joyce8/EMBER2024-capa huggingface dataset:
Function at 0x641018
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, dword [ecx]
test edi, edi
je 0x641056
test eax, eax
je 0x641056
mov cl, byte [edx + edi]
xor cl, byte [esi]
inc esi
mov byte [edx + edi], cl
mov byte [ebx], cl
inc ebx
lea ecx, [eax - 1]
inc edi
and edi, 0xf
je 0x641058
cmp eax, 1
mov eax, ecx
jne 0x641038
jmp 0x641058
mov ecx, eax
cmp ecx, 0x10
jb 0x6410a3
mov dword [ebp - 0x10], ecx
push dword [ebp + 0x14]
push edx
push edx
call fcn.006407f0
mov edx, dword [ebp + 0x18]
add esp, 0xc
cmp edi, 0xf
ja 0x641090
add edi, 0xfffffffc
mov eax, dword [edx + edi + 4]
xor eax, dword [esi + edi + 4]
mov dword [edx + edi + 4], eax
mov dword [ebx + edi + 4], eax
add edi, 4
cmp edi, 0xc
jb 0x641078
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
add ebx, 0x10
add esi, 0x10
xor edi, edi
cmp ecx, 0xf
ja 0x64105d
test ecx, ecx
je 0x6410d3
push dword [ebp + 0x14]
push edx
push edx
mov dword [ebp - 0x10], ecx
call fcn.006407f0
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x18]
add esp, 0xc
mov al, byte [ecx + edi]
xor al, byte [esi + edi]
mov byte [ecx + edi], al
mov byte [ebx + edi], al
lea eax, [edi + 1]
mov edi, eax
dec edx
jne 0x6410bd
jmp 0x6410d5
mov eax, edi
mov ecx, dword [ebp + 0x1c]
mov dword [ecx], eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x6410e2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, dword [ecx]
test edi, edi
je 0x641128
test eax, eax
je 0x641128
mov cl, byte [esi]
inc esi
mov edx, dword [ebp + 0x18]
mov dl, byte [edx + edi]
xor dl, cl
mov byte [ebx], dl
mov edx, dword [ebp + 0x18]
inc ebx
mov byte [edx + edi], cl
lea ecx, [eax - 1]
inc edi
and edi, 0xf
je 0x64112a
cmp eax, 1
mov eax, ecx
jne 0x641102
jmp 0x64112a
mov ecx, eax
cmp ecx, 0x10
jb 0x641177
mov dword [ebp - 0x10], ecx
push dword [ebp + 0x14]
push edx
push edx
call fcn.006407f0
mov edx, dword [ebp + 0x18]
add esp, 0xc
cmp edi, 0xf
ja 0x641164
add edi, 0xfffffffc
mov eax, dword [esi + edi + 4]
mov ecx, dword [edx + edi + 4]
xor ecx, eax
mov dword [ebx + edi + 4], ecx
mov dword [edx + edi + 4], eax
add edi, 4
cmp edi, 0xc
jb 0x64114a
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
add ebx, 0x10
add esi, 0x10
xor edi, edi
cmp ecx, 0xf
ja 0x64112f
test ecx, ecx
je 0x6411a8
push dword [ebp + 0x14]
push edx
push edx
mov dword [ebp - 0x10], ecx
call fcn.006407f0
mov edx, dword [ebp + 0x18]
add esp, 0xc
mov al, byte [esi + edi]
mov cl, byte [edx + edi]
xor cl, al
mov byte [ebx + edi], cl
mov byte [edx + edi], al
lea eax, [edi + 1]
mov edi, eax
dec dword [ebp - 0x10]
jne 0x64118e
jmp 0x6411aa
mov eax, edi
mov ecx, dword [ebp + 0x1c]
mov dword [ecx], eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x66de60
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x1a0
mov eax, dword [0x7a8498]
xor eax, ebp
mov dword [esp + 0x198], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0xd0], xmm0
movdqa xmmword [esp + 0xc0], xmm0
movdqa xmmword [esp + 0xb0], xmm0
movdqa xmmword [esp + 0xa0], xmm0
lea esi, [esp + 0xa0]
push esi
push 0x20
push dword [ebp + 0x10]
call fcn.00541470
add esp, 0xc
and byte [esp + 0xa0], 0xf8
mov al, byte [esp + 0xbf]
and al, 0x3f
or al, 0x40
mov byte [esp + 0xbf], al
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x90], xmm0
movdqa xmmword [esp + 0x80], xmm0
movdqa xmmword [esp + 0x70], xmm0
movdqa xmmword [esp + 0x60], xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
movdqa xmmword [esp + 0x10], xmm0
movdqa xmmword [esp], xmm0
mov edi, esp
push 0x778cd8
push esi
push edi
call fcn.0066b3a0
add esp, 0xc
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x150], xmm0
movdqa xmmword [esp + 0x140], xmm0
mov dword [esp + 0x164], 0xffffffff
mov dword [esp + 0x160], 0xffffffff
movdqa xmmword [esp + 0x120], xmm0
movdqa xmmword [esp + 0x110], xmm0
mov dword [esp + 0x134], 0xffffffff
mov dword [esp + 0x130], 0xffffffff
movdqa xmmword [esp + 0xf0], xmm0
movdqa xmmword [esp + 0xe0], xmm0
mov dword [esp + 0x104], 0xffffffff
mov dword [esp + 0x100], 0xffffffff
movsd xmm0, qword [esp + 0x70]
movsd qword [esp + 0x190], xmm0
movdqa xmm0, xmmword [esp + 0x50]
movaps xmm1, xmmword [esp + 0x60]
movaps xmmword [esp + 0x180], xmm1
movdqa xmmword [esp + 0x170], xmm0
lea esi, [esp + 0x140]
lea edx, [esp + 0x170]
mov ecx, esi
call fcn.00674a00
lea ebx, [esp + 0x110]
mov ecx, ebx
mov edx, edi
push esi
call fcn.00674dd0
add esp, 4
lea edx, [esp + 0x28]
lea edi, [esp + 0xe0]
mov ecx, edi
push esi
call fcn.00674dd0
add esp, 4
mov esi, dword [ebp + 8]
mov ecx, esi
mov edx, edi
call fcn.006697b0
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x180], xmm0
movdqa xmmword [esp + 0x170], xmm0
lea ecx, [esp + 0x170]
mov edx, ebx
call fcn.006697b0
mov al, byte [esp + 0x170]
shl al, 7
xor byte [esi + 0x1f], al
mov eax, dword [ebp + 0x10]
movups xmm0, xmmword [eax]
movups xmm1, xmmword [eax + 0x10]
mov eax, dword [ebp + 0xc]
movups xmmword [eax + 0x10], xmm1
movups xmmword [eax], xmm0
movups xmm0, xmmword [esi]
movups xmm1, xmmword [esi + 0x10]
movups xmmword [eax + 0x20], xmm0
movups xmmword [eax + 0x30], xmm1
mov ecx, dword [esp + 0x198]
xor ecx, ebp
call fcn.006c9121
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x673780
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x7a8498]
xor ecx, ebp
mov dword [esp + 0x148], ecx
movdqu xmm0, xmmword [eax]
movups xmm1, xmmword [eax + 0x10]
movdqu xmmword [esp + 0x128], xmm0
and byte [esp + 0x128], 0xf8
movups xmmword [esp + 0x138], xmm1
mov al, byte [esp + 0x147]
and al, 0x3f
or al, 0x40
mov byte [esp + 0x147], al
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x110], xmm0
movdqa xmmword [esp + 0x100], xmm0
movdqa xmmword [esp + 0xf0], xmm0
movdqa xmmword [esp + 0xe0], xmm0
movdqa xmmword [esp + 0xd0], xmm0
movdqa xmmword [esp + 0xc0], xmm0
movdqa xmmword [esp + 0xb0], xmm0
movdqa xmmword [esp + 0xa0], xmm0
movdqa xmmword [esp + 0x90], xmm0
movdqa xmmword [esp + 0x80], xmm0
lea eax, [esp + 0x128]
lea ecx, [esp + 0x80]
push 0x778cd8
push eax
push ecx
call fcn.0066b3a0
add esp, 0xc
movdqa xmm0, xmmword [esp + 0xd0]
movdqu xmm1, xmmword [esp + 0xa8]
movdqu xmm2, xmmword [esp + 0xb8]
movdqa xmm4, xmm1
paddd xmm4, xmm0
movdqa xmm3, xmmword [esp + 0xe0]
movdqu xmmword [esp + 0x58], xmm4
movdqa xmm4, xmm2
paddd xmm4, xmm3
mov eax, dword [esp + 0xf0]
mov edi, dword [esp + 0xc8]
lea ebx, [edi + eax]
mov ecx, dword [esp + 0xf4]
mov edx, dword [esp + 0xcc]
movdqu xmmword [esp + 0x68], xmm4
mov dword [esp + 0x78], ebx
lea ebx, [edx + ecx]
mov dword [esp + 0x7c], ebx
sub eax, edi
sub ecx, edx
psubd xmm0, xmm1
paddd xmm0, xmmword [0x778c20]
psubd xmm3, xmm2
paddd xmm3, xmmword [0x778c30]
add eax, 0x7fffffe
movdqu xmmword [esp + 0x30], xmm0
movdqu xmmword [esp + 0x40], xmm3
mov dword [esp + 0x50], eax
add ecx, 0x3fffffe
mov dword [esp + 0x54], ecx
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
movdqa xmmword [esp], xmm0
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x20], 0xffffffff
mov edi, esp
lea edx, [esp + 0x30]
mov ecx, edi
call fcn.00674a00
lea edx, [esp + 0x58]
mov ecx, edi
push edi
call fcn.00674dd0
add esp, 4
mov ecx, esi
mov edx, edi
call fcn.006697b0
mov ecx, dword [esp + 0x148]
xor ecx, ebp
call fcn.006c9121
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x676fe0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov dword [ecx], eax
mov dword [ecx + 4], 0
mov word [ecx + 8], 0
movzx eax, word [edi + 0xa2]
mov word [ecx + 0xa], ax
xorps xmm0, xmm0
movups xmmword [ecx + 0xc], xmm0
mov dword [ecx + 0x1c], 0
mov eax, dword [edi + 0x84]
mov dword [ecx + 0x20], eax
mov eax, dword [edi + 0x88]
mov dword [ecx + 0x24], eax
mov dword [ecx + 0x28], 0x3e8
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], 0
test edi, edi
je 0x67705d
lea ebx, [edi + 0x48]
push ebx
call fcn.0060b580
add esp, 4
mov dword [esi + 0x34], edi
push ebx
call fcn.0060b580
add esp, 4
mov eax, dword [esi + 0x34]
jmp 0x677066
mov dword [esi + 0x34], 0
xor eax, eax
mov dword [esi + 0x38], edi
mov ecx, dword [eax + 0x74]
mov dword [esi + 0x40], ecx
mov ecx, dword [eax + 0x78]
mov dword [esi + 0x44], ecx
mov ecx, dword [eax + 0x7c]
mov dword [esi + 0x48], ecx
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov cl, byte [esi + 0x58]
mov edx, ecx
and dl, 0xfe
mov byte [esi + 0x58], dl
mov dl, byte [eax + 0x124]
and dl, 2
and cl, 0xfc
or cl, dl
mov byte [esi + 0x58], cl
mov al, byte [eax + 0x125]
and al, 4
and cl, 0xfa
or cl, al
mov byte [esi + 0x58], cl
lea eax, [esi + 0x3c]
push eax
call fcn.0060e100
add esp, 4
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x687d84
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov ebx, dword [ebp + 8]
mov eax, dword [0x7a8498]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov byte [ebp - 0x11], 0xff
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 0x14]
lea esi, [ecx + eax*2]
add esi, 0xc
mov ecx, dword [fcn.00474d30]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x687f24
mov edi, eax
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], ebx
add edi, 0xc
mov dword [ecx + 4], edi
mov eax, dword [ebx + 0xc]
add eax, edi
mov dword [ecx + 8], eax
mov eax, dword [ebp + 0xc]
cmp dword [ebx + 0x10], edx
mov esi, ebx
jae 0x687e42
mov ecx, dword [esi]
call dword [section..00cfg]
push edi
call ecx
add esp, 4
mov ecx, dword [esi + 4]
mov ebx, dword [ebp - 0x1c]
mov edi, dword [ebx + 4]
call dword [section..00cfg]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call ecx
add esp, 0xc
mov eax, dword [ebx + 4]
mov dword [ebp - 0x18], eax
mov edi, dword [ebx + 8]
add edi, dword [esi + 0xc]
mov ecx, dword [esi + 8]
call dword [section..00cfg]
push dword [ebp - 0x18]
mov dword [ebp - 0x20], edi
push edi
call ecx
add esp, 8
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 4]
mov edi, ebx
mov ebx, eax
jmp 0x687e4d
mov dword [ebp - 0x20], eax
mov ebx, edi
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x18], edx
mov ecx, dword [esi]
call dword [section..00cfg]
push ebx
call ecx
add esp, 4
mov ecx, dword [esi]
mov ebx, dword [edi + 8]
call dword [section..00cfg]
push ebx
call ecx
add esp, 4
mov eax, dword [ebp - 0x18]
test eax, eax
mov ecx, dword [ebp - 0x20]
je 0x687ed8
xor ebx, ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], ecx
mov al, byte [ecx + ebx]
xor al, 0x36
mov byte [ebp - 0x11], al
mov ecx, dword [esi + 4]
mov edi, dword [ebp - 0x1c]
mov eax, dword [edi + 4]
mov dword [ebp - 0x24], eax
call dword [section..00cfg]
xor eax, eax
inc eax
push eax
lea eax, [ebp - 0x11]
push eax
push dword [ebp - 0x24]
call ecx
add esp, 0xc
mov eax, dword [ebp - 0x20]
mov al, byte [eax + ebx]
xor al, 0x5c
mov byte [ebp - 0x11], al
mov ecx, dword [esi + 4]
mov edi, dword [edi + 8]
call dword [section..00cfg]
xor eax, eax
inc eax
push eax
lea eax, [ebp - 0x11]
push eax
push edi
call ecx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
add esp, 0xc
inc ebx
cmp eax, ebx
jne 0x687e7e
cmp eax, dword [esi + 0x10]
jae 0x687f24
mov ebx, esi
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebx + 4]
mov esi, dword [edi + 4]
call dword [section..00cfg]
xor eax, eax
inc eax
push eax
push 0x77bdc8
push esi
call ecx
add esp, 0xc
mov ecx, dword [ebx + 4]
mov esi, dword [edi + 8]
call dword [section..00cfg]
xor eax, eax
inc eax
push eax
push 0x77bdc9
push esi
call ecx
mov eax, dword [ebp - 0x18]
add esp, 0xc
inc eax
cmp eax, dword [ebx + 0x10]
jb 0x687ee2
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006c9121
mov eax, dword [ebp - 0x1c]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x688643
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x7a8498]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [ebp + 8], 0
je 0x688711
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
movzx eax, ax
push dword [ebp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x688711
mov ebx, eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x688711
mov edi, eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x688711
mov esi, eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
je 0x68870a
mov ebx, eax
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x688703
push edi
push esi
push eax
call fcn.006cca40
add esp, 0xc
xor eax, eax
lea ecx, [ebp - 0x14]
mov dword [ecx], eax
push ecx
push eax
push ebx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x6886fc
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x6886fc
mov ecx, dword [ebp + 8]
push eax
call fcn.00688724
mov edi, esi
mov esi, dword [ebp - 0x14]
mov eax, dword [esi]
mov ecx, dword [eax + 8]
call dword [section..00cfg]
push esi
mov esi, edi
call ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006c9121
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x68dd30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
cmp byte [ecx + 0xb1c], 0
je 0x68dd42
pop ebp
jmp fcn.0068dd58
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0068e606
pop ebp
ret 0x10
Function at 0x690fc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov edi, dword [ebp + 8]
lea ebx, [ecx + 0x400]
lea eax, [ecx + 0xa5c]
push ebx
push dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_IntersectRect]
test eax, eax
je 0x691017
mov eax, dword [esi]
mov dword [ebp - 0x10], edi
mov edi, dword [eax + 0x2e4]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push ebx
push dword [ebp - 0x10]
call edi
mov ecx, esi
call fcn.00691022
mov ecx, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.00649340
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x69b8b2
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x20
mov esi, esp
mov eax, dword [0x7a8498]
xor eax, ebp
mov dword [esi + 0x18], eax
cmp byte [ecx + 0x1c], 0
je 0x69b95b
mov edi, ecx
cmp dword [ecx + 0x14], 0
je 0x69b95b
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
mov dword [esi + 0xc], ecx
lea ecx, [eax + eax]
add ecx, 2
add eax, eax
add eax, 5
and eax, 0xfffffffc
call fcn.006c9620
mov ebx, esp
and ebx, 0xfffffff0
mov esp, ebx
push ecx
push 0xff
push ebx
call fcn.006ccfc0
add esp, 0xc
push dword [esi + 0xc]
push ebx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, 0x478
add ecx, dword [edi + 0x14]
push ebx
call fcn.00520cac
mov eax, dword [edi + 0x14]
mov dword [esi + 0xc], eax
mov eax, dword [eax]
mov ebx, dword [eax + 0x24]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, dword [esi + 0xc]
call ebx
xor edx, edx
mov ecx, eax
push edx
push edx
push edx
push str.textchanged
push dword [edi + 0x14]
call fcn.0051e668
mov ecx, dword [esi + 0x18]
xor ecx, ebp
call fcn.006c9121
xor eax, eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x6a6e80
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xa0
mov esi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [0x7a8498]
xor ecx, ebp
mov dword [esp + 0x98], ecx
mov dword [esi + 0x14], eax
mov dword [eax + 0x1108], 0
cmp dword [esi + 4], 0
jne 0x6a6f78
pcmpeqd xmm0, xmm0
lea eax, [esp + 0x10]
movdqa xmmword [eax], xmm0
mov ebx, dword [esi + 0x14]
mov eax, dword [ebx]
mov edi, dword [eax + 0x50]
mov ecx, edi
call dword [section..00cfg]
mov ecx, ebx
call edi
lea edi, [esp + 0x10]
mov ecx, edi
push eax
call fcn.00520694
movaps xmm0, xmmword [edi]
movaps xmmword [esp], xmm0
mov edi, dword [esi + 0x14]
mov eax, dword [edi]
mov ebx, dword [eax + 0x24]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, edi
call ebx
mov ecx, eax
call fcn.004b45c0
sub esp, 0x24
xor ecx, ecx
mov dword [esp + 0x20], ecx
movaps xmm0, xmmword [esp + 0x24]
movups xmmword [esp + 0x10], xmm0
mov dword [esp + 0xc], ecx
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 8], 0x40000000
mov ecx, esi
call fcn.00524aec
mov edi, dword [esi + 0x14]
mov eax, dword [edi]
mov ebx, dword [eax + 0x24]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, edi
call ebx
mov edi, eax
mov ecx, dword [esi + 0x14]
lea ebx, [esp + 0x10]
push ebx
call fcn.0064e150
mov ecx, edi
push ebx
mov edi, ebx
call fcn.0051f4fa
push 1
push dword [eax]
push 0x30
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, edi
call fcn.00520b96
mov edi, dword [esi + 0x14]
mov eax, dword [edi]
mov ebx, dword [eax + 0x44]
mov ecx, ebx
call dword [section..00cfg]
lea eax, [esp + 0x10]
mov ecx, edi
push eax
mov edi, eax
call ebx
mov ecx, edi
call fcn.00520c46
mov ebx, eax
mov ecx, edi
call fcn.00520b96
test bl, bl
je 0x6a6fb6
mov eax, 0x10f8
add eax, dword [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, 0x10f8
add eax, dword [esi + 0x14]
push eax
push 0
push 0x1002
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov byte [esi + 0x1c], 1
mov ecx, dword [esp + 0x98]
xor ecx, ebp
call fcn.006c9121
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x6c8d50
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
test eax, eax
je 0x6c8dc0
mov dword [ebp - 0x10], 0
nop dword [eax]
add ecx, 1
movzx ecx, cl
mov edi, dword [esi + ecx*4 + 8]
add edx, edi
movzx edx, dl
mov eax, dword [ebp + 8]
mov ebx, dword [eax + edx*4 + 8]
mov eax, dword [ebp + 8]
mov dword [eax + ecx*4 + 8], ebx
mov eax, dword [ebp + 8]
mov dword [eax + edx*4 + 8], edi
add ebx, edi
movzx edi, bl
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp - 0x10]
movzx ebx, byte [esi + eax]
mov esi, dword [ebp + 8]
xor bl, byte [esi + edi*4 + 8]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov byte [esi + eax], bl
mov esi, dword [ebp + 8]
add eax, 1
mov dword [ebp - 0x10], eax
cmp edi, eax
jne 0x6c8d70
mov dword [esi], ecx
mov dword [esi + 4], edx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x6f2709
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.006f2952

Function at 0x6f58b3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.006f58be
Function at 0x407180
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x4071be
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x4071b6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4071c0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x4071a6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4072a0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x4072b6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x4072d1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x152bc0
Capabilities:
Encode data using xor

Disassembly:
xor al, al
cmp dword [esp + 8], 0
push ebp
mov ebp, dword [esp + 8]
je 0x152c57
test ebp, ebp
je 0x152c57
mov eax, ebp
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x152be0
sub eax, edx
push ebx
sar eax, 1
shr eax, 1
push esi
mov ebx, eax
push edi
lea edi, [ebx + 2]
push edi
call fcn.0015374f
mov esi, eax
add esp, 4
test esi, esi
je 0x152c52
push edi
push 0
push esi
call fcn.00156370
push esi
push ebp
mov eax, ebx
call fcn.001520d0
add esp, 0x14
xor eax, eax
test ebx, ebx
jbe 0x152c2b
xor byte [eax + esi], bl
inc eax
cmp eax, ebx
jb 0x152c23
mov ecx, dword [esp + 0x18]
lea eax, [ebx + ebx]
push eax
push ecx
push ebx
push esi
push 0
push 0
call dword [0x15f018]
push esi
mov bl, 1
call fcn.0015574e
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret
Function at 0x7ffe549d
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x30]
call 0x7ffe54a8
pop edx
xor dx, dx
add edx, 0xd5e0
xor ecx, ecx
mov cl, 0x1e
xor byte [ecx + edx], 0x74
loop 0x7ffe54b6
push dword fs:[0x24]
pop dword [edx + 0xa]
mov cl, 0xff
push edx
loop 0x7ffe54c8
mov dword [edx + 0x11], 0xffffacbb
mov ecx, dword [eax + 0x2c]
mov dword [edx + 0x1b], ecx
mov dword [edx + 0x100], ecx
mov dword [eax + 0x2c], esp
push 0
push 0
push 0
push 0
push 0x30
push 0x20
push 0
push 0
stc
add edx, 0xffff7f38
push edx
cld
cld
push edx
nop
push 0
cld
call dword [edx + 0x820b]
clc
stc
add esp, 0x3f8
cld
xor eax, eax
nop
inc eax
ret 0xc

Function at 0x7ffe8354
Capabilities:
Encode data using xor

Disassembly:
pop eax
clc
cld
stc
add eax, 0x11
clc
nop
mov byte [eax], 5
nop
pushal
inc eax
popal
cld
call 0x7ffe8354
add eax, 0
clc
add eax, 5
push edx
cdq
pop edx
cld
clc
cld
cld
mov ecx, eax
clc
pushal
inc eax
popal
cld
cld
call 0x7ffe831f
cld
pop eax
add eax, 0xd
stc
cld
stc
mov byte [eax], 5
cld
clc
call int.7ffe84d6
stc
and bh, 0xff
nop
add eax, 5
add eax, 0
nop
xchg ecx, eax
add eax, 0
cld
clc
nop
nop
sub ecx, eax
stc
add eax, 0
nop
clc
xor byte [eax + ecx], 0x67
nop
loop 0x7ffe834d
pop ecx
invalid