joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6250e0
Capabilities:
Query environment variable

Disassembly:
push ebx
push edi
push esi
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
cmp byte [0x716203], 1
jne 0x6250ff
cmp byte [0x716202], 0
jne 0x62511e
jmp 0x62514b
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x716203], 1
test eax, eax
setne byte [0x716202]
je 0x62514b
mov ebx, dword [fcn.004a11a0]
push 2
call ebx
add esp, 4
push edi
push esi
push str.libunwind:___unw_init_local_cursor_p__context_p__n
push eax
call fcn.00694a00
add esp, 0x10
push 2
call ebx
add esp, 4
push eax
call sub.msvcrt.dll_fflush
add esp, 4
mov dword [esi], 0x6ed480
mov dword [esi + 4], 0x7161f8
movups xmm0, xmmword [edi]
movups xmm1, xmmword [edi + 0x10]
movups xmmword [esi + 8], xmm0
movups xmmword [esi + 0x18], xmm1
movups xmm0, xmmword [edi + 0x20]
movups xmmword [esi + 0x28], xmm0
movups xmm0, xmmword [edi + 0x30]
movups xmmword [esi + 0x38], xmm0
xorps xmm0, xmm0
movups xmmword [esi + 0x48], xmm0
movups xmmword [esi + 0x58], xmm0
movups xmmword [esi + 0x62], xmm0
mov ecx, esi
push 0
call fcn.00625ef0
xor eax, eax
pop esi
pop edi
pop ebx
ret

Function at 0x6251a0
Capabilities:
Query environment variable

Disassembly:
cmp byte [0x716203], 1
jne 0x6251b4
cmp byte [0x716202], 0
setne al
ret
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
test eax, eax
setne al
setne byte [0x716202]
mov byte [0x716203], 1
ret

Function at 0x6251e0
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp byte [0x716203], 1
jne 0x625204
cmp byte [0x716202], 0
jne 0x625223
jmp 0x625251
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x716203], 1
test eax, eax
setne byte [0x716202]
je 0x625251
mov edi, dword [fcn.004a11a0]
push 2
call edi
add esp, 4
push ebx
push ebp
push esi
push str.libunwind:___unw_get_reg_cursor_p__regNum_d__value_p__n
push eax
call fcn.00694a00
add esp, 0x14
push 2
call edi
add esp, 4
push eax
call sub.msvcrt.dll_fflush
add esp, 4
mov eax, dword [esi]
mov edi, dword [eax + 8]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push ebp
call edi
mov ecx, eax
mov eax, 0xffffe672
test cl, cl
je 0x625284
mov eax, dword [esi]
mov edi, dword [eax + 0xc]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push ebp
call edi
mov dword [ebx], eax
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x625290
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x44]
mov ebx, dword [esp + 0x40]
mov esi, dword [esp + 0x3c]
cmp byte [0x716203], 1
jne 0x6252b7
cmp byte [0x716202], 0
jne 0x6252d6
jmp 0x625304
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x716203], 1
test eax, eax
setne byte [0x716202]
je 0x625304
mov edi, dword [fcn.004a11a0]
push 2
call edi
add esp, 4
push ebp
push ebx
push esi
push str.libunwind:___unw_set_reg_cursor_p__regNum_d__value0x_x__n
push eax
call fcn.00694a00
add esp, 0x14
push 2
call edi
add esp, 4
push eax
call sub.msvcrt.dll_fflush
add esp, 4
mov eax, dword [esi]
mov edi, dword [eax + 8]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push ebx
call edi
mov edi, 0xffffe672
test al, al
je 0x625394
mov eax, dword [esi]
mov edi, dword [eax + 0x10]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push ebp
push ebx
call edi
xor edi, edi
cmp ebx, 0xffffffff
jne 0x625394
mov eax, dword [esi]
mov ebx, dword [eax + 0x24]
mov ecx, ebx
call dword [section..00cfg]
mov eax, esp
mov ecx, esi
push eax
call ebx
mov eax, dword [esi]
mov ebx, dword [eax + 0x34]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, esi
push 0
call ebx
cmp dword [esp + 0x10], 0
je 0x625394
mov eax, dword [esi]
mov ebx, dword [eax + 0xc]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, esi
push 0xfffffffffffffffe
call ebx
mov ebx, eax
add ebx, dword [esp + 0x10]
mov eax, dword [esi]
mov ebp, dword [eax + 0x10]
mov ecx, ebp
call dword [section..00cfg]
mov ecx, esi
push ebx
push 0xfffffffffffffffe
call ebp
mov eax, edi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x6253a0
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
mov esi, dword [esp + 0xc]
cmp byte [0x716203], 1
jne 0x6253ba
cmp byte [0x716202], 0
jne 0x6253d9
jmp 0x625405
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x716203], 1
test eax, eax
setne byte [0x716202]
je 0x625405
mov edi, dword [fcn.004a11a0]
push 2
call edi
add esp, 4
push esi
push str.libunwind:___unw_step_cursor_p__n
push eax
call fcn.00694a00
add esp, 0xc
push 2
call edi
add esp, 4
push eax
call sub.msvcrt.dll_fflush
add esp, 4
mov eax, dword [esi]
mov edi, dword [eax + 0x20]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push 0
call edi
pop esi
pop edi
ret

Function at 0x625420
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
mov esi, dword [esp + 0xc]
cmp byte [0x716203], 1
jne 0x62543a
cmp byte [0x716202], 0
jne 0x625459
jmp 0x625485
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x716203], 1
test eax, eax
setne byte [0x716202]
je 0x625485
mov edi, dword [fcn.004a11a0]
push 2
call edi
add esp, 4
push esi
push str.libunwind:___unw_step_stage2_cursor_p__n
push eax
call fcn.00694a00
add esp, 0xc
push 2
call edi
add esp, 4
push eax
call sub.msvcrt.dll_fflush
add esp, 4
mov eax, dword [esi]
mov edi, dword [eax + 0x20]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push 1
call edi
pop esi
pop edi
ret
Function at 0x6254a0
Capabilities:
Query environment variable

Disassembly:
push ebx
push edi
push esi
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
cmp byte [0x716203], 1
jne 0x6254bf
cmp byte [0x716202], 0
jne 0x6254de
jmp 0x62550b
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x716203], 1
test eax, eax
setne byte [0x716202]
je 0x62550b
mov edi, dword [fcn.004a11a0]
push 2
call edi
add esp, 4
push ebx
push esi
push str.libunwind:___unw_get_proc_info_cursor_p__info_p__n
push eax
call fcn.00694a00
add esp, 0x10
push 2
call edi
add esp, 4
push eax
call sub.msvcrt.dll_fflush
add esp, 4
mov eax, dword [esi]
mov edi, dword [eax + 0x24]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push ebx
call edi
xor ecx, ecx
cmp dword [ebx + 4], 0
mov eax, 0xffffe66b
cmovne eax, ecx
pop esi
pop edi
pop ebx
ret

Function at 0x625530
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
mov esi, dword [esp + 0xc]
cmp byte [0x716203], 1
jne 0x62554a
cmp byte [0x716202], 0
jne 0x625569
jmp 0x625595
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x716203], 1
test eax, eax
setne byte [0x716202]
je 0x625595
mov edi, dword [fcn.004a11a0]
push 2
call edi
add esp, 4
push esi
push str.libunwind:___unw_resume_cursor_p__n
push eax
call fcn.00694a00
add esp, 0xc
push 2
call edi
add esp, 4
push eax
call sub.msvcrt.dll_fflush
add esp, 4
mov eax, dword [esi]
mov edi, dword [eax + 0x28]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
call edi
mov eax, 0xffffe674
pop esi
pop edi
ret

Function at 0x6255b0
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp byte [0x716203], 1
jne 0x6255d4
cmp byte [0x716202], 0
jne 0x6255f3
jmp 0x625621
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x716203], 1
test eax, eax
setne byte [0x716202]
je 0x625621
mov edi, dword [fcn.004a11a0]
push 2
call edi
add esp, 4
push ebp
push ebx
push esi
push str.libunwind:___unw_get_proc_name_cursor_p__buf_p__bufLen_lu__n
push eax
call fcn.00694a00
add esp, 0x14
push 2
call edi
add esp, 4
push eax
call sub.msvcrt.dll_fflush
add esp, 4
mov eax, dword [esi]
mov edi, dword [eax + 0x30]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push dword [esp + 0x20]
push ebp
push ebx
call edi
xor ecx, ecx
test al, al
mov eax, 0xffffe674
cmovne eax, ecx
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x625650
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
mov esi, dword [esp + 0xc]
cmp byte [0x716203], 1
jne 0x62566a
cmp byte [0x716202], 0
jne 0x625689
jmp 0x6256b5
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x716203], 1
test eax, eax
setne byte [0x716202]
je 0x6256b5
mov edi, dword [fcn.004a11a0]
push 2
call edi
add esp, 4
push esi
push str.libunwind:___unw_is_signal_frame_cursor_p__n
push eax
call fcn.00694a00
add esp, 0xc
push 2
call edi
add esp, 4
push eax
call sub.msvcrt.dll_fflush
add esp, 4
mov eax, dword [esi]
mov edi, dword [eax + 0x2c]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
call edi
movzx eax, al
pop esi
pop edi
ret

Function at 0x625b50
Capabilities:
Query environment variable

Disassembly:
cmp byte [0x716201], 1
jne 0x625b64
cmp byte [0x716200], 0
setne al
ret
push str.LIBUNWIND_PRINT_UNWINDING
call sub.msvcrt.dll_getenv
add esp, 4
test eax, eax
setne al
setne byte [0x716200]
mov byte [0x716201], 1
ret
Function at 0x628e00
Capabilities:
Enumerate process modules
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x1014
call fcn.005d1cf0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push 0x1000
push edx
push eax
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x628f3e
mov ecx, dword [esp + 0x10]
xor edx, edx
mov eax, 0
cmp ecx, 4
jb 0x628fab
shr ecx, 2
mov dword [esp + 8], ecx
jmp 0x628e63
mov edx, dword [esp + 0xc]
inc edx
xor eax, eax
mov ecx, dword [esp + 8]
cmp edx, ecx
je 0x628fab
mov dword [esp + 0xc], edx
mov esi, dword [esp + edx*4 + 0x14]
mov eax, dword [esi + 0x3c]
movzx ecx, word [esi + eax + 0x14]
mov edx, dword [esp + 0x102c]
mov dword [edx], esi
mov dword [esp + 4], esi
movzx ebx, word [esi + eax + 6]
test ebx, ebx
je 0x628e50
add eax, dword [esp + 4]
lea ebp, [eax + ecx]
add ebp, 0x18
mov dword [esp], 0
xor ecx, ecx
jmp 0x628ede
mov eax, dword [ebp + 8]
add eax, edi
mov ecx, dword [esp + 0x1028]
cmp eax, ecx
mov eax, esi
movzx esi, al
mov eax, esi
mov edx, 1
cmova eax, edx
cmp edi, ecx
mov ecx, eax
cmova ecx, esi
test cl, 1
je 0x628ed4
mov eax, dword [esp]
and al, 1
jne 0x628f5a
add ebp, 0x28
dec ebx
je 0x628e50
mov esi, ecx
mov edi, dword [ebp + 0xc]
add edi, dword [esp + 4]
push 8
push str..text
push ebp
call sub.msvcrt.dll_strncmp
add esp, 0xc
test eax, eax
je 0x628ea0
push 8
push str..eh_frame
push ebp
call sub.msvcrt.dll_strncmp
add esp, 0xc
test eax, eax
je 0x628f20
mov ecx, esi
test cl, 1
jne 0x628ec9
jmp 0x628ed4
mov ecx, dword [esp + 0x102c]
mov dword [ecx + 4], edi
mov eax, dword [ebp + 8]
mov dword [ecx + 8], eax
mov al, 1
mov dword [esp], eax
mov ecx, esi
test cl, 1
jne 0x628ec9
jmp 0x628ed4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp byte [0x716201], 1
jne 0x628f5e
cmp byte [0x716200], 0
jne 0x628f7d
jmp 0x628fa9
mov al, 1
jmp 0x628fab
push str.LIBUNWIND_PRINT_UNWINDING
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x716201], 1
test eax, eax
setne byte [0x716200]
je 0x628fa9
mov edi, dword [fcn.004a11a0]
push 2
call edi
add esp, 4
push esi
push str.libunwind:_findUnwindSections:_EnumProcessModules_failed__returned_error__d_n
push eax
call fcn.00694a00
add esp, 0xc
push 2
call edi
add esp, 4
push eax
call sub.msvcrt.dll_fflush
add esp, 4
xor eax, eax
add esp, 0x1014
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x683f50
Capabilities:
Check for time delay via gettickcount
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea eax, [edi + 1]
cmp eax, 1
ja 0x683f77
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x684130
mov ecx, dword [0x71524c]
test ecx, ecx
je 0x683fa0
call dword [section..00cfg]
call ecx
mov esi, eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
jmp 0x684028
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x68400e
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 4], eax
cmp eax, 1
mov eax, ecx
sbb eax, 0
mov dword [esp + 8], ecx
jl 0x68401e
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x68401e
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], eax
mov esi, dword [esp + 0x14]
push 0
push 0x3e8
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.0060dc48
add esp, 0x10
push edx
push eax
push esi
push dword [esp + 0x18]
call fcn.00624f24
add esp, 0x10
mov esi, eax
jmp 0x684028
mov dword [esp + 4], 0xffffffff
mov dword [esp + 8], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
xor edx, edx
add esi, edi
adc edx, 0
push edi
push ebx
mov edi, edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x684130
mov dword [esp + 0xc], edi
lea edi, [esp + 0x18]
nop word [eax + eax]
mov ecx, dword [0x71524c]
test ecx, ecx
je 0x684070
call dword [section..00cfg]
call ecx
jmp 0x684108
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
or eax, ecx
jne 0x684093
push edi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x6840e9
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x1c]
cmp dword [esp + 4], 1
mov eax, ecx
sbb eax, 0
mov dword [esp + 8], ecx
jl 0x684100
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x684100
mov eax, dword [esp + 0x10]
mov dword [esp + 0x20], eax
mov ebx, dword [esp + 0x14]
push 0
push 0x3e8
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.0060dc48
add esp, 0x10
push edx
push eax
push ebx
push dword [esp + 0x2c]
mov ebx, dword [ebp + 8]
call fcn.00624f24
add esp, 0x10
jmp 0x684108
mov dword [esp + 4], 0xffffffff
mov dword [esp + 8], 0xffffffff
nop dword [eax]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, dword [esp + 0xc]
cmp eax, esi
sbb edx, ecx
jae 0x68412b
mov ecx, esi
sub ecx, eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x684050
jmp 0x684130
mov eax, 0x102
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x684140
Capabilities:
Check for time delay via gettickcount
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov ebx, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
lea eax, [ebx + 1]
cmp eax, 1
ja 0x68416d
push ebx
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
jmp 0x684332
mov ecx, dword [0x71524c]
test ecx, ecx
je 0x684195
call dword [section..00cfg]
call ecx
mov esi, eax
mov dword [esp + 4], 0
mov dword [esp], 0
jmp 0x684217
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x6841fe
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
cmp ecx, 1
mov eax, edx
sbb eax, 0
mov dword [esp + 4], ecx
mov dword [esp], edx
jl 0x68420d
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x68420d
mov esi, dword [esp + 8]
mov edi, dword [esp + 0xc]
push 0
push 0x3e8
push dword [esp + 8]
push dword [esp + 0x10]
call fcn.0060dc48
add esp, 0x10
push edx
push eax
push edi
mov edi, dword [ebp + 0xc]
push esi
call fcn.00624f24
add esp, 0x10
mov esi, eax
jmp 0x684217
mov dword [esp + 4], 0xffffffff
mov dword [esp], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
xor edx, edx
add esi, ebx
adc edx, 0
push ebx
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
mov ebx, edx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 0x102
jne 0x684332
mov dword [esp + 0x18], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
nop word cs:[eax + eax]
mov ecx, dword [0x71524c]
test ecx, ecx
je 0x684270
call dword [section..00cfg]
call ecx
jmp 0x684304
mov ecx, dword [esp + 4]
mov eax, ecx
mov edx, dword [esp]
or eax, edx
jne 0x684294
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x6842ea
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
cmp ecx, 1
mov eax, edx
sbb eax, 0
mov dword [esp + 4], ecx
mov dword [esp], edx
jl 0x684300
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x684300
mov ebx, dword [esp + 8]
mov edi, dword [esp + 0xc]
push 0
push 0x3e8
push dword [esp + 8]
push dword [esp + 0x10]
call fcn.0060dc48
add esp, 0x10
push edx
push eax
push edi
mov edi, dword [ebp + 0xc]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call fcn.00624f24
add esp, 0x10
jmp 0x684304
mov dword [esp + 4], 0xffffffff
mov dword [esp], 0xffffffff
nop dword [eax]
call ebx
xor edx, edx
mov ecx, dword [esp + 0x18]
cmp eax, esi
sbb edx, ecx
jae 0x68432d
mov ecx, esi
sub ecx, eax
push ecx
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 0x102
je 0x684250
jmp 0x684332
mov eax, 0x102
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x68ebd0
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 0xc]
xor esi, esi
test ebx, ebx
je 0x68ec0b
push 2
push ebx
push dword [ebp + 8]
push 0
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, 0xc0000000
jb 0x68ec0b
mov edi, eax
push ebx
push dword [ebp + 8]
call sub.ADVAPI32.dll_SystemFunction036
add edi, 0x80000000
xor esi, esi
test al, al
cmove esi, edi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x68f2e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, edx
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
xor ecx, ecx
test eax, eax
sete cl
mov dword [esp + 4], ecx
xorps xmm0, xmm0
movups xmmword [edi], xmm0
movzx eax, byte [esi]
cmp eax, 0x5c
je 0x68f313
cmp eax, 0x2f
jne 0x68f3ad
movzx ecx, byte [esi + 1]
cmp ecx, 0x5c
je 0x68f325
cmp ecx, 0x2f
jne 0x68f3ad
movzx edx, byte [esi + 2]
add esi, 2
test dl, dl
je 0x68f3c6
xor ebp, ebp
mov ebx, dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
xor ecx, ecx
mov dword [esp], 0
jmp 0x68f370
movzx eax, dl
push eax
push dword [esp + 8]
call ebx
mov ecx, 1
test eax, eax
je 0x68f37a
xor eax, eax
movzx edx, byte [esi + 1]
inc esi
mov ebp, eax
test dl, dl
je 0x68f3c6
test ecx, ecx
je 0x68f350
xor eax, eax
xor ecx, ecx
jmp 0x68f365
movzx eax, byte [esi]
cmp al, 0x2f
sete dl
cmp al, 0x5c
sete cl
or cl, dl
movzx eax, cl
test ebp, ebp
jne 0x68f376
test cl, cl
je 0x68f376
mov eax, 1
mov ecx, 0
cmp dword [esp], 1
mov dword [esp], 1
jne 0x68f365
jmp 0x68f3c6
mov ecx, eax
add cl, 0xbf
cmp cl, 0x19
jbe 0x68f3bd
add al, 0x9f
cmp al, 0x19
ja 0x68f3c8
cmp byte [esi + 1], 0x3a
jne 0x68f3c8
add esi, 2
mov dword [edi], esi
movzx edx, byte [esi]
test dl, dl
je 0x68f45b
xor ebp, ebp
xor ecx, ecx
jmp 0x68f3fd
mov edx, dword [edi + 0xc]
mov dword [edi + 4], edx
mov dword [edi + 8], esi
xor ebx, ebx
mov ebp, eax
mov dword [edi + 0xc], ebx
mov eax, ebp
movzx edx, byte [esi + 1]
inc esi
mov ebp, eax
test dl, dl
je 0x68f45b
test ecx, ecx
mov ecx, 0
jne 0x68f41d
movzx eax, dl
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
mov ecx, 1
test eax, eax
je 0x68f430
test ebp, ebp
setne dh
xor eax, eax
mov dl, 1
test dh, dh
je 0x68f3f2
test dl, dl
jne 0x68f3e0
jmp 0x68f3f2
movzx eax, byte [esi]
cmp al, 0x2f
sete cl
cmp al, 0x5c
sete dl
or dl, cl
movzx eax, dl
xor dl, 1
xor ecx, ecx
test ebp, ebp
setne dh
jne 0x68f426
mov ebp, 1
mov ebx, esi
test dl, dl
je 0x68f3ed
jmp 0x68f426
mov dword [edi + 0x10], esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6acb00
Capabilities:
Delete directory

Disassembly:
push ebx
push edi
push esi
movzx ebx, word [esp + 0x18]
mov esi, dword [esp + 0x14]
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeA]
test eax, eax
je 0x6acb78
mov ecx, dword [esp + 0x10]
mov edx, esi
call fcn.006ac360
test eax, eax
je 0x6acbb4
mov esi, eax
push eax
call fcn.006acdd0
add esp, 4
mov edi, 0xffffffff
test eax, eax
js 0x6acb6d
movzx eax, bx
push eax
push esi
call sub.msvcrt.dll__chmod
add esp, 8
xor edi, edi
test eax, eax
jns 0x6acb6d
mov edi, dword [sym.imp.msvcrt.dll__errno]
call edi
mov ebx, dword [eax]
push esi
call sub.msvcrt.dll__rmdir
add esp, 4
call edi
mov dword [eax], ebx
mov edi, 0xffffffff
push esi
call sub.msvcrt.dll_free
add esp, 4
jmp 0x6acbb9
push esi
call fcn.006acdd0
add esp, 4
mov edi, 0xffffffff
test eax, eax
js 0x6acbb9
movzx eax, bx
push eax
push esi
call sub.msvcrt.dll__chmod
add esp, 8
xor edi, edi
test eax, eax
jns 0x6acbb9
mov edi, dword [sym.imp.msvcrt.dll__errno]
call edi
mov ebx, dword [eax]
push esi
call sub.msvcrt.dll__rmdir
add esp, 4
call edi
mov dword [eax], ebx
mov edi, 0xffffffff
mov eax, edi
pop esi
pop edi
pop ebx
ret

Function at 0x6acbc0
Capabilities:
Move file

Disassembly:
push ebp
push ebx
push edi
push esi
mov edi, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeA]
test eax, eax
je 0x6acbf3
mov ecx, dword [esp + 0x14]
mov edx, esi
call fcn.006ac360
mov esi, eax
test eax, eax
jne 0x6acc10
mov edi, 0xffffffff
jmp 0x6acc61
push esi
call sub.msvcrt.dll__strdup
add esp, 4
mov esi, eax
test eax, eax
jne 0x6acc10
xor esi, esi
nop word cs:[eax + eax]
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeA]
test eax, eax
jne 0x6acc2c
push edi
call sub.msvcrt.dll__strdup
add esp, 4
test eax, eax
je 0x6acc10
mov ebp, eax
jmp 0x6acc3b
mov ecx, ebx
mov edx, edi
call fcn.006ac360
mov ebp, eax
test eax, eax
je 0x6acc68
push ebp
push esi
call sub.msvcrt.dll_rename
add esp, 8
mov edi, eax
test esi, esi
je 0x6acc54
push esi
call sub.msvcrt.dll_free
add esp, 4
test ebp, ebp
je 0x6acc61
push ebp
call sub.msvcrt.dll_free
add esp, 4
mov eax, edi
pop esi
pop edi
pop ebx
pop ebp
ret
xor ebp, ebp
mov edi, 0xffffffff
test esi, esi
jne 0x6acc4b
jmp 0x6acc54

Function at 0x6acd70
Capabilities:
Delete directory

Disassembly:
push ebx
push edi
push esi
mov esi, dword [esp + 0x10]
push esi
call fcn.006acdd0
add esp, 4
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
js 0x6acdbe
movzx eax, word [esp + 0x14]
push eax
push esi
call sub.msvcrt.dll__chmod
add esp, 8
mov ecx, eax
xor eax, eax
test ecx, ecx
jns 0x6acdbe
mov edi, dword [sym.imp.msvcrt.dll__errno]
call edi
mov ebx, dword [eax]
push esi
call sub.msvcrt.dll__rmdir
add esp, 4
call edi
mov dword [eax], ebx
mov eax, 0xffffffff
pop esi
pop edi
pop ebx
ret
Function at 0x6ace70
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x2000
call fcn.005d1cf0
mov ebx, dword [esp + 0x201c]
test ebx, ebx
je 0x6acefe
mov ebp, dword [esp + 0x2014]
mov edi, esp
jmp 0x6acea6
sub ebx, edi
mov edi, esp
je 0x6acefe
cmp ebx, 0x2000
mov eax, 0x2000
cmovl eax, ebx
push eax
push edi
push dword [esp + 0x2020]
call fcn.006ae46c
add esp, 0xc
test eax, eax
je 0x6acefe
mov esi, eax
push eax
push edi
push ebp
call fcn.006ae47e
add esp, 0xc
mov edi, eax
cmp eax, esi
jae 0x6acea0
nop dword [eax]
mov eax, edi
shl eax, 0xd
add eax, esp
mov ecx, esi
sub ecx, edi
push ecx
push eax
push ebp
call fcn.006ae47e
add esp, 0xc
add edi, eax
cmp edi, esi
jb 0x6acee0
jmp 0x6acea0
add esp, 0x2000
pop esi
pop edi
pop ebx
pop ebp
ret