joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a9310
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x52d5e6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x98
mov eax, dword [0x79b478]
push ebx
push ebp
push esi
mov esi, ecx
mov dword [esp + 0xc], eax
lea ecx, [esp + 0xc]
xor ebx, ebx
push ecx
mov ecx, esi
mov dword [esp + 0xb0], ebx
call fcn.0051b8d4
mov edx, dword [0x79b478]
mov dword [esp + 0x3c], edx
cmp esi, ebx
mov byte [esp + 0xac], 1
jne 0x4a936a
mov dword [esp + 0x1c], ebx
jmp 0x4a9371
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x1c], eax
push edi
mov ecx, esi
call fcn.0051da22
mov ecx, dword [esi + 0x3c]
mov edx, dword [esi + 0x40]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x10]
mov edi, 1
mov dword [esp + 0x2c], ecx
push eax
lea ecx, [esp + 0x44]
mov dword [esp + 0x2c], 0xffffff96
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], edx
call fcn.0051958a
mov eax, dword [esi + 0x54]
mov ecx, dword [esi + 0x1c]
cmp eax, ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x1c], ecx
jne 0x4a93c2
mov dword [esp + 0x14], ebx
jmp 0x4a93c9
mov edx, dword [eax + 0x1c]
mov dword [esp + 0x14], edx
cmp dword [esi + 0x44], 0xd
jne 0x4a93e4
mov eax, dword [eax + 0x3c4]
cmp eax, edi
je 0x4a93de
cmp eax, 2
jne 0x4a93e4
mov dword [esp + 0x18], edi
jmp 0x4a93e8
mov dword [esp + 0x18], ebx
mov eax, dword [esi + 0x20]
cmp eax, ebx
jne 0x4a93f6
push ecx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.0051af0a
mov edi, eax
cmp edi, ebx
jne 0x4a9406
xor eax, eax
jmp 0x4a9409
mov eax, dword [edi + 0x1c]
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
push eax
call ebx
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x4a9431
mov ecx, esi
call fcn.0051da22
mov edx, dword [edi + 0x1c]
lea ecx, [esp + 0x20]
push ecx
push eax
push 0x4e
push edx
call ebp
mov eax, dword [esp + 0x1c]
push eax
call ebx
test eax, eax
pop edi
je 0x4a944d
mov ecx, dword [esi + 0x1c]
push 0
push 0
push 0x10
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4a946c
mov esi, dword [esp + 0x10]
push esi
call ebx
test eax, eax
je 0x4a946c
push 1
push 0xd
push 0x100
push esi
call ebp
lea ecx, [esp + 0x3c]
mov byte [esp + 0xac], 0
call fcn.0051949d
lea ecx, [esp + 0xc]
mov dword [esp + 0xac], 0xffffffff
call fcn.0051949d
mov ecx, dword [esp + 0xa4]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xa4
ret
Function at 0x4b7460
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x4b7493
push esi
call fcn.004bc350
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x4b748c
mov dword [esi + 0x14], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x4b7519
mov eax, dword [esi + 0x1b8]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4b7502
mov eax, dword [esi + 8]
test eax, eax
je 0x4b74b7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b8]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x4b74fe
cmp eax, 2
je 0x4b7502
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4b74aa
cmp eax, 3
je 0x4b74dd
cmp eax, 1
jne 0x4b74aa
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x4b74aa
mov edx, dword [esi + 0x144]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x4b74aa
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.004b7550
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x4b7539
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x15
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
push esi
call fcn.004b7550
add esp, 4
pop esi
ret

Function at 0x4e81f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x4e81fb
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x4e82fe
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x762670]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x762670]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x762670]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x762670]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x762670]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x762670]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x762670]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x762670]
xor eax, edx
inc ecx
dec edi
jne 0x4e8216
pop edi
test esi, esi
je 0x4e8320
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x762670]
xor eax, edx
inc ecx
dec esi
jne 0x4e8302
pop esi
pop ebx
not eax
ret
Function at 0x51b8d4
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x51b90c
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.005198f8
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.005198d0
jmp 0x51b918
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x51d14c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x51d18e
call fcn.00523665
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x51d18e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x51d185
xor eax, eax
jmp 0x51d196
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0051d19c
pop edi
pop esi
pop ebx
ret 4

Function at 0x523b95
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x523bc3
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x523be1
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00523afb
jmp 0x523be1
mov eax, dword [esi + 0x14]
test eax, eax
je 0x523be1
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00523afb
test edi, edi
mov eax, edi
jne 0x523bcb
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x526423
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
push 1
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
call edi
test ax, ax
jge 0x52644b
or dword [esi + 0x38], 1
or dword [esi + 0x34], 2
jmp 0x52645c
push 2
call edi
test ax, ax
jge 0x52645c
or dword [esi + 0x38], 2
or dword [esi + 0x34], 1
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
push dword [eax + 0x1c]
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call fcn.0051af0a
cmp dword [esi + 0x30], ebx
jne 0x526536
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
mov ebx, 0x100
call dword [sym.imp.USER32.dll_GetCapture]
push eax
call fcn.0051af0a
cmp eax, dword [esp + 0x34]
jne 0x526536
push 1
push 0x209
push 0x200
lea eax, [esp + 0x20]
push 0
push eax
call edi
test eax, eax
jne 0x5264d2
push 1
push 0x108
push ebx
push eax
lea eax, [esp + 0x24]
push eax
call edi
test eax, eax
je 0x526517
mov eax, dword [esp + 0x18]
cmp eax, 0x202
je 0x526536
cmp eax, 0x205
je 0x526536
cmp eax, 0x201
je 0x526536
cmp eax, 0x204
je 0x526536
cmp eax, ebx
jne 0x5264fd
cmp dword [esp + 0x1c], 0x1b
je 0x526536
push dword [esp + 0x2c]
lea eax, [esi + 0x20]
push dword [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x30], eax
call ebp
sub eax, dword [esp + 0x10]
cmp eax, dword [0x7e7d54]
jbe 0x52652c
mov dword [esi + 0x30], 1
cmp dword [esi + 0x30], 0
je 0x52648f
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, dword [esi + 0x30]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0xd40058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00d401a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xd4007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd4006a
add dl, dl
jne 0xd40089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd400dc
xor eax, eax
add dl, dl
jne 0xd40096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd4017d
add dl, dl
jne 0xd400a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd400b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd400bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd400c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xd400d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xd40075
mov eax, 1
add dl, dl
jne 0xd400ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd400f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd400e1
sub eax, ebx
mov ebx, 1
jne 0xd40128
mov ecx, 1
add dl, dl
jne 0xd4010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd40119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd40105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd40075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xd4013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd4014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd40136
cmp eax, 0x7d00
jae 0xd4016d
cmp eax, 0x500
jb 0xd40168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd40075
cmp eax, 0x7f
ja 0xd40170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd40075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xd4019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xd40075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x57f7d0
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0
call fcn.00589060
add esp, 4
test eax, eax
mov dword [esi], eax
jne 0x57f7f3
push 1
call fcn.0057f770
add esp, 4
xor eax, eax
pop esi
ret
push 0x57f8b0
push eax
call fcn.00589ae0
add esp, 8
push 0x57f9f0
push 0x57f900
push dword [esi]
call fcn.00589ab0
add esp, 0xc
push 0x57faa0
push dword [esi]
call fcn.00589ad0
add esp, 8
push esi
push dword [esi]
call fcn.00589a50
add esp, 8
mov eax, 1
pop esi
ret
Function at 0x58d7d0
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
jle 0x58d8be
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ecx]
mov ebx, dword [ecx + 0x14]
mov dword [esp + 0x14], edx
mov ebp, dword [ecx + 0xc]
mov esi, dword [ecx + 8]
mov edi, dword [ecx + 4]
mov edx, dword [ecx + 0x1c]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 0
mov dword [esp], eax
mov dword [esp + 4], ebx
mov eax, dword [ecx + 0x18]
mov ebx, dword [ecx + 0x10]
mov ecx, dword [esp]
add ecx, esi
mov dword [esp], ecx
mov ecx, ebp
adc edi, ebp
shld ecx, esi, 0xd
shld esi, ebp, 0xd
mov ebp, edx
xor ecx, edi
xor esi, dword [esp]
add ebx, eax
mov dword [esp + 8], ecx
mov ecx, dword [esp + 4]
adc ecx, edx
shld ebp, eax, 0x10
shld eax, edx, 0x10
xor ebp, ecx
mov dword [esp + 0x18], ecx
mov ecx, edi
mov edi, dword [esp]
xor eax, ebx
add ecx, eax
mov edx, ebp
mov dword [esp], ecx
adc edi, ebp
shld edx, eax, 0x15
shld eax, ebp, 0x15
mov ebp, dword [esp + 8]
xor eax, ecx
xor edx, edi
add ebx, esi
mov ecx, dword [esp + 8]
mov dword [esp + 4], ebx
mov ebx, dword [esp + 0x18]
adc ebx, dword [esp + 8]
shld ebp, esi, 0x11
shld esi, ecx, 0x11
mov ecx, dword [esp + 0xc]
xor esi, dword [esp + 4]
inc ecx
xor ebp, ebx
cmp ecx, dword [esp + 0x14]
mov dword [esp + 0xc], ecx
jne 0x58d80d
mov ecx, dword [esp + 0x10]
mov dword [ecx + 8], esi
mov esi, dword [esp]
mov dword [ecx + 0xc], ebp
mov dword [ecx + 4], edi
mov dword [ecx], esi
mov dword [ecx + 0x1c], edx
mov edx, dword [esp + 4]
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], edx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x676800
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov eax, dword [0x6d6f40]
xor eax, ebp
test edx, edx
mov dword [esp + 0x20], eax
mov dword [esp + 8], edx
je 0x6768c5
mov esi, dword [esp + 8]
xor ebx, ebx
xor eax, eax
xor edi, edi
mov dword [esp + 0x10], ecx
mov ecx, 7
mov dword [esp + 0xc], esi
mov dword [esp + 4], 0
mov esi, eax
mov dword [esp + 0x14], ecx
call fcn.006768e0
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], eax
push ebx
push 8
lea eax, [esp + 0x20]
push eax
call fcn.0068d230
add esp, 0xc
mov ebx, eax
and eax, 1
xor edi, eax
call fcn.006768e0
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], eax
push ebx
push 8
lea eax, [esp + 0x20]
push eax
call fcn.0068d230
add esp, 0xc
mov ebx, eax
and eax, 1
xor eax, esi
mov esi, edi
cmp edi, eax
je 0x676848
mov ecx, dword [esp + 4]
add ecx, ecx
or ecx, edi
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x14]
test ecx, ecx
lea ecx, [ecx - 1]
jne 0x676842
mov esi, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 4]
mov byte [ecx], dl
dec esi
lea ecx, [ecx + 1]
jne 0x67682d
mov ecx, dword [esp + 0x20]
xor ecx, ebp
call fcn.0068f43b
mov eax, dword [esp + 8]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x678810
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [0x6d6f40]
mov ebx, dword [esp + 0x3c]
xor eax, esp
mov dword [esp + 0x18], eax
push dword [ebx]
call fcn.00679ac0
add esp, 4
mov edi, eax
test eax, eax
jne 0x6788c6
mov ecx, dword [ebx + 4]
mov edi, 0x16
lea eax, [ecx - 1]
cmp eax, 0x7f
ja 0x6788c6
mov eax, dword [esp + 0x38]
xor edx, edx
mov dword [esp + 4], eax
div ecx
and ecx, 3
or ecx, edx
jne 0x6788c6
imul edx, dword [ebx], 0x58
mov esi, dword [esp + 0x34]
mov ebp, dword [esp + 0x30]
mov ecx, dword [edx + 0x6e2efc]
test ecx, ecx
jne 0x6788db
cmp dword [esp + 0x38], 0
je 0x6788c4
lea eax, [ebx + 0x88]
lea ecx, [esp + 8]
mov dword [esp], eax
push eax
push ecx
push ebp
call dword [edx + 0x6e2ee4]
add esp, 0xc
mov edi, eax
test eax, eax
jne 0x6788c6
mov ecx, dword [ebx + 4]
xor eax, eax
test ecx, ecx
jle 0x6788be
mov ecx, dword [esp + eax + 8]
mov edx, dword [ebp + eax]
xor ecx, dword [ebx + eax + 8]
mov dword [ebx + eax + 8], edx
mov dword [esi + eax], ecx
add eax, 4
mov ecx, dword [ebx + 4]
cmp eax, ecx
jl 0x6788a1
sub dword [esp + 4], ecx
jne 0x6788ff
xor edi, edi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0068f43b
mov eax, edi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
lea edx, [ebx + 0x88]
add ebx, 8
push edx
push ebx
push eax
push esi
push ebp
call ecx
add esp, 0x14
mov ecx, dword [esp + 0x18]
mov esi, eax
xor ecx, esp
call fcn.0068f43b
mov eax, esi
jmp 0x6788d3
imul eax, dword [ebx], 0x58
add esi, ecx
add ebp, ecx
push dword [esp]
lea ecx, [esp + 0xc]
push ecx
push ebp
call dword [eax + 0x6e2ee4]
jmp 0x67888f
Function at 0x678e10
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, dword [esp + 0x30]
push dword [ebx]
call fcn.00679ac0
add esp, 4
test eax, eax
jne 0x678f73
mov ecx, dword [ebx + 4]
mov eax, 0x16
lea edx, [ecx - 1]
cmp edx, 0x7f
ja 0x678f73
test cl, 3
jne 0x678f73
mov edx, dword [ebx + 8]
cmp edx, 0x80
ja 0x678f73
mov esi, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
cmp edx, ecx
jne 0x678ec4
cmp ecx, esi
ja 0x678ec4
imul eax, dword [ebx], 0x58
mov eax, dword [eax + 0x6e2f00]
test eax, eax
je 0x678ec4
lea edx, [ebx + 0x110]
mov dword [esp + 8], eax
mov eax, esi
mov dword [esp + 0xc], edx
mov edx, dword [ebx + 0xc]
mov dword [esp], edx
lea edx, [ebx + 0x10]
mov dword [esp + 4], edx
xor edx, edx
div ecx
push dword [esp + 0xc]
push dword [esp + 4]
push dword [esp + 0xc]
push eax
push ebp
push edi
call dword [esp + 0x20]
add esp, 0x18
test eax, eax
jne 0x678f73
mov ecx, dword [ebx + 4]
mov eax, esi
xor edx, edx
div ecx
mov esi, edx
xor eax, eax
test esi, esi
je 0x678f73
lea eax, [ebx + 0x110]
lea edx, [ebx + 0x10]
mov dword [esp + 8], eax
lea eax, [ebx + 0x90]
mov dword [esp], edx
mov dword [esp + 4], eax
mov eax, dword [ebx + 8]
cmp eax, ecx
jne 0x678f20
push ebx
call fcn.0067d370
add esp, 4
imul eax, dword [ebx], 0x58
push dword [esp + 8]
push dword [esp + 8]
push dword [esp + 8]
call dword [eax + 0x6e2ee0]
add esp, 0xc
test eax, eax
jne 0x678f73
mov dword [ebx + 8], 0
mov ecx, dword [ebx + 4]
jmp 0x678f24
test eax, eax
jne 0x678f5c
xor eax, eax
cmp esi, ecx
jb 0x678f5c
xor eax, eax
test ecx, ecx
jle 0x678f48
mov ecx, dword [ebx + eax + 0x90]
xor ecx, dword [edi + eax]
mov dword [ebp + eax], ecx
add eax, 4
mov ecx, dword [ebx + 4]
cmp eax, ecx
jl 0x678f30
add edi, ecx
add ebp, ecx
sub esi, ecx
mov dword [ebx + 8], ecx
xor eax, eax
test esi, esi
je 0x678f73
mov ecx, dword [ebx + 4]
jmp 0x678ee8
mov cl, byte [edi]
lea edx, [eax + 1]
inc edi
dec esi
mov dword [ebx + 8], edx
xor cl, byte [ebx + eax + 0x90]
mov byte [ebp], cl
inc ebp
jmp 0x678f51
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x67d540
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [esp + 0x24]
push dword [esi]
call fcn.00679ac0
add esp, 4
test eax, eax
jne 0x67d6a6
mov ecx, dword [esi + 4]
mov eax, 0x16
cmp ecx, 0x80
ja 0x67d6a6
mov edx, dword [esi + 8]
cmp edx, 0x80
jg 0x67d6a6
cmp ecx, edx
jg 0x67d6a6
mov edi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x28]
cmp edi, 0x11
jb 0x67d614
test ecx, ecx
jne 0x67d614
imul eax, dword [esi], 0x58
mov ebp, dword [eax + 0x6e2ed4]
cmp ebp, edi
jae 0x67d61c
mov eax, edi
sub eax, ebp
mov dword [esp + 4], eax
jne 0x67d5b4
xor eax, eax
jmp 0x67d612
lea eax, [esi + 0x210]
mov dword [esp], eax
lea eax, [esi + 0x8c]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], eax
test ebp, ebp
mov eax, 0
je 0x67d5e7
mov ecx, dword [ebx + eax]
xor dword [esi + eax + 0x8c], ecx
add eax, 4
cmp eax, ebp
jb 0x67d5d6
imul eax, dword [esi], 0x58
push dword [esp]
mov ecx, dword [esp + 0x10]
push ecx
push ecx
call dword [eax + 0x6e2ee0]
add esp, 0xc
test eax, eax
jne 0x67d6a6
mov eax, dword [esp + 8]
add ebx, ebp
add eax, ebp
cmp eax, dword [esp + 4]
jb 0x67d5c9
sub edi, eax
test edi, edi
je 0x67d6a4
lea eax, [esi + 0x210]
mov dword [esp + 8], eax
lea eax, [esi + 0x8c]
mov dword [esp + 4], eax
lea eax, [esi + 0xc]
mov dword [esp], eax
mov eax, dword [esi + 4]
mov ebp, dword [esi + 8]
cmp eax, ebp
jne 0x67d680
xor ecx, ecx
test eax, eax
je 0x67d658
movzx eax, byte [esi + ecx + 0x8c]
xor byte [esi + ecx + 0xc], al
inc ecx
cmp ecx, dword [esi + 8]
jb 0x67d646
imul eax, dword [esi], 0x58
push dword [esp + 8]
push dword [esp + 8]
push dword [esp + 8]
call dword [eax + 0x6e2ee0]
add esp, 0xc
test eax, eax
jne 0x67d6a6
mov dword [esi + 4], 0
xor eax, eax
mov ebp, dword [esi + 8]
sub ebp, eax
lea eax, [esi + eax + 0xc]
cmp edi, ebp
cmovb ebp, edi
push ebp
push ebx
push eax
call fcn.00687310
add esp, 0xc
mov eax, dword [esi + 4]
add ebx, ebp
add eax, ebp
sub edi, ebp
mov dword [esi + 4], eax
jne 0x67d639
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x67d6b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov esi, dword [esp + 0x10]
push dword [esi]
call fcn.00679ac0
add esp, 4
test eax, eax
jne 0x67d7a1
mov edx, dword [esi + 4]
mov eax, 0x16
cmp edx, 0x80
ja 0x67d7a1
mov ecx, dword [esi + 8]
cmp ecx, 0x80
jg 0x67d7a1
cmp edx, ecx
jg 0x67d7a1
xor eax, eax
cmp edx, ecx
jne 0x67d6fe
xor ecx, ecx
jmp 0x67d72b
lea ecx, [edx + 1]
mov dword [esi + 4], ecx
mov byte [esi + edx + 0xc], pe_nt_image_headers32
mov ecx, 1
mov edi, dword [esi + 4]
mov edx, dword [esi + 8]
jmp 0x67d727
lea edx, [edi + 1]
mov dword [esi + 4], edx
mov byte [esi + edi + 0xc], 0
mov edi, dword [esi + 4]
mov edx, dword [esi + 8]
cmp edi, edx
jl 0x67d716
test edx, edx
je 0x67d74d
shl ecx, 7
add ecx, esi
movzx edx, byte [eax + ecx + 0x10c]
xor dl, byte [esi + eax + 0x8c]
xor byte [esi + eax + 0xc], dl
inc eax
cmp eax, dword [esi + 8]
jb 0x67d734
imul eax, dword [esi], 0x58
lea ebx, [esi + 0x210]
lea ecx, [esi + 0xc]
push ebx
push ecx
push ecx
call dword [eax + 0x6e2ee0]
add esp, 0xc
test eax, eax
jne 0x67d7a1
mov edi, dword [esp + 0x18]
imul eax, dword [esi], 0x58
push ebx
call dword [eax + 0x6e2ee8]
add esp, 4
xor eax, eax
cmp dword [esi + 8], 0
mov ecx, 0
je 0x67d79f
mov edx, dword [esp + 0x14]
xor ecx, ecx
cmp ecx, dword [edi]
jae 0x67d79f
movzx ebx, byte [esi + ecx + 0xc]
mov byte [edx + ecx], bl
inc ecx
cmp ecx, dword [esi + 8]
jb 0x67d78d
mov dword [edi], ecx
pop esi
pop edi
pop ebx
ret

Function at 0x67dd60
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebp, dword [esp + 0x18]
mov eax, 0x16
cmp ebp, 4
jb 0x67de3b
mov ecx, dword [esp + 0x14]
mov eax, 0x20005
mov bl, byte [ecx]
and bl, 0x1f
cmp bl, 3
jne 0x67de3b
movzx ebx, byte [ecx + 1]
mov esi, 2
mov edx, ebx
and edx, 0x7f
test bl, bl
js 0x67dda3
mov edi, edx
jmp 0x67ddd1
mov ebx, edx
dec bl
cmp bl, 1
ja 0x67de3b
xor edi, edi
mov esi, 2
mov ebp, edx
mov ebx, edi
movzx edi, byte [ecx + esi]
inc esi
shl ebx, 8
or edi, ebx
dec ebp
jne 0x67ddb9
mov ebp, dword [esp + 0x18]
add edx, 2
mov esi, edx
test edi, edi
je 0x67de3b
lea edx, [esi + edi]
cmp edx, ebp
ja 0x67de3b
movzx eax, byte [ecx + esi]
mov ebx, dword [esp + 0x20]
lea edx, [edi*8 - 8]
and eax, 7
sub edx, eax
cmp edx, dword [ebx]
jbe 0x67ddfd
mov dword [ebx], edx
mov eax, 0x20004
jmp 0x67de3b
test edx, edx
je 0x67de33
inc esi
xor ebx, ebx
mov eax, ebx
movzx ebp, byte [ecx + esi]
mov edi, ecx
and eax, 7
mov ecx, eax
xor cl, 7
movzx ecx, cl
bt ebp, ecx
mov ecx, dword [esp + 0x1c]
setb byte [ecx + ebx]
xor ecx, ecx
cmp eax, 7
sete cl
inc ebx
add esi, ecx
mov ecx, edi
cmp ebx, edx
jne 0x67de04
mov eax, dword [esp + 0x20]
mov dword [eax], edx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret