joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5dfc14
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x5dfc45
dec al
je 0x5dfc80
dec al
je 0x5dfcc5
dec al
je 0x5dfd2e
jmp 0x5dfdb8
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x5dfdb8
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x5dfc55
jmp 0x5dfdb8
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5dfdb8
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x5dfc90
jmp 0x5dfdb8
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5dfdb8
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x5dfcf4
xor ebp, ebp
jmp 0x5dfd04
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x5dfd0d
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x5dfcd5
jmp 0x5dfdb8
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5dfdb8
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x5dfd87
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.005dcd60
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x5dfd42
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5e4c80
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x5e4cd1
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x5e4cb8
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x5e4ca8
jmp 0x5e4cd1
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x5e4cb9
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x618ac0
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, eax
mov ebx, dword [esi + 8]
lea eax, [ebx + 1]
add eax, eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x618b4d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GlobalLock
mov edi, eax
xor eax, eax
push ebp
push 0x618b3c
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, ebx
add ecx, ecx
mov edx, edi
mov eax, dword [esi + 4]
call fcn.0040490c
mov word [edi + ebx*2], 0
mov eax, dword [ebp - 4]
push eax
push 0xd
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x618b43
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
Function at 0x640930
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040708c
xor eax, eax
push ebp
push 0x640a08
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x640a18
call sub.user32.dll_RegisterClipboardFormatW
mov edi, eax
lea eax, [ebx + 1]
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x6409df
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov esi, eax
xor eax, eax
push ebp
push 0x6409ce
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00407560
mov edx, esi
mov ecx, ebx
call fcn.0040490c
mov byte [esi + ebx], 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6409d5
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
Function at 0x66fee0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe48
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x670080
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x6c], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0x6d], 7
mov byte [ebp - 5], 0
xor eax, eax
push ebp
push 0x66ff62
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x1b8], 0x9c
lea eax, [ebp - 0x1b8]
push eax
call sub.kernel32.dll_GetVersionExA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
mov dword [ebp - 0x11c], 0x114
lea eax, [ebp - 0x11c]
push eax
call sub.kernel32.dll_GetVersionExW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x66ff88
test bl, bl
jne 0x66ff96
cmp byte [ebp - 5], 0
je 0x670072
lea edx, [ebp - 0x1b8]
lea eax, [ebp - 0x11c]
mov ecx, 0x114
call fcn.0040490c
mov eax, dword [ebp - 0x1a8]
dec eax
je 0x670020
dec eax
jne 0x670072
mov eax, dword [ebp - 4]
mov byte [eax + 0x6c], 1
cmp dword [ebp - 0x1b4], 4
ja 0x66ffd3
mov eax, dword [ebp - 4]
mov byte [eax + 0x6d], 3
cmp dword [ebp - 0x1b4], 5
jne 0x66ffec
cmp dword [ebp - 0x1b0], 0
jne 0x66ffec
mov eax, dword [ebp - 4]
mov byte [eax + 0x6d], 4
cmp dword [ebp - 0x1b4], 5
jne 0x670005
cmp dword [ebp - 0x1b0], 1
jne 0x670005
mov eax, dword [ebp - 4]
mov byte [eax + 0x6d], 5
cmp dword [ebp - 0x1b4], 6
jne 0x670072
cmp dword [ebp - 0x1b0], 0
jne 0x670072
mov eax, dword [ebp - 4]
mov byte [eax + 0x6d], 6
jmp 0x670072
mov eax, dword [ebp - 4]
mov byte [eax + 0x6c], 0
cmp dword [ebp - 0x118], 4
jne 0x670040
cmp dword [ebp - 0x114], 0
jne 0x670040
mov eax, dword [ebp - 4]
mov byte [eax + 0x6d], 0
cmp dword [ebp - 0x118], 4
jne 0x670059
cmp dword [ebp - 0x114], 0xa
jne 0x670059
mov eax, dword [ebp - 4]
mov byte [eax + 0x6d], 1
cmp dword [ebp - 0x118], 4
jne 0x670072
cmp dword [ebp - 0x114], 0x5a
jne 0x670072
mov eax, dword [ebp - 4]
mov byte [eax + 0x6d], 2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x670087
ret
Function at 0x680f7c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 0xd], 1
mov eax, dword [ebp - 4]
cmp byte [eax + 0x40], 0
jne 0x6810b8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0055fb9c
dec eax
test eax, eax
jl 0x6810b8
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x14]
call fcn.0055ffbc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x14], 0
jne 0x681095
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x44], 0
je 0x681095
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x40], 1
mov dl, 1
mov eax, dword [0x557934]
call fcn.0055fe80
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x68108e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0xc]
call fcn.0055fb9c
mov esi, eax
dec esi
test esi, esi
jl 0x681060
inc esi
xor ebx, ebx
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0xc]
mov edx, ebx
call fcn.0055ffbc
mov edx, eax
xor ecx, ecx
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0x38]
test al, al
je 0x68105c
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0xc]
mov edx, ebx
call fcn.0055ffbc
mov edx, eax
mov eax, dword [ebp - 0x1c]
call fcn.0055fdf8
inc ebx
dec esi
jne 0x681028
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0x38]
mov byte [ebp - 0xd], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6810a6
mov eax, dword [ebp - 4]
mov byte [eax + 0x40], 0
mov eax, dword [ebp - 0x1c]
call fcn.00405330
ret
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0x38]
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x6810b8
inc dword [ebp - 0x14]
dec dword [ebp - 0x24]
jne 0x680fbe
movzx eax, byte [ebp - 0xd]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6ca0f8
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov ebx, edx
mov edx, dword [eax + 4]
xor ecx, ecx
call fcn.006cb148
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6ca233
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x8003
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_CryptCreateHash
test eax, eax
jne 0x6ca14c
mov ecx, 0x6ca24c
mov dl, 1
mov eax, dword [0x41a190]
call fcn.00425db0
call fcn.004066b0
xor eax, eax
push ebp
push 0x6ca213
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
push eax
mov eax, dword [ebx + 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CryptHashData
test eax, eax
jne 0x6ca18a
mov ecx, 0x6ca280
mov dl, 1
mov eax, dword [0x41a190]
call fcn.00425db0
call fcn.004066b0
mov eax, ebx
call fcn.0044cbc4
xor eax, eax
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 2
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CryptGetHashParam
test eax, eax
jne 0x6ca1c3
mov ecx, 0x6ca2b0
mov dl, 1
mov eax, dword [0x41a190]
call fcn.00425db0
call fcn.004066b0
mov edx, dword [ebp - 0xc]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 4]
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebx + 4]
push eax
push 2
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CryptGetHashParam
test eax, eax
jne 0x6ca1fc
mov ecx, 0x6ca2f8
mov dl, 1
mov eax, dword [0x41a190]
call fcn.00425db0
call fcn.004066b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6ca21a
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CryptDestroyHash
ret
Function at 0x6ca32c
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, ebx
call fcn.006ca05c
mov edx, dword [ebx + 4]
xor ecx, ecx
mov eax, ebx
call fcn.006cb148
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6ca480
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
push 1
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_CryptGetUserKey
test eax, eax
jne 0x6ca388
mov ecx, 0x6ca49c
mov dl, 1
mov eax, dword [0x41a190]
call fcn.00425db0
call fcn.004066b0
xor eax, eax
push ebp
push 0x6ca460
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
mov eax, edi
mov edx, dword [eax]
call dword [edx]
push eax
mov eax, dword [edi + 4]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_CryptImportKey
test eax, eax
jne 0x6ca3ce
mov ecx, 0x6ca4d0
mov dl, 1
mov eax, dword [0x41a190]
call fcn.00425db0
call fcn.004066b0
xor eax, eax
push ebp
push 0x6ca442
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, dword [eax]
call dword [edx]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [esi + 4]
push eax
push 0
push 0xffffffffffffffff
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CryptDecrypt
test eax, eax
jne 0x6ca416
mov ecx, 0x6ca510
mov dl, 1
mov eax, dword [0x41a190]
call fcn.00425db0
call fcn.004066b0
mov edx, dword [ebp - 0x10]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 4]
push 0
push 0
mov eax, esi
call fcn.0044bee4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6ca449
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CryptDestroyKey
ret
Function at 0x6ca630
Capabilities:
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
mov eax, esi
call fcn.006ca05c
mov edx, dword [esi + 4]
xor ecx, ecx
mov eax, esi
call fcn.006cb148
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6ca82f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
push 0
push 0
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
push eax
mov eax, dword [ebx + 4]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_CryptImportKey
test eax, eax
jne 0x6ca699
mov ecx, 0x6ca84c
mov dl, 1
mov eax, dword [0x41a190]
call fcn.00425db0
call fcn.004066b0
xor eax, eax
push ebp
push 0x6ca80f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
push 1
push 0x6801
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_CryptGenKey
test eax, eax
jne 0x6ca6d5
mov ecx, 0x6ca88c
mov dl, 1
mov eax, dword [0x41a190]
call fcn.00425db0
call fcn.004066b0
xor eax, eax
push ebp
push 0x6ca7f1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0044cbc4
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 1
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CryptExportKey
test eax, eax
jne 0x6ca71b
mov ecx, 0x6ca8d0
mov dl, 1
mov eax, dword [0x41a190]
call fcn.00425db0
call fcn.004066b0
mov edx, dword [ebp - 0x10]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 4]
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx + 4]
push eax
push 0
push 1
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CryptExportKey
test eax, eax
jne 0x6ca758
mov ecx, 0x6ca90c
mov dl, 1
mov eax, dword [0x41a190]
call fcn.00425db0
call fcn.004066b0
mov eax, edi
mov edx, dword [eax]
call dword [edx]
mov dword [ebp - 0x14], eax
mov eax, edi
mov edx, dword [eax]
call dword [edx]
mov dword [ebp - 0x18], eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0xffffffffffffffff
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CryptEncrypt
test eax, eax
jne 0x6ca79b
mov ecx, 0x6ca94c
mov dl, 1
mov eax, dword [0x41a190]
call fcn.00425db0
call fcn.004066b0
mov edx, dword [ebp - 0x14]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 4]
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [edi + 4]
push eax
push 0
push 0xffffffffffffffff
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CryptEncrypt
test eax, eax
jne 0x6ca7da
mov ecx, 0x6ca990
mov dl, 1
mov eax, dword [0x41a190]
call fcn.00425db0
call fcn.004066b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6ca7f8
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CryptDestroyKey
ret
Function at 0x6caee8
Capabilities:
Encrypt data using rc4 via winapi
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, ebx
call fcn.006ca05c
mov edx, dword [ebx + 4]
xor ecx, ecx
mov eax, ebx
call fcn.006cb148
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6cb05f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x8003
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_CryptCreateHash
test eax, eax
jne 0x6caf4b
mov ecx, 0x6cb07c
mov dl, 1
mov eax, dword [0x41a190]
call fcn.00425db0
call fcn.004066b0
xor eax, eax
push ebp
push 0x6cb03f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, edi
mov edx, dword [eax]
call dword [edx]
push eax
mov eax, dword [edi + 4]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CryptHashData
test eax, eax
jne 0x6caf89
mov ecx, 0x6cb0b0
mov dl, 1
mov eax, dword [0x41a190]
call fcn.00425db0
call fcn.004066b0
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 0x10]
push eax
push 0x6801
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_CryptDeriveKey
test eax, eax
jne 0x6cafbb
mov ecx, 0x6cb0e0
mov dl, 1
mov eax, dword [0x41a190]
call fcn.00425db0
call fcn.004066b0
xor eax, eax
push ebp
push 0x6cb021
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
push 1
mov eax, dword [ebp - 0xc]
push eax
mov eax, esi
mov edx, dword [eax]
call dword [edx]
push eax
mov eax, dword [esi + 4]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_CryptImportKey
test eax, eax
jne 0x6cb001
mov ecx, 0x6cb124
mov dl, 1
mov eax, dword [0x41a190]
call fcn.00425db0
call fcn.004066b0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CryptDestroyKey
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6cb028
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CryptDestroyKey
ret

Function at 0x6d10ec
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x6d117b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, esi
call fcn.004208a0
test al, al
je 0x6d112a
lea eax, [ebp - 4]
mov edx, esi
call fcn.004073c0
jmp 0x6d1132
lea eax, [ebp - 4]
call fcn.006d10ac
lea eax, [ebp - 0x20c]
push eax
xor bl, 1
movzx eax, bl
push eax
push 0x6d118c
mov eax, dword [ebp - 4]
call fcn.00407e90
push eax
call sub.kernel32.dll_GetTempFileNameW
mov eax, edi
lea edx, [ebp - 0x20c]
mov ecx, 0x104
call fcn.00407f3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6d1182
lea eax, [ebp - 4]
call fcn.00406f98
ret
Function at 0x6d1204
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x6d12c0
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00420fa4
mov edx, dword [ebp - 4]
mov eax, 0x6d12dc
call fcn.004587b0
test al, al
je 0x6d124d
lea eax, [ebp - 4]
mov ecx, 8
mov edx, 1
call fcn.004082a4
jmp 0x6d1270
mov edx, dword [ebp - 4]
mov eax, 0x6d12fc
call fcn.004587b0
test al, al
je 0x6d1270
lea eax, [ebp - 4]
mov ecx, 4
mov edx, 1
call fcn.004082a4
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00420e54
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.004272e0
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.004073c0
mov eax, dword [ebp - 4]
call fcn.00407e90
push eax
call sub.kernel32.dll_GetDriveTypeW
cmp eax, 2
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6d12c7
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00406ff8
ret

Function at 0x6d22e8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
mov esi, edx
mov edx, dword [eax]
dec ecx
test ecx, ecx
jl 0x6d2313
inc ecx
mov ebx, edx
xor bl, byte [esi]
movzx ebx, bl
mov ebx, dword [ebx*4 + 0x7745e8]
shr edx, 8
and edx, 0xffffff
xor ebx, edx
mov edx, ebx
inc esi
dec ecx
jne 0x6d22f4
mov dword [eax], edx
pop esi
pop ebx
ret

Function at 0x6d3ad8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, edx
mov edx, dword [eax]
dec ecx
test ecx, ecx
jl 0x6d3b00
inc ecx
mov ebx, edx
xor bl, byte [esi]
movzx ebx, bl
mov edi, dword [0x77b2fc]
mov ebx, dword [edi + ebx*4]
shr edx, 8
xor ebx, edx
mov edx, ebx
inc esi
dec ecx
jne 0x6d3ae5
mov dword [eax], edx
pop edi
pop esi
pop ebx
ret

Function at 0x6d894c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6d8992
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x30]
call fcn.006d73e8
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6d8999
lea eax, [ebp - 4]
call fcn.00406f98
ret
Function at 0x6daa58
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x6dab6e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebx + 0x20]
mov edx, dword [eax]
xor ecx, ecx
mov dword [eax], ecx
mov eax, edx
call fcn.00405330
inc dword [ebx + 0x10]
cmp dword [ebx + 0x2c], 0
jne 0x6daa93
cmp dword [ebx + 0x28], 0
jbe 0x6daacc
jmp 0x6daa95
jle 0x6daacc
lea eax, [ebp - 4]
mov edx, dword [ebx + 4]
call fcn.004073c0
lea ecx, [ebp - 8]
mov edx, dword [ebx + 0x10]
mov eax, ebx
call fcn.006da458
mov eax, dword [ebp - 8]
call fcn.00407e90
push eax
mov eax, dword [ebp - 4]
call fcn.00407e90
push eax
call sub.kernel32.dll_MoveFileW
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x6dab2e
cmp word [ebx + 0x32], 0
je 0x6dab0d
mov byte [ebp - 9], 0
lea ecx, [ebp - 9]
mov edx, ebx
mov eax, dword [ebx + 0x34]
call dword [ebx + 0x30]
cmp byte [ebp - 9], 0
je 0x6daaf9
mov dl, 1
mov eax, dword [0x6cef94]
call fcn.006d0390
call fcn.004066b0
mov eax, dword [ebx + 4]
call fcn.006d1308
cmp edx, 0xffffffff
jne 0x6dab09
cmp eax, 0xffffffff
je 0x6daad7
jmp 0x6dab1e
mov dl, 1
mov eax, dword [0x6cef94]
call fcn.006d0390
call fcn.004066b0
mov eax, dword [ebx + 4]
call fcn.006d1194
mov edx, dword [ebx + 0x10]
call fcn.006d24bc
push 0xff20
mov ecx, dword [ebx + 4]
mov dl, 1
mov eax, dword [0x43e23c]
call fcn.0044c8b4
mov dword [ebx + 0x20], eax
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6dab75
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406ff8
ret