joyce8/EMBER2024-capa huggingface dataset:
Function at 0x660de0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [eax + 0x38]
mov dword [ebp - 0x10], edx
mov esi, dword [ebx + 0x18]
cmp dword [ebx + 0x2c], esi
jge 0x660f27
lea eax, [ebx + 0x44]
lea edx, [ebx + 0x45]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edx
jmp 0x660e96
mov eax, dword [edi + 0x38]
mov edx, dword [eax + 0x3c]
test edx, edx
je 0x660eba
mov dword [esp + 8], 1
mov ecx, dword [ebp - 0x14]
mov dword [esp], edi
mov dword [esp + 4], ecx
call edx
sub eax, 1
setne al
test al, al
jne 0x660eea
mov eax, dword [edi + 0x38]
mov edx, dword [eax + 0x3c]
test edx, edx
je 0x660efe
movzx eax, byte [ebx + 0x44]
mov dword [esp + 8], eax
mov ecx, dword [ebp - 0x18]
mov dword [esp], edi
mov dword [esp + 4], ecx
call edx
mov edx, eax
movzx eax, byte [ebx + 0x44]
cmp edx, eax
jne 0x660eea
sub byte [ebx + 0x44], 1
mov esi, dword [ebx + 0x18]
movzx edx, byte [ebx + 0x45]
mov byte [ebx + 0x45], 2
mov ecx, dword [ebx + 0x2c]
movzx eax, dl
shl eax, cl
or dword [ebx + 0x30], eax
mov eax, ecx
add eax, 8
cmp esi, eax
mov dword [ebx + 0x2c], eax
jle 0x660f27
cmp byte [ebx + 0x44], 0
je 0x660e10
movzx eax, byte [ebx + 0x45]
mov ecx, dword [ebp - 0x14]
movzx edx, al
add eax, 1
movzx edx, byte [edx + ecx]
sub byte [ebx + 0x44], 1
mov byte [ebx + 0x45], al
jmp 0x660e7b
mov eax, dword [eax + 0x38]
mov dword [esp + 8], 1
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_fread
sub eax, 1
setne al
test al, al
je 0x660e40
mov dword [0xc1f620], 0x66
add esp, 0x1c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [eax + 0x38]
mov dword [esp + 0xc], eax
movzx eax, byte [ebx + 0x44]
mov dword [esp + 4], 1
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov edx, eax
jmp 0x660e64
mov eax, dword [ebx + 0x30]
mov edx, dword [ebp - 0x10]
and eax, dword [esi*4 + 0xb00cc0]
mov dword [edx], eax
mov eax, dword [ebx + 0x14]
mov edx, dword [ebx + 0x1c]
mov ecx, dword [ebx + 0x18]
shr dword [ebx + 0x30], cl
add eax, 1
sub dword [ebx + 0x2c], ecx
cmp eax, edx
mov dword [ebx + 0x14], eax
jle 0x660f6b
cmp ecx, 0xb
jg 0x660f6b
add dword [ebx + 0x18], 1
lea eax, [edx + edx]
mov dword [ebx + 0x1c], eax
add esp, 0x1c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x1c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x661270
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x20
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 0x38]
mov edx, dword [ebx + 0x3c]
test edx, edx
je 0x661342
lea eax, [ebp - 9]
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov dword [esp], esi
call edx
sub eax, 1
setne al
test al, al
je 0x6612c0
mov dword [0xc1f620], 0x66
xor edx, edx
add esp, 0x20
mov eax, edx
pop ebx
pop esi
pop ebp
ret
cmp byte [ebp - 9], 0
je 0x661320
mov edx, dword [ebp + 0xc]
lea eax, [ebx + 0x44]
mov dword [edx], eax
movzx edx, byte [ebp - 9]
mov byte [ebx + 0x44], dl
mov eax, dword [esi + 0x38]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x66136f
movzx eax, dl
mov dword [esp + 8], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov dword [esp], esi
add eax, 1
mov dword [esp + 4], eax
call ecx
mov ecx, eax
movzx eax, byte [ebp - 9]
mov edx, 1
cmp ecx, eax
je 0x6612b3
mov dword [0xc1f620], 0x66
add esp, 0x20
xor dl, dl
pop ebx
mov eax, edx
pop esi
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov edx, 1
mov dword [ebx + 0x34], 0
mov dword [eax], 0
mov eax, edx
mov byte [ebx + 0x44], 0
add esp, 0x20
pop ebx
pop esi
pop ebp
ret
mov eax, dword [ebx + 0x38]
mov dword [esp + 8], 1
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
lea eax, [ebp - 9]
mov dword [esp], eax
call sub.msvcrt.dll_fread
sub eax, 1
setne al
jmp 0x6612a3
mov eax, dword [eax + 0x38]
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
movzx eax, dl
mov dword [esp + 8], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
add eax, 1
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov ecx, eax
jmp 0x6612fd

Function at 0x6615f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ecx, eax
mov ebp, esp
push ebx
mov ebx, edx
sub esp, 0x24
mov eax, dword [eax + 0x38]
mov edx, dword [eax + 0x3c]
test edx, edx
je 0x661650
lea eax, [ebp - 6]
mov dword [esp + 8], 2
mov dword [esp + 4], eax
mov dword [esp], ecx
call edx
cmp eax, 2
setne al
test al, al
je 0x661635
mov dword [0xc1f620], 0x66
add esp, 0x24
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, byte [ebp - 5]
movzx edx, byte [ebp - 6]
shl eax, 8
add eax, edx
mov dword [ebx], eax
add esp, 0x24
mov eax, 1
pop ebx
pop ebp
ret
mov eax, dword [eax + 0x38]
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
lea eax, [ebp - 6]
mov dword [esp], eax
call sub.msvcrt.dll_fread
cmp eax, 2
setne al
jmp 0x66161f
Function at 0x661680
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x20
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 0x38]
mov edx, dword [ebx + 0x3c]
test edx, edx
je 0x661747
lea eax, [ebp - 9]
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov dword [esp], esi
call edx
sub eax, 1
setne al
test al, al
je 0x6616d0
mov dword [0xc1f620], 0x66
xor edx, edx
add esp, 0x20
mov eax, edx
pop ebx
pop esi
pop ebp
ret
cmp byte [ebp - 9], 0
je 0x661730
mov edx, dword [ebp + 0xc]
lea eax, [ebx + 0x44]
mov dword [edx], eax
movzx edx, byte [ebp - 9]
mov byte [ebx + 0x44], dl
mov eax, dword [esi + 0x38]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x661774
movzx eax, dl
mov dword [esp + 8], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov dword [esp], esi
add eax, 1
mov dword [esp + 4], eax
call ecx
mov ecx, eax
movzx eax, byte [ebp - 9]
mov edx, 1
cmp ecx, eax
je 0x6616c3
mov dword [0xc1f620], 0x66
add esp, 0x20
xor dl, dl
pop ebx
mov eax, edx
pop esi
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov edx, 1
mov dword [eax], 0
add esp, 0x20
mov eax, edx
pop ebx
pop esi
pop ebp
ret
mov eax, dword [ebx + 0x38]
mov dword [esp + 8], 1
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
lea eax, [ebp - 9]
mov dword [esp], eax
call sub.msvcrt.dll_fread
sub eax, 1
setne al
jmp 0x6616b3
mov eax, dword [eax + 0x38]
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
movzx eax, dl
mov dword [esp + 8], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
add eax, 1
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov ecx, eax
jmp 0x66170d

Function at 0x6617b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x38]
test byte [eax], 8
jne 0x6617d4
mov dword [0xc1f620], 0x6f
add esp, 0x24
xor eax, eax
pop ebx
pop ebp
ret
mov edx, dword [eax + 0x3c]
test edx, edx
je 0x66180b
lea eax, [ebp - 5]
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov dword [esp], ebx
call edx
sub eax, 1
setne al
test al, al
je 0x661835
mov dword [0xc1f620], 0x66
add esp, 0x24
xor eax, eax
pop ebx
pop ebp
ret
mov eax, dword [eax + 0x38]
mov dword [esp + 8], 1
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
lea eax, [ebp - 5]
mov dword [esp], eax
call sub.msvcrt.dll_fread
sub eax, 1
setne al
jmp 0x6617f5
movzx eax, byte [ebp - 5]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.00661680
add esp, 0x24
pop ebx
pop ebp
ret
Function at 0x661860
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x38]
test byte [eax], 8
jne 0x661880
mov dword [0xc1f620], 0x6f
xor eax, eax
leave
ret
mov edx, dword [eax + 0x3c]
test edx, edx
je 0x6618da
lea eax, [ebp - 1]
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov dword [esp], ecx
call edx
sub eax, 1
setne al
test al, al
je 0x6618b3
mov dword [0xc1f620], 0x66
xor eax, eax
leave
ret
movzx eax, byte [ebp - 1]
cmp al, 0x2c
je 0x661904
cmp al, 0x3b
je 0x661924
cmp al, 0x21
je 0x661914
mov eax, dword [ebp + 0xc]
mov dword [0xc1f620], 0x6b
mov dword [eax], 0
xor eax, eax
leave
ret
mov eax, dword [eax + 0x38]
mov dword [esp + 8], 1
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
lea eax, [ebp - 1]
mov dword [esp], eax
call sub.msvcrt.dll_fread
sub eax, 1
setne al
jmp 0x6618a1
mov eax, dword [ebp + 0xc]
mov dword [eax], 2
mov eax, 1
leave
ret
mov eax, dword [ebp + 0xc]
mov dword [eax], 3
mov eax, 1
leave
ret
mov eax, dword [ebp + 0xc]
mov dword [eax], 4
mov eax, 1
leave
ret
Function at 0x661a00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov eax, dword [ebx + 0x38]
test byte [eax], 8
jne 0x661a33
mov dword [0xc1f620], 0x6f
xor eax, eax
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov edx, ebx
mov eax, ebx
call fcn.006615f0
test eax, eax
jne 0x661a44
xor eax, eax
jmp 0x661a26
lea edx, [ebx + 4]
mov eax, ebx
call fcn.006615f0
test eax, eax
je 0x661a40
mov eax, dword [ebx + 0x38]
mov edx, dword [eax + 0x3c]
test edx, edx
je 0x661ab3
lea eax, [ebp - 0xf]
mov dword [esp + 8], 3
mov dword [esp + 4], eax
mov dword [esp], ebx
call edx
cmp eax, 3
setne al
test al, al
jne 0x661aa2
movzx eax, byte [ebp - 0xf]
and eax, 0x70
shr eax, 4
add eax, 1
mov dword [ebx + 8], eax
movzx eax, byte [ebp - 0xe]
movzx edx, byte [ebp - 0xf]
mov dword [ebx + 0xc], eax
cmp byte [ebp - 0xf], 0
js 0x661add
mov eax, 1
jmp 0x661a26
xor eax, eax
mov dword [0xc1f620], 0x66
jmp 0x661a26
mov eax, dword [eax + 0x38]
mov dword [esp + 8], 3
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
lea eax, [ebp - 0xf]
mov dword [esp], eax
call sub.msvcrt.dll_fread
cmp eax, 3
setne al
jmp 0x661a76
mov ecx, edx
mov eax, 1
and ecx, 7
add ecx, 1
shl eax, cl
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00662750
mov dword [ebx + 0x10], eax
mov eax, dword [eax]
test eax, eax
jle 0x661a9b
xor edi, edi
xor esi, esi
jmp 0x661b67
lea eax, [ebp - 0xf]
mov dword [esp + 8], 3
mov dword [esp + 4], eax
mov dword [esp], ebx
call edx
cmp eax, 3
setne al
test al, al
jne 0x661aa2
mov eax, dword [ebx + 0x10]
add edi, 1
mov edx, dword [eax + 8]
movzx eax, byte [ebp - 0xf]
mov byte [edx + esi], al
mov eax, dword [ebx + 0x10]
mov edx, dword [eax + 8]
movzx eax, byte [ebp - 0xe]
mov byte [edx + esi + 1], al
mov eax, dword [ebx + 0x10]
mov edx, dword [eax + 8]
movzx eax, byte [ebp - 0xd]
mov byte [edx + esi + 2], al
mov eax, dword [ebx + 0x10]
add esi, 3
cmp dword [eax], edi
jle 0x661a9b
mov eax, dword [ebx + 0x38]
mov edx, dword [eax + 0x3c]
test edx, edx
jne 0x661b0b
mov eax, dword [eax + 0x38]
mov dword [esp + 8], 3
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
lea eax, [ebp - 0xf]
mov dword [esp], eax
call sub.msvcrt.dll_fread
cmp eax, 3
setne al
jmp 0x661b25
Function at 0x662090
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [ebp + 0xc]
mov dword [esp], 0x3c
call sub.msvcrt.dll_malloc
test eax, eax
mov dword [ebp - 0x24], eax
je 0x6621eb
mov eax, dword [ebp - 0x24]
mov ecx, 0xf
cld
mov dword [ebp - 0x20], eax
mov edi, dword [ebp - 0x20]
xor eax, eax
rep stosd dword es:[edi], eax
mov dword [esp], 0x6148
call sub.msvcrt.dll_malloc
test eax, eax
mov ebx, eax
je 0x662201
mov eax, dword [ebp - 0x20]
test esi, esi
mov edx, dword [ebp + 8]
mov dword [ebx + 4], 0
mov dword [ebx + 0x38], 0
mov dword [eax + 0x38], ebx
mov dword [ebx], 8
mov dword [ebx + 0x3c], esi
mov dword [eax + 0x34], edx
je 0x662165
lea eax, [ebp - 0x13]
mov dword [ebp - 0x28], eax
mov dword [esp + 8], 6
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call esi
cmp eax, 6
setne al
test al, al
jne 0x6621c2
mov edi, dword [ebp - 0x28]
mov esi, str.GIFVER
mov ecx, 3
cld
mov byte [ebp - 0xd], 0
repe cmpsb byte [esi], byte es:[edi]
jne 0x662193
mov edx, dword [ebp - 0x24]
mov dword [esp], edx
call fcn.00661a00
test eax, eax
je 0x66219d
mov dword [0xc1f620], 0
mov eax, dword [ebp - 0x20]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
lea edx, [ebp - 0x13]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [ebp - 0x28], edx
mov dword [esp], edx
call sub.msvcrt.dll_fread
cmp eax, 6
setne al
jmp 0x662123
mov dword [0xc1f620], 0x67
mov dword [esp], ebx
call fcn.008f2ba8
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call fcn.008f2ba8
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [0xc1f620], 0x66
mov dword [esp], ebx
call fcn.008f2ba8
mov edx, dword [ebp - 0x24]
mov dword [esp], edx
call fcn.008f2ba8
mov dword [ebp - 0x20], 0
jmp 0x66215a
mov dword [0xc1f620], 0x6d
mov dword [ebp - 0x20], 0
jmp 0x66215a
mov edx, dword [ebp - 0x20]
mov dword [0xc1f620], 0x6d
mov dword [esp], edx
call fcn.008f2ba8
mov dword [ebp - 0x20], 0
jmp 0x66215a
Function at 0x662230
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [ebp + 8]
mov dword [esp], 0x3c
call sub.msvcrt.dll_malloc
test eax, eax
je 0x662369
mov dword [ebp - 0x24], eax
mov edi, dword [ebp - 0x24]
xor eax, eax
cld
mov ecx, 0xf
rep stosd dword es:[edi], eax
mov dword [esp], 0x6148
call sub.msvcrt.dll_malloc
test eax, eax
mov ebx, eax
je 0x66237c
mov dword [esp + 4], 0x8000
mov dword [esp], esi
call sub.msvcrt.dll__setmode
mov dword [esp + 4], 0xb00ca7
mov dword [esp], esi
call sub.msvcrt.dll__fdopen
mov dword [ebx + 4], esi
mov dword [ebx], 8
mov dword [ebx + 0x3c], 0
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x24]
mov dword [eax + 0x38], ebx
mov eax, dword [ebp - 0x20]
mov dword [ebx + 0x38], eax
mov eax, dword [ebp - 0x24]
mov dword [eax + 0x34], 0
mov eax, dword [ebp - 0x20]
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x13]
mov dword [ebp - 0x28], eax
mov dword [esp], eax
call sub.msvcrt.dll_fread
cmp eax, 6
jne 0x66235d
mov edi, dword [ebp - 0x28]
mov esi, str.GIFVER
mov ecx, 3
cld
mov byte [ebp - 0xd], 0
repe cmpsb byte [esi], byte es:[edi]
jne 0x662323
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call fcn.00661a00
test eax, eax
je 0x66232d
mov dword [0xc1f620], 0
mov eax, dword [ebp - 0x24]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [0xc1f620], 0x67
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov dword [esp], ebx
call fcn.008f2ba8
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call fcn.008f2ba8
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x24]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [0xc1f620], 0x66
jmp 0x66232d
mov dword [0xc1f620], 0x6d
mov dword [ebp - 0x24], 0
jmp 0x662318
mov eax, dword [ebp - 0x24]
mov dword [0xc1f620], 0x6d
mov dword [esp], eax
call fcn.008f2ba8
mov dword [ebp - 0x24], 0
jmp 0x662318
Function at 0x667037
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0xc1f628]
test eax, eax
jne 0x6670f2
mov dword [0xc1f628], 1
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [0xc1f62c], eax
mov dword [ebp - 0xc], 0
mov dword [esp], str.BD_DEBUG_MASK
call sub.msvcrt.dll_getenv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x6670a0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_strtol
mov dword [0x91aef8], eax
mov dword [esp], str.BD_DEBUG_FILE
call sub.msvcrt.dll_getenv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x6670f2
mov dword [esp + 4], 0xb01b49
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [0xc1f62c], eax
mov eax, dword [0xc1f62c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x40
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_setvbuf
mov eax, dword [0x91aef8]
and eax, dword [ebp + 0x10]
test eax, eax
je 0x66718c
lea eax, [ebp - 0x214]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s:_d:
lea eax, [ebp - 0x214]
mov dword [esp], eax
call fcn.00666f7c
add dword [ebp - 0x10], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00666fac
mov eax, dword [0xc1f624]
test eax, eax
je 0x66716d
mov edx, dword [0xc1f624]
lea eax, [ebp - 0x214]
mov dword [esp], eax
call edx
jmp 0x66718c
mov eax, dword [0xc1f62c]
lea edx, [ebp - 0x214]
mov dword [esp + 8], edx
mov dword [esp + 4], 0xb01b54
mov dword [esp], eax
call fcn.00666f4c
leave
ret
Function at 0x680158
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x68018b
xor eax, eax
mov ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
lea esi, [ecx - 1]
cmp esi, 2
je 0x680198
call sub.KERNEL32.dll_GetVersion
test eax, eax
js 0x68018b
cmp esi, 6
je 0x6801d8
xor eax, eax
add esp, 0x1c
pop ebx
pop esi
pop edi
leave
ret
movsx edx, byte [ebx]
mov eax, dword [sym.imp.msvcrt.dll___mb_cur_max]
cmp dword [eax], 1
jne 0x6801c4
mov eax, dword [sym.imp.msvcrt.dll__pctype]
mov eax, dword [eax]
movzx eax, word [eax + edx*2]
and eax, 0x103
test eax, eax
je 0x68017d
cmp byte [ebx + 1], 0x3a
jne 0x68017d
mov al, 1
jmp 0x68018d
mov dword [esp + 4], 0x103
mov dword [esp], edx
call sub.msvcrt.dll__isctype
jmp 0x6801b5
cmp byte [ebx], 0x5c
jne 0x68018b
cmp byte [ebx + 1], 0x5c
jne 0x68018b
cmp byte [ebx + 2], 0x2e
jne 0x68018b
cmp byte [ebx + 3], 0x5c
jne 0x68018b
movsx eax, byte [ebx + 4]
mov edx, dword [sym.imp.msvcrt.dll___mb_cur_max]
cmp dword [edx], 1
jne 0x680223
mov edx, dword [sym.imp.msvcrt.dll__pctype]
mov edx, dword [edx]
movzx eax, word [edx + eax*2]
and eax, 0x103
test eax, eax
je 0x68018b
cmp byte [ebx + 5], 0x3a
sete al
jmp 0x68018d
mov dword [esp + 4], 0x103
mov dword [esp], eax
call sub.msvcrt.dll__isctype
jmp 0x68020f

Function at 0x688c48
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov byte [ebp - 0x1c], bl
mov byte [ebp - 0x1b], 0x3a
mov byte [ebp - 0x1a], 0x5c
mov byte [ebp - 0x19], 0
lea eax, [ebp - 0x1c]
mov dword [esp], eax
call sub.KERNEL32.dll_GetDriveTypeA
push edi
cmp eax, 5
je 0x688c94
movsx esi, bl
mov dword [esp + 4], esi
mov dword [esp], str.Drive__c_is_not_a_CD_ROM
call fcn.0067e140
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
lea edi, [ebp - 0x23]
mov esi, str..X:
mov ecx, 7
rep movsb byte es:[edi], byte [esi]
mov byte [ebp - 0x1f], bl
lea eax, [ebp - 0x23]
mov dword [esp], eax
call sub.msvcrt.dll__strdup
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x688e64
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xdc
mov ebx, dword [ebp + 8]
mov edi, dword [ebx]
xor eax, eax
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea esi, [ecx - 1]
mov dword [esp], str.using_winNT_2K_XP_ioctl_layer
mov byte [ebp - 0xbc], al
call fcn.0067e140
lea edx, [ebp - 0xb4]
mov ecx, 0x94
mov al, byte [ebp - 0xbc]
mov edi, edx
rep stosb byte es:[edi], al
mov dword [ebp - 0xb4], 0x94
mov dword [esp], edx
call sub.KERNEL32.dll_GetVersionExA
push edx
cmp dword [ebp - 0xa4], 2
je 0x688f58
mov edi, 0x80000000
mov eax, dword [ebx]
mov dword [esp], eax
call fcn.00680158
test al, al
jne 0x688ee8
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov eax, dword [ebx]
movsx eax, byte [eax + esi - 2]
mov dword [esp + 8], eax
mov dword [esp + 4], str.._c:
lea esi, [ebp - 0x1f]
mov dword [esp], esi
call sub.msvcrt.dll_sprintf
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], edi
mov dword [esp], esi
call sub.KERNEL32.dll_CreateFileA
sub esp, 0x1c
mov dword [ebx + 0x40c4], eax
inc eax
je 0x688f74
mov byte [ebx + 0x40d4], 1
mov al, 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
cmp dword [ebp - 0xb0], 5
sbb edi, edi
and edi, 0xc0000000
sub edi, 0x40000000
jmp 0x688ecf
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
xor edi, 0x40000000
mov dword [esp + 4], edi
mov dword [esp], esi
call sub.KERNEL32.dll_CreateFileA
sub esp, 0x1c
mov dword [ebx + 0x40c4], eax
test eax, eax
jne 0x688f46
jmp 0x688edd
Function at 0x690e70
Capabilities:
Encrypt data using speck

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 4
mov eax, dword [ebp + 8]
mov esi, dword [eax]
mov edi, dword [eax + 4]
test esi, esi
jne 0x690e9a
mov eax, edi
sar eax, 0x1f
mov edx, eax
xor edx, edi
sub edx, eax
add esp, 4
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
test edi, edi
jne 0x690eb3
mov eax, esi
add esp, 4
sar eax, 0x1f
mov edx, eax
xor edx, esi
pop ebx
sub edx, eax
pop esi
mov eax, edx
pop edi
pop ebp
ret
mov eax, edi
mov edx, esi
sar eax, 0x1f
mov ebx, eax
sar edx, 0x1f
xor ebx, edi
sub ebx, eax
mov eax, edx
xor eax, esi
sub eax, edx
xor edx, edx
or ebx, eax
cmp ebx, 0xffff
jg 0x690fef
cmp ebx, 0xff
jle 0x690ee7
sar ebx, 8
add edx, 8
cmp ebx, 0xf
jle 0x690ef2
sar ebx, 4
add edx, 4
cmp ebx, 3
jle 0x690efd
sar ebx, 2
add edx, 2
xor eax, eax
cmp ebx, 2
setge al
add edx, eax
cmp edx, 0x1b
jle 0x691005
lea ecx, [edx - 0x1b]
mov ebx, esi
mov edx, edi
sar ebx, cl
sar edx, cl
neg ecx
mov dword [ebp - 0x10], ecx
test ebx, ebx
js 0x691020
test edx, edx
js 0x691029
lea eax, [ebx + ebx]
mov esi, edx
sub esi, eax
lea edi, [ebx + edx*2]
xor ebx, ebx
jmp 0x690f56
mov ecx, ebx
mov edx, edi
mov eax, esi
add ebx, 1
sar edx, cl
sar eax, cl
sub esi, edx
add edi, eax
cmp ebx, 0x17
je 0x690f71
test esi, esi
jns 0x690f40
mov ecx, ebx
mov eax, esi
mov edx, edi
add ebx, 1
sar eax, cl
sar edx, cl
sub edi, eax
cmp ebx, 0x17
lea esi, [edx + esi]
jne 0x690f56
mov edx, edi
sar edx, 0x1f
mov eax, edx
xor eax, edi
sub eax, edx
mov edx, eax
and eax, 0xffff
shr edx, 0x10
imul ecx, eax, 0x4585
imul esi, edx, 0x4585
imul eax, eax, 0xb9e9
imul edx, edx, 0xb9e9
shr eax, 0x10
add edx, ecx
lea ebx, [eax + edx]
mov ecx, ebx
shr ecx, 0x10
add ecx, esi
cmp eax, edx
cmovae edx, eax
cmp edx, ebx
mov edx, ecx
lea eax, [ecx + 0x10000]
cmova edx, eax
mov eax, edx
neg eax
add edi, 1
cmovle edx, eax
mov eax, dword [ebp - 0x10]
test eax, eax
jle 0x691038
mov ecx, dword [ebp - 0x10]
mov eax, 1
sub ecx, 1
shl eax, cl
movzx ecx, byte [ebp - 0x10]
add esp, 4
add edx, eax
pop ebx
pop esi
pop edi
pop ebp
sar edx, cl
mov eax, edx
ret
sar ebx, 0x10
mov dl, 0x10
cmp ebx, 0xff
jle 0x690ee7
jmp 0x690ee1
mov dword [ebp - 0x10], 0x1b
mov ebx, esi
sub dword [ebp - 0x10], edx
mov edx, edi
movzx ecx, byte [ebp - 0x10]
shl ebx, cl
shl edx, cl
jmp 0x690f20
neg ebx
neg edx
jmp 0x690f28
lea eax, [edx + edx]
mov edi, ebx
lea esi, [edx + ebx*2]
sub edi, eax
jmp 0x690f3a
neg dword [ebp - 0x10]
movzx ecx, byte [ebp - 0x10]
shl edx, cl
jmp 0x690e90
Function at 0x691730
Capabilities:
Encrypt data using speck

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], 0
mov dword [ebp + 0xc], edx
pop ebp
jmp fcn.00691490
Function at 0x69bd50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], esi
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
test ebx, ebx
je 0x69bd96
mov edx, dword [ebx + 0x5c]
mov eax, ecx
test edx, edx
je 0x69bd7f
mov eax, dword [edx + 0xc]
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [eax + 0xc]
mov dword [ebp + 0x10], esi
mov esi, dword [ebp - 4]
mov dword [ebp + 8], ebx
mov ebx, dword [ebp - 8]
mov dword [ebp + 0xc], eax
mov esp, ebp
pop ebp
jmp fcn.0069b2d0
mov ebx, dword [ebp - 8]
mov eax, 0x23
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret