0x44]
mov esi, ebx
push 5
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x66940b
lea esi, [ebp - 0x44]
sub esi, ebx
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x88]
call fcn.006688dd
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x84]
push eax
push dword [ebp - 0x8c]
call fcn.006688dd
add esp, 0x18
mov ecx, ebx
push 5
pop edx
mov eax, dword [esi + ecx]
xor dword [ecx], eax
lea ecx, [ecx + 4]
sub edx, 1
jne 0x6693f9
sub edi, 1
jne 0x6693c5
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005c234a
leave
ret 8
Function at 0x66941c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
mov eax, dword [0x93bf44]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
push 0x10
xor eax, eax
mov dword [ebp - 0xbc], ebx
pop ecx
lea edi, [ebp - 0x58]
mov dword [ebp - 0xc0], esi
rep stosd dword es:[edi], eax
mov edi, dword [ebp + 0xc]
cmp edi, 0x40
jbe 0x66949a
lea eax, [ebp - 0xb8]
push eax
call fcn.00669165
push edi
lea eax, [ebp - 0xb8]
push esi
push eax
call fcn.00669197
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xb8]
push eax
call fcn.0066884d
add esp, 0x18
xor esi, esi
mov ecx, esi
mov eax, dword [ebp + ecx - 0x18]
bswap eax
mov dword [ebp + ecx - 0x58], eax
add ecx, 4
cmp ecx, 0x14
jb 0x669486
jmp 0x6694d1
xor esi, esi
mov ebx, esi
test edi, edi
je 0x6694cb
mov esi, dword [ebp - 0xc0]
mov eax, ebx
mov edx, ebx
and eax, 3
shr edx, 2
push 3
pop ecx
sub ecx, eax
movzx eax, byte [esi + ebx]
shl ecx, 3
shl eax, cl
or dword [ebp + edx*4 - 0x58], eax
inc ebx
cmp ebx, edi
jb 0x6694a8
xor esi, esi
mov ebx, dword [ebp - 0xbc]
mov eax, esi
movups xmm0, xmmword [ebp + eax*4 - 0x58]
pxor xmm0, xmmword [str.6666666666666666jjjjjjjjjjjjjjjjP]
movups xmmword [ebp + eax*4 - 0x58], xmm0
add eax, 4
cmp eax, 0x10
jb 0x6694d3
push ebx
call fcn.00669165
push 0x10
lea eax, [ebp - 0x58]
push eax
push ebx
call fcn.006687fe
add esp, 0x10
movups xmm0, xmmword [ebp + esi*4 - 0x58]
pxor xmm0, xmmword [0x878690]
movups xmmword [ebp + esi*4 - 0x58], xmm0
add esi, 4
cmp esi, 0x10
jb 0x669502
lea esi, [ebx + 0x60]
push esi
call fcn.00669165
push 0x10
lea eax, [ebp - 0x58]
push eax
push esi
call fcn.006687fe
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.005c234a
leave
ret 8

Function at 0x669545
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x93bf44]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
mov eax, ebx
mov esi, ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x48], ecx
push edi
mov edi, dword [ebp + 0xc]
cmp eax, 0x40
jae 0x669606
mov byte [ebp + eax - 0x44], bl
inc eax
cmp eax, 0x40
jb 0x669570
cmp edi, 0x40
jbe 0x66959e
push esi
call fcn.00669165
push edi
push dword [ebp - 0x48]
push esi
call fcn.00669197
lea eax, [ebp - 0x44]
push eax
push esi
call fcn.0066884d
add esp, 0x18
jmp 0x6695b0
test edi, edi
je 0x6695b0
push edi
push ecx
lea eax, [ebp - 0x44]
push eax
call fcn.006cdfd0
add esp, 0xc
mov eax, ebx
xor byte [ebp + eax - 0x44], 0x36
inc eax
cmp eax, 0x40
jb 0x6695b2
push esi
call fcn.00669165
push 0x40
lea eax, [ebp - 0x44]
push eax
push esi
call fcn.00669197
add esp, 0x10
xor byte [ebp + ebx - 0x44], 0x6a
inc ebx
cmp ebx, 0x40
jb 0x6695d2
add esi, 0x60
push esi
call fcn.00669165
push 0x40
lea eax, [ebp - 0x44]
push eax
push esi
call fcn.00669197
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.005c234a
leave
ret 8
call fcn.005c247c
int3
Function at 0x66a523
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi + 0x18]
mov dword [esi + 8], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0xc], eax
xor eax, eax
mov word [esi], ax
cmp byte [edi + 1], al
je 0x66a5a0
mov bl, byte [edi + 2]
lea eax, [edi + 0x20]
push eax
lea ecx, [esi + 0x24]
call fcn.0062565a
movzx eax, byte [edi + 4]
mov ecx, esi
push eax
push 0x800
call fcn.0066a605
mov eax, dword [edi + 0x10]
mov dword [esi + 0x44], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x68], eax
mov eax, dword [edi + 0x30]
mov dword [esi + 0x6c], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 0x70], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x74], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x78], eax
mov eax, dword [edi + 0x40]
mov dword [esi + 0x7c], eax
mov al, byte [edi + 3]
mov byte [esi + 0x80], al
jmp 0x66a5a9
mov ecx, esi
call fcn.00656080
mov bl, al
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0x38]
mov dword [esi + 0x48], ecx
mov ecx, dword [edx + 0x3c]
mov dword [esi + 0x4c], ecx
xor ecx, ecx
mov dword [esi + 0x40], 0x3f
mov byte [esi + 5], cl
test bl, bl
jne 0x66a5d4
mov eax, dword [ebp + 0xc]
mov byte [ebp + 0x14], 1
cmp byte [eax + 0x24], cl
jne 0x66a5d7
mov byte [ebp + 0x14], cl
push dword [ebp + 0x14]
mov ecx, esi
push 1
call fcn.0066a605
test bl, bl
je 0x66a600
xor eax, eax
mov byte [esi + 4], 0x14
mov word [esi + 2], ax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x1c], eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x66d2dc
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi], 0
je 0x66d2ef
xor eax, eax
jmp 0x66d379
lea eax, [esi + 0x30]
push edi
push eax
call fcn.0065f4c0
pop ecx
test eax, eax
jne 0x66d375
xor edi, edi
lea eax, [esi + 0x14]
inc edi
push eax
mov dword [esi + 0x28], edi
call fcn.0065f4ac
pop ecx
test eax, eax
jne 0x66d375
lea eax, [esi + 0x18]
push eax
call fcn.0065f4ac
pop ecx
test eax, eax
jne 0x66d375
lea eax, [esi + 0x1c]
push eax
call fcn.0065f4ac
pop ecx
test eax, eax
jne 0x66d375
push dword [ebp + 0x14]
lea eax, [esi + 0x20]
push dword [ebp + 0x14]
push eax
call fcn.0065f5c9
add esp, 0xc
test eax, eax
jne 0x66d375
push dword [ebp + 0x14]
push eax
lea eax, [esi + 0x24]
push eax
call fcn.0065f5c9
add esp, 0xc
test eax, eax
jne 0x66d375
push dword [ebp + 0x10]
lea eax, [esi + 0x10]
mov dword [esi + 4], edi
push dword [ebp + 0xc]
push eax
call fcn.0065f628
add esp, 0xc
test eax, eax
jne 0x66d375
mov dword [esi], edi
jmp 0x66d378
push 0xc
pop eax
pop edi
pop esi
pop ebp
ret
Function at 0x66d527
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 4]
cmp dword [ebx], 0
jne 0x66d53e
push ebx
call fcn.0065f4ac
pop ecx
test eax, eax
jne 0x66d580
push edi
lea edi, [esi + 8]
cmp dword [edi], 0
jne 0x66d552
push edi
call fcn.0065f4ac
pop ecx
test eax, eax
jne 0x66d57f
push ebx
call fcn.0065f534
push edi
call fcn.0065f534
lea eax, [esi + 0xc]
mov byte [esi + 0x10], 0
cmp dword [eax], 0
pop ecx
pop ecx
je 0x66d570
xor eax, eax
jmp 0x66d57f
push esi
push 0x66d4e9
push eax
call fcn.0065f628
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x66d528
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 4]
cmp dword [ebx], 0
jne 0x66d53e
push ebx
call fcn.0065f4ac
pop ecx
test eax, eax
jne 0x66d580
push edi
lea edi, [esi + 8]
cmp dword [edi], 0
jne 0x66d552
push edi
call fcn.0065f4ac
pop ecx
test eax, eax
jne 0x66d57f
push ebx
call fcn.0065f534
push edi
call fcn.0065f534
lea eax, [esi + 0xc]
mov byte [esi + 0x10], 0
cmp dword [eax], 0
pop ecx
pop ecx
je 0x66d570
xor eax, eax
jmp 0x66d57f
push esi
push 0x66d4e9
push eax
call fcn.0065f628
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x67d870
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x67d8fc
push esi
call fcn.00692bb0
add esp, 4
test al, al
jne 0x67d8fc
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x67d893
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.0069bfa0
add esp, 0xc
test eax, eax
je 0x67d8c7
sub eax, esi
push eax
push 0x2e
push esi
call fcn.0069bfa0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x67d8c9
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
mov ebx, 0x1505
add edi, esi
cmp esi, edi
jae 0x67d8f5
mov al, byte [esi]
push eax
call fcn.0068c9a0
movsx ecx, al
inc esi
mov eax, ebx
add esp, 4
shl eax, 5
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp esi, edi
jb 0x67d8d7
pop edi
movzx eax, bl
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x688170
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp byte [edi + 0x6f9], 0
je 0x688207
cmp dword [edi + 0x1a8], 0
je 0x6881c1
push esi
push 1
push edi
call fcn.00678920
push dword [edi + 0x14c]
mov eax, dword [edi + 0x1a8]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push edi
call eax
push 0
push edi
mov esi, eax
call fcn.00678920
add esp, 0x24
mov eax, esi
pop esi
pop edi
ret
mov edx, dword [esp + 0xc]
mov ecx, edx
sub ecx, 0
je 0x6881d6
sub ecx, 1
je 0x6881d6
sub ecx, 1
jne 0x688207
push dword [edi + 0x148]
lea eax, [edx*2 + 0x87b748]
push 1
add eax, edx
push 2
push eax
call fcn.006d7c55
push dword [edi + 0x148]
push 1
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call fcn.006d7c55
add esp, 0x20
xor eax, eax
pop edi
ret
Function at 0x69d050
Capabilities:
Create thread

Disassembly:
push 0
push 0
push dword [esp + 0x10]
push dword [esp + 0x10]
push 0
push 0
call fcn.006e2490
mov ecx, eax
add esp, 0x18
xor eax, eax
test ecx, ecx
je 0x69d076
cmp ecx, 0xffffffff
cmovne eax, ecx
ret
Function at 0x6c07d0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push dword [esp + 0x24]
call fcn.0068abb0
mov edx, dword [ebp + 0xc]
mov ebx, eax
mov ecx, dword [ebp + 0x14]
mov dword [esp + 0x14], ebx
lea ecx, [ecx + edx*2]
add ecx, 0xc
push ecx
call dword [0x93c0f8]
mov esi, eax
add esp, 8
test esi, esi
je 0x6c0952
lea ecx, [esi + 0xc]
mov dword [esi], ebp
mov dword [esi + 4], ecx
mov eax, dword [ebp + 0xc]
add eax, ecx
mov dword [esi + 8], eax
push edi
lea edi, [ebp + 4]
cmp ebx, dword [ebp + 0x10]
jbe 0x6c0852
mov eax, dword [ebp]
push ecx
call eax
mov eax, dword [esp + 0x28]
push ebx
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
mov eax, dword [esi + 8]
add eax, dword [ebp + 0xc]
push dword [esi + 4]
mov dword [esp + 0x38], eax
push eax
mov eax, dword [ebp + 8]
call eax
mov eax, dword [ebp + 0x14]
add esp, 0x18
mov dword [esp + 0x14], eax
push dword [esi + 4]
mov eax, dword [ebp]
call eax
push dword [esi + 8]
mov eax, dword [ebp]
call eax
mov eax, dword [esp + 0x1c]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x6c08c3
mov ebp, dword [esp + 0x24]
mov ebx, eax
mov dword [esp + 0x18], eax
nop dword [eax]
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x13], al
lea eax, [esp + 0x13]
push 1
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x1f], al
lea eax, [esp + 0x1f]
push 1
push eax
push dword [esi + 8]
mov eax, dword [edi]
call eax
add esp, 0x18
sub ebx, 1
jne 0x6c0880
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x20]
cmp ebx, dword [ebp + 0x10]
jae 0x6c08f5
nop dword [eax + eax]
mov eax, dword [edi]
push 1
push 0x884224
push dword [esi + 4]
call eax
mov eax, dword [edi]
push 1
push 0x884225
push dword [esi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [ebp + 0x10]
jb 0x6c08d0
push dword [esp + 0x30]
call fcn.0068abb0
mov ecx, dword [esi]
push eax
push dword [esp + 0x34]
push dword [esi + 4]
mov eax, dword [ecx + 4]
call eax
mov edi, dword [esp + 0x44]
add esp, 0x10
mov ebx, dword [esi]
test edi, edi
jne 0x6c0920
mov edi, dword [ebx + 0xc]
add edi, dword [esi + 8]
push dword [esi + 4]
mov eax, dword [ebx + 8]
push edi
call eax
push dword [ebx + 0x14]
mov eax, dword [ebx + 4]
push edi
push dword [esi + 8]
call eax
push dword [esi + 8]
mov eax, dword [ebx + 8]
push edi
call eax
push esi
call dword [0x93c0fc]
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
pop esi
pop ebp
mov eax, 0x1b
pop ebx
add esp, 0xc
ret
Function at 0x6ca4c0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.006ca4d0
Function at 0x6f3ac2
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.006f3941
Function at 0x7180f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc
call fcn.005c35b0
mov eax, dword [esp + 0x10]
push ebx
push esi
test byte [eax + 0x10], 4
mov esi, dword [eax + 4]
lea ebx, [esi - 1]
je 0x718197
mov ecx, dword [eax + 8]
xor edx, edx
push ebp
xor ebp, ebp
mov dword [esp + 0xc], 0
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], ecx
test ecx, ecx
jle 0x718180
mov ecx, dword [eax]
mov dword [esp + 0x10], ecx
push edi
push dword [ecx]
mov eax, ebp
xor eax, ebx
lea edi, [eax - 1]
not eax
shr edi, 0x1f
shr eax, 0x1f
and edi, eax
neg edi
mov esi, edi
or esi, dword [esp + 0x14]
call fcn.007181c0
mov ecx, dword [esp + 0x18]
mov edx, esi
not edx
mov dword [esp + 0x14], esi
and edx, 0x20
and eax, edi
add edx, dword [esp + 0x24]
inc ebp
add edx, eax
add ecx, 4
add esp, 4
mov dword [esp + 0x20], edx
mov dword [esp + 0x14], ecx
cmp ebp, dword [esp + 0x18]
jl 0x718133
pop edi
mov eax, ebx
shr ebx, 0x1f
not eax
dec eax
shr eax, 0x1f
and eax, ebx
pop ebp
dec eax
pop esi
and eax, edx
pop ebx
add esp, 0xc
ret
test esi, esi
jne 0x7181a3
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret
mov eax, dword [eax]
push dword [eax + esi*4 - 4]
call fcn.007181c0
add esp, 4
shl esi, 5
add esi, 0xffffffe0
add eax, esi
pop esi
pop ebx
add esp, 0xc
ret

Function at 0x734e30
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
xor dl, dl
test esi, esi
je 0x734e57
mov eax, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
sub edi, eax
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
or dl, cl
sub esi, 1
jne 0x734e46
pop edi
movzx eax, dl
pop esi
ret
Function at 0x81d1a0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0081d1b0

Function at 0x81d430
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0081d440
Function at 0x10001220
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
cmp byte [edi + 4], 0
push esi
mov esi, ecx
jne 0x10001249
push 0x10013d78
lea ecx, [esp + 8]
call fcn.10001b1f
push 0x10011d74
lea eax, [esp + 8]
push eax
call fcn.1000214b
xor ecx, ecx
cmp dword [edi + 0x3cc], ecx
jle 0x10001262
mov dl, byte [esi]
xor byte [eax], dl
inc ecx
inc esi
inc eax
cmp ecx, dword [edi + 0x3cc]
jl 0x10001253
pop esi
add esp, 0xc
ret

Function at 0x10001985
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10013050]
jne 0x1000198f
repz ret
jmp fcn.100025e6

Function at 0x10008c98
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10003400
and dword [ebp - 4], 0
cmp dword [0x100147f8], 0
mov ebx, eax
jne 0x10008d49
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10008dfa
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x10008dfa
push eax
call fcn.1000338e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x100147f8], eax
call esi
push eax
call fcn.1000338e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x100147fc], eax
call esi
push eax
call fcn.1000338e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10014800], eax
call esi
push eax
call fcn.1000338e
pop ecx
mov dword [0x10014808], eax
test eax, eax
je 0x10008d49
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1000338e
pop ecx
mov dword [0x10014804], eax
mov eax, dword [0x10014804]
cmp eax, ebx
je 0x10008da1
cmp dword [0x10014808], ebx
je 0x10008da1
push eax
call fcn.10003409
push dword [0x10014808]
mov esi, eax
call fcn.10003409
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10008da1
test edi, edi
je 0x10008da1
call esi
test eax, eax
je 0x10008d98
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10008d98
test byte [ebp - 0xc], 1
jne 0x10008da1
or dword [ebp + 0x10], 0x200000
jmp 0x10008dda
mov eax, dword [0x100147fc]
cmp eax, ebx
je 0x10008dda
push eax
call fcn.10003409
pop ecx
test eax, eax
je 0x10008dda
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10008dda
mov eax, dword [0x10014800]
cmp eax, ebx
je 0x10008dda
push eax
call fcn.10003409
pop ecx
test eax, eax
je 0x10008dda
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x100147f8]
call fcn.10003409
pop ecx
test eax, eax
je 0x10008dfa
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10008dfc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10009330
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov eax, dword [0x10013050]
xor eax, esp
mov dword [esp + 0x1c], eax
mov al, 0x64
mov dl, 0x73
mov cl, 0x61
push ebx
xor ebx, ebx
mov byte [esp + 0x1e], al
mov byte [esp + 0xc], al
mov byte [esp + 0x11], al
mov byte [esp + 0x18], al
mov byte [esp + 0x1b], dl
mov byte [esp + 0x17], dl
mov byte [esp + 0xb], dl
mov byte [esp + 0xf], dl
lea eax, [esp + 8]
mov byte [esp + 0x13], 0x6b
mov byte [esp + 0x16], cl
mov byte [esp + 0x1c], cl
mov byte [esp + 0x10], cl
mov byte [esp + 0x1d], 0x6c
mov byte [esp + 8], 0x6a
mov byte [esp + 0x19], 0x66
mov byte [esp + 0xe], 0x67
mov byte [esp + 0xa], cl
mov byte [esp + 9], 0x6b
mov byte [esp + 0x12], 0x6a
mov byte [esp + 0x14], 0x66
mov byte [esp + 0x1a], 0x6b
mov byte [esp + 0x15], 0x68
mov byte [esp + 0x1f], bl
mov byte [esp + 0xd], 0x66
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
mov dword [esp + 4], ebx
mov byte [esi + 4], bl
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100093d0
sub eax, edx
push eax
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.100014b0
mov ecx, dword [esp + 0x20]
pop ebx
xor ecx, esp
mov eax, esi
call fcn.10001985
add esp, 0x20
ret