joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6666d8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
xor eax, eax
push ebp
push 0x6667a1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 4]
mov ecx, dword [ecx]
mov eax, ecx
test eax, eax
je 0x6666ff
sub eax, 4
mov eax, dword [eax]
mov edx, eax
test edx, edx
jns 0x66670a
call fcn.004079b0
mov eax, ecx
mov ecx, edx
add ecx, ecx
add ecx, eax
cmp ecx, eax
jbe 0x666728
movzx ebx, word [eax]
xor edx, ebx
imul edx, edx, 0x1000193
add eax, 2
cmp ecx, eax
ja 0x666716
mov ebx, edx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x20]
mov edx, ebx
call fcn.0066a5d4
test al, al
je 0x666773
lea ecx, [ebp - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x20]
mov edx, ebx
call fcn.0066a234
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx]
call fcn.0040a828
jne 0x66678b
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 4]
call fcn.00409cac
jmp 0x66678b
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 4]
mov ecx, dword [ecx]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x20]
mov edx, ebx
call fcn.0066a498
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6667a8
lea eax, [ebp - 4]
call fcn.004098cc
ret
Function at 0x688aa8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x688bb3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x6e33a0]
mov dword [ebp - 0xc], eax
mov eax, dword [0x6e3398]
add eax, eax
add eax, 0x63f34f
mov dword [ebp - 0xc], eax
mov edx, 0x688bd0
mov eax, dword [ebp - 0xc]
call fcn.006889fc
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
jne 0x688b9d
mov eax, dword [ebp - 4]
call fcn.004098cc
xor eax, eax
push ebp
push 0x688b73
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffffffffffffffff
push 0xfff03e6f
push 0
push 0xfc991
call fcn.00683710
call fcn.00425204
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push 0xffffffffffffffff
push 0xffedbe6b
push 0
push 0x124995
call fcn.00683710
push eax
call sub.kernel32.dll_GetTempPathW
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.0040a4ec
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dl, 1
call fcn.00424730
test al, al
jne 0x688b69
mov eax, dword [ebp - 4]
call fcn.004e9c30
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x688b85
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0042b468
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00409cac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x688bba
lea eax, [ebp - 0x14]
call fcn.004098cc
ret
Function at 0x68ae90
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x68afd0
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [0x6e3394]
call fcn.0068ae54
mov dword [ebp - 0x14], eax
mov al, byte [0x6e3395]
call fcn.0068ae54
add dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jge 0x68af00
mov eax, dword [ebp - 0x14]
cdq
mov dword [0x6e3398], eax
mov dword [0x6e339c], edx
mov eax, dword [ebp - 0x14]
cdq
add eax, dword [0x6e33a0]
adc edx, dword [0x6e33a4]
mov dword [0x6e33a0], eax
mov dword [0x6e33a4], edx
jmp 0x68afb2
lea eax, [ebp - 0xc]
call fcn.0040e584
push eax
call sub.shell32.dll_SHGetMalloc
lea eax, [ebp - 0x10]
push eax
push 0x26
push 0
push 0x16f9d0
push 0
push 0x16f9d0
call fcn.00683710
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
mov eax, 0x104
call fcn.00406f00
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.0040a4ec
mov eax, dword [ebp - 8]
call fcn.00406f1c
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
push 0
push 0x1856bc
push 0
push 0x1856bc
call fcn.00683710
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00409dbc
cdq
cmp edx, dword [esp + 4]
jne 0x68af96
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x68afb2
jmp 0x68af9a
pop edx
pop eax
jle 0x68afb2
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0042b468
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00409cac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x68afd7
lea eax, [ebp - 0x18]
call fcn.004098cc
lea eax, [ebp - 0xc]
call fcn.0040e584
ret
Function at 0x68ee10
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004099b0
xor eax, eax
push ebp
push 0x68ef07
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x6e33a0]
mov dword [ebp - 0xc], eax
mov eax, dword [0x6e3398]
add eax, eax
add eax, 0x7abe0
mov dword [ebp - 0xc], eax
mov edx, 0x68ef20
mov eax, dword [ebp - 0xc]
call fcn.0068ed74
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x68ee8f
mov al, byte [0x6e3394]
mov byte [0x6e3395], al
mov eax, dword [ebp - 0xc]
cdq
mov dword [0x6e33a0], eax
mov dword [0x6e33a4], edx
mov eax, dword [ebp - 0xc]
inc eax
cdq
mov dword [0x6e3398], eax
mov dword [0x6e339c], edx
push 0
push 0x1d54e2
lea edx, [ebp - 8]
mov eax, 0x68ef54
call fcn.00683764
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00685fd4
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 4]
call fcn.00409cf4
cmp dword [ebp - 4], 0
je 0x68eee4
push 5
push 0x68ef98
push 0x68ef98
mov eax, dword [ebp - 4]
call fcn.0040a488
push eax
mov eax, dword [ebp - 8]
call fcn.0040a488
push eax
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x68ef0e
lea eax, [ebp - 0x14]
call fcn.004098cc
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040992c
ret
Function at 0x68f2f0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x68f535
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [0x6e3394]
mov byte [ebp - 0x29], al
mov al, byte [ebp - 0x29]
xor al, 1
mov byte [ebp - 0x29], al
lea eax, [ebp - 0x30]
call fcn.004098cc
cmp byte [0x6e3394], 0
jne 0x68f340
cmp byte [0x6e3395], 0
je 0x68f36e
cmp byte [0x6e3394], 0
je 0x68f361
cmp byte [0x6e3395], 0
je 0x68f361
lea eax, [ebp - 0x30]
mov edx, 0x68f550
call fcn.00409cf4
jmp 0x68f36e
lea eax, [ebp - 0x30]
mov edx, 0x68f59c
call fcn.0040a698
mov eax, dword [ebp - 0xc]
call fcn.004098cc
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 4]
call fcn.00409cf4
cmp dword [ebp - 0x24], 0
jne 0x68f3e3
push 0xffffffffffffffff
push 0xffed73fa
push 0
push 0x128c07
call fcn.00683710
add eax, 0x104
adc edx, 0
mov edx, eax
lea eax, [ebp - 0x24]
call fcn.0040a618
push 0
push 0x120fab
push 0
push 0x120faa
call fcn.00683710
add eax, 0x104
push eax
mov eax, dword [ebp - 0x24]
call fcn.0040a488
push eax
mov eax, dword [0x6e7634]
push eax
call sub.kernel32.dll_GetModuleFileNameW
mov edx, eax
lea eax, [ebp - 0x24]
call fcn.0040a618
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x24]
call fcn.0040a488
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x10], eax
push 0
push 0x162bc2
push 0
push 0x162bc2
call fcn.00683710
push edx
push eax
mov eax, dword [ebp - 0x10]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x68f425
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x68f517
jmp 0x68f42d
pop edx
pop eax
jle 0x68f517
mov eax, dword [ebp - 0x10]
call fcn.00406f00
mov dword [ebp - 0x28], eax
xor eax, eax
push ebp
push 0x68f4d0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 0
push 0x10c03a
push 0
push 0x10c03a
call fcn.00683710
push eax
mov eax, dword [ebp - 0x24]
call fcn.0040a488
push eax
call sub.version.dll_GetFileVersionInfoW
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x68f5b8
mov eax, dword [ebp - 0x28]
push eax
call sub.version.dll_VerQueryValueW
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 8]
call fcn.00414c2c
mov word [ebp - 0x20], ax
mov eax, dword [ebp - 0x18]
mov ax, word [eax + 8]
mov word [ebp - 0x1e], ax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
call fcn.00414c2c
mov word [ebp - 0x1c], ax
mov eax, dword [ebp - 0x18]
mov ax, word [eax + 0xc]
mov word [ebp - 0x1a], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x68f4d7
mov eax, dword [ebp - 0x28]
call fcn.00406f1c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x68f53c
lea eax, [ebp - 0x30]
call fcn.004098cc
lea eax, [ebp - 0x24]
call fcn.004098cc
ret
Function at 0x690f90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
xor edx, edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6910d5
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [0x6e3394]
mov byte [ebp - 0x11], al
jmp 0x690ffa
mov al, byte [ebp - 0x11]
xor al, 1
mov byte [ebp - 0x11], al
lea eax, [ebp - 0x18]
call fcn.004098cc
cmp byte [0x6e3394], 0
je 0x690fed
cmp byte [0x6e3395], 0
je 0x690fed
lea eax, [ebp - 0x18]
mov edx, 0x6910ec
call fcn.00409cf4
jmp 0x690ffa
lea eax, [ebp - 0x18]
mov edx, 0x69112c
call fcn.0040a698
cmp byte [ebp - 0x11], 0
jne 0x690fbc
lea eax, [ebp - 8]
call fcn.0040e584
push eax
call sub.shell32.dll_SHGetMalloc
lea eax, [ebp - 0x10]
push eax
push 2
push 0
push 0x15d1d0
push 0
push 0x15d1d0
call fcn.00683710
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
mov eax, 0x104
call fcn.00406f00
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
call fcn.0040a4ec
mov eax, dword [ebp - 0xc]
call fcn.00406f1c
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
push 0xffffffffffffffff
push 0xffeabeb5
push 0
push 0x15414b
call fcn.00683710
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00409dbc
cdq
cmp edx, dword [esp + 4]
jne 0x691096
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x6910b2
jmp 0x69109a
pop edx
pop eax
jle 0x6910b2
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0042b468
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00409cac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6910dc
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.0040992c
lea eax, [ebp - 8]
call fcn.0040e584
ret
Function at 0x6a06bc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004099b0
xor eax, eax
push ebp
push 0x6a088e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
mov edx, 0x6a08a8
call fcn.00409cf4
mov dword [ebp - 0x20], 0x8884a6
mov byte [ebp - 0x21], 0
cmp dword [0x6e33e4], 0xffffffff
jne 0x6a0718
cmp dword [0x6e33e0], 0xffff3f04
jae 0x6a0721
jmp 0x6a071a
jge 0x6a0721
mov byte [0x6e33d8], 0
mov byte [ebp - 0x21], 1
cmp byte [0x6e33d9], 0
je 0x6a0736
mov eax, dword [0x6e33e8]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jge 0x6a0776
cmp byte [ebp - 0x21], 0
je 0x6a0776
cmp byte [0x6e33d8], 0
je 0x6a0776
mov dword [ebp - 0x20], 0x5cccf9
mov eax, dword [ebp - 0x20]
mov ecx, 0x3068c0
cdq
idiv ecx
cmp edx, 0x2ef274
sete byte [0x6e33d8]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x954251
jne 0x6a0752
mov eax, dword [ebp - 0x1c]
mov edx, 0x6a08d8
call fcn.0040a828
je 0x6a07a2
cmp dword [0x6e33e4], 0xffffffff
jne 0x6a0799
cmp dword [0x6e33e0], 0xffffffff
jae 0x6a07a2
jmp 0x6a079b
jge 0x6a07a2
mov byte [0x6e33d9], 0
mov eax, dword [ebp - 8]
call fcn.004098cc
call fcn.0042fda4
lea ecx, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.0042f518
push 0
push 0x1b8917
push 0
push 0x1b8906
call fcn.00683710
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
call fcn.0040c764
test eax, eax
jl 0x6a07fb
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
mov cl, byte [ebp - 0x14]
xor byte [eax + edx], cl
inc dword [ebp - 0x18]
dec dword [ebp - 0x28]
jne 0x6a07e7
push 0xffffffffffffffff
push 0xffed24d4
push 0
push 0x12db2b
call fcn.00683710
mov ecx, eax
mov dl, 1
mov eax, dword [0x60fc00]
call fcn.00610c60
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x6a0850
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
call fcn.0040c770
mov ecx, eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0061083c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6a085a
mov eax, dword [ebp - 0xc]
call fcn.00407ac8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a0895
lea eax, [ebp - 0x1c]
call fcn.004098cc
lea eax, [ebp - 0x10]
mov edx, dword [0x404b8c]
call fcn.0040cc58
lea eax, [ebp - 4]
call fcn.004098cc
ret
Function at 0x6a14f8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004099b0
xor eax, eax
push ebp
push 0x6a1699
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [0x6e33d9]
xor al, 1
mov byte [ebp - 0x15], al
jmp 0x6a152b
cmp byte [0x6e33d8], 0
cmp dword [0x6e33e4], 0
jne 0x6a1549
cmp dword [0x6e33e0], 0xa51cb
jbe 0x6a1553
jmp 0x6a154b
jle 0x6a1553
mov al, byte [0x6e33d9]
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x6a1579
cmp dword [0x6e33ec], 0xffffffff
jne 0x6a1573
cmp dword [0x6e33e8], 0xffb2fe4c
jae 0x6a1579
jmp 0x6a1683
jl 0x6a1683
xor eax, eax
push ebp
push 0x6a1675
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffffffffffffffff
push 0xffe9c4cf
push 0
push 0x163b31
call fcn.00683710
mov ecx, eax
lea eax, [ebp - 0x6c]
mov edx, 0x10
call fcn.00414c30
push 0
push 0x12e100
push 0
push 0x12e100
call fcn.00683710
mov ecx, eax
lea eax, [ebp - 0x5c]
mov edx, 0x44
call fcn.00414c30
mov dword [ebp - 0x5c], 0x44
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x5c]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
lea eax, [ebp - 4]
call fcn.00409e84
push eax
push 0
call sub.kernel32.dll_CreateProcessW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x6a160f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6a1683
push 0xffffffffffffffff
push 0xffe97049
push 0
push 0x17a127
call fcn.00683710
push eax
mov eax, dword [ebp - 0x6c]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x6a1655
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x6c]
push eax
call sub.kernel32.dll_GetExitCodeProcess
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov dword [eax], edx
jmp 0x6a1659
mov byte [ebp - 9], 0
mov eax, dword [ebp - 0x68]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x6c]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6a1683
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a16a0
lea eax, [ebp - 4]
call fcn.004098cc
ret
Function at 0x6aacf4
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6aaf12
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x1c], 0x12dd98
mov dword [ebp - 0x18], 0x8715f0
mov eax, dword [ebp - 0x18]
neg eax
sub eax, 0x47be37
cdq
cmp edx, dword [0x6e3474]
jne 0x6aad4a
cmp eax, dword [0x6e3470]
jbe 0x6aad78
jmp 0x6aad4c
jle 0x6aad78
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x6aad78
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
sub eax, 0x4c58e5
cmp eax, dword [ebp - 0x18]
setne byte [0x6e3461]
inc dword [ebp - 0x1c]
dec dword [ebp - 0x24]
jne 0x6aad5e
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], 0x531b96
mov byte [ebp - 0x1d], 0
cmp byte [0x6e3462], 0
jne 0x6aad9a
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x1c]
jle 0x6aada5
mov al, byte [0x6e3461]
or al, byte [ebp - 0x1d]
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x6aadd9
cmp dword [ebp - 0x1c], 0
jge 0x6aadd9
cmp dword [ebp - 0x18], 0
jle 0x6aaeea
mov eax, dword [ebp - 0x18]
imul dword [ebp - 0x1c]
cdq
mov dword [0x6e3470], eax
mov dword [0x6e3474], edx
cmp dword [ebp - 0x18], 0
jg 0x6aadbb
jmp 0x6aaeea
push 0
push 0x177ba4
push 0
push 0x177ba4
call fcn.00683710
push edx
push eax
mov eax, dword [ebp - 4]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x6aae02
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x6aae23
jmp 0x6aae06
pop edx
pop eax
jle 0x6aae23
push 0xffffffffffffffff
push 0xfff0b44b
push 0
push 0xf4bb5
call fcn.00683710
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_TerminateProcess
push 0xffffffffffffffff
push 0xffed3d37
push 0
push 0x12c2c9
call fcn.00683710
push edx
push eax
mov eax, dword [ebp - 8]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x6aae50
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x6aaeea
jmp 0x6aae58
pop edx
pop eax
jle 0x6aaeea
push 0
push 0xfa027
lea edx, [ebp - 0x28]
mov eax, 0x6aaf2c
call fcn.00683764
mov eax, dword [ebp - 0x28]
push eax
lea edx, [ebp - 0x2c]
lea eax, [ebp - 8]
call fcn.0042e8f4
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0xc]
pop edx
call fcn.0040a6f0
push 0
push 0x119400
lea edx, [ebp - 0x10]
mov eax, 0x6aaf64
call fcn.00683764
push 0
push 0x10b452
lea edx, [ebp - 0x14]
mov eax, 0x6aafbc
call fcn.00683764
push 0
push 0x6aafe0
mov eax, dword [ebp - 0xc]
call fcn.0040a488
push eax
mov eax, dword [ebp - 0x10]
call fcn.0040a488
push eax
mov eax, dword [ebp - 0x14]
call fcn.0040a488
push eax
push 0xffffffffffffffff
push 0xffed1f45
push 0
push 0x12e0bb
call fcn.00683710
push eax
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6aaf19
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.0040992c
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.0040992c
ret
Function at 0x6ab1e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x6ab1e8
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6ab3af
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x6ab285
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x128bec
push 0
push 0x1283ec
call fcn.00683710
call fcn.00425204
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
push 0xffffffffffffffff
push 0xffeea0c7
push 0
push 0x116739
call fcn.00683710
push eax
call sub.kernel32.dll_GetTempPathW
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
call fcn.0040a4ec
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dl, 1
call fcn.00424730
test al, al
jne 0x6ab27b
lea eax, [ebp - 0x1c]
call fcn.004e9c30
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00409cac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6ab2a2
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0042b468
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.00409cac
mov eax, dword [ebp - 8]
call fcn.004098cc
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dl, 1
call fcn.00424730
test al, al
jne 0x6ab334
mov al, byte [0x6ab3c0]
push eax
lea eax, [ebp - 0x28]
push eax
push 0
push 0x1c7804
lea edx, [ebp - 0x2c]
mov eax, 0x6ab3d0
call fcn.00683764
mov eax, dword [ebp - 0x2c]
push eax
push 0
push 0x124a33
lea edx, [ebp - 0x30]
mov eax, 0x6ab424
call fcn.00683764
mov eax, dword [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
call fcn.004e9b98
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x10]
call fcn.0042b468
lea eax, [ebp - 0x10]
pop edx
pop ecx
call fcn.0042dd3c
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 8]
call fcn.00409cac
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dl, 1
call fcn.00424730
test al, al
je 0x6ab374
push 0
push 0x18d76e
lea edx, [ebp - 0x38]
mov eax, 0x6ab48c
call fcn.00683764
mov eax, dword [ebp - 0x38]
push eax
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.0042e548
lea eax, [ebp - 0x14]
pop edx
call fcn.0042d6ec
test al, al
je 0x6ab387
lea eax, [ebp - 0x3c]
call fcn.0068ef9c
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 8]
call fcn.00409cac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6ab3b6
lea eax, [ebp - 0x3c]
mov edx, 9
call fcn.0040992c
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0040992c
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..idata
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x65726317
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x704e5e2c
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x10198210
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
mov ecx, 0x10475455
call fcn.100e28b3
nop
mov eax, dword [0x1044e7f0]
mov dword [ebp - 4], eax
jmp 0x10198236
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
je 0x1019824c
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x1019824a
mov eax, dword [ebp - 4]
jmp 0x101982c6
jmp 0x1019822e
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x101982c3
mov eax, dword [ebp - 4]
add eax, 0x20
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [eax], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 8]
add eax, 0x20
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 4]
cmp eax, 0xfe0
jbe 0x10198286
mov eax, dword [ebp - 4]
mov ecx, dword [0x1044e7f0]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
mov dword [0x1044e7f0], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret