joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ad1e0
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
mov eax, ebx
call fcn.00424500
call fcn.0041f728
mov esi, eax
push 0
push 1
push 1
mov eax, dword [edi + 4]
push eax
mov eax, dword [edi]
push eax
call sub.gdi32.dll_CreateBitmap
mov dword [ebp - 0x14], eax
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0x18], eax
push esi
call sub.gdi32.dll_GetBkColor
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
test eax, eax
jl 0x5ad29c
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
call fcn.0041dd30
push eax
push esi
call sub.gdi32.dll_SetBkColor
cmp dword [ebp - 0x1c], 0
sete al
and eax, 0x7f
mov eax, dword [eax*4 + 0x9b0e14]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
push eax
push esi
mov eax, dword [edi + 4]
push eax
mov eax, dword [edi]
push eax
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_BitBlt
inc dword [ebp - 0x1c]
add ebx, 4
dec dword [ebp - 0x20]
jne 0x5ad24f
mov eax, dword [ebp - 0xc]
push eax
push esi
call sub.gdi32.dll_SetBkColor
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_DeleteDC
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00425160
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x5c0350
Capabilities:
Check os version

Disassembly:
push ebx
add esp, 0xffffff6c
mov ebx, eax
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
mov eax, dword [esp + 0x10]
sub eax, 1
jb 0x5c0376
je 0x5c0384
dec eax
je 0x5c03bd
jmp 0x5c03c9
mov eax, ebx
mov edx, 0x5c03dc
call fcn.004040dc
jmp 0x5c03c9
and dword [esp + 0xc], 0xffff
cmp dword [esp + 4], 4
ja SetVolumeLabelA
cmp dword [esp + 4], 4
jne 0x5c03af
cmp dword [esp + 8], 0xa
jb 0x5c03af
mov eax, ebx
mov edx, 0x5c03e8
call fcn.004040dc
jmp 0x5c03c9
mov eax, ebx
mov edx, 0x5c03f4
call fcn.004040dc
jmp 0x5c03c9
mov eax, ebx
mov edx, 0x5c0400
call fcn.004040dc
add esp, 0x94
pop ebx
ret
Function at 0x63fab0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x63fbac
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x64]
mov edi, dword [eax + 8]
dec edi
test edi, edi
jl 0x63fb96
inc edi
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x64]
mov edx, dword [ebp - 8]
call fcn.00413f08
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [ebx + 0x30]
call fcn.00404120
fld qword [ebx + 8]
fmul dword [0x63fbbc]
call fcn.00402c94
mov esi, eax
fld qword [ebx + 0x10]
fmul dword [0x63fbbc]
call fcn.00402c94
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x14]
mov edx, dword [ebp - 0x18]
mov eax, esi
call fcn.00413238
call fcn.0042940c
call fcn.00428be4
lea ecx, [ebp - 0x28]
lea edx, [ebp - 0x14]
call fcn.0063e100
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
cdq
xor eax, edx
sub eax, edx
mov dword [ebp - 0x20], eax
call fcn.0042940c
call fcn.00428be4
mov esi, eax
mov edx, dword [ebx + 0x28]
mov eax, dword [esi + 0xc]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
mov eax, esi
call fcn.0041f3f0
inc dword [ebp - 8]
dec edi
jne 0x63fae9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63fbb3
lea eax, [ebp - 0xc]
call fcn.00404088
ret

Function at 0x642318
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6423eb
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jg 0x64234a
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
dec eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebx + 0x30], eax
xor edx, edx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x18c]
push dword [ebx + 0xa4]
push 0x642404
lea ecx, [ebp - 0x10]
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x24]
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0x10]
push 0x642410
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.004043d8
mov edx, dword [ebp - 0xc]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x194]
mov dl, 1
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x18c]
mov eax, esi
call fcn.004a73c8
lea ecx, [ebp - 0x14]
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x28]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x14]
call fcn.0040a988
mov edx, eax
mov eax, esi
call fcn.004a74f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6423f2
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004040ac
ret
Function at 0x666258
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov edi, 0x9bb3ac
mov eax, dword [edi]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x6662e6
inc esi
xor ebx, ebx
mov edx, ebx
mov eax, dword [edi]
call fcn.00413f08
mov edx, dword [eax + 0x10]
mov dword [ebp - 0x10], edx
mov edx, dword [eax + 0x14]
mov dword [ebp - 0xc], edx
fld qword [ebp - 0x10]
fmul dword [0x6662f0]
call fcn.00402c94
lea ecx, [ebp - 8]
xor edx, edx
call fcn.00413238
lea eax, [ebp - 0x18]
push eax
call fcn.0042940c
call fcn.00428be4
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
lea ecx, [ebp - 8]
call fcn.006652f4
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov edx, ebx
mov eax, dword [edi]
call fcn.00413f08
add eax, 0xc
push eax
mov eax, dword [ebp - 8]
cdq
xor eax, edx
sub eax, edx
pop edx
mov dword [edx], eax
inc ebx
dec esi
jne 0x666273
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x6839f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004044cc
xor eax, eax
push ebp
push 0x683ae0
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [esi + 4]
mov word [ebx + 4], ax
mov ax, word [esi + 6]
mov word [ebx + 6], ax
mov ax, word [esi + 8]
mov word [ebx + 8], ax
mov ax, word [esi + 0xa]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xc]
call fcn.006856c0
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1e]
mov word [ebx + 0x1e], ax
mov ax, word [esi + 0x20]
mov word [ebx + 0x22], ax
mov ax, word [esi + 0x22]
mov word [ebx + 0x24], ax
mov ax, word [esi + 0x24]
mov word [ebx + 0x26], ax
mov eax, dword [esi + 0x26]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2a]
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [ebx + 0x30], eax
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040aff0
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00684264
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040aecc
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.006842d8
xor eax, eax
mov dword [ebx + 0x3c], eax
mov byte [ebx + 0x40], 0
mov byte [ebx + 0x42], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x683ae7
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004040ac
ret
Function at 0x683af0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004044cc
xor eax, eax
push ebp
push 0x683bf0
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
mov ax, word [esi + 4]
mov word [ebx + 6], ax
mov ax, word [esi + 6]
mov word [ebx + 8], ax
mov ax, word [esi + 8]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xa]
call fcn.006856c0
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0xe]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x12]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x16]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1a]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], 0
mov word [ebx + 0x24], 0
mov word [ebx + 0x26], 0
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [ebx + 0x30], eax
cmp dword [ebp - 4], 0
je 0x683bb6
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040aff0
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00684264
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040aecc
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.006842d8
jmp 0x683bc8
xor edx, edx
mov eax, ebx
call fcn.00684264
xor edx, edx
mov eax, ebx
call fcn.006842d8
xor eax, eax
mov dword [ebx + 0x3c], eax
mov byte [ebx + 0x40], 0
mov byte [ebx + 0x42], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x683bf7
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004040ac
ret
Function at 0x6845a4
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 9], 0
mov eax, dword [ebp - 8]
call fcn.004165f8
cmp eax, 0x16
jge 0x6845db
mov eax, dword [ebp - 8]
call fcn.004165f8
test eax, eax
jne 0x6846f2
mov byte [ebp - 9], 1
jmp 0x6846f2
mov eax, dword [ebp - 8]
call fcn.004165f8
cdq
push edx
push eax
push 0
push 0x10015
call fcn.00685404
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
neg edx
mov cx, 2
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x14]
call fcn.00402858
mov dword [ebp - 0x10], eax
xor ecx, ecx
push ebp
push 0x6846eb
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
cmp eax, dword [ebp - 0x14]
je 0x68463c
call fcn.00403b58
jmp 0x6846f2
mov eax, dword [ebp - 0x14]
sub eax, 0x16
xor edx, edx
jmp 0x68466a
dec eax
test eax, eax
jl 0x684656
mov ecx, dword [ebp - 0x10]
cmp byte [ecx + eax], 0x50
jne 0x684648
test eax, eax
jl 0x684672
mov edx, dword [ebp - 0x10]
add edx, eax
cmp dword [edx], 0x6054b50
je 0x68466a
dec eax
xor edx, edx
test eax, eax
jl 0x684672
test edx, edx
je 0x684649
test edx, edx
jne 0x68467d
call fcn.00403b58
jmp 0x6846f2
mov eax, dword [ebp - 4]
add eax, 4
mov cx, word [edx + 4]
mov word [eax + 4], cx
mov cx, word [edx + 6]
mov word [eax + 6], cx
mov cx, word [edx + 8]
mov word [eax + 8], cx
mov cx, word [edx + 0xa]
mov word [eax + 0xa], cx
mov ecx, dword [edx + 0xc]
mov dword [eax + 0xc], ecx
mov ecx, dword [edx + 0x10]
mov dword [eax + 0x10], ecx
mov dx, word [edx + 0x14]
mov word [eax + 0x14], dx
mov eax, dword [ebp - 8]
call fcn.004165f8
mov edx, dword [ebp - 4]
movzx edx, word [edx + 0x18]
sub eax, edx
mov edx, dword [ebp - 4]
mov dword [edx + 0x20], eax
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6846f2
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
call fcn.00402870
ret
mov al, byte [ebp - 9]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x685b5c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004044cc
xor eax, eax
push ebp
push 0x685bc0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xe
lea eax, [ebp - 0x1a]
push eax
lea eax, [ebp - 4]
call fcn.00685c98
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov edx, ebx
lea eax, [ebp - 0x1a]
call fcn.0040b56c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x685bc7
lea eax, [ebp - 4]
call fcn.00404088
ret
Function at 0x685bcc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004044cc
xor eax, eax
push ebp
push 0x685c30
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x104]
push eax
push 0
push 0x685c3c
lea eax, [ebp - 4]
call fcn.00685c98
push eax
call sub.kernel32.dll_GetTempFileNameA
mov edx, ebx
lea eax, [ebp - 0x104]
call fcn.00685a30
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x685c37
lea eax, [ebp - 4]
call fcn.00404088
ret

Function at 0x68b404
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x154]
mov edx, ebx
mov eax, edi
call fcn.0068b628
mov esi, eax
mov dword [edi + 0x154], esi
and esi, 0xff
add dword [edi + 0x158], esi
imul esi, dword [edi + 0x158], 0x8088405
inc esi
mov dword [edi + 0x158], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x15c]
mov eax, edi
call fcn.0068b628
mov dword [edi + 0x15c], eax
pop edi
pop esi
pop ebx
ret

Function at 0x68b478
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
movzx esi, cx
dec esi
test esi, esi
jl 0x68b49e
inc esi
mov eax, edi
call fcn.0068b45c
xor byte [ebx], al
mov dl, byte [ebx]
mov eax, edi
call fcn.0068b404
inc ebx
dec esi
jne 0x68b488
pop edi
pop esi
pop ebx
ret

Function at 0x68b52c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.004044cc
xor eax, eax
push ebp
push 0x68b5a1
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.0068b4a4
mov dword [ebp - 8], 0xc
lea esi, [ebp - 0x14]
mov eax, edi
call fcn.0068b45c
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, edi
call fcn.0068b404
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x68b56c
mov bl, byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x68b5a8
lea eax, [ebp - 4]
call fcn.00404088
ret
Function at 0x68c004
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x68c19f
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x68c15b
mov eax, dword [ebp - 4]
call fcn.0068d510
cmp ebx, eax
jge 0x68c15b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xdc]
mov edx, ebx
call fcn.00682284
mov edx, dword [0x683500]
call fcn.004033f0
mov esi, eax
mov eax, esi
call fcn.006841d0
test al, al
je 0x68c151
mov edi, dword [esi + 0x3c]
test edi, edi
jne 0x68c145
xor eax, eax
push ebp
push 0x68c13e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0068c514
mov edx, dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xf0]
xor ecx, ecx
mov esi, dword [eax]
call dword [esi + 0xc]
lea edx, [ebp - 0x37]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xf0]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 4]
movzx edx, word [ebp - 0x1b]
movzx eax, word [ebp - 0x19]
add edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xf0]
mov cx, 1
mov esi, dword [eax]
call dword [esi + 0xc]
movzx esi, word [ebp - 0x17]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.0040464c
mov eax, dword [ebp - 8]
call fcn.004044e8
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xf0]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x144]
mov al, byte [eax + 0x24]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0068c300
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x144]
mov dl, byte [ebp - 9]
mov byte [eax + 0x24], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x68c189
mov eax, dword [ebp - 4]
call fcn.0068c590
ret
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.0040b56c
jmp 0x68c189
mov eax, dword [ebp - 8]
call fcn.00404088
jmp 0x68c189
mov dword [ebp - 0x40], ebx
mov byte [ebp - 0x3c], 0
lea eax, [ebp - 0x40]
push eax
push 0
lea edx, [ebp - 0x44]
mov eax, 0xb3
call fcn.0040aa2c
mov ecx, dword [ebp - 0x44]
mov dl, 1
mov eax, dword [0x41203c]
call fcn.0040e2b0
call fcn.00403ab8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x68c1a6
lea eax, [ebp - 0x44]
call fcn.00404088
ret
Function at 0x68fbe4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
add esi, 0xfffffbf4
mov eax, dword [ebp + 8]
mov word [eax - 0x1a5c], 0
mov eax, dword [ebp + 8]
cmp dword [eax - 0x1a58], 0
jne 0x68fc24
mov eax, dword [ebp + 8]
mov word [eax - 0x1a5c], 1
mov eax, dword [ebp + 8]
mov dword [eax - 0x1a58], 0x10000
mov eax, 0x7fff
mov edx, dword [esi]
mov edx, dword [edx + 0xb5c]
mov word [edx + eax*2], 0
mov eax, edx
xor ecx, ecx
mov edx, 0xfffe
call fcn.004090c0
mov eax, dword [esi]
mov eax, dword [eax + 0x190]
mov ax, word [eax*8 + 0x9b2ede]
mov edx, dword [ebp + 8]
mov word [edx - 0x1a62], ax
mov eax, dword [esi]
mov eax, dword [eax + 0x190]
mov ax, word [eax*8 + 0x9b2edc]
mov edx, dword [ebp + 8]
mov word [edx - 0x1a64], ax
mov eax, dword [esi]
mov eax, dword [eax + 0x190]
movzx eax, word [eax*8 + 0x9b2ee0]
mov edx, dword [ebp + 8]
mov dword [edx - 0x1a68], eax
mov eax, dword [esi]
mov eax, dword [eax + 0x190]
mov ax, word [eax*8 + 0x9b2ee2]
mov edx, dword [ebp + 8]
mov word [edx - 0x1a6a], ax
mov eax, dword [esi]
mov eax, dword [eax + 0x190]
cmp eax, 2
jg 0x68fcc8
mov eax, dword [esi]
mov eax, dword [eax + 0x234]
or word [eax + 8], 4
jmp 0x68fcda
cmp eax, 8
jl 0x68fcda
mov eax, dword [esi]
mov eax, dword [eax + 0x234]
or word [eax + 8], 2
mov eax, dword [ebp + 8]
mov word [eax - 0x10fe], 0
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax - 0x1104], edx
mov bx, 0x8000
mov eax, dword [ebp + 8]
lea edi, [eax - 0x420]
mov eax, dword [esi]
mov edx, dword [eax + 0xb54]
mov ecx, ebx
mov eax, dword [edi + 4]
call dword [edi]
mov edx, dword [ebp + 8]
mov word [edx - 0x1a5a], ax
mov eax, dword [ebp + 8]
cmp word [eax - 0x1a5a], 0
je 0x68fd32
mov eax, dword [ebp + 8]
cmp word [eax - 0x1a5a], 0xffff
jne 0x68fd4a
mov eax, dword [ebp + 8]
mov byte [eax - 0x1a5f], 1
mov eax, dword [ebp + 8]
mov word [eax - 0x1a5a], 0
jmp 0x68fdae
mov eax, dword [ebp + 8]
mov byte [eax - 0x1a5f], 0
mov eax, dword [ebp + 8]
cmp word [eax - 0x1a5a], 0x106
jae 0x68fd6c
mov eax, dword [ebp + 8]
push eax
call fcn.0068fa0c
pop ecx
mov eax, dword [ebp + 8]
mov word [eax - 0x1a6c], 0
xor ebx, ebx
movzx eax, bx
mov edx, dword [esi]
mov edx, dword [edx + 0xb54]
movzx eax, byte [edx + eax]
mov edx, dword [ebp + 8]
mov dx, word [edx - 0x1a6c]
shl edx, 5
xor ax, dx
and ax, 0x7fff
mov edx, dword [ebp + 8]
mov word [edx - 0x1a6c], ax
inc ebx
cmp bx, 2
jne 0x68fd7a
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x6948b4
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffed0
mov esi, edx
mov ebx, eax
cmp dword [ebx + 0x1a8], 0
je 0x6948d8
mov eax, dword [ebx + 0x1a8]
call fcn.006858a4
test al, al
jne 0x6948ee
push esp
push 0x12d
call sub.kernel32.dll_GetTempPathA
mov edx, esi
mov eax, esp
call fcn.00685a30
jmp 0x6948fb
mov eax, esi
mov edx, dword [ebx + 0x1a8]
call fcn.004040dc
add esp, 0x130
pop esi
pop ebx
ret

Function at 0x694aa4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.004044cc
xor eax, eax
push ebp
push 0x694c00
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
call fcn.0069495c
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov ecx, 0x694c18
call fcn.00404364
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
call fcn.0040ab94
test al, al
je 0x694ba6
xor edx, edx
push ebp
push 0x694b9f
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xffff
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x412984]
call fcn.00416864
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00694dd0
test al, al
jne 0x694b44
mov eax, dword [ebp - 0xc]
call fcn.00403260
call fcn.00403b58
jmp 0x694bdd
mov eax, dword [ebp - 0xc]
call fcn.004165f8
mov ebx, eax
mov edx, ebx
mov eax, esi
call fcn.00694990
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.004166a0
test eax, eax
je 0x694b6f
cmp ebx, eax
jne 0x694b6f
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x694bdd
mov eax, dword [ebp - 0xc]
call fcn.00403260
mov eax, dword [ebp - 0x10]
call fcn.0040ab94
test al, al
je 0x694b9e
mov eax, dword [ebp - 0x10]
call fcn.004044dc
push eax
call sub.kernel32.dll_DeleteFileA_1
ret
push 0x10
push 0x694c2c
push dword [ebp - 4]
push 0x694c48
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.004043d8
mov eax, dword [ebp - 0x18]
call fcn.004044dc
mov edx, eax
mov ecx, 0x694c64
mov eax, dword [0x9b8724]
mov eax, dword [eax]
call fcn.0045b480
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x694c07
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.004040ac
lea eax, [ebp - 4]
call fcn.00404088
ret