joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6b89a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6f424a
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x70b414]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x34
call fcn.006df1ed
mov edi, eax
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov dword [edi], 0x6ffaec
mov byte [edi + 4], 1
movups xmmword [edi + 8], xmm0
mov dword [edi + 8], 0x6ffa60
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
lea esi, [edi + 0x20]
mov byte [ebp - 4], 2
push 0x10
mov dword [ebp - 0x14], esi
call fcn.006df1ed
xorps xmm0, xmm0
mov dword [ebp - 0x14], eax
add esp, 8
movq qword [eax], xmm0
lea ecx, [eax + 0xc]
mov dword [eax + 8], 0
mov dword [eax + 4], 1
mov dword [eax + 8], 1
mov dword [eax], fcn.006c0340
mov dword [ecx], 0
mov dword [esi + 4], eax
mov eax, edi
mov dword [esi], ecx
mov dword [edi], 0x6ffb40
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov word [edi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x6b8da0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6f42b0
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x70b414]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [edi + 8]
test esi, esi
je 0x6b8e07
mov dword [ebp - 4], 0
lea ecx, [esi + 8]
xor al, al
xchg byte [ecx], al
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x6b8df5
mov eax, dword [ecx]
call dword [eax + 0x24]
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x6b8df5
mov eax, dword [ecx]
push 1
call dword [eax]
push 0x10
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.006df222
add esp, 8
mov ebx, dword [edi + 4]
mov dword [edi + 8], 0
test ebx, ebx
je 0x6b8e3f
mov eax, dword [ebx]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [fcn.006f83a4]
mov ecx, ebx
call esi
mov ebx, dword [edi + 4]
test ebx, ebx
je 0x6b8e3f
mov eax, dword [ebx]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [fcn.006f83a4]
mov ecx, ebx
call esi
push dword [edi + 0xc]
mov dword [edi + 4], 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [edi + 0x18], 0xffffffe8
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0xffffffe8
mov dword [edi + 0x28], 0xffffffe8
mov dword [edi + 0x2c], 0xffffffe8
mov dword [edi + 0x30], 0xffffffe8
mov dword [edi + 0x34], 0xffffffe8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6c1390
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6f4dee
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x70b414]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x20], edi
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x18], 0
mov esi, dword [0x70be70]
push eax
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call esi
mov ebx, eax
mov dword [edi + 4], 0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], 1
mov ecx, edi
push 0
mov dword [edi], 0x6ff81c
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
call fcn.006bac90
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 1
test ebx, ebx
je 0x6c150f
xor esi, esi
cmp dword [ebp - 0x10], esi
jle 0x6c1508
nop word [eax + eax]
push dword [ebx + esi*4]
lea ecx, [ebp - 0x30]
call fcn.006c6fd0
mov dword [ebp - 4], 2
mov edx, dword [edi + 0xc]
cmp dword [edi + 4], edx
jne 0x6c149b
mov ebx, edx
mov eax, 0xa
shr ebx, 1
cmp ebx, 0xa
cmovb ebx, eax
mov eax, dword [edi]
mov eax, dword [eax + 8]
cmp eax, 0x6bab40
je 0x6c147b
mov ecx, edi
call eax
mov edx, eax
mov ecx, dword [edi]
lea eax, [edx + ebx]
push eax
mov ecx, dword [ecx + 4]
cmp ecx, fcn.006baaf0
mov dword [ebp - 0x1c], ecx
mov ecx, edi
jne 0x6c1498
call fcn.006baaf0
jmp 0x6c149b
call dword [ebp - 0x1c]
mov ecx, dword [edi + 4]
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x2c]
shl ecx, 4
add ecx, dword [edi + 8]
mov dword [ebp - 0x1c], ecx
mov dword [ecx], 0x6ffa60
mov dword [ecx + 4], 0
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], eax
test edx, edx
je 0x6c14e0
push edx
call fcn.006e3fc6
mov ecx, dword [ebp - 0x1c]
push dword [ecx + 8]
mov dword [ecx + 4], eax
push ebx
push eax
call fcn.006e1ac0
add esp, 0x10
inc dword [edi + 4]
mov byte [ebp - 4], 0
mov dword [ebp - 0x30], 0x6ffa60
test ebx, ebx
je 0x6c14fb
push ebx
call fcn.006e3fab
add esp, 4
mov ebx, dword [ebp - 0x14]
inc esi
cmp esi, dword [ebp - 0x10]
jl 0x6c1440
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree_1]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6c2270
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6f42b0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x70b414]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
push 0x20
mov byte [esi], 0
mov dword [ebp - 4], 0xffffffff
call fcn.006ba460
mov dword [esi + 0x10], 0x1b
xorps xmm0, xmm0
mov dword [esi + 0x14], 0x1f
movups xmmword [eax], xmm0
movq qword [eax + 0x10], xmm0
mov dword [eax + 0x18], 0
mov dword [esi], eax
mov eax, esi
cmp dword [esi + 0x14], 0x10
jb 0x6c22eb
mov eax, dword [esi]
movsx ecx, byte [eax]
mov eax, esi
add ecx, 0x253a0b9
cmp dword [esi + 0x14], 0x10
jb 0x6c22fe
mov eax, dword [esi]
sub edi, eax
mov dword [ebp - 0x10], edi
mov edi, 0x1b
mov esi, dword [ebp - 0x10]
nop dword [eax + eax]
mov edx, ecx
lea eax, [eax + 1]
imul ecx, ecx, 0xd3f5
shr edx, 8
xor dl, byte [esi + eax - 1]
mov byte [eax - 1], dl
add ecx, 0x1e3f7cfe
sub edi, 1
jne 0x6c2310
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x6c53b0
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x18]
test esi, esi
jne 0x6c53c9
push dword [edi + 4]
push esi
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
xor al, al
test esi, esi
je 0x6c53ef
push ebx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess_1]
cmp eax, 1
sete bl
cmp dword [edi + 0x18], 0
jne 0x6c53ec
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle_1]
mov al, bl
pop ebx
pop edi
pop esi
ret
Function at 0x6ccae0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6f42b0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x70b414]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
push 0x30
mov byte [esi], 0
mov dword [ebp - 4], 0xffffffff
call fcn.006ba460
mov dword [esi + 0x10], 0x24
xorps xmm0, xmm0
mov dword [esi + 0x14], 0x2f
movups xmmword [eax], xmm0
movups xmmword [eax + 0x10], xmm0
mov dword [eax + 0x20], 0
mov byte [eax + 0x24], 0
mov dword [esi], eax
mov eax, esi
cmp dword [esi + 0x14], 0x10
jb 0x6ccb5e
mov eax, dword [esi]
movsx ecx, byte [eax]
mov eax, esi
add ecx, 0x97979a
cmp dword [esi + 0x14], 0x10
jb 0x6ccb71
mov eax, dword [esi]
sub edi, eax
mov dword [ebp - 0x10], edi
mov edi, 0x24
mov esi, dword [ebp - 0x10]
nop
mov edx, ecx
lea eax, [eax + 1]
imul ecx, ecx, 0xdcf5
shr edx, 0xa
xor dl, byte [esi + eax - 1]
mov byte [eax - 1], dl
add ecx, 0x7b3066b
sub edi, 1
jne 0x6ccb80
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x6cdd30
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, edi
or eax, ecx
test al, 3
je 0x6cdd52
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ebx, dword [ebp + 0x10]
mov eax, ebx
shr eax, 3
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], 0
test eax, eax
je 0x6cde06
mov eax, edi
lea ebx, [ecx + 4]
sub eax, ecx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], eax
nop dword [eax]
mov esi, dword [ebx - 4]
mov eax, 0xc6ef3720
mov edi, dword [ebx]
mov dword [ebp - 4], 0x20
mov ebx, dword [ebp + 0x14]
mov edx, esi
shr edx, 5
mov ecx, esi
shl ecx, 4
xor edx, ecx
mov ecx, eax
shr ecx, 0xb
add edx, esi
and ecx, 3
mov ecx, dword [ebx + ecx*4]
add ecx, eax
add eax, 0x61c88647
xor edx, ecx
sub edi, edx
mov edx, edi
mov ecx, edi
shl ecx, 4
shr edx, 5
xor edx, ecx
mov ecx, eax
and ecx, 3
add edx, edi
mov ecx, dword [ebx + ecx*4]
add ecx, eax
xor edx, ecx
sub esi, edx
sub dword [ebp - 4], 1
jne 0x6cdd91
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 0xc]
mov dword [eax + ecx*8], esi
inc ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], ecx
mov dword [eax + ebx], edi
add ebx, 8
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], ebx
cmp ecx, eax
jb 0x6cdd80
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
lea esi, [eax*8]
cmp ebx, esi
jbe 0x6cde37
push ecx
push dword [ebp + 0x14]
lea eax, [esi + ecx]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.006cde50
mov ecx, ebx
lea eax, [ebp - 0x18]
sub ecx, esi
push ecx
push eax
lea ecx, [esi + edi]
push ecx
call fcn.006e1ac0
add esp, 0xc
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x6cde50
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov esi, dword [eax]
mov edi, dword [eax + 4]
mov eax, 0xc6ef3720
mov dword [ebp - 4], 0x20
nop dword [eax + eax]
mov ebx, dword [ebp + 0x10]
mov edx, esi
shr edx, 5
mov ecx, esi
shl ecx, 4
xor edx, ecx
mov ecx, eax
shr ecx, 0xb
add edx, esi
and ecx, 3
mov ecx, dword [ebx + ecx*4]
add ecx, eax
add eax, 0x61c88647
xor edx, ecx
sub edi, edx
mov edx, edi
mov ecx, edi
shl ecx, 4
shr edx, 5
xor edx, ecx
mov ecx, eax
and ecx, 3
add edx, edi
mov ecx, dword [ebx + ecx*4]
add ecx, eax
xor edx, ecx
sub esi, edx
sub dword [ebp - 4], 1
jne 0x6cde70
mov eax, dword [ebp + 8]
mov dword [eax + 4], edi
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x6d07b0
Capabilities:
Hash data using sha256

Disassembly:
push 0x40
lea eax, [ecx + 0x18]
mov dword [ecx + 8], 0
push 0
push eax
mov dword [ecx + 0x11c], 0x6a09e667
mov dword [ecx + 0x120], 0xbb67ae85
mov dword [ecx + 0x124], 0x3c6ef372
mov dword [ecx + 0x128], 0xa54ff53a
mov dword [ecx + 0x12c], 0x510e527f
mov dword [ecx + 0x130], 0x9b05688c
mov dword [ecx + 0x134], 0x1f83d9ab
mov dword [ecx + 0x138], 0x5be0cd19
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x118], 0
call fcn.006e0650
add esp, 0xc
ret 4
Function at 0x6d77d0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x70b414]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
push ebx
mov dword [ebp - 8], eax
push esi
mov ecx, dword [eax + 4]
lea ebx, [eax + 0xc]
mov eax, dword [ebx]
inc eax
push edi
test ecx, ecx
jne 0x6d77fa
mov ecx, 0x6ff7c8
push 0
push 0
push eax
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar_1]
mov esi, eax
lea eax, [esi + esi]
call fcn.006f3e10
mov ecx, dword [ebp - 8]
mov edi, esp
mov edx, dword [ebx]
mov eax, 0x6ff7c8
push esi
inc edx
mov ecx, dword [ecx + 4]
test ecx, ecx
push edi
push edx
cmovne eax, ecx
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar_1]
push 0
push 0x80
push 3
push 0
push 7
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW_1]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError_1]
cmp ebx, 0xffffffff
jne 0x6d787e
mov ecx, eax
call fcn.006d4610
lea esp, [ebp - 0x20]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006df1da
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push 0
push eax
push dword [ebp + 0xc]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError_1]
mov dword [ebp - 8], eax
cmp esi, dword [ebp - 0x10]
jne 0x6d78b1
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0xc]
jne 0x6d78b1
mov ecx, 1
jmp 0x6d78b3
xor ecx, ecx
and edi, ecx
je 0x6d78ca
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile_1]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError_1]
mov esi, eax
jmp 0x6d78cd
mov esi, dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle_1]
test edi, edi
jne 0x6d78f3
mov ecx, esi
call fcn.006d4610
lea esp, [ebp - 0x20]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006df1da
mov esp, ebp
pop ebp
ret
xor eax, eax
lea esp, [ebp - 0x20]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006df1da
mov esp, ebp
pop ebp
ret
Function at 0x6d84c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6f42b0
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x70b414]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 8]
mov dword [edi], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
push 0x30
mov byte [edi], 0
mov dword [ebp - 4], 0xffffffff
call fcn.006ba460
push 0x2c
mov esi, eax
mov dword [edi + 0x10], 0x2c
push 0
push esi
mov dword [edi + 0x14], 0x2f
call fcn.006e0650
mov byte [esi + 0x2c], 0
add esp, 0xc
mov dword [edi], esi
mov eax, edi
cmp dword [edi + 0x14], 0x10
jb 0x6d853c
mov eax, esi
movsx edx, byte [eax]
mov eax, edi
add edx, 0xab6dc6
cmp dword [edi + 0x14], 0x10
jb 0x6d854f
mov eax, dword [edi]
sub ebx, eax
mov esi, 0x2c
nop word [eax + eax]
mov ecx, edx
lea eax, [eax + 1]
imul edx, edx, 0xe4f5
shr ecx, 8
xor cl, byte [ebx + eax - 1]
mov byte [eax - 1], cl
add edx, 0x8b4e6a7
sub esi, 1
jne 0x6d8560
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x6d85a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6f42b0
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x70b414]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
mov dword [esi], 0
mov dword [esi + 0x10], 0
xorps xmm0, xmm0
mov dword [esi + 0x14], 0xf
mov eax, esi
mov byte [esi], 0
mov dword [esi + 0x10], 0xf
movq qword [esi], xmm0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
cmp dword [esi + 0x14], 0x10
jb 0x6d8607
mov eax, dword [esi]
movsx edx, byte [eax]
mov eax, esi
add edx, 0x6cddfd
cmp dword [esi + 0x14], 0x10
jb 0x6d861a
mov eax, dword [esi]
sub ebx, eax
mov edi, 0xf
mov ecx, edx
lea eax, [eax + 1]
imul edx, edx, 0xc7f5
shr ecx, 7
xor cl, byte [ebx + eax - 1]
mov byte [eax - 1], cl
add edx, 0x5879972
sub edi, 1
jne 0x6d8621
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x6d8660
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6f42b0
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x70b414]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
mov dword [esi], 0
mov dword [esi + 0x10], 0
xorps xmm0, xmm0
mov dword [esi + 0x14], 0xf
mov eax, esi
mov byte [esi], 0
mov dword [esi + 0x10], 0xb
movq qword [esi], xmm0
mov dword [esi + 8], 0
cmp dword [esi + 0x14], 0x10
jb 0x6d86c0
mov eax, dword [esi]
movsx edx, byte [eax]
mov eax, esi
add edx, 0x6cddfd
cmp dword [esi + 0x14], 0x10
jb 0x6d86d3
mov eax, dword [esi]
sub ebx, eax
mov edi, 0xb
nop word [eax + eax]
mov ecx, edx
lea eax, [eax + 1]
imul edx, edx, 0xc3f5
shr ecx, 7
xor cl, byte [ebx + eax - 1]
mov byte [eax - 1], cl
add edx, 0x5879972
sub edi, 1
jne 0x6d86e0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x6d8720
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6f42b0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x70b414]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
push 0x20
mov byte [esi], 0
mov dword [ebp - 4], 0xffffffff
call fcn.006ba460
mov dword [esi + 0x10], 0x12
xorps xmm0, xmm0
mov dword [esi + 0x14], 0x1f
movups xmmword [eax], xmm0
mov word [eax + 0x10], 0
mov byte [eax + 0x12], 0
mov dword [esi], eax
mov eax, esi
cmp dword [esi + 0x14], 0x10
jb 0x6d8799
mov eax, dword [esi]
movsx ecx, byte [eax]
mov eax, esi
add ecx, 0x684a1a
cmp dword [esi + 0x14], 0x10
jb 0x6d87ac
mov eax, dword [esi]
sub edi, eax
mov dword [ebp - 0x10], edi
mov edi, 0x12
mov esi, dword [ebp - 0x10]
nop dword [eax]
mov edx, ecx
lea eax, [eax + 1]
imul ecx, ecx, 0xcaf5
shr edx, 0xa
xor dl, byte [esi + eax - 1]
mov byte [eax - 1], dl
add ecx, 0x54c16eb
sub edi, 1
jne 0x6d87c0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x6d8800
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6f42b0
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x70b414]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
mov dword [esi], 0
mov dword [esi + 0x10], 0
xorps xmm0, xmm0
mov dword [esi + 0x14], 0xf
mov eax, esi
mov byte [esi], 0
mov dword [esi + 0x10], 0xb
movq qword [esi], xmm0
mov dword [esi + 8], 0
cmp dword [esi + 0x14], 0x10
jb 0x6d8860
mov eax, dword [esi]
movsx edx, byte [eax]
mov eax, esi
add edx, 0x684a1a
cmp dword [esi + 0x14], 0x10
jb 0x6d8873
mov eax, dword [esi]
sub ebx, eax
mov edi, 0xb
nop word [eax + eax]
mov ecx, edx
lea eax, [eax + 1]
imul edx, edx, 0xc3f5
shr ecx, 0xa
xor cl, byte [ebx + eax - 1]
mov byte [eax - 1], cl
add edx, 0x54c16eb
sub edi, 1
jne 0x6d8880
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x6d88c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6f42b0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x70b414]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
push 0x20
mov byte [esi], 0
mov dword [ebp - 4], 0xffffffff
call fcn.006ba460
mov dword [esi + 0x10], 0x13
xorps xmm0, xmm0
mov dword [esi + 0x14], 0x1f
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
mov dword [esi], eax
mov eax, esi
cmp dword [esi + 0x14], 0x10
jb 0x6d8936
mov eax, dword [esi]
movsx ecx, byte [eax]
mov eax, esi
add ecx, 0x5a8e71
cmp dword [esi + 0x14], 0x10
jb 0x6d8949
mov eax, dword [esi]
sub edi, eax
mov dword [ebp - 0x10], edi
mov edi, 0x13
mov esi, dword [ebp - 0x10]
nop word [eax + eax]
mov edx, ecx
lea eax, [eax + 1]
imul ecx, ecx, 0xcbf5
shr edx, 0xa
xor dl, byte [esi + eax - 1]
mov byte [eax - 1], dl
add ecx, 0x4998f56
sub edi, 1
jne 0x6d8960
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x6d89a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6f42b0
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x70b414]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
mov dword [esi], 0
mov dword [esi + 0x10], 0
xorps xmm0, xmm0
mov dword [esi + 0x14], 0xf
mov eax, esi
mov byte [esi], 0
mov dword [esi + 0x10], 0xb
movq qword [esi], xmm0
mov dword [esi + 8], 0
cmp dword [esi + 0x14], 0x10
jb 0x6d8a00
mov eax, dword [esi]
movsx edx, byte [eax]
mov eax, esi
add edx, 0x5a8e71
cmp dword [esi + 0x14], 0x10
jb 0x6d8a13
mov eax, dword [esi]
sub ebx, eax
mov edi, 0xb
nop word [eax + eax]
mov ecx, edx
lea eax, [eax + 1]
imul edx, edx, 0xc3f5
shr ecx, 0xa
xor cl, byte [ebx + eax - 1]
mov byte [eax - 1], cl
add edx, 0x4998f56
sub edi, 1
jne 0x6d8a20
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x6ebe0a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.006ebc80

Function at 0x6ed0bb
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.006ecd38

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx