joyce8/EMBER2024-capa huggingface dataset:
Function at 0x62e8d8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x108], edx
mov edi, eax
xor eax, eax
push ebp
push 0x62eb56
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
cmp dword [edi + 0xc8], 0
jne 0x62eb2d
mov eax, dword [edi + 0x40]
test eax, eax
je 0x62e931
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x62e951
mov eax, dword [edi + 0x44]
test eax, eax
je 0x62e941
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x62e951
mov eax, edi
call fcn.0062ec0c
jmp 0x62eb2d
cmp dword [edi + 0xcc], 0
jne 0x62e9a0
lea eax, [ebp - 0x108]
mov edx, dword [edi + 0x40]
mov ecx, 0
call fcn.0040ab3c
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 0x101]
call fcn.00427494
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x91d2a4]
call fcn.0062e374
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [edi + 0xcc], eax
cmp dword [edi + 0xd0], 0
jne 0x62e9ef
lea eax, [ebp - 0x10c]
mov edx, dword [edi + 0x44]
mov ecx, 0
call fcn.0040ab3c
mov edx, dword [ebp - 0x10c]
lea eax, [ebp - 0x101]
call fcn.00427494
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x91d2a4]
call fcn.0062e374
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [edi + 0xd0], eax
mov ecx, dword [edi + 0xd0]
mov edx, dword [edi + 0xcc]
mov eax, edi
call fcn.0062ec4c
mov ebx, eax
test bl, bl
jne 0x62eae2
mov eax, dword [edi + 0x40]
test eax, eax
je 0x62ea18
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x62ea32
mov eax, dword [edi + 0xc0]
test eax, eax
je 0x62ea2b
sub eax, 4
mov eax, dword [eax]
test eax, eax
sete al
jmp 0x62ea34
xor eax, eax
test al, al
jne 0x62eae2
mov eax, dword [edi + 0xc0]
test eax, eax
je 0x62ea4b
sub eax, 4
mov eax, dword [eax]
test eax, eax
je 0x62ea78
lea eax, [ebp - 0x110]
mov edx, dword [edi + 0xc0]
mov ecx, 0
call fcn.0040ab3c
mov edx, dword [ebp - 0x110]
lea eax, [ebp - 0x101]
call fcn.00427494
jmp 0x62eaba
push dword [edi + 0x40]
push 0x62eb74
push dword [edi + 0x44]
lea eax, [ebp - 0x118]
mov edx, 3
call fcn.0040b118
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 0x114]
mov ecx, 0
call fcn.0040ab3c
mov edx, dword [ebp - 0x114]
lea eax, [ebp - 0x101]
call fcn.00427494
push 7
lea eax, [ebp - 0x101]
push eax
call sub.kernel32.dll_WinExec
cmp eax, 0x20
jb 0x62eae2
mov ecx, dword [edi + 0xd0]
mov edx, dword [edi + 0xcc]
mov eax, edi
call fcn.0062ec4c
mov ebx, eax
test bl, bl
jne 0x62eaef
mov eax, edi
call fcn.0062ec0c
jmp 0x62eb2d
mov eax, dword [edi + 0x64]
test eax, eax
je 0x62eafe
mov dword [edi + 0xac], eax
jmp 0x62eb08
mov dword [edi + 0xac], 1
mov eax, edi
call fcn.0062ecd0
test al, al
je 0x62eb2d
mov eax, edi
mov si, 0xffee
call fcn.00408570
xor ecx, ecx
xor edx, edx
mov eax, edi
call fcn.0062f1c0
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62eb5d
lea eax, [ebp - 0x118]
call fcn.00409fc0
lea eax, [ebp - 0x114]
mov edx, 4
call fcn.0040a050
ret
Function at 0x633704
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x63397e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
mov edx, 0x24
call fcn.00634518
lea eax, [ebp - 0x28]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov eax, dword [ebp - 0x14]
mov dword [0x9006c8], eax
mov eax, dword [ebp - 0xc]
mov dword [0x9006cc], eax
mov eax, dword [ebp - 0x24]
mov dword [0x9006d0], eax
mov eax, dword [0x90e594]
cmp dword [eax], 2
sete byte [0x8ffea1]
push 0x63398c
call sub.kernel32.dll_GetModuleHandleW_2
lea edx, [ebp - 4]
call fcn.0063441c
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp byte [0x8ffea1], 0
jne 0x633793
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.00634450
test al, al
je 0x633793
mov eax, dword [ebp - 0x4c]
mov dword [0x91d2c0], eax
jmp 0x63379a
xor eax, eax
mov dword [0x91d2c0], eax
call fcn.00632c54
and eax, 0x7f
cmp eax, 0x1c
ja case.0x6337ab.0
jmp dword [eax*4 + 0x6337b2]
mov byte [0x8ffe9c], 1
jmp case.0x6337ab.0
mov byte [0x8ffe9d], 1
jmp case.0x6337ab.0
mov byte [0x8ffe9e], 1
jmp case.0x6337ab.0
mov byte [0x8ffe9f], 1
jmp case.0x6337ab.0
mov byte [0x8ffea0], 1
jmp case.0x6337ab.0
mov byte [0x8ffea2], 1
mov byte [0x8ffea3], 1
jmp case.0x6337ab.0
mov byte [0x8ffea2], 1
mov byte [0x8ffea4], 1
jmp case.0x6337ab.0
mov byte [0x8ffea2], 1
mov byte [0x8ffea4], 1
mov byte [0x8ffea5], 1
jmp case.0x6337ab.0
mov byte [0x8ffea6], 1
jmp case.0x6337ab.0
mov byte [0x8ffea7], 1
jmp case.0x6337ab.0
mov byte [0x8ffea8], 1
jmp case.0x6337ab.0
mov byte [0x8ffea9], 1
jmp case.0x6337ab.0
mov byte [0x8ffeaa], 1
jmp case.0x6337ab.0
mov byte [0x8ffeab], 1
jmp case.0x6337ab.0
mov byte [0x8ffeac], 1
jmp case.0x6337ab.0
mov byte [0x8ffead], 1
jmp case.0x6337ab.0
mov byte [0x8ffeae], 1
jmp case.0x6337ab.0
mov byte [0x8ffeaf], 1
jmp case.0x6337ab.0
mov byte [0x8ffeb0], 1
jmp case.0x6337ab.0
mov byte [0x8ffeb1], 1
jmp case.0x6337ab.0
mov byte [0x8ffeb2], 1
jmp case.0x6337ab.0
mov byte [0x8ffeb3], 1
jmp case.0x6337ab.0
mov byte [0x8ffeb4], 1
jmp case.0x6337ab.0
mov byte [0x8ffeb5], 1
jmp case.0x6337ab.0
mov byte [0x8ffeb6], 1
jmp case.0x6337ab.0
mov byte [0x8ffeb7], 1
jmp case.0x6337ab.0
mov byte [0x8ffeb8], 1
jmp case.0x6337ab.0
mov byte [0x8ffeb9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x633985
lea eax, [ebp - 4]
call fcn.00409fc0
ret

Function at 0x6343cc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040ae24
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x6343e8
test al, 0x10
jne 0x6343ed
xor eax, eax
pop ebx
pop ebp
ret
mov al, 1
pop ebx
pop ebp
ret

Function at 0x6343f4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
test ebx, ebx
je 0x634416
push ebx
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x63440d
test al, 0x10
je 0x634411
xor eax, eax
jmp 0x634418
mov al, 1
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x634450
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x634502
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov eax, esi
call fcn.0040ae24
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jbe 0x6344ec
lea eax, [ebp - 4]
mov edx, edi
call fcn.0040afb8
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebp - 0x10]
push eax
mov eax, esi
call fcn.0040ae24
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x6344ec
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x634514
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x6344ec
cmp dword [ebp - 0xc], 0x34
jne 0x6344ec
mov bl, 1
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 8]
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x634509
lea eax, [ebp - 4]
call fcn.00409fc0
ret

Function at 0x6350f4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 0x14], edx
xor edx, edx
push ebp
push 0x635158
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 0xe]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xe]
mov ecx, 7
call fcn.0040aee0
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetACP_1
mov edx, eax
pop eax
call fcn.00426064
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63515f
lea eax, [ebp - 0x14]
call fcn.00409fc0
ret

Function at 0x635df8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x635e8e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x90e594]
cmp dword [eax], 2
jne 0x635e38
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
push esi
push ebx
call sub.advapi32.dll_RegQueryValueExW_1
mov ebx, eax
jmp 0x635e70
lea eax, [ebp - 8]
mov edx, esi
call fcn.0040abbc
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0
call fcn.0040a7a0
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
mov eax, dword [ebp - 4]
call fcn.0040aa00
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x635e95
lea eax, [ebp - 8]
call fcn.0040a008
lea eax, [ebp - 4]
call fcn.00409fe4
ret
Function at 0x63622c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [ebp - 8], eax
push 0x20019
lea eax, [ebp - 8]
push eax
mov eax, edi
call fcn.0040ae24
mov edx, eax
mov eax, ebx
call fcn.00635c64
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.00635d40
test eax, eax
sete al
mov ebx, eax
test bl, bl
je 0x63629e
push 0
push 0
push esi
push 0
mov eax, dword [ebp - 4]
call fcn.0040ae24
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x636fd4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6370a8
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040a3e8
lea eax, [ebp - 4]
call fcn.0040a590
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040ae24
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x637092
mov eax, ebx
call fcn.00406ef8
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x63708b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040ae24
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x637075
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x6370b8
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x637075
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x637092
mov eax, dword [ebp - 0x10]
call fcn.00406f14
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6370af
lea eax, [ebp - 4]
call fcn.00409fc0
ret

Function at 0x672b48
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, edx
mov ebx, eax
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x672ba3
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, esi
call fcn.0040ae24
push eax
mov eax, ebx
call fcn.0040ae24
push eax
call sub.kernel32.dll_CopyFileW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x672baa
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x67f738
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffdc
mov ebx, eax
mov eax, ebx
call fcn.00409fc0
mov dword [esp], 0xf
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x67f769
lea edx, [esp + 4]
mov eax, ebx
mov ecx, dword [esp]
call fcn.0040a148
add esp, 0x24
pop ebx
ret
Function at 0x691600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov eax, 8
test byte [edx + 1], 0x80
setne bl
movzx esi, word [edx]
add esi, esi
movzx edi, cl
shr edi, 7
or si, di
mov word [edx], si
test bl, bl
je 0x691629
xor word [edx], 0x1021
add ecx, ecx
and cl, 0xff
dec eax
jne 0x691608
pop edi
pop esi
pop ebx
ret

Function at 0x6aaa44
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
test dl, dl
je 0x6aaa57
add esp, 0xfffffff0
call fcn.00408820
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x6aaad0
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, esi
call fcn.00408168
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [esi + 0x18], 0
lea edx, [ebp - 4]
mov eax, esi
call fcn.006aafa4
mov edx, dword [ebp - 4]
lea eax, [esi + 0xc]
call fcn.0040a3a0
mov ecx, dword [esi + 0xc]
lea eax, [esi + 0x10]
mov edx, 0x6aab00
call fcn.0040b090
mov ecx, esi
mov dl, 1
mov eax, dword [0x6a9f48]
call fcn.006ab618
mov dword [esi + 0x30], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6aaad7
lea eax, [ebp - 4]
call fcn.00409fc0
ret

Function at 0x6aad34
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
xor edx, edx
push ebp
push 0x6aaddf
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.006ab60c
mov ebx, eax
lea eax, [ebx + 0x1c]
mov edx, dword [ebp - 4]
call fcn.0040a3a0
lea edx, [ebp - 0xc]
mov eax, dword [ebp + 8]
call fcn.004270c4
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.0040a3a0
lea eax, [ebx + 0x24]
mov edx, dword [ebp - 8]
call fcn.0040a3a0
test edi, edi
je 0x6aada1
mov edx, edi
mov eax, ebx
call fcn.006ac1bc
jmp 0x6aadae
lea eax, [ebx + 0x14]
mov edx, 0x6aae00
call fcn.0040a3a0
test esi, esi
je 0x6aadbc
lea eax, [ebx + 0x10]
mov edx, esi
call fcn.0040a3a0
lea eax, [ebx + 0x18]
mov edx, 0x6aae24
call fcn.0040a3a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6aade6
lea eax, [ebp - 0xc]
call fcn.00409fc0
ret
Function at 0x6ab770
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x6ab778
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6ab92d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x18]
mov ecx, dword [eax + 0xc]
lea eax, [ebp - 4]
mov edx, 0x6ab948
call fcn.0040b090
push esi
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
mov eax, dword [ebx + 0x2c]
push eax
lea eax, [ebp - 0x18]
push eax
movzx ecx, word [ebx + 0x30]
mov eax, dword [ebx + 0x1c]
xor edx, edx
call fcn.0068e2f0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0x11
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x6ab95c
call fcn.0063ddb4
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x6ab7f3
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x6ab834
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebx + 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
movzx ecx, word [ebx + 0x30]
mov eax, dword [ebx + 0xc]
xor edx, edx
call fcn.0068e2f0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x6ab9c4
call fcn.0063ddb4
mov edx, dword [ebp - 0x1c]
mov eax, esi
call fcn.0040b038
mov eax, esi
mov edx, 0x6ab9f0
call fcn.0040b038
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x6ab84c
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x6ab8ba
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x6aba04
call fcn.0063ddb4
mov edx, dword [ebp - 0x2c]
mov eax, esi
call fcn.0040b038
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x6ab883
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x6ab8ae
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x6aba34
call fcn.0063ddb4
mov edx, dword [ebp - 0x30]
mov eax, esi
call fcn.0040b038
mov eax, esi
mov edx, 0x6ab9f0
call fcn.0040b038
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x6ab8c6
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x6ab8f1
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x6aba60
call fcn.0063ddb4
mov edx, dword [ebp - 0x34]
mov eax, esi
call fcn.0040b038
mov eax, esi
mov edx, 0x6ab9f0
call fcn.0040b038
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6ab934
lea eax, [ebp - 0x34]
mov edx, 4
call fcn.0040a020
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.0040a020
lea eax, [ebp - 4]
call fcn.00409fc0
ret
Function at 0x6d7a44
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
add eax, 0xc
mov eax, dword [eax]
mov dword [edx + 0xc], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0xc]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
movzx ebx, cl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
movzx ebx, bl
mov esi, dword [ebx*4 + str.cwko0]
mov ebx, ecx
shr ebx, 0x10
movzx ebx, bl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 8], ebx
shr ecx, 0x18
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x9037ac]
mov dword [edx + eax*4 + 0x10], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x14], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x18], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x1c], ecx
add eax, 4
cmp eax, 0x28
jl 0x6d7a6f
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x6e5208
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x99f00c], 0
jne 0x6e5222
call fcn.006e51c4
mov eax, edi
dec eax
test eax, eax
jl 0x6e524a
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x99ec0c]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x6e522c
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x6e82ac
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x6e8346.0
jmp dword [ecx*4 + 0x6e82df]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x6e8311
sub dl, 8
je 0x6e8320
jmp case.0x6e8346.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x6e7f54
jmp case.0x6e8346.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x6e7fac
jmp case.0x6e8346.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x6e8346.0
movzx ecx, byte [ecx + 0x6e834d]
jmp dword [ecx*4 + 0x6e835e]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x6e8058
jmp case.0x6e8346.0
cmp dl, 3
jne 0x6e838b
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x6e80b0
jmp case.0x6e8346.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x6e806c
jmp case.0x6e8346.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x6e80f4
jmp case.0x6e8346.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x6e83b6
sub dl, 8
je 0x6e83c2
jmp case.0x6e8346.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x6e8120
jmp case.0x6e8346.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x6e818c
jmp case.0x6e8346.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x6e83e1
sub dl, 8
je 0x6e83ed
jmp case.0x6e8346.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x6e8248
jmp case.0x6e8346.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x6e8270
mov ecx, dword [eax + 0x468]
mov edx, dword [ebx + 0x1c]
dec edx
imul ecx, edx
mov esi, ecx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
add ecx, dword [eax + 0x44c]
mov dword [ebp - 0x10], ecx
mov esi, edx
test esi, esi
jb 0x6e848f
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.006e741c
test eax, eax
je 0x6e848f
mov eax, ebx
call fcn.006e8498
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x6e8428
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8