joyce8/EMBER2024-capa huggingface dataset:
Function at 0x67881c80
Capabilities:
Terminate process
Terminate thread

Disassembly:
push esi
push dword [0x67b38c64]
push 0
push 1
call dword [sym.imp.kernel32.dll_OpenProcess]
mov esi, eax
push 1
push esi
call dword [sym.imp.kernel32.dll_TerminateProcess]
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [0x67b38c70]
pop esi
test eax, eax
je 0x67881cf2
cmp dword [0x67b38c68], 0
je 0x67881cf2
push 1
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
push 1
push dword [0x67b38c68]
call dword [sym.imp.kernel32.dll_TerminateThread]
mov dword [0x67b38c6c], 0
mov byte [0x67b38b65], 0
mov dword [0x67b72134], 0
mov dword [0x67b38c64], 0
ret
Function at 0x67886410
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 9], 0
je 0x67886432
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x70]
inc eax
xor byte [edx], cl
cmp eax, 8
jb 0x67886420
mov byte [esi + 9], 0
mov eax, esi
pop esi
ret

Function at 0x67886440
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xb], 0
je 0x67886462
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x70]
inc eax
xor byte [edx], cl
cmp eax, 0xa
jb 0x67886450
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret

Function at 0x67886470
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x43], 0
je 0x67886492
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6a]
inc eax
xor byte [edx], cl
cmp eax, 0x42
jb 0x67886480
mov byte [esi + 0x43], 0
mov eax, esi
pop esi
ret

Function at 0x678864a0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xf], 0
je 0x678864c2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6a]
inc eax
xor byte [edx], cl
cmp eax, 0xe
jb 0x678864b0
mov byte [esi + 0xf], 0
mov eax, esi
pop esi
ret

Function at 0x6788cb90
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x28], 0
je 0x6788cbb4
xor eax, eax
nop word [eax + eax]
lea ecx, [eax + 0x4496]
xor word [edx + eax*2], cx
inc eax
cmp eax, 0x13
jb 0x6788cba0
mov byte [edx + 0x28], 0
mov eax, edx
ret

Function at 0x6788cbf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x679362f0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x67ad7034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 0x28], 0
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], edi
je 0x6788cc37
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x6a]
inc edx
xor byte [ecx], al
cmp edx, 0x27
jb 0x6788cc25
mov byte [esi + 0x28], 0
lea ecx, [esi + 0x27]
mov dword [edi], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov dword [ebp - 4], 0xffffffff
cmp esi, ecx
je 0x6788cc66
push 0x27
push esi
mov ecx, edi
call fcn.677d7ac0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x6788f3f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x67ad7034]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x6788f4ac
cmp byte [esi + 0x3d], 0
je 0x6788f4ac
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x6788f49a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.msvcp140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x6788f461
sub eax, 1
je 0x6788f465
sub eax, 2
jne 0x6788f49a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.679343f5
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x6788f483
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x6788f49a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.679343f5
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.679343f5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.679343f5
mov esp, ebp
pop ebp
ret

Function at 0x67890720
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x67ad7034]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [0x67b6c1a8]
lea eax, [ebp - 8]
push edi
mov edi, dword [ebp + 8]
push eax
push 0x40
push 4
push edi
push dword [esi + 0x14]
mov dword [ebp - 8], 0
call dword [sym.imp.kernel32.dll_VirtualProtectEx]
mov eax, dword [esi + 8]
test eax, eax
je 0x6789076c
push 0
push 4
lea ecx, [ebp + 0xc]
push ecx
push edi
push dword [esi + 0x14]
call eax
add esp, 0x14
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
push dword [ebp - 8]
push 4
push edi
push dword [esi + 0x14]
call dword [sym.imp.kernel32.dll_VirtualProtectEx]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.679343f5
mov esp, ebp
pop ebp
ret 0xc
Function at 0x67893500
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
cmp eax, 1
jne 0x67893549
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.kernel32.dll_DisableThreadLibraryCalls]
push 0
push 0
push esi
push 0x67893c30
push 0
push 0
mov dword [0x67b38cb8], esi
call dword [sym.imp.kernel32.dll_CreateThread]
test eax, eax
je 0x67893624
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, 1
pop esi
pop ebp
ret 0xc
test eax, eax
jne 0x67893624
cmp dword [ebp + 0x10], eax
jne 0x67893624
mov eax, dword [0x67b7192c]
test eax, eax
je 0x67893574
push eax
mov eax, dword [0x67b6c82c]
push 0xfffffffffffffffc
push dword [eax + 0x38]
call dword [sym.imp.user32.dll_SetWindowLongA]
push 0x64
call dword [sym.imp.kernel32.dll_Sleep]
xor edx, edx
xor ecx, ecx
call fcn.678761c0
call fcn.67875ec0
cmp dword [0x67b38c60], 0
je 0x6789361b
xor ecx, ecx
call fcn.67875e00
test eax, eax
jne 0x6789361b
mov eax, dword [0x67b731ac]
mov dword [0x67b731ac], 0
test eax, eax
je 0x678935d3
push edi
mov edi, dword [sym.imp.kernel32.dll_VirtualFree]
nop dword [eax]
mov esi, dword [eax]
push 0x8000
push 0
push eax
call edi
mov eax, esi
test esi, esi
jne 0x678935c0
pop edi
push dword [0x67b731a0]
push 0
push dword [0x67b38c60]
call dword [sym.imp.kernel32.dll_HeapFree]
push dword [0x67b38c60]
call dword [sym.imp.kernel32.dll_HeapDestroy]
mov dword [0x67b38c60], 0
mov dword [0x67b731a0], 0
mov dword [0x67b731a4], 0
mov dword [0x67b731a8], 0
xor eax, eax
mov ecx, 0x67b38b74
xchg dword [ecx], eax
mov eax, 1
pop esi
pop ebp
ret 0xc
Function at 0x67893c00
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xa], 0
je 0x67893c22
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x70]
inc eax
xor byte [edx], cl
cmp eax, 9
jb 0x67893c10
mov byte [esi + 0xa], 0
mov eax, esi
pop esi
ret
Function at 0x67898860
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x18]
push esi
inc eax
push eax
push 0
call dword [sym.imp.kernel32.dll_GlobalAlloc]
cmp dword [ebp + 0x1c], 0x10
lea edx, [ebp + 8]
mov ecx, dword [ebp + 0x18]
mov esi, eax
cmovae edx, dword [ebp + 8]
inc ecx
push ecx
push edx
push esi
call sub.VCRUNTIME140.dll_memcpy_1
add esp, 0xc
push 0
call dword [sym.imp.user32.dll_OpenClipboard]
call dword [sym.imp.user32.dll_EmptyClipboard]
push esi
push 1
call dword [sym.imp.user32.dll_SetClipboardData]
call dword [sym.imp.user32.dll_CloseClipboard]
mov edx, dword [ebp + 0x1c]
pop esi
cmp edx, 0x10
jb 0x678988e1
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x678988d7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x678988d7
call dword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.67934867
add esp, 8
pop ebp
ret 0x18
Function at 0x678990c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
call fcn.678eb2e0
mov edi, eax
test edi, edi
jne 0x678990db
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 0xc
push ebx
push esi
push dword [ebp + 8]
push 0x2712
push edi
call fcn.678ef8a0
push edi
call fcn.678f0a50
mov ebx, eax
push ebx
call fcn.678f0690
mov esi, eax
push 0x67abc92c
push esi
call fcn.678f0ad0
push dword [ebp + 0x10]
push esi
call fcn.678f0800
push ebx
call fcn.678f0690
add esp, 0x28
mov dword [ebp - 0x10], 0xffebf0e0
mov esi, eax
mov dword [ebp - 0xc], 0xc8f2f4fb
mov dword [ebp - 8], 0xf5f5eaf2
xor ecx, ecx
mov word [ebp - 4], 0x100
lea eax, [ecx - 0x70]
xor byte [ebp + ecx - 0x10], al
inc ecx
cmp ecx, 0xc
jb 0x67899137
lea eax, [ebp - 0x10]
mov byte [ebp - 3], 0
push eax
push esi
call fcn.678f0ad0
push 0xffffffffffffffff
push dword [ebp + 0xc]
push esi
call fcn.678f0710
push 1
push 0x51
push edi
call fcn.678ef8a0
push 1
push 0x40
push edi
call fcn.678ef8a0
push ebx
push 0x281d
push edi
call fcn.678ef8a0
push 0
push 0x4e2b
push edi
call fcn.678ef8a0
add esp, 0x44
push edi
call fcn.678eb320
push edi
call fcn.678eb2c0
add esp, 8
mov al, 1
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x6789a380
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6793b940
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x67ad7034]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x40], eax
call fcn.678eb2e0
mov edi, eax
test edi, edi
jne 0x6789a3c6
xor al, al
jmp 0x6789a4e4
mov dword [ebp - 0x2c], 0
push esi
push 0x2712
push edi
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
call fcn.678ef8a0
push edi
call fcn.678f0a50
mov ebx, eax
push ebx
call fcn.678f0690
mov esi, eax
push 0x67abc92c
push esi
call fcn.678f0ad0
push 0x67abdb7c
push esi
call fcn.678f0800
push ebx
call fcn.678f0690
add esp, 0x28
mov dword [ebp - 0x3c], 0xffebf0e0
mov esi, eax
mov dword [ebp - 0x38], 0xc8f2f4fb
mov dword [ebp - 0x34], 0xf5f5eaf2
xor ecx, ecx
mov word [ebp - 0x30], 0x100
lea eax, [ecx - 0x70]
xor byte [ebp + ecx - 0x3c], al
inc ecx
cmp ecx, 0xc
jb 0x6789a435
lea eax, [ebp - 0x3c]
mov byte [ebp - 0x2f], 0
push eax
push esi
call fcn.678f0ad0
push 0xffffffffffffffff
push dword [ebp - 0x40]
push esi
call fcn.678f0710
push 1
push 0x51
push edi
call fcn.678ef8a0
push 1
push 0x40
push edi
call fcn.678ef8a0
push ebx
push 0x281d
push edi
call fcn.678ef8a0
push 0x67868e90
push 0x4e2b
push edi
call fcn.678ef8a0
add esp, 0x44
lea eax, [ebp - 0x2c]
push eax
push 0x2711
push edi
call fcn.678ef8a0
push edi
call fcn.678eb320
push edi
call fcn.678eb2c0
mov edx, dword [ebp - 0x18]
add esp, 0x14
cmp edx, 0x10
jb 0x6789a4e2
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x6789a4d8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x6789a4d8
call dword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.67934867
add esp, 8
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.679343f5
mov esp, ebp
pop ebp
ret 0xc

Function at 0x6789a510
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x7a], 0
je 0x6789a532
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x51]
inc eax
xor byte [edx], cl
cmp eax, 0x79
jb 0x6789a520
mov byte [esi + 0x7a], 0
mov eax, esi
pop esi
ret
Function at 0x6789a540
Capabilities:
Delete file
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x67ad7034]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x67abdb3c
push 4
push dword [0x67b6d578]
call fcn.67893350
add esp, 0xc
push 0x9c4
call dword [sym.imp.kernel32.dll_Sleep]
push 0x67abdb7c
call dword [sym.imp.ucrtbase.dll_remove]
mov eax, dword [0x67b6c82c]
add esp, 4
push dword [eax + 0x38]
call fcn.67899490
test eax, eax
jne 0x6789a66d
lea eax, [ebp - 0x390]
push 0x67abdb48
push eax
call fcn.678a87b0
movaps xmm0, xmmword [0x67ac56a0]
add esp, 8
movups xmmword [ebp - 0x410], xmm0
xor eax, eax
mov dword [ebp - 0x3a0], 0x4c6d6d79
movaps xmm0, xmmword [0x67ac5a20]
movups xmmword [ebp - 0x400], xmm0
mov dword [ebp - 0x39c], 0x5e76711b
movaps xmm0, xmmword [0x67ac5e00]
movups xmmword [ebp - 0x3f0], xmm0
mov word [ebp - 0x398], 0x75
movaps xmm0, xmmword [0x67ac5780]
movups xmmword [ebp - 0x3e0], xmm0
mov byte [ebp - 0x396], 1
movaps xmm0, xmmword [0x67ac5680]
movups xmmword [ebp - 0x3d0], xmm0
movaps xmm0, xmmword [0x67ac54f0]
movups xmmword [ebp - 0x3c0], xmm0
movaps xmm0, xmmword [0x67ac54e0]
movups xmmword [ebp - 0x3b0], xmm0
lea ecx, [eax - 0x51]
xor byte [ebp + eax - 0x410], cl
inc eax
cmp eax, 0x79
jb 0x6789a632
push ecx
lea eax, [ebp - 0x390]
mov byte [ebp - 0x396], 0
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.6789a380
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.679343f5
mov esp, ebp
pop ebp
ret
push eax
push 0x67abdb88
push 3
push dword [0x67b6d578]
call fcn.67893350
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
xor al, al
call fcn.679343f5
mov esp, ebp
pop ebp
ret
Function at 0x6789e910
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x67ad7034]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x67b37504]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ebx
mov dword [ebp - 8], eax
push edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x6789e933
sub esi, ecx
lea edi, [esi + 0x21]
push edi
call fcn.67934d46
push edi
mov dword [ebp - 0xc], eax
call fcn.67934d46
push edi
push 0
push dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
call sub.VCRUNTIME140.dll_memset
movups xmm0, xmmword [0x67b3751c]
mov eax, dword [ebp - 0xc]
push esi
push ebx
movups xmmword [eax], xmm0
movups xmm0, xmmword [0x67b3752c]
movups xmmword [eax + 0x10], xmm0
add eax, 0x20
push eax
call sub.VCRUNTIME140.dll_memcpy_1
mov esi, dword [0x67b6c1a8]
add esp, 0x20
mov dword [ebp - 0x18], 0
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x6789e9b8
lea eax, [ebp - 0x18]
push eax
mov eax, dword [0x67b6b48c]
push edi
push dword [ebp - 0x14]
mov eax, dword [eax + 8]
add eax, dword [ebp - 8]
push eax
push dword [esi + 0x14]
call ecx
mov esi, dword [0x67b6c1a8]
add esp, 0x14
mov eax, dword [0x67b6b48c]
mov dword [ebp - 0x10], 0
mov ebx, dword [eax + 8]
lea eax, [ebp - 0x10]
add ebx, dword [ebp - 8]
push eax
push 0x40
push edi
push ebx
push dword [esi + 0x14]
call dword [sym.imp.kernel32.dll_VirtualProtectEx]
mov eax, dword [esi + 8]
test eax, eax
je 0x6789e9f1
push 0
push edi
push dword [ebp - 0xc]
push ebx
push dword [esi + 0x14]
call eax
add esp, 0x14
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
push dword [ebp - 0x10]
push edi
push ebx
push dword [esi + 0x14]
call dword [sym.imp.kernel32.dll_VirtualProtectEx]
mov esi, dword [sym.imp.kernel32.dll_Sleep]
mov ecx, dword [0x67b6c1a8]
mov dword [ebp - 0x10], 0
mov edx, dword [ecx + 4]
test edx, edx
je 0x6789ea48
push 0
push 4
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0x67b6b48c]
mov eax, dword [eax + 0xc]
add eax, 0x148
push eax
push dword [ecx + 0x14]
call edx
add esp, 0x14
cmp dword [ebp - 0x10], 0
ja 0x6789ea51
push 0xc8
call esi
jmp 0x6789ea10
mov eax, dword [0x67b6b48c]
mov ebx, dword [0x67b6c1a8]
mov esi, dword [eax + 8]
lea eax, [ebp - 8]
add esi, dword [ebp - 8]
push eax
push 0x40
push edi
push esi
push dword [ebx + 0x14]
mov dword [ebp - 8], 0
call dword [sym.imp.kernel32.dll_VirtualProtectEx]
mov eax, dword [ebx + 8]
test eax, eax
je 0x6789ea90
push 0
push edi
push dword [ebp - 0x14]
push esi
push dword [ebx + 0x14]
call eax
add esp, 0x14
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push dword [ebp - 8]
push edi
push esi
push dword [ebx + 0x14]
call dword [sym.imp.kernel32.dll_VirtualProtectEx]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.679343f5
mov esp, ebp
pop ebp
ret 4
Function at 0x678a1550
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1a], 0
je 0x678a1572
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x51]
inc eax
xor byte [edx], cl
cmp eax, 0x19
jb 0x678a1560
mov byte [esi + 0x1a], 0
mov eax, esi
pop esi
ret

Function at 0x678a1580
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x4b], 0
je 0x678a15a2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x51]
inc eax
xor byte [edx], cl
cmp eax, 0x4a
jb 0x678a1590
mov byte [esi + 0x4b], 0
mov eax, esi
pop esi
ret

Function at 0x678a5840
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2a], 0
je 0x678a5862
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x51]
inc eax
xor byte [edx], cl
cmp eax, 0x29
jb 0x678a5850
mov byte [esi + 0x2a], 0
mov eax, esi
pop esi
ret

Function at 0x678a5870
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x24], 0
je 0x678a5892
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x51]
inc eax
xor byte [edx], cl
cmp eax, 0x23
jb 0x678a5880
mov byte [esi + 0x24], 0
mov eax, esi
pop esi
ret

Function at 0x678a58a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6793728d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x20
push esi
push edi
mov eax, dword [0x67ad7034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov esi, dword [ebx + 8]
mov dword [ebp - 0x18], ecx
cmp byte [esi + 0x30], 0
je 0x678a5903
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x51]
inc edx
xor byte [ecx], al
cmp edx, 0x2f
jb 0x678a58f1
mov byte [esi + 0x30], 0
lea eax, [esi + 0x2f]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0xf
mov byte [ebp - 0x30], 0
mov dword [ebp - 4], 0xffffffff
cmp esi, eax
je 0x678a5935
push 0x2f
push esi
lea ecx, [ebp - 0x30]
call fcn.677d7ac0
mov dword [ebp - 4], 1
cmp dword [edi + 0x14], 0x10
mov eax, dword [edi + 0x10]
jb 0x678a5947
mov edi, dword [edi]
push eax
push edi
push ecx
lea ecx, [ebp - 0x30]
call fcn.6786c690
mov esi, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov edx, dword [ebp - 0x1c]
cmp edx, 0x10
jb 0x678a59c0
mov ecx, dword [ebp - 0x30]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x678a59b6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x678a59b6
call dword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.67934867
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x678a5d10
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x71], 0
je 0x678a5d32
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x51]
inc eax
xor byte [edx], cl
cmp eax, 0x70
jb 0x678a5d20
mov byte [esi + 0x71], 0
mov eax, esi
pop esi
ret

Function at 0x678a5d40
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2d], 0
je 0x678a5d62
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x51]
inc eax
xor byte [edx], cl
cmp eax, 0x2c
jb 0x678a5d50
mov byte [esi + 0x2d], 0
mov eax, esi
pop esi
ret

Function at 0x678a8a20
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x67ad7034]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [0x67b6c1a8]
lea eax, [ebp - 8]
push edi
mov edi, dword [ebp + 8]
push eax
push 0x40
push 4
push edi
push dword [esi + 0x14]
movss dword [ebp - 0xc], xmm2
mov dword [ebp - 8], 0
call dword [sym.imp.kernel32.dll_VirtualProtectEx]
mov eax, dword [esi + 8]
test eax, eax
je 0x678a8a71
push 0
push 4
lea ecx, [ebp - 0xc]
push ecx
push edi
push dword [esi + 0x14]
call eax
add esp, 0x14
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push dword [ebp - 8]
push 4
push edi
push dword [esi + 0x14]
call dword [sym.imp.kernel32.dll_VirtualProtectEx]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.679343f5
mov esp, ebp
pop ebp
ret 8

Function at 0x678aa280
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6793c388
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x67ad7034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
lea ecx, [edi + 0x10]
mov eax, dword [esi]
mov dword [edi], eax
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
lea eax, [esi + 0x10]
push eax
call fcn.677d84b0
mov dword [ebp - 4], 0
movq xmm0, qword [esi + 0x28]
movq qword [edi + 0x28], xmm0
mov eax, dword [esi + 0x30]
mov dword [edi + 0x30], eax
movups xmm0, xmmword [esi + 0x34]
movups xmmword [edi + 0x34], xmm0
mov eax, dword [esi + 0x44]
mov dword [edi + 0x44], eax
add edi, 0x48
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov eax, dword [esi + 0x48]
mov ecx, dword [esi + 0x4c]
mov dword [ebp - 0x14], eax
mov dword [ebp + 8], ecx
cmp eax, ecx
je 0x678aa35c
sub ecx, eax
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 3
mov esi, edx
shr esi, 0x1f
add esi, edx
push esi
call fcn.678aa5e0
imul ecx, esi, 0x2c
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [ebp - 0x18], edi
add ecx, eax
mov dword [edi + 8], ecx
mov byte [ebp - 4], 1
mov ecx, edi
push dword [edi]
push dword [ebp + 8]
push dword [ebp - 0x14]
call fcn.678aba00
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x678ac180
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6793c610
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x67ad7034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
mov eax, dword [edi + 8]
mov dword [ecx + 8], eax
mov eax, dword [edi + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x24], 0
movups xmm0, xmmword [edi + 0x10]
movups xmmword [ecx + 0x10], xmm0
movq xmm0, qword [edi + 0x20]
movq qword [ecx + 0x20], xmm0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0xf
mov byte [edi + 0x10], 0
movq xmm0, qword [edi + 0x28]
movq qword [ecx + 0x28], xmm0
mov eax, dword [edi + 0x30]
mov dword [ecx + 0x30], eax
movups xmm0, xmmword [edi + 0x34]
movups xmmword [ecx + 0x34], xmm0
mov eax, dword [edi + 0x44]
mov dword [ecx + 0x44], eax
mov eax, dword [ebp - 0x10]
mov esi, dword [edi + 0x50]
mov edx, dword [edi + 0x4c]
mov ecx, dword [edi + 0x48]
mov dword [edi + 0x50], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x48], 0
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], edx
mov dword [eax + 0x50], esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4