joyce8/EMBER2024-capa huggingface dataset:
Function at 0x605130
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov esi, esp
mov dword [esi + 0x20], ebp
mov dword [esi + 0x24], esp
mov dword [esi + 0x30], 0xffffffff
lea eax, [esi + 0x28]
mov dword [esi + 0x2c], 0x606d10
mov ecx, dword fs:[0]
mov dword [esi + 0x28], ecx
mov dword fs:[0], eax
mov dword [esi + 0x30], 0
call fcn.00606ae0
mov dword [esi + 4], eax
mov dword [esi], edx
call fcn.00606af0
push dword [esi]
push dword [esi + 4]
push edx
push eax
mov dword [esi + 0xc], edx
mov dword [esi + 8], eax
call fcn.00765b40
mov edi, eax
mov ecx, edx
mov edx, 0x3b9aca00
mul edx
mov dword [esi + 0x14], eax
imul eax, ecx, 0x3b9aca00
add eax, edx
mov dword [esi + 0x10], eax
mov ebx, dword [esi]
imul ebx, edi
mov eax, edi
mov edi, dword [esi + 4]
mul edi
add edx, ebx
imul ecx, edi
add ecx, edx
mov edx, dword [esi + 8]
sub edx, eax
mov ebx, dword [esi + 0xc]
sbb ebx, ecx
mov eax, edx
mov ecx, 0x3b9aca00
mul ecx
imul ecx, ebx, 0x3b9aca00
add edx, ecx
push dword [esi]
push edi
push edx
push eax
call fcn.00765b40
mov edi, eax
add edi, dword [esi + 0x14]
adc edx, dword [esi + 0x10]
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
cmp ebx, 1
mov eax, ecx
sbb eax, 0
jl 0x605245
mov dword [esi], edx
mov edx, 0xfff0bdc0
mov eax, ebx
mul edx
sub edx, ebx
mov dword [esi + 4], ecx
imul ecx, ecx, 0xfff0bdc0
add ecx, edx
add eax, 0xffffffff
adc ecx, 0x7fffffff
cmp edi, eax
mov eax, dword [esi]
sbb eax, ecx
jge 0x60523b
mov ecx, 0xf4240
mov eax, ebx
mul ecx
imul ecx, dword [esi + 4], 0xf4240
add ecx, edx
mov edx, dword [esi]
add edi, eax
adc edx, ecx
jmp 0x605245
mov edx, 0x7fffffff
mov edi, 0xffffffff
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edx
mov dword [esi + 0x30], 0xffffffff
lea eax, [esi + 0x18]
push eax
call fcn.00605280
add esp, 4
mov eax, dword [esi + 0x28]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x605280
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, esp
mov dword [esi + 0x28], ebp
mov dword [esi + 0x2c], esp
mov dword [esi + 0x38], 0xffffffff
lea eax, [esi + 0x30]
mov dword [esi + 0x34], 0x606d20
mov ecx, dword fs:[0]
mov dword [esi + 0x30], ecx
mov dword fs:[0], eax
nop word cs:[eax + eax]
mov dword [esi + 0x38], 0
call fcn.00606ae0
mov dword [esi + 4], eax
mov dword [esi], edx
call fcn.00606af0
push dword [esi]
push dword [esi + 4]
push edx
push eax
mov dword [esi + 0x14], edx
mov dword [esi + 0x10], eax
call fcn.00765b40
mov edi, eax
mov ecx, edx
mov edx, 0x3b9aca00
mul edx
mov dword [esi + 0xc], eax
imul eax, ecx, 0x3b9aca00
add eax, edx
mov dword [esi + 8], eax
mov ebx, dword [esi]
imul ebx, edi
mov eax, edi
mov edi, dword [esi + 4]
mul edi
add edx, ebx
imul ecx, edi
add ecx, edx
mov edx, dword [esi + 0x10]
sub edx, eax
mov ebx, dword [esi + 0x14]
sbb ebx, ecx
mov eax, edx
mov ecx, 0x3b9aca00
mul ecx
imul ecx, ebx, 0x3b9aca00
add edx, ecx
push dword [esi]
push edi
push edx
push eax
call fcn.00765b40
mov ebx, eax
add ebx, dword [esi + 0xc]
adc edx, dword [esi + 8]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edi, dword [eax + 4]
cmp ebx, ecx
mov eax, edx
sbb eax, edi
jge 0x6053e5
mov dword [esi + 8], ebx
mov dword [esi + 0xc], edx
mov dword [esi + 4], edi
mov dword [esi], ecx
mov dword [esi + 0x38], 1
call fcn.00606b00
mov edi, edx
mov ebx, dword [esi]
sub ebx, dword [esi + 8]
mov ecx, dword [esi + 4]
sbb ecx, dword [esi + 0xc]
mov edx, 0x64
mul edx
mov dword [esi], eax
imul eax, edi, 0x64
add eax, edx
cmp ebx, 0xad160000
mov edx, 0xad160000
cmovb edx, ebx
cmp ecx, 0x311cd
mov edi, 0xad160000
cmovge ebx, edi
cmove ebx, edx
mov edx, 0x311cd
cmovge ecx, edx
add ebx, dword [esi]
adc ecx, eax
push 0
push 0x3b9aca00
push ecx
push ebx
call fcn.00765b40
mov dword [esi + 0x1c], edx
mov dword [esi + 0x18], eax
imul eax, eax, 0xc4653600
add eax, ebx
mov dword [esi + 0x20], eax
mov dword [esi + 0x38], 0xffffffff
lea ecx, [esi + 0x18]
call fcn.00606bd0
jmp 0x6052c0
mov eax, dword [esi + 0x30]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6133e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xc8
mov esi, esp
mov dword [esi + 0xb0], ebp
movzx edx, word [ebp + 8]
mov dword [esi + 0xb4], esp
mov dword [esi + 0xc0], 0xffffffff
lea eax, [esi + 0xb8]
mov dword [esi + 0xbc], 0x6164f0
mov edi, dword fs:[0]
mov dword [esi + 0xb8], edi
mov dword fs:[0], eax
mov ebx, dword [ecx]
mov dword [esi + 0x10], ecx
lea edi, [ecx + 4]
lea ecx, [esi + 8]
call fcn.00616200
mov dword [esi], ebx
mov eax, dword [ebx + 0x1c]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0x14]
lea ecx, [esi + 0x78]
push eax
call fcn.00616090
add esp, 4
mov dword [esi + 0xc0], 0
lea ecx, [esi + 0x40]
mov dword [esi + 0xc], edi
mov edx, edi
call fcn.006160b0
mov dword [esi + 0x40], 8
movzx eax, word [esi + 8]
lea edx, [esi + 0x48]
mov dword [esi + 0x18], 0xaac6f4
mov word [esi + 0x1c], ax
lea ebx, [esi + 0x18]
mov dword [esi + 0x3c], ebx
mov ecx, ebx
push edx
call fcn.00614f40
mov edi, dword [esi + 0x3c]
test edi, edi
je 0x6134c1
mov eax, ebx
xor ebx, ebx
cmp edi, eax
setne bl
mov eax, dword [edi]
mov ecx, dword [eax + 0x10]
mov dword [esi + 4], ecx
mov dword [esi + 0xc0], 0xffffffff
call dword [0xb0836c]
mov ecx, edi
push ebx
call dword [esi + 4]
mov dword [esi + 0xc0], 1
lea ecx, [esi + 0x78]
lea eax, [esi + 0x40]
push eax
call fcn.00615950
lea ecx, [esi + 0x78]
call fcn.00616120
mov ecx, eax
call fcn.00616110
mov ebx, eax
mov eax, dword [esi]
mov edi, dword [eax]
mov eax, dword [eax + 4]
mov edx, eax
sub edx, edi
mov ecx, ebx
sub ecx, edx
jae 0x6134fd
add edi, ebx
jmp 0x61352a
jbe 0x61352f
cmp byte [0xb53280], 0
jne 0x6135de
mov edx, dword [esi]
mov edx, dword [edx + 8]
sub edx, edi
cmp edx, ebx
jb 0x6135de
lea edi, [eax + ecx]
push ecx
push 0
push eax
call fcn.0077d260
add esp, 0xc
mov eax, dword [esi]
mov dword [eax + 4], edi
lea ecx, [esi + 0x78]
xor edx, edx
push ebx
mov eax, dword [esi]
push dword [eax]
call fcn.00616130
add esp, 8
mov edi, dword [esi + 0x6c]
test edi, edi
je 0x61356e
xor ebx, ebx
lea eax, [esi + 0x48]
cmp edi, eax
setne bl
mov eax, dword [edi]
mov ecx, dword [eax + 0x10]
mov dword [esi], ecx
mov dword [esi + 0xc0], 0xffffffff
call dword [0xb0836c]
mov ecx, edi
push ebx
call dword [esi]
mov edi, dword [esi + 0xa4]
mov dword [esi + 0xc0], 0xffffffff
test edi, edi
je 0x6135ab
lea eax, [esi + 0x80]
cmp edi, eax
setne bl
or bl, byte [0xb532c2]
mov eax, dword [edi]
mov ecx, dword [eax + 0x10]
mov dword [esi], ecx
call dword [0xb0836c]
movzx eax, bl
and eax, 1
mov ecx, edi
push eax
call dword [esi]
mov eax, dword [esi + 0x10]
mov eax, dword [eax]
lea ecx, [eax + 0xc]
xor edx, edx
push eax
push dword [esi + 0xc]
call fcn.00613060
add esp, 8
cmp dword [eax], 0
sete al
mov ecx, dword [esi + 0xb8]
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov ecx, dword [esi]
lea eax, [esi + 0x18]
push eax
push ebx
mov dword [esi + 4], ebx
call fcn.005fe850
mov ebx, dword [esi + 4]
jmp 0x61352f
Function at 0x61abf0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov esi, ecx
mov eax, dword [0xb44908]
xor eax, ebp
mov dword [esp + 0x28], eax
mov eax, dword [ecx + 0xc]
test eax, eax
je 0x61ac18
cmp eax, 8
jae 0x61ac41
jmp 0x61acaf
mov ecx, dword [0xb53408]
test ecx, ecx
jne 0x61ac2e
mov eax, esp
push eax
call sub.KERNEL32.dll_GetSystemInfo
mov ecx, dword [esp + 0x14]
xor eax, eax
cmp ecx, 2
setb al
shl eax, 5
mov dword [esi + 0xc], eax
cmp eax, 8
jb 0x61acaf
cmp eax, 0x1f
ja 0x61ac4a
pause
jmp 0x61acaf
cmp eax, 0x20
jne 0x61ac58
mov ecx, esi
call fcn.0061d200
jmp 0x61acaf
cmp dword [esi + 8], 0
je 0x61ac97
mov eax, esp
push eax
call sub.KERNEL32.dll_QueryPerformanceCounter
test eax, eax
jne 0x61ac7a
call sub.KERNEL32.dll_GetTickCount
mov dword [esp], eax
mov dword [esp + 4], 0
mov eax, dword [esp]
sub eax, dword [esi]
mov ecx, dword [esp + 4]
sbb ecx, dword [esi + 4]
cmp eax, dword [esi + 8]
sbb ecx, 0
jb 0x61ac9f
mov dword [esi + 8], 0
jmp 0x61ac9b
test al, 1
jne 0x61ac9f
push 1
jmp 0x61acaa
call sub.KERNEL32.dll_SwitchToThread
test eax, eax
jne 0x61acaf
push 0
call sub.KERNEL32.dll_Sleep
inc dword [esi + 0xc]
mov ecx, dword [esp + 0x28]
xor ecx, ebp
call fcn.0076521b
lea esp, [ebp - 4]
pop esi
pop ebp
ret
Function at 0x61b7d0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x110
mov esi, esp
mov dword [esi + 0xf8], ebp
mov dword [esi + 0xfc], esp
mov dword [esi + 0x108], 0xffffffff
lea eax, [esi + 0x100]
mov dword [esi + 0x104], 0x622300
mov ecx, dword fs:[0]
mov dword [esi + 0x100], ecx
mov dword fs:[0], eax
mov dword [esp], 1
lea ecx, [esi + 0x48]
call fcn.005440b0
sub esp, 4
mov dword [esi + 0x108], 2
call sub.KERNEL32.dll_GetCurrentProcessId
lea ecx, [esi + 0x58]
mov dword [esp], eax
call fcn.0061c240
sub esp, 4
mov dword [esp], eax
mov dword [esp + 4], 0x5f
call fcn.0061bbc0
mov eax, dword [esi + 0x48]
mov eax, dword [eax + 4]
mov dword [esi + eax + 0x60], 6
mov dword [esi + eax + 0x64], 0
mov eax, dword [esi + 0x58]
mov eax, dword [eax + 4]
mov ecx, 0xffffcfff
and ecx, dword [esi + eax + 0x6c]
or ecx, 0x2000
mov dword [esi + eax + 0x6c], ecx
call sub.KERNEL32.dll_GetCurrentProcess
lea ecx, [esi + 0x30]
mov dword [esp + 0x10], ecx
lea ecx, [esi + 0x38]
mov dword [esp + 0xc], ecx
lea ecx, [esi + 0x40]
mov dword [esp + 8], ecx
lea ecx, [esi + 0x18]
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcessTimes
sub esp, 0x14
movsd xmm1, qword [0xaacc60]
movss xmm0, dword [esi + 0x1c]
orpd xmm0, xmm1
movss xmm2, dword [esi + 0x18]
orpd xmm2, xmm1
subsd xmm2, xmm1
mulsd xmm2, qword [0xaacc68]
subsd xmm0, xmm1
mulsd xmm0, qword [0xaacc70]
addsd xmm0, xmm2
movsd qword [esp], xmm0
lea ecx, [esi + 0x58]
call fcn.0061c7d0
sub esp, 8
lea ecx, [esi + 0x60]
lea eax, [esi + 0x18]
mov dword [esp], eax
call fcn.0055d5e0
sub esp, 4
mov edi, dword [ebp + 8]
lea eax, [esi + 0x18]
cmp eax, edi
je 0x61b96c
mov eax, dword [edi + 0x14]
cmp eax, 0x10
jb 0x61b947
mov ecx, dword [edi]
lea edx, [eax + 1]
cmp edx, 0x1000
jb 0x61b942
mov ebx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, ebx
cmp ecx, 0x20
jae 0x61b9c6
add eax, 0x24
mov edx, eax
mov ecx, ebx
call fcn.0053e020
movsd xmm0, qword [esi + 0x28]
movsd qword [edi + 0x10], xmm0
movupd xmm0, xmmword [esi + 0x18]
movupd xmmword [edi], xmm0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0xf
mov byte [esi + 0x18], 0
mov eax, dword [esi + 0x2c]
cmp eax, 0x10
jb 0x61b99b
mov ecx, dword [esi + 0x18]
lea edx, [eax + 1]
cmp edx, 0x1000
jb 0x61b996
mov edi, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edi
cmp ecx, 0x20
jae 0x61b9b7
add eax, 0x24
mov edx, eax
mov ecx, edi
call fcn.0053e020
lea ecx, [esi + 0x48]
call fcn.00544da0
mov eax, dword [esi + 0x100]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esi + 0x108], 1
call fcn.00748ef1
mov dword [esi + 0x108], 0
call fcn.00748ef1
nop word cs:[eax + eax]
push ebp
sub esp, 0x14
lea esi, [ebp - 0x10c]
mov ebp, dword [esi + 0xf8]
call fcn.0077ccd0
nop word cs:[eax + eax]
push ebp
sub esp, 0x14
lea esi, [ebp - 0x10c]
mov ebp, dword [esi + 0xf8]
call fcn.0077ccd0
nop word cs:[eax + eax]
push ebp
sub esp, 0x14
lea esi, [ebp - 0x10c]
mov ebp, dword [esi + 0xf8]
lea ecx, [esi + 0x48]
call fcn.00544da0
add esp, 0x14
pop ebp
ret
Function at 0x61eb20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
lea ecx, [esp + 0x24]
mov ebp, dword [esp + 0x24]
mov eax, dword [ebp]
and eax, 0xfffffffe
je 0x61eb53
mov ecx, dword [ecx + 4]
movzx edx, byte [ecx]
test dl, 1
jne 0x61eba1
mov edx, dword [ecx]
shr edx, 1
mov dword [esp + 4], edx
mov ecx, dword [ecx + 8]
mov dword [esp + 8], ecx
jmp 0x61ebac
xor esi, esi
mov bl, 1
xor edi, edi
lea eax, [esp + 0x24]
mov eax, dword [eax + 0x10]
test eax, eax
je 0x61eb66
mov dword [eax], edi
test esi, esi
je 0x61ec67
lea eax, [esp + 0x24]
mov edi, dword [eax + 4]
movzx edx, byte [esi + 0xc]
movzx eax, byte [edi]
test al, 1
jne 0x61ec23
mov eax, dword [edi]
shr eax, 1
mov edi, dword [edi + 8]
test dl, 1
je 0x61ec2f
lea ecx, [esi + 0xd]
mov dword [esp], ecx
shr edx, 1
jmp 0x61ec3a
inc ecx
mov dword [esp + 8], ecx
shr edx, 1
mov dword [esp + 4], edx
xor edi, edi
xor esi, esi
jmp 0x61ec0e
mov eax, dword [ebp + 0xc]
shr eax, 1
mov edx, dword [ebp + 0x14]
mov ecx, dword [esp + 8]
mov esi, dword [esp + 4]
inc edi
xor ebx, ebx
cmp esi, eax
setb bl
mov dword [esp], ebx
cmovb eax, esi
push eax
call fcn.0053e9f0
add esp, 4
xor ebx, ebx
test eax, eax
sets bl
cmove ebx, dword [esp]
test bl, bl
mov esi, dword [esp + 0xc]
cmove esi, ebp
mov eax, ebx
xor al, 1
movzx eax, al
mov eax, dword [ebp + eax*4 + 4]
test eax, eax
je 0x61eb59
mov ebp, eax
movzx eax, byte [eax + 0xc]
test al, 1
mov dword [esp + 0xc], esi
je 0x61ebc0
lea edx, [ebp + 0xd]
shr eax, 1
jmp 0x61ebc8
inc edi
shr eax, 1
test dl, 1
jne 0x61eb94
mov edx, dword [esi + 0xc]
shr edx, 1
mov ecx, dword [esi + 0x14]
mov dword [esp], ecx
xor ecx, ecx
cmp edx, eax
setb cl
mov dword [esp + 0xc], ecx
cmovb eax, edx
mov ecx, dword [esp]
mov edx, edi
push eax
call fcn.0053e9f0
add esp, 4
xor ecx, ecx
test eax, eax
sets cl
cmove ecx, dword [esp + 0xc]
cmp cl, 1
jne 0x61ec7a
lea ecx, [esp + 0x24]
mov eax, dword [ecx + 0xc]
mov byte [eax], bl
mov eax, dword [ecx + 0xc]
mov dword [eax + 4], ebp
mov al, 1
jmp 0x61ec7c
xor eax, eax
movzx edx, al
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x620d40
Capabilities:
Clear file content
Get file size

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
mov eax, dword [0xb44908]
xor eax, ebp
mov dword [esp + 0x10], eax
mov eax, esp
push eax
push dword [ebp + 8]
call sub.KERNEL32.dll_GetFileSizeEx
test eax, eax
je 0x620e08
mov edi, dword [ebp + 0xc]
mov eax, dword [esp]
mov ecx, dword [esp + 4]
cmp eax, edi
mov edx, ecx
sbb edx, 0
jge 0x620dd4
mov dword [esp + 0xc], ecx
lea ebx, [esp + 0xc]
push ebx
push eax
push dword [ebp + 8]
call fcn.00622060
cmp eax, 0xffffffff
jne 0x620d9d
call sub.KERNEL32.dll_GetLastError
test eax, eax
je 0x620e08
sub edi, dword [esp]
je 0x620e04
nop word cs:[eax + eax]
cmp edi, 0x200
mov esi, 0x200
cmovb esi, edi
push ebx
push esi
push dword [ebp + 8]
call fcn.00622180
cmp dword [esp + 0xc], esi
jne 0x620e08
sub edi, esi
jne 0x620db0
jmp 0x620e04
mov dword [esp + 0xc], 0
lea eax, [esp + 0xc]
push eax
push edi
push dword [ebp + 8]
call fcn.00622060
cmp eax, 0xffffffff
jne 0x620df8
call sub.KERNEL32.dll_GetLastError
test eax, eax
je 0x620e08
push dword [ebp + 8]
call sub.KERNEL32.dll_SetEndOfFile
test eax, eax
je 0x620e08
mov bl, 1
jmp 0x620e0a
xor ebx, ebx
mov ecx, dword [esp + 0x10]
xor ecx, ebp
call fcn.0076521b
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x621270
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x90
mov esi, esp
mov dword [esi + 0x78], ebp
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [esi + 0x7c], esp
mov dword [esi + 0x88], 0xffffffff
mov dword [esi + 0x84], 0x6224d0
mov eax, dword fs:[0]
mov dword [esi + 0x80], eax
lea eax, [esi + 0x80]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xorps xmm0, xmm0
movaps xmmword [esi + 0x30], xmm0
mov dword [esi + 0x1c], 0x13
mov dword [esi + 0x88], 0
mov al, 1
mov dword [esi], eax
sub esp, 0x14
movzx eax, byte [esi + 8]
mov byte [esp + 0x10], al
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.00621180
add esp, 0x14
jmp 0x621338
mov eax, dword [esi + 0x80]
mov dword fs:[0], eax
mov eax, dword [esi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x632430
Capabilities:
Create directory
Get file attributes

Disassembly:
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
cmp dword [esp + 4], 0
je 0x632452
test edx, edx
je 0x632469
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
ret 0x1c
test edx, edx
je 0x632474
push dword [esp + 0x18]
push ecx
push dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
ret 0x1c
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
ret 0x1c
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
ret 0x1c
Function at 0x632e30
Capabilities:
Copy file
Create directory
Delete directory
Delete file
Get common file path
Move file
Set current directory
Set file attributes

Disassembly:
push ebx
push edi
push esi
mov edx, dword [esp + 0x30]
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
cmp dword [esp + 0x10], 0
je 0x632e64
test ebx, ebx
je 0x632e76
test edi, edi
je 0x632e85
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x632ec1
test ebx, ebx
je 0x632e8e
test edi, edi
je 0x632e9b
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
jmp 0x632ec1
test edi, edi
je 0x632eaf
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x632ec1
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x632ec1
test edi, edi
je 0x632eba
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x632ec1
push edx
push dword [esp + 0x30]
push dword [esp + 0x30]
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
jmp 0x632ec1
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExW]
jmp 0x632ec1
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
pop esi
pop edi
pop ebx
ret 0x28
Function at 0x640dd0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x6427a0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebx], esi
lea eax, [ebx + 4]
mov dword [ebp - 0x30], eax
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0xf
mov byte [ebx + 8], 0
mov dword [ebx + 4], 0x799e70
lea eax, [ebx + 0x30]
mov dword [ebp - 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x38], 0
cmp byte [0xb532f0], 0
mov edi, dword [edx + 0xc]
mov eax, dword [esi + 4]
mov dword [ebp - 0x28], ebx
jne 0x640e59
cmp byte [esi + 0xc], 0
jne 0x640e7d
mov dword [ebp - 0x20], eax
mov eax, dword [esi]
mov ebx, dword [eax + 4]
mov ecx, ebx
call dword [0xb0836c]
mov dword [ebp - 0x10], 0
mov ecx, esi
push edi
call ebx
mov ebx, dword [ebp - 0x28]
mov edi, eax
mov eax, dword [ebp - 0x20]
add eax, edi
lea ecx, [ebx + 8]
mov dword [ebp - 0x20], ecx
mov esi, eax
mov ecx, eax
call fcn.0053db10
mov edi, eax
mov eax, dword [ebx + 0x1c]
cmp eax, edi
jae 0x640ebd
mov dword [ebp - 0x10], 0
sub esp, 0xc
movzx eax, byte [ebp - 0x24]
mov byte [esp + 4], al
mov dword [esp + 8], esi
mov dword [esp], edi
mov ecx, dword [ebp - 0x20]
call fcn.0052ce20
mov ebx, dword [ebp - 0x28]
jmp 0x640edc
cmp eax, 0x10
mov eax, dword [ebp - 0x20]
jb 0x640ec8
mov eax, dword [ebx + 8]
mov dword [ebx + 0x18], edi
push edi
push esi
push eax
mov esi, eax
call fcn.0077cce0
add esp, 0xc
mov byte [esi + edi], 0
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + 4]
mov dword [ebx + 0x20], eax
mov eax, dword [ecx + 8]
mov dword [ebx + 0x24], eax
mov eax, dword [ecx]
mov dword [ebx + 0x28], eax
mov eax, dword [ecx + 0x10]
mov dword [ebx + 0x2c], eax
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ebx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x65ec70
Capabilities:
Get file attributes

Disassembly:
cmp dword [ecx + 0x18], 0x10
jb 0x64636b
mov ecx, dword [ecx + 4]
jmp 0x64636e
add ecx, 4
push ecx
call sub.KERNEL32.dll_GetFileAttributesA
test al, 0x10
sete al
ret
jmp 0x646360
Function at 0x663f20
Capabilities:
Write file on windows

Disassembly:
push dword [esp + 4]
push 1
push edx
push ecx
call fcn.0074a0f8
add esp, 0x10
ret

Function at 0x663f60
Capabilities:
Generate random numbers via winapi

Disassembly:
push dword [esp + 8]
push 0x20
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
ret 8
Function at 0x66a6d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebx, dword [esp + 0x44]
mov eax, dword [0xb44908]
xor eax, esp
mov dword [esp + 0x24], eax
xor esi, esi
test ebx, ebx
je 0x66a881
cmp dword [esp + 0x3c], 0
je 0x66a881
mov ebp, dword [esp + 0x40]
test ebp, ebp
je 0x66a881
mov edi, dword [esp + 0x48]
test edi, edi
je 0x66a881
cmp ebx, 0xf
ja 0x66a74a
mov esi, 0x10
sub esi, ebx
mov eax, dword [esp + 0x3c]
add eax, ebx
add eax, 0x28
lea ecx, [esp + 0x14]
push esi
push eax
push ecx
call fcn.0077cce0
add esp, 0xc
lea eax, [esp + esi]
add eax, 0x14
push ebx
push ebp
push eax
call fcn.0077cce0
add esp, 0xc
jmp 0x66a7c3
movups xmm0, xmmword [ebx + ebp - 0x10]
movups xmmword [esp + 0x14], xmm0
mov esi, ebx
shr esi, 4
mov eax, dword [esp + 0x3c]
add eax, 0x28
mov dword [esp], eax
mov ebx, dword [esp]
nop word cs:[eax + eax]
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax + 0x10]
call dword [0xb0836c]
lea eax, [esp + 4]
push eax
push ebx
push dword [esp + 0x44]
call ecx
add esp, 0xc
movups xmm0, xmmword [ebp]
movups xmmword [ebx], xmm0
mov eax, dword [esp + 4]
xor eax, dword [ebp]
mov dword [edi], eax
mov eax, dword [esp + 8]
xor eax, dword [ebp + 4]
mov dword [edi + 4], eax
mov eax, dword [esp + 0xc]
xor eax, dword [ebp + 8]
mov dword [edi + 8], eax
mov eax, dword [esp + 0x10]
xor eax, dword [ebp + 0xc]
mov dword [edi + 0xc], eax
add edi, 0x10
add ebp, 0x10
dec esi
jne 0x66a770
mov esi, dword [esp + 0x44]
and esi, 0xf
je 0x66a870
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax + 0x10]
lea ebx, [eax + 0x28]
call dword [0xb0836c]
lea eax, [esp + 4]
push eax
push ebx
push dword [esp + 0x44]
call ecx
add esp, 0xc
mov eax, dword [esp + 0x44]
and eax, 3
xor ecx, ecx
cmp esi, 4
jb 0x66a84a
sub esi, eax
xor ecx, ecx
nop word cs:[eax + eax]
movzx edx, byte [esp + ecx + 4]
xor dl, byte [ebp + ecx]
mov byte [edi + ecx], dl
movzx edx, byte [esp + ecx + 5]
xor dl, byte [ebp + ecx + 1]
mov byte [edi + ecx + 1], dl
movzx edx, byte [esp + ecx + 6]
xor dl, byte [ebp + ecx + 2]
mov byte [edi + ecx + 2], dl
movzx edx, byte [esp + ecx + 7]
xor dl, byte [ebp + ecx + 3]
mov byte [edi + ecx + 3], dl
add ecx, 4
cmp esi, ecx
jne 0x66a810
test eax, eax
je 0x66a870
add edi, ecx
lea edx, [esp + ecx]
add edx, 4
add ebp, ecx
xor ecx, ecx
nop word [eax + eax]
movzx ebx, byte [edx + ecx]
xor bl, byte [ebp + ecx]
mov byte [edi + ecx], bl
inc ecx
cmp eax, ecx
jne 0x66a860
movups xmm0, xmmword [esp + 0x14]
mov eax, dword [esp + 0x3c]
movups xmmword [eax + 0x28], xmm0
mov esi, dword [esp + 0x44]
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0076521b
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret