joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6eb810
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x10
push esi
mov esi, ecx
cmp eax, dword [esi + 0x28]
je 0x6eb93c
mov edx, dword [esp + 0x20]
push ebx
mov ebx, dword [esp + 0x1c]
mov cl, byte [ebx + 0x10]
sar eax, cl
mov ecx, dword [esi + 0x18]
push ebp
push edi
mov edi, dword [esi + 0x14]
imul ecx, eax
add ecx, edi
cmp eax, edx
je 0x6eb88c
mov dl, byte [ebx + 6]
xor eax, eax
cmp dl, al
mov dword [esp + 0x24], eax
jbe 0x6eb932
xor edi, edi
mov ebp, ecx
mov eax, dword [esi + 0x30]
add eax, edi
push eax
mov ecx, ebp
call fcn.006eb490
mov eax, dword [esp + 0x24]
movzx ecx, byte [ebx + 6]
inc eax
add edi, 0x10
add ebp, 6
cmp eax, ecx
mov dword [esp + 0x24], eax
jl 0x6eb857
mov edx, dword [esp + 0x28]
pop edi
pop ebp
pop ebx
mov dword [esi + 0x28], edx
pop esi
add esp, 0x10
ret 0x10
movzx edx, byte [ebx + 6]
mov eax, dword [esp + 0x30]
add eax, 2
imul eax, edx
lea ecx, [ecx + eax*2]
add eax, ecx
mov ebp, eax
xor eax, eax
cmp edx, eax
mov dword [esp + 0x2c], eax
jle 0x6eb932
xor edi, edi
mov dword [esp + 0x24], eax
mov eax, dword [esi + 0x10]
lea edx, [esp + 0x10]
push edx
add eax, dword [esp + 0x28]
push eax
mov ecx, ebp
call fcn.006eb540
fld dword [esp + 0x10]
mov ecx, dword [esi + 0x24]
fadd dword [ecx + edi]
mov edx, dword [esi + 0x30]
add ebp, 3
add edi, 0x10
fstp dword [edi + edx - 0x10]
mov eax, dword [esi + 0x24]
fld dword [esp + 0x14]
mov ecx, dword [esi + 0x30]
fadd dword [eax + edi - 0xc]
fstp dword [edi + ecx - 0xc]
mov edx, dword [esi + 0x24]
fld dword [esp + 0x18]
mov eax, dword [esi + 0x30]
fadd dword [edx + edi - 8]
fstp dword [edi + eax - 8]
mov ecx, dword [esi + 0x24]
fld dword [esp + 0x1c]
mov edx, dword [esi + 0x30]
fadd dword [ecx + edi - 4]
mov eax, dword [esp + 0x2c]
inc eax
mov dword [esp + 0x2c], eax
fstp dword [edi + edx - 4]
mov edx, dword [esp + 0x24]
movzx ecx, byte [ebx + 6]
add edx, 0x20
cmp eax, ecx
mov dword [esp + 0x24], edx
jl 0x6eb8b5
mov edx, dword [esp + 0x28]
pop edi
pop ebp
mov dword [esi + 0x28], edx
pop ebx
pop esi
add esp, 0x10
ret 0x10
Function at 0x6eb817
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x10
push esi
mov esi, ecx
cmp eax, dword [esi + 0x28]
je 0x6eb93c
mov edx, dword [esp + 0x20]
push ebx
mov ebx, dword [esp + 0x1c]
mov cl, byte [ebx + 0x10]
sar eax, cl
mov ecx, dword [esi + 0x18]
push ebp
push edi
mov edi, dword [esi + 0x14]
imul ecx, eax
add ecx, edi
cmp eax, edx
je 0x6eb88c
mov dl, byte [ebx + 6]
xor eax, eax
cmp dl, al
mov dword [esp + 0x24], eax
jbe 0x6eb932
xor edi, edi
mov ebp, ecx
mov eax, dword [esi + 0x30]
add eax, edi
push eax
mov ecx, ebp
call fcn.006eb490
mov eax, dword [esp + 0x24]
movzx ecx, byte [ebx + 6]
inc eax
add edi, 0x10
add ebp, 6
cmp eax, ecx
mov dword [esp + 0x24], eax
jl 0x6eb857
mov edx, dword [esp + 0x28]
pop edi
pop ebp
pop ebx
mov dword [esi + 0x28], edx
pop esi
add esp, 0x10
ret 0x10
movzx edx, byte [ebx + 6]
mov eax, dword [esp + 0x30]
add eax, 2
imul eax, edx
lea ecx, [ecx + eax*2]
add eax, ecx
mov ebp, eax
xor eax, eax
cmp edx, eax
mov dword [esp + 0x2c], eax
jle 0x6eb932
xor edi, edi
mov dword [esp + 0x24], eax
mov eax, dword [esi + 0x10]
lea edx, [esp + 0x10]
push edx
add eax, dword [esp + 0x28]
push eax
mov ecx, ebp
call fcn.006eb540
fld dword [esp + 0x10]
mov ecx, dword [esi + 0x24]
fadd dword [ecx + edi]
mov edx, dword [esi + 0x30]
add ebp, 3
add edi, 0x10
fstp dword [edi + edx - 0x10]
mov eax, dword [esi + 0x24]
fld dword [esp + 0x14]
mov ecx, dword [esi + 0x30]
fadd dword [eax + edi - 0xc]
fstp dword [edi + ecx - 0xc]
mov edx, dword [esi + 0x24]
fld dword [esp + 0x18]
mov eax, dword [esi + 0x30]
fadd dword [edx + edi - 8]
fstp dword [edi + eax - 8]
mov ecx, dword [esi + 0x24]
fld dword [esp + 0x1c]
mov edx, dword [esi + 0x30]
fadd dword [ecx + edi - 4]
mov eax, dword [esp + 0x2c]
inc eax
mov dword [esp + 0x2c], eax
fstp dword [edi + edx - 4]
mov edx, dword [esp + 0x24]
movzx ecx, byte [ebx + 6]
add edx, 0x20
cmp eax, ecx
mov dword [esp + 0x24], edx
jl 0x6eb8b5
mov edx, dword [esp + 0x28]
pop edi
pop ebp
mov dword [esi + 0x28], edx
pop ebx
pop esi
add esp, 0x10
ret 0x10
Function at 0x6eb950
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [esp + 4], ecx
mov ecx, dword [eax + 0xc]
movzx eax, byte [eax + 6]
mov dword [esp], ecx
lea ecx, [edx + 2]
imul ecx, eax
push ebp
push esi
mov esi, dword [esp + 0x24]
lea esi, [esi + ecx*2]
add ecx, esi
mov ebp, ecx
mov ecx, dword [esp + 0x30]
cmp edx, ecx
jge 0x6eba1e
sub ecx, edx
push ebx
mov dword [esp + 0x30], ecx
push edi
xor edi, edi
test eax, eax
jle 0x6eba12
mov esi, dword [esp + 0x3c]
xor ebx, ebx
add esi, 8
mov edx, dword [esp + 0x10]
movzx eax, byte [edi + edx]
mov ecx, eax
and ecx, 0x1f
mov edx, 1
shl edx, cl
mov ecx, dword [esp + 0x40]
sar eax, 5
test dword [ecx + eax*4], edx
je 0x6eb9fc
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x10]
lea edx, [esp + 0x18]
add ecx, ebx
push edx
push ecx
mov ecx, ebp
call fcn.006eb540
fld dword [esp + 0x18]
fadd dword [esi - 8]
fstp dword [esi - 8]
fld dword [esp + 0x1c]
fadd dword [esi - 4]
fstp dword [esi - 4]
fld dword [esp + 0x20]
fadd dword [esi]
fstp dword [esi]
fld dword [esp + 0x24]
fadd dword [esi + 4]
fstp dword [esi + 4]
mov edx, dword [esp + 0x30]
movzx eax, byte [edx + 6]
add ebp, 3
inc edi
add ebx, 0x20
add esi, 0x10
cmp edi, eax
jl 0x6eb9a0
dec dword [esp + 0x34]
jne 0x6eb991
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x18
ret 0x18

Function at 0x6eba30
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x18
mov edx, dword [esp + 0x20]
mov eax, dword [edx + 0xc]
push ebp
push esi
movzx esi, byte [edx + 6]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 8], eax
lea eax, [ecx + 2]
imul eax, esi
mov esi, dword [esp + 0x24]
lea esi, [esi + eax*2]
lea ebp, [eax + esi - 3]
lea eax, [ecx - 1]
mov ecx, dword [esp + 0x30]
cmp eax, ecx
jl 0x6ebb0c
sub eax, ecx
inc eax
push ebx
mov dword [esp + 0x30], eax
push edi
movzx edi, byte [edx + 6]
dec edi
js 0x6ebb00
mov edx, dword [esp + 0x3c]
mov ebx, edi
mov ecx, edi
shl ebx, 5
shl ecx, 4
lea esi, [ecx + edx + 8]
mov eax, dword [esp + 0x10]
movzx eax, byte [edi + eax]
mov ecx, eax
and ecx, 0x1f
mov edx, 1
shl edx, cl
mov ecx, dword [esp + 0x40]
sar eax, 5
test dword [ecx + eax*4], edx
je 0x6ebaee
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x10]
lea edx, [esp + 0x18]
add ecx, ebx
push edx
push ecx
mov ecx, ebp
call fcn.006eb540
fld dword [esi - 8]
fsub dword [esp + 0x18]
fstp dword [esi - 8]
fld dword [esi - 4]
fsub dword [esp + 0x1c]
fstp dword [esi - 4]
fld dword [esi]
fsub dword [esp + 0x20]
fstp dword [esi]
fld dword [esi + 4]
fsub dword [esp + 0x24]
fstp dword [esi + 4]
sub ebp, 3
dec edi
sub ebx, 0x20
sub esi, 0x10
test edi, edi
jge 0x6eba92
mov edx, dword [esp + 0x30]
dec dword [esp + 0x34]
jne 0x6eba75
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x18
ret 0x18
Function at 0x6f55b9
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp eax, 0xffffffff
push esi
jne 0x6f55cf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov esi, eax
jmp 0x6f55d2
mov esi, dword [eax + 4]
test esi, esi
je 0x6f55df
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebp
ret

Function at 0x6f57a0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [ebp + 8], edi
jne 0x6f57b5
lea esi, [ebp - 0x18]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
lea eax, [esi + 8]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push 0x6f5524
push dword [ebp + 0x18]
mov dword [ebp - 0xc], edi
push edi
call fcn.0075f3eb
add esp, 0x18
cmp eax, edi
mov dword [esi + 4], eax
je 0x6f581d
push dword [ebp + 0x1c]
push esi
call fcn.006f56c8
pop ecx
pop ecx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x6f5806
push 1
push 1
call dword [sym.imp.KERNEL32.dll_SleepEx]
cmp dword [ebp - 0xc], edi
je 0x6f57fc
cmp dword [ebp + 8], edi
jne 0x6f5819
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x6f581f
xor al, al
pop edi
pop esi
leave
ret

Function at 0x6f58ad
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
fld dword [0x8ad42c]
push edi
fadd dword [0x8ad428]
push ecx
fst dword [ebp - 4]
fstp dword [esp]
call fcn.006f5823
fld dword [ebp - 4]
fsub st(1)
pop ecx
fstp dword [0x8ad42c]
call fcn.0075bc00
add dword [0x8ad41c], eax
xor edi, edi
cmp dword [0x8ad414], edi
je 0x6f5951
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov ecx, eax
mov eax, dword [0x8ad41c]
sub eax, ecx
dec eax
cmp eax, 1
jge 0x6f591b
cmp eax, 0xfffffc18
jge 0x6f5918
call esi
inc eax
inc dword [0x8ad43c]
mov dword [0x8ad41c], eax
xor eax, eax
inc eax
push edi
push edi
push fcn.006f58ad
push dword [0x8ad418]
push eax
call dword [sym.imp.WINMM.dll_timeSetEvent]
cmp eax, edi
mov dword [0x8ad420], eax
pop esi
jne 0x6f5951
push dword [0x8ad418]
mov dword [0x8ad4a4], edi
mov dword [0x8ad414], edi
call dword [sym.imp.WINMM.dll_timeEndPeriod]
cmp dword [0x8ad424], edi
je 0x6f596c
cmp dword [0x8ad438], edi
jne 0x6f596c
push 0x8ad430
call fcn.006f606c
pop ecx
call fcn.006f62ee
pop edi
leave
ret 0x14
Function at 0x6f59f1
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x8ad440], ebx
push esi
push edi
mov dword [ebp - 8], 5
jne 0x6f5a21
push 8
pop ecx
xor eax, eax
mov edi, 0x8ad484
mov dword [0x8ad440], 1
rep stosd dword es:[edi], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call fcn.006f5976
mov edi, dword [ebp + 8]
cmp edi, ebx
jne 0x6f5a3d
mov dword [ebp + 8], 0x64
mov edi, dword [ebp + 8]
cmp edi, 1
jl 0x6f5a4a
cmp edi, 0x2710
jle 0x6f5a54
mov dword [ebp + 8], 0x64
mov edi, dword [ebp + 8]
fild dword [ebp + 8]
push 8
lea eax, [ebp - 0x10]
push eax
fdivr dword [0x784550]
mov dword [0x8ad4a8], ebx
fstp dword [0x8ad428]
fldz
fstp dword [0x8ad42c]
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x6f5b70
fld1
inc eax
fcomp dword [0x8ad428]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [0x8ad418], eax
fnstsw ax
test ah, 0x41
je 0x6f5b70
push 2
push ebx
push ebx
push ebx
push 0x6f5837
push ebx
call fcn.006f57a0
add esp, 0x18
test al, al
je 0x6f5b70
push dword [0x8ad418]
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
test eax, eax
jne 0x6f5b80
push fcn.006f5976
call fcn.006f6321
cmp edi, ebx
pop ecx
mov dword [0x8ad4a4], edi
mov dword [0x8ad414], edi
je 0x6f5b1d
cmp dword [0x8ad420], ebx
jne 0x6f5b1d
mov edi, dword [0x8ad438]
mov dword [0x8ad438], 1
call esi
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [0x8ad41c], eax
call fcn.006f58ad
mov dword [0x8ad438], edi
call fcn.006f5482
mov dword [ebp - 4], eax
call esi
mov edi, eax
mov eax, dword [0x8ad4a4]
lea eax, [eax + eax*4]
add edi, eax
jmp 0x6f5b47
call fcn.006f5482
cmp dword [ebp - 4], eax
jne 0x6f5b4d
push 1
call fcn.006f55e9
pop ecx
call esi
cmp eax, edi
jl 0x6f5b35
call fcn.006f5482
cmp dword [ebp - 4], eax
jne 0x6f5b5c
call fcn.006f5976
mov eax, dword [0x8ad4a4]
cmp eax, ebx
jne 0x6f5b9c
dec dword [ebp - 8]
jne 0x6f5a27
jmp 0x6f5b9c
mov dword [0x8ad4a4], ebx
mov dword [0x8ad414], ebx
xor eax, eax
jmp 0x6f5b9c
push 0x8ad430
mov dword [0x8ad4a4], ebx
mov dword [0x8ad414], ebx
call fcn.006f606c
mov eax, dword [0x8ad4a4]
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x6f5ba1
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 8], 0
push esi
push 4
pop esi
lea eax, [ebp - 4]
push eax
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x6f5bf2
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.MHz
push dword [ebp - 4]
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
pop esi
leave
ret
Function at 0x6f5d47
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
push 0x38
push 0x8ad448
call fcn.006fad4d
pop ecx
pop ecx
call fcn.006f5cee
test eax, eax
je 0x6f5f18
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x2c]
and dword [ebp - 0xc], 0
mov dword [0x8ad454], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, 0
cpuid
mov esi, dword [ebp - 4]
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], edx
mov dword [esi + 0xc], ecx
mov eax, dword [ebp - 0x1c]
test eax, eax
lea esi, [ebp - 0x18]
mov edi, 0x8ad45c
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 8], eax
mov byte [0x8ad468], 0
jle 0x6f5f31
push 0xd
mov eax, 0x8ad45c
pop edx
mov edi, str.GenuineIntel
mov esi, eax
mov ecx, edx
xor ebx, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x6f5ddc
or byte [0x8ad45b], 1
jmp 0x6f5e22
mov edi, str.AuthenticAMD
mov esi, eax
mov ecx, edx
xor ebx, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x6f5df4
or byte [0x8ad45b], 2
jmp 0x6f5e22
mov edi, str.CyrixInstead
mov esi, eax
mov ecx, edx
xor ebx, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x6f5e0c
or byte [0x8ad45b], 4
jmp 0x6f5e22
mov esi, eax
mov edi, str.CentaurHauls
mov ecx, edx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x6f5e22
or byte [0x8ad45b], 8
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, 1
cpuid
mov esi, dword [ebp - 4]
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], edx
mov dword [esi + 0xc], ecx
mov eax, dword [ebp - 0x1c]
mov ecx, eax
sar ecx, 8
and cl, 0xf
mov byte [0x8ad458], cl
mov ecx, eax
and al, 0xf
sar ecx, 4
mov byte [0x8ad45a], al
and cl, 0xf
lea eax, [ebp - 0x1c]
mov byte [0x8ad459], cl
mov dword [ebp - 4], eax
mov eax, connect
cpuid
mov esi, dword [ebp - 4]
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], edx
mov dword [esi + 0xc], ecx
mov edi, 0x2000000
test dword [0x8ad458], edi
je 0x6f5ebd
cmp dword [ebp - 0x1c], 0x80000000
jbe 0x6f5ebd
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, reloc.WS2_32.dll_accept
cpuid
mov esi, dword [ebp - 4]
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], edx
mov dword [esi + 0xc], ecx
mov eax, dword [ebp - 0x14]
and eax, 0x80400000
or dword [0x8ad450], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, 1
cpuid
mov esi, dword [ebp - 4]
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], edx
mov dword [esi + 0xc], ecx
mov eax, dword [ebp - 0x14]
and eax, 0x6000000
or dword [0x8ad450], eax
test dword [0x8ad450], edi
je 0x6f5ef5
or byte [0x8ad452], 0x40
cmp dword [ebp - 8], 2
jl 0x6f5f31
lea eax, [ebp - 0x1c]
mov dword [ebp - 8], eax
mov eax, 2
cpuid
mov esi, dword [ebp - 8]
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], edx
mov dword [esi + 0xc], ecx
jmp 0x6f5f31
call fcn.006f5d25
shl eax, 0x1a
xor eax, dword [0x8ad458]
and eax, 0x4000000
xor dword [0x8ad458], eax
and dword [ebp - 4], 0
fnstcw word [ebp - 4]
movzx eax, word [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x6f7a49
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
push edi
jne 0x6f7a8d
call fcn.006f6af0
mov ecx, dword [0x813aa4]
lea esi, [ebp - 0xc]
push esi
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], str.File_System
mov dword [ebp - 4], ebx
mov edx, dword [ecx]
push eax
mov dword [ebp + 0xc], eax
call dword [edx]
mov dword [0x8ad614], eax
mov esi, eax
push dword [ebp + 0xc]
push esi
call fcn.006fad4d
cmp esi, ebx
pop ecx
pop ecx
je 0x6f7aa5
mov ecx, esi
call fcn.006f7de2
jmp 0x6f7aa7
xor eax, eax
lea ecx, [eax + 0x9c]
mov dword [eax + 0x88], ecx
mov edx, dword [0x813ab0]
lea ecx, [ecx + edx*4]
mov dword [eax + 0x8c], ecx
mov edx, dword [0x813ab4]
lea ecx, [ecx + edx + 7]
and ecx, 0xfffffff8
mov dword [eax + 0x90], ecx
mov edx, dword [0x813aac]
shl edx, 6
lea ecx, [edx + ecx + 7]
and ecx, 0xfffffff8
mov dword [eax + 0x94], ecx
mov edx, dword [0x813aa8]
shl edx, 5
add edx, ecx
lea ecx, [eax + 0xc]
mov dword [0x8ad610], eax
mov dword [eax + 0x98], edx
call fcn.006f5327
mov ecx, dword [0x8ad610]
add ecx, 0x34
call fcn.006f5327
cmp dword [0x813aac], 0
mov esi, dword [0x8ad610]
mov edi, dword [esi + 0x90]
jle 0x6f7b40
push edi
mov ecx, esi
call fcn.006f7cb5
inc ebx
add edi, 0x40
cmp ebx, dword [0x813aac]
jl 0x6f7b2c
mov edi, dword [esi + 0x94]
xor ebx, ebx
cmp dword [0x813aa8], ebx
jle 0x6f7b65
push edi
lea ecx, [esi + 0x28]
call fcn.006f6895
inc ebx
add edi, 0x20
cmp ebx, dword [0x813aa8]
jl 0x6f7b50
mov edi, dword [esi + 0x98]
xor ebx, ebx
cmp dword [0x813ab8], ebx
jle 0x6f7b8d
push edi
lea ecx, [esi + 0x70]
call fcn.006f6895
inc ebx
add edi, 0x84
cmp ebx, dword [0x813ab8]
jl 0x6f7b75
lea ecx, [esi + 0x54]
mov dword [esi + 0x50], 1
call fcn.006f5327
call fcn.006fac3f
push 0x8ad618
mov edi, eax
call fcn.006f7007
xor esi, esi
test edi, edi
pop ecx
jle 0x6f7bc6
push dword [esi*4 + 0x8ad6a8]
call fcn.006f7007
inc esi
cmp esi, edi
pop ecx
jl 0x6f7bb4
lea eax, [ebp - 0x20c]
push eax
push 0x200
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x20c]
push eax
call fcn.006f6b53
mov eax, dword [0x8ad610]
mov eax, dword [eax + 0x88]
push dword [eax]
call fcn.006f767d
mov esi, eax
call fcn.006f7129
push 0x6f7856
call fcn.006f6321
add esp, 0xc
pop edi
pop esi
mov byte [0x8ad62c], 1
mov al, 1
pop ebx
leave
ret
Function at 0x6f9585
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [0x813ac8]
mov eax, esi
add eax, 3
push edi
and eax, 0xfffffffc
xor edi, edi
call fcn.0075c1f0
mov eax, esi
add eax, 3
and eax, 0xfffffffc
mov dword [ebp - 0x14], esp
call fcn.0075c1f0
mov dword [ebp - 0x10], esp
push 1
push edi
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
push dword [ebp + 0x10]
mov ebx, eax
push dword [0x813ac8]
push dword [ebp - 0x14]
push ebx
push dword [ebp + 8]
call fcn.006f755d
mov dword [ebp - 0x1c], eax
mov eax, dword [0x813ac8]
add esp, 0x18
push 0
push dword [ebp + 0x10]
mov esi, edi
push eax
xor esi, 1
push dword [ebp + esi*4 - 0x14]
add eax, ebx
push eax
push dword [ebp + 8]
call fcn.006f755d
mov dword [ebp + esi*4 - 0x1c], eax
push dword [ebp + edi*4 - 0x1c]
call fcn.006f737e
push dword [ebp + edi*4 - 0x1c]
call fcn.006f741d
add esp, 0x20
push 0
lea ecx, [ebp - 0xc]
push ecx
mov dword [ebp - 4], eax
push dword [ebp - 4]
mov eax, dword [ebp + edi*4 - 0x14]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x6f9672
mov edi, dword [ebp + 0x14]
xor eax, eax
mov ax, word [edi]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.006faeef
add ebx, dword [ebp - 4]
mov word [edi], ax
mov eax, dword [0x813ac8]
add esp, 0xc
cmp dword [ebp - 4], eax
mov edi, esi
jne 0x6f9678
cmp byte [0x8ad660], 0
je 0x6f95e6
jmp 0x6f9678
or ebx, 0xffffffff
xor edi, 1
push dword [ebp + edi*4 - 0x1c]
call fcn.006f748a
pop ecx
mov eax, ebx
lea esp, [ebp - 0x28]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x6f9d42
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov ecx, dword [ebp + 8]
mov byte [ebp - 1], 0
call fcn.006f97f3
test al, al
je 0x6f9d5f
mov al, 1
leave
ret
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
jne 0x6f9d7e
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.006f9900
pop ecx
pop ecx
mov byte [ebp - 1], al
jmp 0x6f9ef9
push dword [0x813ad0]
call fcn.006f7738
mov esi, eax
mov eax, dword [0x8ad67c]
cmp eax, ebx
pop ecx
mov edi, edx
je 0x6f9da2
mov ebx, dword [eax + 0x10]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x14], eax
jmp 0x6f9da6
and dword [ebp - 0x14], 0
mov eax, dword [ebp + 0x10]
cdq
mov ecx, eax
mov dword [ebp - 0xc], ecx
add ecx, ebx
mov eax, edx
adc eax, dword [ebp - 0x14]
mov dword [ebp - 8], edx
cmp eax, dword [0x813adc]
jg 0x6f9efe
jl 0x6f9dd3
cmp ecx, dword [0x813ad8]
jae 0x6f9efe
sub esi, dword [ebp - 0xc]
sbb edi, edx
cmp edi, dword [0x813ae4]
jg 0x6f9efe
jl 0x6f9df2
cmp esi, dword [0x813ae0]
ja 0x6f9efe
mov eax, dword [0x813ad0]
lea edx, [ebp - 0x11c]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x6f9dff
mov eax, dword [ebp + 8]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x6f9e0e
lea edi, [ebp - 0x11c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x6f9e1e
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x11c]
rep movsb byte es:[edi], byte [esi]
call fcn.006f9460
xor edi, edi
push edi
push 0x80
push 2
push edi
push edi
push 0x40000000
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x6f9ef9
push dword [ebp + 8]
call fcn.006f968c
pop ecx
push edi
mov edi, dword [ebp + 0x10]
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
push edi
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x10], edi
jne 0x6f9eec
mov esi, 0x8ad680
mov ecx, esi
call fcn.006f533d
mov eax, dword [0x8ad67c]
mov edx, dword [eax + 0x10]
add edx, dword [ebp - 0xc]
mov ecx, dword [eax + 0x14]
adc ecx, dword [ebp - 8]
cmp ecx, dword [0x813adc]
jg 0x6f9ed6
jl 0x6f9ec3
cmp edx, dword [0x813ad8]
jae 0x6f9ed6
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], ecx
mov byte [ebx + 0x104], 1
mov byte [ebp - 1], 1
jmp 0x6f9ee3
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, esi
call fcn.006f5348
jmp 0x6f9ef9
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov al, byte [ebp - 1]
jmp 0x6f9f00
xor al, al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x6fae97
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
cmp esi, 4
jge 0x6faea7
xor eax, eax
jmp 0x6faeec
mov ecx, dword [ebp + 8]
movzx eax, byte [ecx]
shl eax, 0x18
inc ecx
movzx edx, byte [ecx]
shl edx, 0x10
or eax, edx
xor edx, edx
inc ecx
mov dh, byte [ecx]
sub esi, 4
or eax, edx
inc ecx
movzx edx, byte [ecx]
or eax, edx
inc ecx
test esi, esi
not eax
jle 0x6faeea
push edi
movzx edi, byte [ecx]
mov edx, eax
shl eax, 8
shr edx, 0x18
or eax, edi
xor eax, dword [edx*4 + 0x813b70]
inc ecx
dec esi
jne 0x6faed1
pop edi
not eax
pop esi
pop ebp
ret

Function at 0x6faeef
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov ebx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
movzx eax, word [esp + 0x14]
xor edx, edx
xor esi, esi
dec ecx
jns 0x6faf0f
jmp 0x6faf23
xor eax, esi
mov dl, byte [ebx]
xor dl, al
inc ebx
shr eax, 8
dec ecx
mov esi, dword [edx*4 + 0x813f70]
jns 0x6faf0f
xor eax, esi
pop esi
pop ebx
ret

Function at 0x6fdebd
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
cmp esi, 4
jge 0x6fdecd
xor eax, eax
jmp 0x6fdf12
mov ecx, dword [ebp + 8]
movzx eax, byte [ecx]
shl eax, 0x18
inc ecx
movzx edx, byte [ecx]
shl edx, 0x10
or eax, edx
xor edx, edx
inc ecx
mov dh, byte [ecx]
sub esi, 4
or eax, edx
inc ecx
movzx edx, byte [ecx]
or eax, edx
inc ecx
test esi, esi
not eax
jle 0x6fdf10
push edi
movzx edi, byte [ecx]
mov edx, eax
shl eax, 8
shr edx, 0x18
or eax, edi
xor eax, dword [edx*4 + 0x8145e0]
inc ecx
dec esi
jne 0x6fdef7
pop edi
not eax
pop esi
pop ebp
ret