joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6c2884f4
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [esp + 0x50]
mov eax, dword [esp + 0x54]
mov dword [esp + 0x28], eax
mov ebx, dword [esp + 0x58]
mov edx, dword [esp + 0x5c]
mov dword [esp + 0x2c], edx
mov ebp, dword [esp + 0x60]
mov dword [esp], esi
call fcn.6c28590c
test eax, eax
jne 0x6c2885f0
mov dword [esp], esi
call fcn.6c286be4
test eax, eax
jne 0x6c2885c8
mov dword [esp], esi
call fcn.6c286c54
test eax, eax
jne 0x6c288638
mov dword [esp], esi
call fcn.6c287860
test eax, eax
jne 0x6c288618
mov dword [esp], esi
call fcn.6c287534
test eax, eax
jne 0x6c2886a8
mov eax, dword [0x6c4b3344]
test eax, eax
jle 0x6c288660
xor edi, edi
jmp 0x6c288585
inc edi
cmp edi, dword [0x6c4b3344]
jge 0x6c288660
mov eax, dword [edi*4 + 0x6c4b8440]
mov dword [esp], esi
call dword [eax + 8]
test eax, eax
je 0x6c288578
mov eax, dword [edi*4 + 0x6c4b8440]
mov dword [esp + 0x60], ebp
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x5c], edx
mov dword [esp + 0x58], ebx
mov ebx, dword [esp + 0x28]
mov dword [esp + 0x54], ebx
mov dword [esp + 0x50], esi
mov eax, dword [eax + 0xc]
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
jmp eax
mov dword [esp + 0x60], ebp
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x5c], edx
mov dword [esp + 0x58], ebx
mov eax, dword [esp + 0x28]
mov dword [esp + 0x54], eax
mov dword [esp + 0x50], esi
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.6c286ad8
mov dword [esp + 0x60], ebp
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x5c], eax
mov dword [esp + 0x58], ebx
mov eax, dword [esp + 0x28]
mov dword [esp + 0x54], eax
mov dword [esp + 0x50], esi
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.6c285800
mov dword [0x6c4b3348], esi
mov dword [esp + 0x50], ebp
mov ecx, dword [esp + 0x2c]
mov edx, ebx
mov eax, dword [esp + 0x28]
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.6c287f7c
mov dword [esp + 0x60], ebp
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x5c], edx
mov dword [esp + 0x58], ebx
mov eax, dword [esp + 0x28]
mov dword [esp + 0x54], eax
mov dword [esp + 0x50], esi
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.6c286cf0
mov dword [esp], esi
call fcn.6c286dfc
test eax, eax
je 0x6c288694
mov dword [esp + 0x60], ebp
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x5c], eax
mov dword [esp + 0x58], ebx
mov eax, dword [esp + 0x28]
mov dword [esp + 0x54], eax
mov dword [esp + 0x50], esi
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.6c287400
mov dword [0x6c4b3340], str.Image_not_of_any_known_type__or_corrupt
xor eax, eax
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x10], ebp
mov edx, dword [esp + 0x2c]
mov dword [esp + 0xc], edx
mov dword [esp + 8], ebx
mov eax, dword [esp + 0x28]
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.6c2875f8
test ebp, ebp
jne 0x6c2886d2
mov edx, dword [esp + 0x2c]
mov ebp, dword [edx]
mov dword [esp + 0x50], ebp
mov ecx, dword [ebx]
mov ebx, dword [esp + 0x28]
mov edx, dword [ebx]
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.6c281a58
Function at 0x6c288e34
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
lea esi, [ecx + 2]
cmp esi, edx
jae 0x6c288e5c
movzx eax, byte [eax + ecx + 1]
shl eax, 4
movzx edx, byte [ebx + ecx + 2]
shl edx, 8
xor eax, edx
movzx edx, byte [ebx + ecx]
xor eax, edx
pop ebx
pop esi
pop edi
ret
xor eax, eax
cmp ecx, edx
jae 0x6c288e58
sub edx, ecx
je 0x6c288e58
xor esi, esi
lea edi, [ebx + ecx]
nop
movzx ebx, byte [edi + eax]
lea ecx, [eax*8]
shl ebx, cl
xor esi, ebx
inc eax
cmp edx, eax
jne 0x6c288e6c
mov eax, esi
and eax, 0xffff
pop ebx
pop esi
pop edi
ret

Function at 0x6c28adfc
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp + 4], 0x6c375533
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov ebx, eax
test eax, eax
je 0x6c28ae4c
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
mov dword [esp], ebx
call sub.msvcrt_ruby200.dll_fclose
xor eax, eax
add esp, 0x18
pop ebx
ret
mov eax, 0x4f
add esp, 0x18
pop ebx
ret
Function at 0x6c28d654
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, dword [esp + 0x14]
movzx esi, byte [ebx]
shl esi, 0x18
movzx eax, byte [ebx + 1]
shl eax, 0x10
or esi, eax
movzx eax, byte [ebx + 3]
or esi, eax
movzx eax, byte [ebx + 2]
shl eax, 8
or esi, eax
mov edi, esi
add edi, 4
je 0x6c28d6c9
mov eax, 0xffffffff
xor edx, edx
mov cl, byte [ebx + edx + 4]
xor ecx, eax
movzx ecx, cl
shr eax, 8
xor eax, dword [ecx*4 + 0x6c375800]
inc edx
cmp edi, edx
ja 0x6c28d688
not eax
mov ebp, eax
shr ebp, 0x18
mov edi, eax
shr edi, 0x10
mov ecx, eax
shr ecx, 8
lea edx, [ebx + esi + 8]
mov ebx, ebp
mov byte [edx], bl
mov ebx, edi
mov byte [edx + 1], bl
mov byte [edx + 2], cl
mov byte [edx + 3], al
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
xor ecx, ecx
xor edi, edi
xor ebp, ebp
jmp 0x6c28d6b1
Function at 0x6c28fbf0
Capabilities:
Get file attributes

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sub.KERNEL32.dll_GetFileAttributesA
push edx
inc eax
setne al
add esp, 0x1c
ret
Function at 0x6c29217c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
push edi
push esi
push ebx
mov esi, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
test esi, esi
je 0x6c29229c
mov eax, dword [esp + 0x14]
not eax
cmp ebp, 7
jbe 0x6c292277
mov ecx, ebp
mov edx, esi
nop
mov bl, byte [edx]
xor ebx, eax
mov edi, ebx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x6c3776a0]
mov bl, byte [edx + 1]
xor ebx, eax
mov edi, ebx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x6c3776a0]
mov bl, byte [edx + 2]
xor ebx, eax
mov edi, ebx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x6c3776a0]
mov bl, byte [edx + 3]
xor ebx, eax
mov edi, ebx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x6c3776a0]
mov bl, byte [edx + 4]
xor ebx, eax
mov edi, ebx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x6c3776a0]
mov bl, byte [edx + 5]
xor ebx, eax
mov edi, ebx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x6c3776a0]
mov bl, byte [edx + 6]
xor ebx, eax
mov edi, ebx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x6c3776a0]
mov bl, byte [edx + 7]
xor ebx, eax
mov edi, ebx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x6c3776a0]
add edx, 8
sub ecx, 8
cmp ecx, 7
ja 0x6c2921a4
lea edx, [ebp - 8]
shr edx, 3
lea esi, [esi + edx*8 + 8]
and ebp, 7
test ebp, ebp
jne 0x6c292284
not eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dl, byte [esi]
xor edx, eax
movzx edx, dl
shr eax, 8
xor eax, dword [edx*4 + 0x6c3776a0]
inc esi
dec ebp
jne 0x6c292284
jmp 0x6c29227b
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6c2922a4
Capabilities:
Hash data with crc32

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [eax]
mov cl, byte [esp + 8]
xor ecx, edx
movzx ecx, cl
shr edx, 8
xor edx, dword [ecx*4 + 0x6c3776a0]
mov dword [eax], edx
and edx, 0xff
add edx, dword [eax + 4]
imul edx, edx, 0x8088405
lea ecx, [edx + 1]
mov dword [eax + 4], ecx
mov edx, dword [eax + 8]
shr ecx, 0x18
xor ecx, edx
and ecx, 0xff
shr edx, 8
xor edx, dword [ecx*4 + 0x6c3776a0]
mov dword [eax + 8], edx
ret

Function at 0x6c292b0c
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov edx, dword [esp + 0x50]
mov ebx, dword [esp + 0x5c]
mov eax, dword [esp + 0x54]
imul eax, dword [esp + 0x58]
cmp byte [ebx], 0
jne 0x6c292b58
mov esi, dword [ebx + 0x1c]
mov ecx, dword [ebx + 0x18]
lea ebp, [eax + esi]
mov edi, ecx
sub edi, esi
cmp ebp, ecx
cmova eax, edi
add esi, dword [ebx + 0x14]
mov edi, edx
mov ecx, eax
rep movsb byte es:[edi], byte [esi]
add dword [ebx + 0x1c], eax
xor edx, edx
div dword [esp + 0x54]
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x10], 0
lea ecx, [esp + 0x2c]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov eax, dword [ebx + 4]
mov dword [esp], eax
call sub.KERNEL32.dll_ReadFile
sub esp, 0x14
test eax, eax
jne 0x6c292b86
mov byte [ebx + 8], 1
mov eax, dword [esp + 0x2c]
xor edx, edx
div dword [esp + 0x54]
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6c2944b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [esp + 0x40]
mov edi, dword [esp + 0x44]
test esi, esi
je 0x6c29466b
mov eax, dword [esi + 0x18]
test eax, eax
je 0x6c29466b
mov eax, dword [esi + 0x7c]
test eax, eax
je 0x6c2944e1
mov dword [esp], esi
call fcn.6c294430
lea eax, [esp + 0x1c]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x18]
mov dword [esp + 8], eax
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.6c293838
test eax, eax
jne 0x6c294664
mov dword [esp], 0x84
call sub.msvcrt.dll_malloc
mov ebx, eax
test eax, eax
je 0x6c294672
mov dword [esp], 0x4000
call sub.msvcrt.dll_malloc
mov dword [ebx], eax
mov edx, dword [esp + 0x18]
mov dword [ebx + 0x44], edx
mov edx, dword [esp + 0x1c]
mov dword [ebx + 0x48], edx
mov dword [ebx + 0x4c], 0
test eax, eax
je 0x6c294654
mov dword [ebx + 0x40], 0
mov eax, dword [esi + 0x34]
mov edx, dword [esi + 0x3c]
mov dword [ebx + 0x54], edx
mov dword [ebx + 0x50], 0
mov dword [ebx + 0x64], eax
mov edx, dword [esi]
mov dword [ebx + 0x60], edx
mov edx, dword [esi + 0xc]
mov dword [ebx + 0x68], edx
mov dword [ebx + 0x18], 0
test eax, eax
jne 0x6c294620
mov eax, dword [esi + 0x40]
mov dword [ebx + 0x58], eax
mov eax, dword [esi + 0x44]
mov dword [ebx + 0x5c], eax
mov edx, dword [esi + 0x30]
mov ecx, edx
and ecx, 1
mov al, cl
mov byte [ebx + 0x6c], cl
and edx, 8
jne 0x6c294610
movzx edx, byte [esi + 0x3f]
mov byte [ebx + 0x80], dl
shl eax, 0x1f
sar eax, 0x1f
and eax, 0xc
mov dword [ebx + 0x7c], eax
mov dword [ebx + 0x70], 0x12345678
mov dword [ebx + 0x74], 0x23456789
mov dword [ebx + 0x78], 0x34567890
test edi, edi
je 0x6c2945ec
mov al, byte [edi]
test al, al
je 0x6c2945ec
lea ebp, [ebx + 0x70]
movsx eax, al
mov dword [esp + 4], eax
mov dword [esp], ebp
call fcn.6c2922a4
inc edi
je 0x6c2945ec
mov al, byte [edi]
test al, al
jne 0x6c2945d4
mov eax, dword [esi + 0x78]
add eax, dword [esp + 0x14]
add eax, 0x1e
mov dword [ebx + 0x3c], eax
mov dword [ebx + 8], 0
mov dword [esi + 0x7c], ebx
xor eax, eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [esi + 0x38]
shr edx, 8
mov byte [ebx + 0x80], dl
jmp 0x6c2945a6
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x2c], 0
lea eax, [ebx + 4]
mov dword [esp], eax
call fcn.6c29241c
test eax, eax
jne 0x6c29457e
mov dword [ebx + 0x40], 1
jmp 0x6c29457e
mov dword [esp], ebx
call sub.msvcrt.dll_free
mov eax, 0xffffff98
jmp 0x6c294605
mov eax, 0xffffff99
jmp 0x6c294605
mov eax, 0xffffff9a
jmp 0x6c294605
mov eax, 0xffffff98
jmp 0x6c294605
Function at 0x6c294748
Capabilities:
Get common file path

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x40]
mov ebp, dword [esp + 0x44]
mov esi, dword [esp + 0x4c]
mov eax, dword [ebx]
test eax, eax
je 0x6c294770
mov eax, 0x1000000
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp dword [ebx + 4], 0xffffffff
jne 0x6c294761
lea edi, [ebx + 0x140]
mov dword [esp + 4], edi
mov dword [esp], 0x103
call sub.KERNEL32.dll_GetCurrentDirectoryA
sub esp, 8
xor eax, eax
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
mov al, byte [ebx + ecx + 0x13e]
sub ecx, 2
cmp al, 0x5c
je 0x6c2947bc
cmp al, 0x2f
je 0x6c2947bc
mov byte [ebx + ecx + 0x141], 0x2f
mov byte [ebx + ecx + 0x142], 0
cmp esi, 1
je 0x6c2947fa
lea eax, [esp + 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov eax, dword [esp + 0x48]
mov dword [esp + 4], eax
mov dword [esp], ebp
call fcn.6c2928a4
test eax, eax
je 0x6c29480f
mov dword [esp], eax
call fcn.6c293478
mov dword [ebx], eax
cmp eax, 1
sbb eax, eax
and eax, 0x200
jmp 0x6c294766
mov dword [esp], ebp
call fcn.6c28fb20
inc eax
jne 0x6c2947c1
mov eax, 0x2000000
jmp 0x6c294766
mov eax, dword [esp + 0x1c]
jmp 0x6c294766
Function at 0x6c2949e8
Capabilities:
Create directory

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x22c
mov ebp, dword [esp + 0x240]
test ebp, ebp
je 0x6c294a4e
mov dword [esp + 8], 0x104
mov dword [esp + 4], ebp
lea ebx, [esp + 0x18]
mov dword [esp], ebx
call sub.msvcrt.dll_strncpy
xor eax, eax
mov ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
cmp ecx, 1
je 0x6c294a3e
sub ecx, 2
mov al, byte [esp + ecx + 0x18]
cmp al, 0x2f
je 0x6c294b68
cmp al, 0x5c
je 0x6c294b68
mov dword [esp], ebx
call fcn.6c28fbf0
test al, al
je 0x6c294b44
mov eax, dword [esp + 0x244]
mov cl, byte [eax]
test cl, cl
je 0x6c294b39
mov edx, eax
jmp 0x6c294a71
cmp cl, 0x5c
cmove edx, eax
inc eax
mov cl, byte [eax]
test cl, cl
je 0x6c294a7f
cmp cl, 0x2f
jne 0x6c294a64
mov edx, eax
inc eax
mov cl, byte [eax]
test cl, cl
jne 0x6c294a71
cmp edx, dword [esp + 0x244]
je 0x6c294ab7
sub edx, dword [esp + 0x244]
lea eax, [esp + 0x11c]
mov edi, eax
mov esi, dword [esp + 0x244]
mov ecx, edx
rep movsb byte es:[edi], byte [esi]
mov byte [esp + edx + 0x11c], 0
mov dword [esp + 4], eax
mov dword [esp], ebp
call fcn.6c2949e8
mov byte [esp + 0x18], 0
test ebp, ebp
je 0x6c294b5c
mov dword [esp + 8], 0x104
mov dword [esp + 4], ebp
lea ebx, [esp + 0x18]
mov dword [esp], ebx
call sub.msvcrt.dll_strncpy
mov byte [esp + 0x11b], 0
xor eax, eax
mov ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov eax, 0x104
sub eax, ecx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x244]
mov dword [esp + 4], eax
add ecx, ebx
mov dword [esp], ecx
call sub.msvcrt.dll_strncpy
mov byte [esp + 0x11b], 0
mov dword [esp], ebx
call fcn.6c28fbf0
test al, al
jne 0x6c294b39
mov dword [esp + 4], 0
mov dword [esp], ebx
call sub.KERNEL32.dll_CreateDirectoryA
sub esp, 8
add esp, 0x22c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 0
mov dword [esp], ebx
call sub.KERNEL32.dll_CreateDirectoryA
sub esp, 8
jmp 0x6c294a4e
lea ebx, [esp + 0x18]
jmp 0x6c294adc
mov byte [esp + ecx + 0x18], 0
mov dword [esp], ebx
call fcn.6c28fbf0
test al, al
jne 0x6c294a4e
jmp 0x6c294b44
Function at 0x6c298f80
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
push edi
push esi
push ebx
mov esi, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
test esi, esi
je 0x6c2990a0
mov eax, dword [esp + 0x14]
not eax
cmp ebp, 7
jbe 0x6c29907b
mov ecx, ebp
mov edx, esi
nop
mov bl, byte [edx]
xor ebx, eax
mov edi, ebx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x6c378300]
mov bl, byte [edx + 1]
xor ebx, eax
mov edi, ebx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x6c378300]
mov bl, byte [edx + 2]
xor ebx, eax
mov edi, ebx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x6c378300]
mov bl, byte [edx + 3]
xor ebx, eax
mov edi, ebx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x6c378300]
mov bl, byte [edx + 4]
xor ebx, eax
mov edi, ebx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x6c378300]
mov bl, byte [edx + 5]
xor ebx, eax
mov edi, ebx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x6c378300]
mov bl, byte [edx + 6]
xor ebx, eax
mov edi, ebx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x6c378300]
mov bl, byte [edx + 7]
xor ebx, eax
mov edi, ebx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x6c378300]
add edx, 8
sub ecx, 8
cmp ecx, 7
ja 0x6c298fa8
lea edx, [ebp - 8]
shr edx, 3
lea esi, [esi + edx*8 + 8]
and ebp, 7
test ebp, ebp
jne 0x6c299088
not eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dl, byte [esi]
xor edx, eax
movzx edx, dl
shr eax, 8
xor eax, dword [edx*4 + 0x6c378300]
inc esi
dec ebp
jne 0x6c299088
jmp 0x6c29907f
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6c2990a8
Capabilities:
Hash data with crc32

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [eax]
mov cl, byte [esp + 8]
xor ecx, edx
movzx ecx, cl
shr edx, 8
xor edx, dword [ecx*4 + 0x6c378300]
mov dword [eax], edx
and edx, 0xff
add edx, dword [eax + 4]
imul edx, edx, 0x8088405
lea ecx, [edx + 1]
mov dword [eax + 4], ecx
mov edx, dword [eax + 8]
shr ecx, 0x18
xor ecx, edx
and ecx, 0xff
shr edx, 8
xor edx, dword [ecx*4 + 0x6c378300]
mov dword [eax + 8], edx
ret
Function at 0x6c299468
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [esp + 0x60]
mov esi, dword [esp + 0x64]
mov ebp, dword [esp + 0x68]
cmp byte [ebx + 0x2d], 0
je 0x6c2994e6
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x6c29949c
cmp dword [ebx + 0x40], ebp
jae 0x6c2994ae
mov dword [esp], eax
call fcn.6c2df6ec
mov dword [ebx + 0x3c], 0
lea eax, [ebp + ebp]
mov dword [esp], eax
call fcn.6c2df708
mov dword [ebx + 0x3c], eax
mov dword [ebx + 0x40], ebp
mov edi, eax
mov ecx, ebp
rep movsb byte es:[edi], byte [esi]
test ebp, ebp
je 0x6c2994e3
xor esi, esi
lea eax, [ebx + 0x30]
mov dword [esp + 0x2c], eax
lea esi, [esi]
mov edi, dword [ebx + 0x3c]
add edi, esi
movsx eax, byte [edi]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.6c299110
mov byte [edi], al
inc esi
cmp esi, ebp
jne 0x6c2994c4
mov esi, dword [ebx + 0x3c]
mov eax, dword [ebx + 0x20]
test eax, eax
je 0x6c299524
mov edx, dword [ebx + 0x24]
lea ecx, [ebp + edx]
cmp ecx, dword [ebx + 0x28]
jb 0x6c29950c
mov dword [ebx + 0x14], 0x30000
xor ebp, ebp
mov eax, ebp
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edx
mov edi, eax
mov ecx, ebp
rep movsb byte es:[edi], byte [esi]
add dword [ebx + 0x24], ebp
mov eax, ebp
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebx + 4]
test eax, eax
je 0x6c299554
mov dword [esp + 0x10], 0
lea edx, [esp + 0x3c]
mov dword [esp + 0xc], edx
mov dword [esp + 8], ebp
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
mov ebp, dword [esp + 0x3c]
jmp 0x6c299502
mov dword [ebx + 0x14], 0x1000000
xor ebp, ebp
jmp 0x6c299502

Function at 0x6c299560
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x6c29956c
xor eax, eax
ret
jmp fcn.6c299468

Function at 0x6c29996c
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [esp + 0x60]
mov edx, dword [esp + 0x64]
mov ecx, dword [esp + 0x68]
mov esi, dword [ebx + 0x78]
test esi, esi
je 0x6c2999d8
mov eax, dword [ebx + 0x80]
mov ebp, dword [ebx + 0x7c]
cmp eax, ebp
jae 0x6c2999cc
sub ebp, eax
cmp ecx, ebp
cmovbe ebp, ecx
add esi, eax
mov edi, edx
mov ecx, ebp
rep movsb byte es:[edi], byte [esi]
add dword [ebx + 0x80], ebp
add dword [ebx + 0x68], ebp
mov dword [esp + 8], ebp
mov dword [esp + 4], edx
mov eax, dword [ebx + 0x6c]
mov dword [esp], eax
call fcn.6c298f80
mov dword [ebx + 0x6c], eax
mov eax, ebp
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
xor ebp, ebp
mov eax, ebp
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebx + 0x70]
test eax, eax
je 0x6c299a14
mov dword [esp + 0x10], 0
lea esi, [esp + 0x3c]
mov dword [esp + 0xc], esi
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
mov dword [esp + 0x2c], edx
call sub.KERNEL32.dll_ReadFile
sub esp, 0x14
test eax, eax
mov edx, dword [esp + 0x2c]
je 0x6c2999cc
mov ebp, dword [esp + 0x3c]
jmp 0x6c2999a8
mov dword [ebx + 0x14], 0x1000000
xor ebp, ebp
jmp 0x6c2999c1
Function at 0x6c2c5240
Capabilities:
Encode data using xor

Disassembly:
push esi
push ebx
sub esp, 0x14
mov ebx, dword [eax + 0x1b8]
mov edx, dword [eax + 4]
mov dword [esp + 8], 0x7fc
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [edx]
lea edx, [eax + 0x3fc]
mov dword [ebx + 0x28], edx
xor ecx, ecx
xor edx, edx
mov dword [eax + edx*4 + 0x3fc], edx
mov dword [eax + ecx*4 + 0x3fc], ecx
inc edx
dec ecx
cmp edx, 0x10
jne 0x6c2c5270
lea esi, [eax + 0x3bc]
mov ecx, 0x10
mov dword [eax + edx*4 + 0x3fc], ecx
mov ebx, ecx
neg ebx
mov dword [esi], ebx
inc edx
mov ebx, edx
and ebx, 1
xor ebx, 1
add ecx, ebx
sub esi, 4
cmp edx, 0x30
jne 0x6c2c5290
lea edx, [eax + 0x4bc]
lea ebx, [eax + 0x33c]
add eax, 0x7fc
mov esi, ecx
neg esi
lea esi, [esi]
mov dword [edx], ecx
mov dword [ebx], esi
add edx, 4
sub ebx, 4
cmp edx, eax
jne 0x6c2c52c8
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x6c2c7474
Capabilities:
Query environment variable

Disassembly:
push esi
push ebx
sub esp, 0x24
mov esi, dword [esp + 0x30]
mov dword [esi + 4], 0
mov dword [esp], esi
call fcn.6c2c762c
mov dword [esp + 0x18], eax
mov dword [esp + 4], 0x54
mov dword [esp], esi
call fcn.6c2c75d0
mov ebx, eax
test eax, eax
je 0x6c2c75ac
mov dword [ebx], fcn.6c2c68bc
mov dword [ebx + 4], fcn.6c2c6fec
mov dword [ebx + 8], fcn.6c2c7190
mov dword [ebx + 0xc], fcn.6c2c70b0
mov dword [ebx + 0x10], 0x6c2c6aa4
mov dword [ebx + 0x14], 0x6c2c6a28
mov dword [ebx + 0x18], 0x6c2c7268
mov dword [ebx + 0x1c], 0x6c2c6e48
mov dword [ebx + 0x20], 0x6c2c6ca0
mov dword [ebx + 0x24], fcn.6c2c6b20
mov dword [ebx + 0x28], 0x6c2c6c4c
mov dword [ebx + 0x30], 0x3b9aca00
mov eax, dword [esp + 0x18]
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x38], 0
mov dword [ebx + 0x40], 0
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x3c], 0
mov dword [ebx + 0x44], 0
mov dword [ebx + 0x48], 0
mov dword [ebx + 0x4c], 0x54
mov dword [esi + 4], ebx
mov dword [esp], 0x6c37b2a0
call sub.msvcrt_ruby200.dll_getenv
test eax, eax
je 0x6c2c7590
mov byte [esp + 0x1f], 0x78
lea edx, [esp + 0x1f]
mov dword [esp + 0xc], edx
lea edx, [esp + 0x18]
mov dword [esp + 8], edx
mov dword [esp + 4], str._ld_c
mov dword [esp], eax
call sub.msvcrt.dll_sscanf
test eax, eax
jle 0x6c2c7590
mov al, byte [esp + 0x1f]
cmp al, 0x6d
je 0x6c2c7598
cmp al, 0x4d
je 0x6c2c7598
mov eax, dword [esp + 0x18]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
mov dword [ebx + 0x2c], eax
add esp, 0x24
pop ebx
pop esi
ret
mov eax, dword [esp + 0x18]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
jmp 0x6c2c7581
mov dword [esp], esi
call fcn.6c2c7630
mov eax, dword [esi]
mov dword [eax + 0x14], 0x38
mov dword [eax + 0x18], 0
mov eax, dword [esi]
mov dword [esp], esi
call dword [eax]
jmp 0x6c2c74aa
Function at 0x6c2d1b40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
cmp dword [edx], 0x2c
je 0x6c2d1b6c
mov ecx, dword [eax + 0x11c]
test ecx, ecx
jne 0x6c2d1b64
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.6c2ca4b4
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [edx + 4]
mov edi, dword [edx + 8]
mov ebp, dword [edx + 4]
test edi, edi
je 0x6c2d1b64
mov edx, dword [eax + 0x104]
xor ebx, ebx
lea ecx, [eax + 4]
mov dword [esp + 0x1c], ecx
mov esi, eax
jmp 0x6c2d1ba4
mov ecx, edx
inc edx
mov byte [esi + ecx + 4], al
mov dword [esi + 0x104], edx
mov byte [esi + 0x108], al
inc ebx
cmp edi, ebx
je 0x6c2d1b64
mov al, byte [ebp + ebx]
cmp edx, 0xff
jne 0x6c2d1b8c
mov byte [esi + 0x103], 0
mov edx, dword [esi + 0x110]
mov dword [esp + 8], edx
mov dword [esp + 4], 0xff
mov edx, dword [esp + 0x1c]
mov dword [esp], edx
mov byte [esp + 0x18], al
call dword [esi + 0x10c]
inc dword [esi + 0x124]
mov edx, 1
xor ecx, ecx
mov al, byte [esp + 0x18]
jmp 0x6c2d1b8f