joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4098c4
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
mov byte [ebp - 0x893], 0x6f
mov byte [ebp - 0x892], 0x61
mov byte [ebp - 0x891], 0x64
mov byte [ebp - 0x890], 0x4c
mov byte [ebp - 0x88f], 0x69
mov byte [ebp - 0x88e], 0x62
mov byte [ebp - 0x88d], 0x72
mov byte [ebp - 0x88c], 0x61
mov byte [ebp - 0x88b], 0x72
mov byte [ebp - 0x88a], 0x79
mov byte [ebp - 0x889], 0x57
mov byte [ebp - 0x888], 0
mov eax, dword fs:[0x18]
mov dword [ebp - 0x195c], eax
mov ecx, dword [ebp - 0x195c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1960], edx
invalid

Function at 0x409cef
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [ebx - 0x15e373], cl
dec dword [ebx + 0x428b0c51]
or al, 0x89
test dword [ebx + esi*8 - 1], ebx
call dword [esi + 0x56]
add esp, 4
call 0x4099b0
add byte [ebx], dh
inc ebx
dec ebx
dec ebx
dec ebp
inc edi
dec esp
xor eax, 0xc4834037
add al, 0x81
into
or al, 0xc3
add byte [eax], al
add al, ch
or eax, dword [eax]
add byte [eax], al
add byte [esi + edi], dh
xor ecx, dword [esi + 0x45]
inc eax
aaa
dec eax
dec esp
cmp eax, dword [ebx - 0x7ca1fb3c]
mov ebp, 0xfffff35c
add byte [ebp + 0xf], dh
mov dword [ebp - 0x750], 0
jmp 0x409c45
push edi
push edi
add esp, 4
call 0x409c59
add byte [esi], dh
dec edx
dec esi
aas
cmp cl, byte [ecx + ecx*2 + 0x46]
add esp, 4
sub edi, 0xa3c0
xor edi, 0x463a
xor edi, 0xf348
pop edi
push edx
xor edx, 0x1f06
pop edx
cmp dword [ebp - 0x750], 0
jne 0x409cc1
push eax
push esi
add esp, 4
jmp 0x409c8d
pop eax
push edx
call 0x409c9c
add byte [esi + 0x47], al
dec ecx
xor eax, 0x8335334b
les eax, [edx + ebx*2]
push esi
push eax
add esp, 4
or esi, 0x5ae9
or esi, 0xa10a
pop esi
mov dword [ebp - 0x79c], 0
jmp 0x40a7e8
push edi
xor edi, 0x6787
and edi, 0x131eb
pop edi
push eax
push ecx
add esp, 4
and eax, 0x5e6d
and eax, 0xcd6e
call 0x409cef
add byte [edi], dh
dec ecx
inc ecx
inc edi
xor eax, 0x834b4246
les eax, [eax + ebx*2]
mov eax, dword [ebp - 0x750]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x320], ecx
mov dword [ebp - 0x760], 0
mov edx, dword [ebp - 0x320]
mov dword [ebp - 0x15f0], edx
cmp dword [ebp - 0x15f0], 0
jne 0x409d32
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], eax
jmp 0x40a023
add byte [eax], al
mov ecx, dword [ebp - 0x15f0]
mov edx, dword [ebp - 0x320]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x15f4], edx
jne 0x409d5a
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], eax
jmp 0x40a023
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp - 0x15f4]
mov ecx, dword [eax + edx + 0x78]
mov dword [ebp - 0x15f8], ecx
cmp dword [ebp - 0x15f8], 0
add byte [ebp + 0x11], dh
mov edx, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], edx
jmp 0x40a023
mov eax, dword [ebp - 0x320]
add eax, dword [ebp - 0x15f8]
invalid
invalid
lodsb al, byte [esi]
clc
Function at 0x40a45e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x40a10a
pop eax
push esi
or esi, 0x8b19
or esi, 0x13345
xor esi, 0x1232a
call 0x40a12c
add byte [edi + 0x36], cl
inc edi
dec edx
dec esp
xor eax, 0x4c48340
pop esi
mov eax, dword fs:[0x18]
mov dword [ebp - 0x197c], eax
mov ecx, dword [ebp - 0x197c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1980], edx
mov eax, dword [ebp - 0x1980]
mov dword [ebp - 0x15fc], eax
push edx
xor edx, 0x876a
pop edx
push eax
and eax, 0x4379
jmp 0x40a16e
add eax, 0xfe76
pop eax
push ecx
jmp 0x40a17c
xor ecx, 0x3c38
xor ecx, 0x647d
pop ecx
cmp dword [ebp - 0x15fc], 0
jne 0x40a1a1
mov dword [ebp - 0x31c], 0
jmp 0x40a448
mov ecx, dword [ebp - 0x15fc]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xcb4], eax
push ecx
xor ecx, 0x8017
or ecx, 0x4502
xor ecx, 0xb16
xor ecx, 0x11102
add dl, byte [ecx]
add dword [eax], eax
pop ecx
push edx
jmp 0x40a1d5
call 0x40a1e1
add byte [ebx + 0x36], al
cmp byte [ebp + 0x49], cl
cmp dword [ebx - 0x7ca5fb3c], eax
mov ebp, 0xfffff34c
add byte [ebp + 0xf], dh
jne 0x40a1fd
mov dword [ebp - 0x31c], 0
jmp 0x40a448
push edi
or edi, 0xab94
call 0x40a45e
add byte [edi + 0x38], cl
aas
cmp byte [edx + 0x3c], al
cmp al, 0x36
dec edi
add esp, 4
pop edi
push edx
push edi
add esp, 4
add edx, 0x1793a
invalid
loop 0x40a429

Function at 0x40a470
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub byte [eax], al
add byte [ecx + 0x2267ea], al
add byte [edx - 0x75], bl
test esp, esp
cld
invalid

Function at 0x40a948
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xor al, 0x38
inc esp
xor eax, dword [ebx - 0x39a5fb3c]
test dword [esi + esi*8], ebp
invalid
Function at 0x40b9dc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xce0], ecx
push edx
push eax
add esp, 4
sub edx, 0x24ed
add edx, 0xbbbc
and edx, 0x15e80
pop edx
push eax
or eax, 0x11a35
pop eax
push ebx
call 0x40b71a
add byte [eax + 0x41], cl
xor edi, dword [ecx + ecx*2]
xor al, byte [ebp - 0x7d]
les eax, [ebx + ebx*2]
cmp dword [ebp - 0xce0], 0
jne 0x40b736
mov dword [ebp - 0x2fc], 0
jmp 0x40b981
mov edx, dword [ebp - 0xce0]
push ecx
add ecx, 0x579f
call 0x40b996
add byte [ebx + 0x34], al
xor eax, 0x343e3834
dec esp
add esp, 4
jmp 0x40b99e
pop ecx
push esi
push edi
add esp, 4
add esi, 0x13039
jmp 0x40b9b2
pop esi
mov ecx, dword [ebp - 0x2fc]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x338], edx
push ecx
push eax
add esp, 4
sub ecx, 0x3982
call 0x40b9dc
add byte [ebx], dh
inc eax
inc eax
inc eax
dec edi
inc ebp
dec edx
xor eax, 0x8104c483
leave
sti
into
add byte [eax], al
add ecx, 0x85d3
pop ecx
push eax
add eax, 0x1606c
pop eax
mov dword [ebp - 0x794], 0
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0x1688], eax
cmp dword [ebp - 0x1688], 0
jne 0x40ba24
mov ecx, dword [ebp - 0x794]
mov dword [ebp - 0x520], ecx
jmp 0x40bd15
mov edx, dword [ebp - 0x1688]
mov eax, dword [ebp - 0x338]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x168c], eax
jne fcn.0040ba4c
mov ecx, dword [ebp - 0x794]
mov dword [ebp - 0x520], ecx
jmp 0x40bd15

Function at 0x428ff4
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 4]
mov ecx, dword [0x6cfd54]
mov dl, 1
mov eax, dword [0x41c434]
call fcn.004290dc
jmp fcn.004098c4

Function at 0x42b108
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42b1a8
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x42b16c
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x18], 0
lea ecx, [ebp - 0x20]
xor edx, edx
mov eax, ebx
call fcn.00427d6c
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0x1c]
push eax
push 2
mov ecx, dword [0x6cff98]
mov dl, 1
mov eax, dword [0x41d60c]
call fcn.00429118
mov dword [ebp - 4], eax
jmp 0x42b181
mov ecx, dword [0x6d0160]
mov dl, 1
mov eax, dword [0x41d60c]
call fcn.004290dc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x18], ebx
push dword [ebp + 4]
mov eax, dword [ebp - 4]
jmp fcn.004098c4
Function at 0x42c2ec
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x42c30c
sub eax, 4
mov eax, dword [eax]
lea ebx, [edi + esi]
cmp eax, ebx
jg 0x42c326
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x42c321
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x42c32b
add edi, esi
mov dword [ebp - 8], edi
movzx eax, word [ebp + 0x14]
cmp ax, word [ebp + 0x10]
je 0x42c399
xor eax, eax
mov dword [ebp - 0xc], eax
cmp esi, dword [ebp - 8]
jge 0x42c3e2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x14]
jne 0x42c357
inc dword [ebp - 0xc]
jmp 0x42c36f
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x10]
jne 0x42c36f
cmp dword [ebp - 0xc], 0
jle 0x42c36f
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
jne 0x42c391
xor eax, eax
jmp 0x42c38d
movzx edi, word [edx + eax*2]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
cmp di, word [ebx + esi*2]
jne 0x42c38c
mov eax, esi
jmp 0x42c3e5
inc eax
cmp eax, ecx
jle 0x42c379
inc esi
cmp esi, dword [ebp - 8]
jl 0x42c343
jmp 0x42c3e2
mov byte [ebp - 0xd], 0
cmp esi, dword [ebp - 8]
jge 0x42c3e2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x14]
jne 0x42c3ba
movzx eax, byte [ebp - 0xd]
xor al, 1
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
jne 0x42c3dc
xor eax, eax
jmp 0x42c3d8
movzx edi, word [edx + eax*2]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
cmp di, word [ebx + esi*2]
jne 0x42c3d7
mov eax, esi
jmp 0x42c3e5
inc eax
cmp eax, ecx
jle 0x42c3c4
inc esi
cmp esi, dword [ebp - 8]
jl 0x42c3a2
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x468f48
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
push dword [ebp + 4]
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x43c930]
call fcn.004290dc
jmp fcn.004098c4

Function at 0x468f6c
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 4]
mov ecx, dword [0x6d0104]
mov dl, 1
mov eax, dword [0x43c930]
call fcn.004290dc
jmp fcn.004098c4
Function at 0x4cb114
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 4]
mov ecx, dword [0x6d0070]
mov dl, 1
mov eax, dword [0x41c2c4]
call fcn.004290dc
jmp fcn.004098c4

Function at 0x4ed6e4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4ed6ea
ret

Function at 0x501d98
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, 0x6cc35c
test edx, edx
jne 0x501db7
xor eax, eax
jmp 0x501ed5
mov dword [ebp - 4], 1
cmp byte [ebp - 4], 0
je 0x501dd4
push esi
push edx
push eax
call fcn.00501ef8
add esp, 0xc
jmp 0x501ed5
push esi
push edx
push eax
call fcn.005021b8
add esp, 0xc
jmp 0x501ed5
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x59af14
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
push dword [ebp + 4]
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x5984ec]
call fcn.004290dc
jmp fcn.004098c4

Function at 0x5c9cec
Capabilities:
Hash data using sha1

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
xor edx, edx
mov dword [eax + 0x14], edx
xor edx, edx
mov dword [eax + 0x18], edx
ret

Function at 0x5cd14c
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x6d7828
mov eax, esi
mov edx, 8
test al, 1
je 0x5cd168
shr eax, 1
xor eax, 0xedb88320
jmp 0x5cd16a
shr eax, 1
dec edx
jne 0x5cd15b
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x5cd154
pop esi
ret

Function at 0x5cd180
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x6d7824], 0
jne 0x5cd1aa
call fcn.005cd14c
mov dword [esp], 0x6d7824
mov edx, dword [esp]
mov eax, 1
lock xchg dword [edx], eax
mov eax, edi
test esi, esi
je 0x5cd1d4
mov edx, 0xff
and edx, ebx
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x6d7828]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x5cd1b0
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x605824
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffd4c
mov ebx, eax
movzx eax, bl
mov eax, dword [eax*4 + 0x6cef58]
or eax, 0x4011
push eax
push 0x2b4
lea eax, [esp + 8]
push eax
push 0x10
push 0x605868
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x60585d
mov eax, dword [esp + 4]
jmp 0x60585f
xor eax, eax
add esp, 0x2b4
pop ebx
ret

Function at 0x605847
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffd4c
mov ebx, eax
movzx eax, bl
mov eax, dword [eax*4 + 0x6cef58]
or eax, 0x4011
push eax
push 0x2b4
lea eax, [esp + 8]
push eax
push 0x10
push 0x605868
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x60585d
mov eax, dword [esp + 4]
jmp 0x60585f
xor eax, eax
add esp, 0x2b4
pop ebx
ret

Function at 0x60aee0
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
ret
Function at 0x666ec0
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x667024
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [ebp - 8]
test esi, esi
je 0x666f02
or ebx, 0xffff
mov eax, esi
call fcn.0040b278
mov esi, eax
jmp 0x666f04
xor esi, esi
xor eax, eax
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.winhttp.dll_WinHttpQueryHeaders
call fcn.00413fe8
cmp eax, 0x2f76
jne 0x666f34
mov eax, edi
call fcn.0040a1c8
jmp 0x667009
call fcn.00413fe8
cmp eax, 0x7a
je 0x666f84
call fcn.00413fe8
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
call fcn.00413fe8
lea ecx, [ebp - 0x20]
mov edx, dword [0x6d8408]
call fcn.00427d6c
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
lea eax, [ebp - 0x1c]
push eax
push 1
mov ecx, dword [0x6cfc1c]
mov dl, 1
mov eax, dword [0x669d94]
call fcn.00429118
call fcn.004098c4
mov edx, dword [ebp - 0xc]
shr edx, 1
dec edx
mov eax, edi
call fcn.0040b3f0
mov eax, dword [edi]
test eax, eax
je 0x666f9c
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x667009
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [edi]
call fcn.0040b278
push eax
push esi
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.winhttp.dll_WinHttpQueryHeaders
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x667009
call fcn.00413fe8
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
call fcn.00413fe8
lea ecx, [ebp - 0x24]
mov edx, dword [0x6d8408]
call fcn.00427d6c
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
lea eax, [ebp - 0x1c]
push eax
push 1
mov ecx, dword [0x6cfc1c]
mov dl, 1
mov eax, dword [0x669d94]
call fcn.00429118
call fcn.004098c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x66702b
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.0040a228
ret

Function at 0x667236
Capabilities:
Initialize winhttp library

Disassembly:
push ebx
push esi
push edi
test dl, dl
je 0x6671f7
add esp, 0xfffffff0
call fcn.00408a40
mov ebx, edx
mov edi, eax
mov eax, edi
call fcn.0067007c
mov dl, 1
mov eax, dword [0x6658ec]
call fcn.00669938
mov dword [edi + 0xa0], eax
mov dl, 1
mov eax, dword [0x651714]
call fcn.00659afc
mov dword [edi + 0x9c], eax
mov eax, dword [0x664a3c]
call fcn.00669520
push 0
push 0
push 0
push 1
push 0x667298
call sub.winhttp.dll_WinHttpOpen
mov esi, eax
mov dword [edi + 0x98], esi
test esi, esi
jne 0x667265
mov ecx, dword [0x6cfde0]
mov dl, 1
mov eax, dword [0x669e4c]
call fcn.004290dc
call fcn.004098c4
push 0
push 0x10010
push 0x667044
mov eax, dword [edi + 0x98]
push eax
call sub.winhttp.dll_WinHttpSetStatusCallback
mov eax, edi
test bl, bl
je 0x667292
call fcn.00408a98
pop dword fs:[0]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x6b4020
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, 3
lea ebx, [ebp - 8]
lea esi, [ebp - 0xc]
lea edi, [ebp - 4]
movzx eax, byte [esi]
movzx edx, byte [ebx]
sub eax, edx
imul dword [ebp - 0x10]
push ecx
mov ecx, 0xff
cdq
idiv ecx
pop ecx
movzx edx, byte [ebx]
add eax, edx
mov byte [edi], al
inc edi
inc esi
inc ebx
dec ecx
jne 0x6b4045
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43b64d
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov esi, 0x43b3c1
and ecx, ebx
inc ebx
call fcn.0043b68d
and ecx, ebx
or ebx, ecx
mov ecx, ebx
xor dword [edi], esi
sub ebx, 0x7ef10daa
mov ecx, 0xe93311a
add ecx, 1
inc edi
or ebx, ecx
mov ebx, ecx
cmp edi, edx
jne fcn.0043b64d
add ebx, 0x6ab13e7
sub ecx, ebx
ret
Function at 0x6edc16c0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x6edc179e
mov dword [esp], 0xd
call sub.msvcrt.dll__lock
mov eax, dword [ebx]
test eax, eax
je 0x6edc1760
mov eax, dword [ebx + 4]
mov edx, dword [ebx + 8]
cmp edx, eax
je 0x6edc1710
mov edx, dword [ebp + 0xc]
mov dword [eax], edx
add dword [ebx + 4], 4
mov dword [esp], 0xd
call sub.msvcrt.dll__unlock
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [ebx]
mov dword [esp + 4], 0
sub eax, edx
mov dword [esp + 8], edx
mov edi, eax
mov esi, eax
sar edi, 2
shl edi, 3
mov dword [esp + 0xc], edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapReAlloc
sub esp, 0x10
test eax, eax
je 0x6edc17a8
add edi, eax
mov dword [ebx], eax
add eax, esi
mov dword [ebx + 8], edi
mov dword [ebx + 4], eax
jmp 0x6edc16f0
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapAlloc
mov dword [ebx], eax
sub esp, 0xc
test eax, eax
je 0x6edc17a8
lea edx, [eax + 0x80]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
jmp 0x6edc16ec
mov eax, 0xffffffff
jmp 0x6edc1707
mov dword [esp], 0xd
call sub.msvcrt.dll__unlock
mov eax, 0xffffffff
jmp 0x6edc1707

Function at 0x6edc17c0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, dword [ebp + 8]
test edi, edi
je 0x6edc186b
mov dword [esp], 0xd
call sub.msvcrt.dll__lock
mov esi, dword [edi]
test esi, esi
je 0x6edc17ed
mov ebx, dword [edi + 4]
cmp esi, ebx
jb 0x6edc1808
mov dword [esp], 0xd
call sub.msvcrt.dll__unlock
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [esp], 0xd
call sub.msvcrt.dll__unlock
sub ebx, 4
cmp esi, ebx
ja 0x6edc183e
mov eax, dword [ebx]
test eax, eax
je 0x6edc1828
call eax
sub ebx, 4
cmp esi, ebx
jbe 0x6edc182f
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapFree
xor eax, eax
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0xffffffff
jmp 0x6edc17fb

Function at 0x6edc24b0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.6edc2f80
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.6edc2f80
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]
Function at 0x6edc2510
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x6edc6438]
test esi, esi
jle 0x6edc2610
mov eax, dword [0x6edc643c]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x6edc2540
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x6edc25bf
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x6edc2530
mov dword [esp], ebx
call fcn.6edc2c60
mov edi, eax
test eax, eax
je 0x6edc2637
mov eax, dword [0x6edc643c]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.6edc2d70
mov edx, dword [0x6edc643c]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x6edc2617
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x6edc25b8
sub eax, 4
and eax, 0xfffffffb
jne 0x6edc25c6
add dword [0x6edc6438], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
add ebx, dword [0x6edc643c]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x6edc25b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.6edc24b0
xor esi, esi
jmp 0x6edc254a
mov eax, dword [0x6edc643c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.6edc24b0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.6edc24b0
lea esi, [esi]
nop

Function at 0x6edc28d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x6edc6448
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x6edc6440]
sub esp, 4
test ebx, ebx
je 0x6edc2925
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x6edc291e
test esi, esi
je 0x6edc291e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6edc2900
mov dword [esp], 0x6edc6448
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret