joyce8/EMBER2024-capa huggingface dataset:
Function at 0x67dd28
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff5c
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx edx, byte [ebp + 8]
mov byte [eax], dl
cmp ecx, 0x10
jle 0x67dd4f
mov eax, 0x10
jmp 0x67dd51
mov eax, ecx
cmp eax, 4
jge 0x67dd5b
mov eax, 4
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x24], str.UUUU
mov eax, dword [ebp - 4]
add eax, 8
mov edx, dword [ebp - 8]
mov ecx, dword [edx]
mov edx, dword [ebp - 0x24]
mov esi, dword [edx]
mov ebx, esi
mov edx, dword [ebp - 8]
mov edx, dword [edx + 4]
mov dword [ebp - 0xc], esi
mov edi, dword [ebp - 8]
mov edi, dword [edi + 8]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], esi
mov edi, dword [ebp - 8]
mov edi, dword [edi + 0xc]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], esi
mov esi, 8
mov edi, ebx
shl edi, 0xb
xor ecx, edi
add dword [ebp - 0xc], ecx
add ebx, edx
mov edi, edx
shr edi, 2
xor ebx, edi
add dword [ebp - 0x10], ebx
add edx, dword [ebp - 0xc]
mov edi, dword [ebp - 0xc]
shl edi, 8
xor edx, edi
add dword [ebp - 0x14], edx
mov edi, dword [ebp - 0x10]
add dword [ebp - 0xc], edi
mov edi, dword [ebp - 0x10]
shr edi, 0x10
xor dword [ebp - 0xc], edi
mov edi, dword [ebp - 0xc]
add dword [ebp - 0x18], edi
mov edi, dword [ebp - 0x14]
add dword [ebp - 0x10], edi
mov edi, dword [ebp - 0x14]
shl edi, 0xa
xor dword [ebp - 0x10], edi
mov edi, dword [ebp - 0x10]
add dword [ebp - 0x1c], edi
mov edi, dword [ebp - 0x18]
add dword [ebp - 0x14], edi
mov edi, dword [ebp - 0x18]
shr edi, 4
xor dword [ebp - 0x14], edi
add ecx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x1c]
add dword [ebp - 0x18], edi
mov edi, dword [ebp - 0x1c]
shl edi, 8
xor dword [ebp - 0x18], edi
add ebx, dword [ebp - 0x18]
add dword [ebp - 0x1c], ecx
mov edi, ecx
shr edi, 9
xor dword [ebp - 0x1c], edi
add edx, dword [ebp - 0x1c]
add ecx, ebx
dec esi
jne 0x67dda7
mov dword [eax], ecx
mov dword [eax + 4], ebx
mov dword [eax + 8], edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 0xc], edx
mov edx, dword [ebp - 0x10]
mov dword [eax + 0x10], edx
mov edx, dword [ebp - 0x14]
mov dword [eax + 0x14], edx
mov edx, dword [ebp - 0x18]
mov dword [eax + 0x18], edx
mov edx, dword [ebp - 0x1c]
mov dword [eax + 0x1c], edx
add eax, 0x20
add dword [ebp - 0x24], 4
dec dword [ebp - 0x20]
jne 0x67dd75
cmp byte [ebp + 8], 0
jne 0x67ded6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
dec eax
test eax, eax
jl 0x67deab
inc eax
mov dword [ebp - 0x20], 0
mov ebx, dword [ebp - 4]
add ebx, 8
mov edx, dword [ebp - 4]
mov edx, dword [edx + 4]
dec edx
sub edx, dword [ebp - 0x20]
mov ecx, dword [ebx]
mov dword [ebp + edx*8 - 0xa4], ecx
mov ecx, dword [ebx + 4]
mov dword [ebp + edx*8 - 0xa0], ecx
inc dword [ebp - 0x20]
add ebx, 8
dec eax
jne 0x67de85
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
dec eax
test eax, eax
jl 0x67ded6
inc eax
lea ebx, [ebp - 0xa4]
mov edx, dword [ebp - 4]
add edx, 8
mov ecx, dword [ebx]
mov dword [edx], ecx
mov ecx, dword [ebx + 4]
mov dword [edx + 4], ecx
add edx, 8
add ebx, 8
dec eax
jne 0x67dec3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x67e050
Capabilities:
Hash data with md5

Disassembly:
push ebx
add esp, 0xffffffa8
mov ebx, eax
mov edx, esp
mov eax, ebx
mov ecx, 0x58
call fcn.00407144
xor eax, eax
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], 0x67452301
mov dword [esp + 0xc], 0xefcdab89
mov dword [esp + 0x10], 0x98badcfe
mov dword [esp + 0x14], 0x10325476
mov edx, ebx
mov eax, esp
mov ecx, 0x58
call fcn.00407144
add esp, 0x58
pop ebx
ret

Function at 0x67e434
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x14], edx
mov edx, eax
mov eax, dword [ebp - 0x14]
mov ecx, 0x10
call fcn.0067f258
xor esi, esi
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
test bl, bl
jne 0x67e50f
movzx ecx, byte [eax]
mov ecx, dword [ecx*4 + 0x710cc4]
movzx edi, byte [eax + 1]
xor ecx, dword [edi*4 + 0x7110c4]
movzx edi, byte [eax + 2]
xor ecx, dword [edi*4 + 0x7114c4]
movzx edi, byte [eax + 3]
xor ecx, dword [edi*4 + 0x7118c4]
mov dword [ebp - 0x18], ecx
movzx ecx, byte [ebp - 0x18]
movzx ecx, byte [ecx + 0x70fb8c]
lea edi, [esi]
and edi, 0x80000003
jns 0x67e4a9
dec edi
or edi, 0xfffffffc
inc edi
mov byte [ebp + edi*4 - 0x10], cl
movzx ecx, byte [ebp - 0x17]
movzx ecx, byte [ecx + 0x70fb8c]
lea edi, [esi + 1]
and edi, 0x80000003
jns 0x67e4c8
dec edi
or edi, 0xfffffffc
inc edi
mov byte [ebp + edi*4 - 0xf], cl
movzx ecx, byte [ebp - 0x16]
movzx ecx, byte [ecx + 0x70fb8c]
lea edi, [esi + 2]
and edi, 0x80000003
jns 0x67e4e7
dec edi
or edi, 0xfffffffc
inc edi
mov byte [ebp + edi*4 - 0xe], cl
movzx ecx, byte [ebp - 0x15]
movzx ecx, byte [ecx + 0x70fb8c]
lea edi, [esi + 3]
and edi, 0x80000003
jns 0x67e506
dec edi
or edi, 0xfffffffc
inc edi
mov byte [ebp + edi*4 - 0xd], cl
jmp 0x67e594
lea ecx, [esi]
and ecx, 0x80000003
jns 0x67e51e
dec ecx
or ecx, 0xfffffffc
inc ecx
mov edi, dword [ebp - 0x14]
movzx ecx, byte [edi + ecx*4]
movzx ecx, byte [ecx + 0x70fb8c]
mov byte [edx], cl
lea ecx, [esi + 3]
and ecx, 0x80000003
jns 0x67e53e
dec ecx
or ecx, 0xfffffffc
inc ecx
mov edi, dword [ebp - 0x14]
movzx ecx, byte [edi + ecx*4 + 1]
movzx ecx, byte [ecx + 0x70fb8c]
mov byte [edx + 1], cl
lea ecx, [esi + 2]
and ecx, 0x80000003
jns 0x67e560
dec ecx
or ecx, 0xfffffffc
inc ecx
mov edi, dword [ebp - 0x14]
movzx ecx, byte [edi + ecx*4 + 2]
movzx ecx, byte [ecx + 0x70fb8c]
mov byte [edx + 2], cl
lea ecx, [esi + 1]
and ecx, 0x80000003
jns 0x67e582
dec ecx
or ecx, 0xfffffffc
inc ecx
mov edi, dword [ebp - 0x14]
movzx ecx, byte [edi + ecx*4 + 3]
movzx ecx, byte [ecx + 0x70fb8c]
mov byte [edx + 3], cl
inc esi
add edx, 4
add eax, 4
cmp esi, 4
jne 0x67e459
mov edi, dword [ebp - 0x14]
lea esi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x67e608
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov byte [ebp - 0x11], cl
mov ebx, edx
mov dword [ebp - 0x18], eax
xor eax, eax
lea edx, [ebp - 0x10]
cmp byte [ebp - 0x11], 0
jne 0x67e696
lea ecx, [eax]
and ecx, 0x80000003
jns 0x67e633
dec ecx
or ecx, 0xfffffffc
inc ecx
movzx ecx, byte [ebx + ecx*4]
mov ecx, dword [ecx*4 + 0x70fcc4]
lea esi, [eax + 1]
and esi, 0x80000003
jns 0x67e64e
dec esi
or esi, 0xfffffffc
inc esi
movzx esi, byte [ebx + esi*4 + 1]
xor ecx, dword [esi*4 + 0x7100c4]
lea esi, [eax + 2]
and esi, 0x80000003
jns 0x67e66a
dec esi
or esi, 0xfffffffc
inc esi
movzx esi, byte [ebx + esi*4 + 2]
xor ecx, dword [esi*4 + 0x7104c4]
lea esi, [eax + 3]
and esi, 0x80000003
jns 0x67e686
dec esi
or esi, 0xfffffffc
inc esi
movzx esi, byte [ebx + esi*4 + 3]
xor ecx, dword [esi*4 + 0x7108c4]
mov dword [edx], ecx
jmp 0x67e70f
lea ecx, [eax]
and ecx, 0x80000003
jns 0x67e6a5
dec ecx
or ecx, 0xfffffffc
inc ecx
movzx ecx, byte [ebx + ecx*4]
movzx ecx, byte [ecx + 0x70fa8c]
mov byte [edx], cl
lea ecx, [eax + 1]
and ecx, 0x80000003
jns 0x67e6c2
dec ecx
or ecx, 0xfffffffc
inc ecx
movzx ecx, byte [ebx + ecx*4 + 1]
movzx ecx, byte [ecx + 0x70fa8c]
mov byte [edx + 1], cl
lea ecx, [eax + 2]
and ecx, 0x80000003
jns 0x67e6e1
dec ecx
or ecx, 0xfffffffc
inc ecx
movzx ecx, byte [ebx + ecx*4 + 2]
movzx ecx, byte [ecx + 0x70fa8c]
mov byte [edx + 2], cl
lea ecx, [eax + 3]
and ecx, 0x80000003
jns 0x67e700
dec ecx
or ecx, 0xfffffffc
inc ecx
movzx ecx, byte [ebx + ecx*4 + 3]
movzx ecx, byte [ecx + 0x70fa8c]
mov byte [edx + 3], cl
inc eax
add edx, 4
cmp eax, 4
jne 0x67e61e
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x10]
mov ecx, 0x10
call fcn.0067f258
mov edi, ebx
lea esi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x67e73c
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
add esp, 0xfffffff8
mov dword [esp], eax
movzx eax, byte [esp]
movzx eax, byte [eax + 0x70fa8c]
mov byte [esp + 4], al
movzx eax, byte [esp + 1]
movzx eax, byte [eax + 0x70fa8c]
mov byte [esp + 5], al
movzx eax, byte [esp + 2]
movzx eax, byte [eax + 0x70fa8c]
mov byte [esp + 6], al
movzx eax, byte [esp + 3]
movzx eax, byte [eax + 0x70fa8c]
mov byte [esp + 7], al
mov eax, dword [esp + 4]
pop ecx
pop edx
ret

Function at 0x67e888
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffee8
mov ebx, eax
mov edx, esp
mov eax, ebx
mov ecx, 0x118
call fcn.00407144
xor eax, eax
mov dword [esp], eax
mov esi, 0x70e934
lea edi, [esp + 4]
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov dword [esp + 0x104], eax
mov dword [esp + 0x108], 0x55555555
mov dword [esp + 0x10c], 0x55555555
mov dword [esp + 0x110], 0x55555555
mov dword [esp + 0x114], 0x55555555
mov edx, ebx
mov eax, esp
mov ecx, 0x118
call fcn.00407144
add esp, 0x118
pop edi
pop esi
pop ebx
ret
Function at 0x67e904
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffee0
mov edi, ecx
mov ebx, edx
mov dword [esp], eax
lea edx, [esp + 8]
mov eax, dword [esp]
mov ecx, 0x118
call fcn.00407144
dec edi
test edi, edi
jl 0x67ea24
inc edi
mov dword [esp + 4], edi
mov esi, ebx
movzx eax, byte [esi]
mov edx, dword [esp + 8]
xor byte [esp + edx + 0xc], al
inc dword [esp + 8]
cmp dword [esp + 8], 0x100
jne 0x67e955
xor edx, edx
mov dword [esp + 8], edx
mov edx, dword [esp + 0x10c]
xor byte [esp + edx + 0x110], al
inc dword [esp + 0x10c]
cmp dword [esp + 0x10c], 8
jne 0x67ea19
mov edx, dword [esp + 0x11c]
mov ecx, dword [esp + 0x118]
mov ebx, dword [esp + 0x114]
mov eax, dword [esp + 0x110]
mov edi, 4
add edx, eax
add eax, edx
mov ebp, edx
shr ebp, 7
xor edx, ebp
add ecx, edx
add edx, ecx
mov ebp, ecx
shl ebp, 0xd
xor ecx, ebp
add ebx, ecx
add ecx, ebx
mov ebp, ebx
shr ebp, 0x11
xor ebx, ebp
add eax, ebx
add ebx, eax
mov ebp, eax
shl ebp, 9
xor eax, ebp
add edx, eax
add eax, edx
mov ebp, edx
shr ebp, 3
xor edx, ebp
add ecx, edx
add edx, ecx
mov ebp, ecx
shl ebp, 7
xor ecx, ebp
add ebx, ecx
add ecx, ebx
mov ebp, eax
shr ebp, 0xf
xor ebx, ebp
add eax, ebx
add ebx, eax
mov ebp, eax
shl ebp, 0xb
xor eax, ebp
dec edi
jne 0x67e999
mov dword [esp + 0x110], edx
mov dword [esp + 0x114], ecx
mov dword [esp + 0x118], ebx
mov dword [esp + 0x11c], eax
xor eax, eax
mov dword [esp + 0x10c], eax
inc esi
dec dword [esp + 4]
jne 0x67e936
mov edx, dword [esp]
lea eax, [esp + 8]
mov ecx, 0x118
call fcn.00407144
add esp, 0x120
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x67f258
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, ecx
shr eax, 2
test eax, eax
jle 0x67f272
mov ebx, dword [edx]
xor dword [esi], ebx
add esi, 4
add edx, 4
dec eax
jne 0x67f265
mov eax, ecx
and eax, 3
test eax, eax
jle 0x67f285
movzx ecx, byte [edx]
xor byte [esi], cl
inc esi
inc edx
dec eax
jne 0x67f27b
pop esi
pop ebx
ret
Function at 0x680028
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff88
mov dword [esp + 4], edx
mov dword [esp], eax
lea eax, [esp + 0x39]
xor ecx, ecx
mov edx, 0x3f
call fcn.00407f7c
lea edx, [esp + 0xc]
mov ecx, 0x2d
mov eax, dword [esp]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x6801a9
mov edi, 1
xor esi, esi
jmp 0x6800ea
movzx eax, byte [esp + edi + 0xb]
movzx edx, al
shr edx, 2
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [esp + esi + 0x39], dl
mov edx, eax
shl edx, 4
movzx eax, byte [esp + edi + 0xc]
shr eax, 4
or dl, al
and dl, 0x3f
movzx eax, dl
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [esp + esi + 0x3a], al
movzx edx, byte [esp + edi + 0xc]
add edx, edx
add edx, edx
movzx eax, byte [esp + edi + 0xd]
shr eax, 6
or dl, al
and dl, 0x3f
movzx eax, dl
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [esp + esi + 0x3b], al
movzx edx, byte [esp + edi + 0xd]
and dl, 0x3f
movzx eax, dl
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [esp + esi + 0x3c], al
add edi, 3
add esi, 4
mov eax, dword [esp + 8]
sub eax, 2
cmp edi, eax
jle 0x68006e
cmp edi, dword [esp + 8]
jg 0x68018f
movzx eax, byte [esp + edi + 0xb]
movzx edx, al
shr edx, 2
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [esp + esi + 0x39], dl
cmp edi, dword [esp + 8]
jne 0x680145
mov edx, eax
shl edx, 4
and dl, 0x30
and dl, 0x3f
movzx eax, dl
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [esp + esi + 0x3a], al
mov byte [esp + esi + 0x3b], 0x3d
jmp 0x680187
mov edx, eax
shl edx, 4
and dl, 0x30
movzx eax, byte [esp + edi + 0xc]
shr eax, 4
and al, 0xf
or dl, al
and dl, 0x3f
movzx eax, dl
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [esp + esi + 0x3a], al
movzx edx, byte [esp + edi + 0xc]
add edx, edx
add edx, edx
and dl, 0x3c
and dl, 0x3f
movzx eax, dl
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [esp + esi + 0x3b], al
mov byte [esp + esi + 0x3c], 0x3d
add esi, 4
lea edx, [esp + 0x39]
mov ecx, esi
mov eax, dword [esp + 4]
mov ebx, dword [eax]
call dword [ebx + 0x10]
cmp dword [esp + 8], 0x2d
jge 0x680045
add esp, 0x78
pop edi
pop esi
pop ebx
ret
Function at 0x681998
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
mov esi, 1
call fcn.0042a708
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [esp + 0xe]
push eax
lea ecx, [esp + 0x10]
lea edx, [esp + 0xe]
lea eax, [esp + 0xc]
call fcn.0042a3e0
mov ebp, esi
mov dword [ebx + 4], ebp
mov ecx, 0xf
and ecx, esi
mov edi, ebp
shl edi, cl
movzx eax, word [esp]
or ax, word [esp + 4]
movzx eax, ax
shl eax, 0x10
movzx edx, word [esp + 2]
or dx, word [esp + 6]
movzx edx, dx
or eax, edx
xor edi, eax
mov dword [ebx + 4], edi
mov esi, edi
inc esi
test edi, edi
je 0x6819a6
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x683118
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
mov esi, edx
lea edi, [esp + 0x11]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, eax
lea edi, [esp + 4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ebp, ecx
lea eax, [esp + 4]
call fcn.00682998
lea eax, [esp + 0x11]
call fcn.00682998
mov ecx, ebp
lea edx, [esp + 0x11]
lea eax, [esp + 4]
call fcn.00682a6c
mov eax, ebp
xor ecx, ecx
mov edx, 1
call fcn.00682b3c
mov ecx, esp
lea edx, [esp + 0x11]
lea eax, [esp + 4]
call fcn.00682a28
mov edi, dword [esp]
test edi, edi
jle 0x6831a8
mov esi, 1
lea eax, [esp + 4]
mov edx, esi
call fcn.006828f0
mov ebx, eax
lea eax, [esp + 0x11]
mov edx, esi
call fcn.006828f0
xor bl, al
mov eax, ebp
mov ecx, ebx
mov edx, esi
call fcn.00682b3c
inc esi
dec edi
jne 0x68317f
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x6865b8
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x1010], ebx
mov dword [ebp - 0x100c], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x6866f1
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx], 0x1000
jle 0x686617
lea edx, [ebp - 0x100c]
mov eax, dword [0x71504c]
call fcn.004106c0
mov ecx, dword [ebp - 0x100c]
mov dl, 1
mov eax, dword [0x41ed9c]
call fcn.0042d894
call fcn.0040a120
xor ecx, ecx
mov eax, dword [ebx]
mov dword [ebp - 8], eax
movzx eax, byte [ebp + 8]
mov byte [ebp + ecx - 0x1008], al
inc ecx
cmp dword [ebx], 0x7f
jle 0x68666f
mov eax, dword [ebx]
mov esi, 0xff
cdq
idiv esi
mov esi, eax
test esi, esi
jne 0x686644
mov esi, 1
mov eax, esi
or al, 0x80
mov byte [ebp + ecx - 0x1008], al
add ecx, esi
mov eax, esi
test eax, eax
jle 0x68666a
mov edx, dword [ebx]
and dl, 0xff
mov byte [ebp + ecx - 0x1008], dl
shr dword [ebx], 8
dec ecx
dec eax
jne 0x686657
inc esi
add ecx, esi
jmp 0x686679
mov eax, dword [ebx]
mov byte [ebp + ecx - 0x1008], al
inc ecx
mov eax, dword [ebp - 8]
add eax, ecx
mov dword [ebx], eax
cmp dword [ebx], 0x1000
jle 0x6866af
lea edx, [ebp - 0x1010]
mov eax, dword [0x71504c]
call fcn.004106c0
mov ecx, dword [ebp - 0x1010]
mov dl, 1
mov eax, dword [0x41ed9c]
call fcn.0042d894
call fcn.0040a120
lea edx, [ebp + ecx - 0x1008]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.00407144
mov ecx, dword [ebx]
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1008]
call fcn.00407144
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6866f8
lea eax, [ebp - 0x1010]
mov edx, 2
call fcn.0040aa88
pop eax
jmp eax
Function at 0x68a308
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x68a584
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
mov edx, 0x24
call fcn.0068cdf4
lea eax, [ebp - 0x28]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov eax, dword [ebp - 0x14]
mov dword [0x714648], eax
mov eax, dword [ebp - 0xc]
mov dword [0x71464c], eax
mov eax, dword [ebp - 0x24]
mov dword [0x714650], eax
call fcn.0042ea2c
cmp eax, 2
sete byte [0x713e21]
push 0x68a590
call sub.KERNEL32.DLL_GetModuleHandleW
lea edx, [ebp - 4]
call fcn.0068d0e4
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp byte [0x713e21], 0
jne 0x68a397
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.0068d114
test al, al
je 0x68a397
mov eax, dword [ebp - 0x4c]
mov dword [0x71d420], eax
jmp 0x68a39e
xor eax, eax
mov dword [0x71d420], eax
call fcn.00689878
and eax, 0x7f
cmp eax, 0x1c
ja case.0x68a3af.0
jmp dword [eax*4 + 0x68a3b6]
mov byte [0x713e1c], 1
jmp case.0x68a3af.0
mov byte [0x713e1d], 1
jmp case.0x68a3af.0
mov byte [0x713e1e], 1
jmp case.0x68a3af.0
mov byte [0x713e1f], 1
jmp case.0x68a3af.0
mov byte [0x713e20], 1
jmp case.0x68a3af.0
mov byte [0x713e22], 1
mov byte [0x713e23], 1
jmp case.0x68a3af.0
mov byte [0x713e22], 1
mov byte [0x713e24], 1
jmp case.0x68a3af.0
mov byte [0x713e22], 1
mov byte [0x713e24], 1
mov byte [0x713e25], 1
jmp case.0x68a3af.0
mov byte [0x713e26], 1
jmp case.0x68a3af.0
mov byte [0x713e27], 1
jmp case.0x68a3af.0
mov byte [0x713e28], 1
jmp case.0x68a3af.0
mov byte [0x713e29], 1
jmp case.0x68a3af.0
mov byte [0x713e2a], 1
jmp case.0x68a3af.0
mov byte [0x713e2b], 1
jmp case.0x68a3af.0
mov byte [0x713e2c], 1
jmp case.0x68a3af.0
mov byte [0x713e2d], 1
jmp case.0x68a3af.0
mov byte [0x713e2e], 1
jmp case.0x68a3af.0
mov byte [0x713e2f], 1
jmp case.0x68a3af.0
mov byte [0x713e30], 1
jmp case.0x68a3af.0
mov byte [0x713e31], 1
jmp case.0x68a3af.0
mov byte [0x713e32], 1
jmp case.0x68a3af.0
mov byte [0x713e33], 1
jmp case.0x68a3af.0
mov byte [0x713e34], 1
jmp case.0x68a3af.0
mov byte [0x713e35], 1
jmp case.0x68a3af.0
mov byte [0x713e36], 1
jmp case.0x68a3af.0
mov byte [0x713e37], 1
jmp case.0x68a3af.0
mov byte [0x713e38], 1
jmp case.0x68a3af.0
mov byte [0x713e39], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x68a58b
lea eax, [ebp - 4]
call fcn.0040aa28
pop eax
jmp eax

Function at 0x68b604
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 0x14], edx
xor edx, edx
push ebp
push 0x68b66a
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 0xe]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xe]
mov ecx, 7
call fcn.0040b554
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.DLL_GetACP
mov edx, eax
pop eax
call fcn.004273e8
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x68b671
lea eax, [ebp - 0x14]
call fcn.0040aa28
pop eax
jmp eax
Function at 0x68c3f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x68c488
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0042ea2c
cmp eax, 2
jne 0x68c430
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
push esi
push ebx
call sub.advapi32.dll_RegQueryValueExW
mov ebx, eax
jmp 0x68c468
lea eax, [ebp - 8]
mov edx, esi
call fcn.0040b358
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0
call fcn.0040b190
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
mov eax, dword [ebp - 4]
call fcn.0040b24c
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x68c48f
lea eax, [ebp - 8]
call fcn.0040aa70
lea eax, [ebp - 4]
call fcn.0040aa4c
pop eax
jmp eax

Function at 0x68c830
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [ebp - 8], eax
push 0x20019
lea eax, [ebp - 8]
push eax
mov eax, edi
call fcn.0040b49c
mov edx, eax
mov eax, ebx
call fcn.0068c254
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.0068c334
test eax, eax
sete al
mov ebx, eax
test bl, bl
je 0x68c8a2
push 0
push 0
push esi
push 0
mov eax, dword [ebp - 4]
call fcn.0040b49c
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x68cf50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040b49c
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x68cf69
test al, 0x10
jne 0x68cf6d
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x68cf74
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
test ebx, ebx
je 0x68cf92
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x68cf8a
test al, 0x10
je 0x68cf8e
xor eax, eax
jmp 0x68cf94
mov al, 1
pop ebx
ret
xor eax, eax
pop ebx
ret
Function at 0x68d114
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x68d1c8
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov eax, esi
call fcn.0040b49c
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jbe 0x68d1b0
lea eax, [ebp - 4]
mov edx, edi
call fcn.0040b62c
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebp - 0x10]
push eax
mov eax, esi
call fcn.0040b49c
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x68d1b0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x68d1d8
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x68d1b0
cmp dword [ebp - 0xc], 0x34
jne 0x68d1b0
mov bl, 1
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 8]
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x68d1cf
lea eax, [ebp - 4]
call fcn.0040aa28
pop eax
jmp eax