joyce8/EMBER2024-capa huggingface dataset:
Function at 0xf02ddf9
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [eax*4 + 0xf0754f4]
xor ebx, ebx
lea ecx, [esi + 0x13c]
mov dword [ebp - 4], ebx
cmp dword [ecx], ebx
je 0xf02de5f
lea eax, [esi + 0x138]
mov edx, dword [eax]
mov dword [ebp - 8], ebx
mov bl, byte [ebp + 0xc]
mov byte [esi + edx + 0x70], bl
inc dword [eax]
mov eax, dword [eax]
cmp dword [ecx], eax
mov ebx, dword [ebp - 8]
jle 0xf02de45
cmp dword [esi + 0x1d8], ebx
je 0xf02ded9
mov eax, dword [esi + 0x1d8]
neg eax
sbb eax, eax
and eax, 0xfffffffe
inc eax
inc eax
push eax
push dword [ebp + 8]
call fcn.0f02dabf
jmp 0xf02ded9
push edi
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [esi + 0x1e8]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp + 0xc]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0xf02ded0
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
mov dword [ebp - 4], eax
cmp eax, 0x3e5
jne 0xf02debf
push 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0xf02deba
mov dword [ebp - 4], ebx
jmp 0xf02ded0
call edi
mov dword [ebp - 4], eax
cmp eax, ebx
je 0xf02ded0
push ebx
lea eax, [ebp - 4]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ClearCommError]
push dword [ebp + 8]
call fcn.0f01ce6d
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0xf02ef8d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0xf002e6c
push 0x80000002
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xf02efde
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0xf002e5c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [ebp - 4], esi
pop esi
je 0xf02efed
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
cmp dword [ebp - 8], eax
jne 0xf02effc
mov dword [0xf07ec34], eax
leave
ret
xor eax, eax
leave
ret

Function at 0xf02f005
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0xf072008]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x6c]
push eax
push 1
push 0
push 0xf002ea8
push 0x80000002
mov dword [ebp - 0x70], 0x64
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0xf02f046
mov eax, dword [ebp + 8]
mov eax, dword [eax*8 + 0xf0755c0]
jmp 0xf02f08e
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x68]
push eax
push 0
push 0
shl esi, 3
push dword [esi + 0xf0755bc]
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x6c]
test eax, eax
je 0xf02f07d
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esi + 0xf0755c0]
jmp 0xf02f08d
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x68]
push eax
call fcn.0f00d0b8
pop ecx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0f0057d5
leave
ret 4
Function at 0xf02fdc3
Capabilities:
Manipulate console buffer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push 0x462
call fcn.0f04451f
movzx eax, al
lea eax, [eax + eax + 0x450]
push eax
call fcn.0f044532
mov esi, dword [0xf0ad99c]
movzx eax, ax
mov ecx, eax
shr ax, 8
movsx edx, ax
imul edx, esi
mov word [ebp - 2], ax
mov eax, dword [0xf0ad9ac]
and ecx, 0xff
cmp edx, eax
mov word [ebp - 4], cx
jl 0xf02fe18
cdq
idiv esi
dec eax
mov word [ebp - 2], ax
mov eax, dword [0xf0ad9b0]
movsx edx, cx
mov ecx, dword [0xf0ad998]
imul edx, ecx
cmp edx, eax
jl 0xf02fe35
cdq
idiv ecx
dec eax
mov word [ebp - 4], ax
cmp dword [0xf082d98], 0
jne 0xf02fe75
push dword [ebp - 4]
push dword [0xf0ad920]
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
test eax, eax
jne 0xf02fe75
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 6
je 0xf02fe75
push 0xae5
push 0xf002fe8
call esi
push eax
push 0x3e9
call fcn.0f02cb1f
pop esi
leave
ret
Function at 0xf034036
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
imul esi, esi, 0x28
xor ebx, ebx
add esi, 0xf0ad840
cmp byte [ebp + 0xc], bl
jne 0xf0340e1
mov byte [esi + 0x25], bl
cmp byte [ebp + 0xc], bl
push ebx
sete al
dec al
and al, 0x4c
add al, 0x40
add al, byte [ebp + 8]
mov dword [esi + 0x10], ebx
movzx eax, al
push eax
call fcn.0f02f0e6
push 0x400
mov dword [ebp - 4], eax
call fcn.0f005706
pop ecx
mov dword [esi + 0x20], eax
cmp eax, ebx
je 0xf0340ea
xor eax, eax
cmp byte [ebp + 0xc], bl
push ebx
setne al
push 0x80
push 4
push ebx
mov dword [esi + 0x14], 0x3fc
mov byte [esi + 0x24], bl
mov byte [esi + 0x1c], bl
dec eax
and eax, 2
push eax
push 0x40000000
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
jne 0xf0340ee
push dword [esi + 0x20]
call fcn.0f00996a
pop ecx
cmp byte [ebp + 0xc], bl
je 0xf0340ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0xf0340ea
mov byte [esi + 0x25], 1
jmp 0xf0340ea
cmp byte [esi + 0x25], bl
je 0xf034058
xor eax, eax
jmp 0xf03415d
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [esi + 0x18], eax
cmp byte [ebp + 0xc], bl
je 0xf034116
cmp eax, 2
je 0xf034116
push dword [esi + 0x20]
call fcn.0f00996a
pop ecx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0xf0340ea
mov eax, dword [0xf0ad8bc]
mov ecx, dword [ebp + 8]
push ebx
add eax, ecx
push eax
mov byte [esi + 0x1c], 1
call fcn.0f044546
mov al, byte [ebp + 0xc]
mov byte [esi + 0x24], al
cmp al, bl
je 0xf03414e
push 1
push dword [esi + 4]
mov dword [esi + 0x14], 0x3fc
push dword [ebp + 8]
call fcn.0f042fc0
mov byte [esi + 0x26], bl
jmp 0xf034152
mov byte [esi + 0x26], 1
push dword [ebp + 8]
call fcn.0f033fe8
xor eax, eax
inc eax
pop esi
pop ebx
leave
ret 8

Function at 0xf03418a
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
imul esi, esi, 0x28
xor ebx, ebx
add esi, 0xf0ad840
push ebx
lea eax, [ebp + 8]
push eax
cmp byte [esi + 0x24], bl
je 0xf0341c7
push ebx
push ebx
push dword [esi + 0x10]
push dword [esi + 0x20]
push 0x2c0004
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
xor eax, eax
inc eax
mov dword [esi + 0x10], ebx
jmp 0xf0341ee
push dword [esi + 0x10]
push dword [esi + 0x20]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0xf0341c2
cmp dword [esi + 0x18], 3
mov dword [esi + 0x10], ebx
jne 0xf0341eb
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
inc eax
pop esi
pop ebx
pop ebp
ret 4
Function at 0xf035194
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
movzx esi, byte [ebp + 8]
push edi
imul esi, esi, 0x12c
push dword [0xf0ad82c]
mov ebx, 0x200
push ebx
xor edi, edi
push edi
push dword [ebp + 8]
add esi, 0xf0ad4c0
call fcn.0f035053
cmp eax, ebx
je 0xf0351e9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xf003054
mov dword [0xf082c38], eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x64
pop eax
mov ecx, eax
mov word [esi + 0x12], cx
jmp 0xf035235
mov eax, dword [0xf0ad82c]
mov cl, byte [eax]
cmp cl, 0x69
je 0xf035205
cmp cl, 0xe9
je 0xf035205
cmp cl, 0xeb
jne 0xf03521f
cmp byte [eax + 2], 0x90
jne 0xf03521f
mov cl, byte [eax + 0x15]
and cl, 0xf0
cmp cl, 0xf0
jne 0xf03521f
movzx edi, byte [eax + 0x14]
movzx eax, byte [eax + 0x13]
shl edi, 8
add edi, eax
jmp 0xf035269
mov dword [ebp - 4], 0xf075c28
cmp dword [0xf075c28], edi
jne 0xf035241
push 0x64
pop eax
mov word [esi + 0x12], ax
pop edi
pop esi
pop ebx
leave
ret 4
mov eax, dword [0xf0ad82c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
push ebx
shl eax, 9
push eax
push dword [ebp + 8]
call fcn.0f035053
cmp eax, ebx
jne 0xf035269
mov eax, dword [ebp - 4]
mov edi, dword [eax]
add eax, 4
inc edi
cmp dword [eax], 0
mov dword [ebp - 4], eax
jne 0xf03523c
test edi, edi
je 0xf03522e
cmp edi, 0x2d0
je 0xf03529e
cmp edi, 0x5a0
je 0xf03529e
cmp edi, 0x960
je 0xf035295
cmp edi, 0xb40
je 0xf035295
cmp edi, 0x1680
je 0xf03529a
xor eax, eax
inc eax
jmp 0xf035231
push 2
jmp 0xf035230
xor eax, eax
jmp 0xf035231
Function at 0xf035995
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1f8
mov eax, dword [0xf072008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, 0xf0030e8
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
add byte [ebp - 8], bl
movzx edi, bl
mov esi, edi
imul esi, esi, 0x12c
lea eax, [ebp - 0xc]
push eax
add esi, 0xf0ad4c0
or dword [esi], 0xffffffff
lea eax, [esi + 0x25]
push 0x104
push eax
call fcn.0f00a32c
add esp, 0xc
xor eax, eax
push ebx
mov word [esi + 4], ax
call fcn.0f034978
xor ebx, ebx
mov dword [esi], eax
cmp eax, ebx
jne 0xf035a03
xor eax, eax
jmp 0xf035b34
push 0x11
push 4
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push eax
call sub.ntdll.dll_NtQueryInformationFile
test eax, eax
jge 0xf035a21
push esi
call fcn.0f034956
jmp 0xf0359fc
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x1c], eax
cmp eax, dword [0xf082ca4]
jbe 0xf035a34
mov dword [0xf082ca4], eax
push 0x1e0
lea eax, [ebp - 0x1f8]
push eax
push ebx
push ebx
push 0x70c00
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push ebx
push dword [esi]
call sub.ntdll.dll_NtDeviceIoControlFile
push esi
test eax, eax
jl 0xf035a1a
call fcn.0f034956
mov eax, dword [ebp - 0x14]
push 0x18
xor edx, edx
pop ecx
div ecx
cmp eax, ebx
je 0xf035ac7
mov ecx, eax
imul ecx, ecx, 0x18
lea edx, [ebp + ecx - 0x208]
mov ecx, dword [edx]
dec ecx
je 0xf035ab8
dec ecx
je 0xf035aad
dec ecx
je 0xf035aa9
dec ecx
dec ecx
je 0xf035a95
dec ecx
jne 0xf035abf
cmp word [esi + 4], 2
je 0xf035abf
inc ecx
jmp 0xf035abb
movzx ecx, word [esi + 4]
cmp cx, 4
je 0xf035abf
cmp cx, 5
je 0xf035abf
push 3
jmp 0xf035aba
push 5
jmp 0xf035aba
cmp word [esi + 4], 5
je 0xf035abf
push 4
jmp 0xf035aba
push 2
pop ecx
mov word [esi + 4], cx
dec eax
sub edx, 0x18
cmp eax, ebx
jne 0xf035a79
cmp word [esi + 4], bx
je 0xf0359fc
mov eax, edi
imul eax, eax, 0x1c
mov dword [eax + 0xf0acb80], 0xf0357d0
mov dword [eax + 0xf0acb84], 0xf034bf2
mov dword [eax + 0xf0acb88], 0xf034c27
mov dword [eax + 0xf0acb8c], 0xf034ca4
mov dword [eax + 0xf0acb90], 0xf034c5b
mov dword [eax + 0xf0acb94], 0xf03500b
mov dword [eax + 0xf0acb98], 0xf034fa7
xor eax, eax
mov word [esi + 0xe], ax
mov byte [esi + 0x22], bl
mov byte [esi + 0x21], bl
mov byte [esi + 0x23], 1
mov byte [esi + 0x24], 2
mov byte [esi + 0xd], bl
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0f0057d5
leave
ret 4
Function at 0xf036112
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0xffffffff
push ebx
push esi
push edi
je 0xf036160
mov eax, dword [ebp + 0xc]
test eax, eax
je 0xf036160
push 0
lea ecx, [eax + 4]
push ecx
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0xf036160
mov ebx, dword [ebp + 0x10]
mov esi, 0x9000
cmp ebx, esi
ja 0xf03614c
mov esi, ebx
cmp dword [0xf0ad4bc], 0
je 0xf036169
call fcn.0f036026
mov edi, eax
test edi, edi
jne 0xf03616c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10
mov edi, dword [ebp + 0x14]
and dword [ebp + 0xc], 0
jmp 0xf0361b4
cmp ebx, esi
jae 0xf036178
mov esi, ebx
push 0
lea eax, [ebp - 4]
push eax
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0xf0361b8
cmp dword [ebp - 4], esi
jne 0xf0361b8
cmp dword [0xf0ad4bc], 0
je 0xf0361ad
push esi
push edi
push dword [ebp + 0x14]
call fcn.0f0057f0
add esp, 0xc
add dword [ebp + 0x14], esi
jmp 0xf0361af
add edi, esi
sub ebx, esi
add dword [ebp + 0xc], esi
test ebx, ebx
jne 0xf036172
mov eax, dword [ebp + 0xc]
jmp 0xf036162

Function at 0xf0361c2
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0xffffffff
push ebx
push esi
push edi
je 0xf03620c
mov eax, dword [ebp + 0xc]
push 0
lea ecx, [eax + 4]
push ecx
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0xf03620c
mov edi, dword [ebp + 0x10]
mov esi, 0x9000
cmp edi, esi
ja 0xf0361f8
mov esi, edi
cmp dword [0xf0ad4bc], 0
je 0xf036215
call fcn.0f036026
mov ebx, eax
test ebx, ebx
jne 0xf036218
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10
mov ebx, dword [ebp + 0x14]
and dword [ebp + 0xc], 0
jmp 0xf036261
cmp edi, esi
jae 0xf036224
mov esi, edi
cmp dword [0xf0ad4bc], 0
je 0xf03623c
push esi
push dword [ebp + 0x14]
push ebx
call fcn.0f0057f0
add esp, 0xc
jmp 0xf03623f
mov ebx, dword [ebp + 0x14]
push 0
lea eax, [ebp - 4]
push eax
push esi
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0xf036265
cmp dword [ebp - 4], esi
jne 0xf036265
add dword [ebp + 0x14], esi
sub edi, esi
add dword [ebp + 0xc], esi
test edi, edi
jne 0xf03621e
mov eax, dword [ebp + 0xc]
jmp 0xf03620e
Function at 0xf036fce
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0xf072008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0xf0031d0]
push ebx
xor ebx, ebx
push edi
mov edi, dword [0xf0031cc]
mov dword [ebp - 8], eax
cmp byte [0xf0ad200], bl
je 0xf0370b3
push esi
push 0x44
pop esi
push esi
lea eax, [ebp - 0x27c]
push ebx
push eax
call fcn.0f0060e0
mov ecx, 0xf0ad200
mov eax, ecx
mov dword [ebp - 0x27c], esi
add esp, 0xc
mov dword [ebp - 0x228], 0x20632f
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0xf037030
sub eax, esi
inc eax
push eax
push ecx
lea eax, [ebp - 0x225]
push eax
call fcn.0f0057f0
mov esi, dword [0xf07df68]
add esp, 0xc
cmp esi, 0x110
jae 0xf0370b2
push esi
push dword [0xf07df64]
lea eax, [ebp - 0x11c]
push eax
call fcn.0f0057f0
mov eax, dword [ebp - 8]
add esp, 0xc
mov byte [ebp + esi - 0x11c], 0x5c
mov dword [ebp + esi - 0x11b], edi
mov dword [ebp + esi - 0x117], eax
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x27c]
push eax
push ebx
push ebx
push 0x10
push 1
push ebx
push ebx
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0f0057d5
leave
ret

Function at 0xf037693
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push esi
xor esi, esi
cmp dword [0xf07df54], esi
je 0xf0376a6
pop esi
jmp fcn.0f02d021
cmp dword [0xf082db0], esi
jne 0xf03770e
cmp dword [0xf0754f0], esi
je 0xf03770e
cmp dword [0xf082b84], esi
jne 0xf03770e
push 0xf0ad9cc
push dword [0xf0ad920]
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0xf0376ee
push 0x76f
push 0xf003198
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x3e9
call fcn.0f02cb1f
call fcn.0f0114c7
movzx eax, word [0xf07cf28]
movzx ecx, word [0xf07cf34]
shl eax, 4
push 2
add eax, ecx
push eax
call fcn.0f044546
call fcn.0f031155
push dword [0xf0ad4a4]
and dword [0xf082d9c], 0xfffdffff
call dword [sym.imp.KERNEL32.dll_ResetEvent]
call fcn.0f03b792
call fcn.0f02ee85
push esi
push dword [0xf0adac4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call fcn.0f029e0a
call fcn.0f02ab37
cmp dword [0xf0ad950], 2
je 0xf037763
call fcn.0f030d9d
push dword [0xf0ad9bc]
call fcn.0f032ea4
call sym.ntvdm.exe_ResumeTimerThread
cmp dword [0xf07df54], esi
jne 0xf037775
call fcn.0f0369f5
call fcn.0f02804a
push dword [0xf0ad308]
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop esi
ret
Function at 0xf037b88
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebx
push esi
push edi
xor esi, esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0xf0ad1e4], eax
mov ebx, 0xf003198
mov edi, 0x3e9
jne 0xf037bc0
push 0x113
push ebx
call esi
push eax
push edi
call fcn.0f02cb1f
push 0
push 1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0xf0ad4b4], eax
test eax, eax
jne 0xf037be6
push 0x11d
push ebx
call esi
push eax
push edi
call fcn.0f02cb1f
xor eax, eax
push eax
push eax
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0xf0ad4ac], eax
test eax, eax
jne 0xf037c0b
push 0x120
push ebx
call esi
push eax
push edi
call fcn.0f02cb1f
push 0
push 1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0xf0ad4a8], eax
test eax, eax
jne 0xf037c31
push 0x123
push ebx
call esi
push eax
push edi
call fcn.0f02cb1f
xor eax, eax
push eax
push eax
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
xor ecx, ecx
mov dword [0xf0ad4a4], eax
cmp eax, ecx
jne 0xf037c5a
push 0x126
push ebx
call esi
push eax
push edi
call fcn.0f02cb1f
xor ecx, ecx
cmp dword [0xf07df54], ecx
jne 0xf037d55
push ecx
push ecx
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0xf0ad308], eax
test eax, eax
jne 0xf037c88
push 0x133
push ebx
call esi
push eax
push edi
call fcn.0f02cb1f
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0xf0ad30c], eax
test eax, eax
jne 0xf037cac
push 0x136
push ebx
call esi
push eax
push edi
call fcn.0f02cb1f
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0xf0ad1e0], eax
test eax, eax
jne 0xf037cd0
push 0x139
push ebx
call esi
push eax
push edi
call fcn.0f02cb1f
push 1
push 0xf03698a
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
test eax, eax
jne 0xf037cf0
push 0x13f
push ebx
call esi
push eax
push edi
call fcn.0f02cb1f
push 0xf0adc94
push 4
push 0
push 0xf037abb
push 0x2000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0xf0adc90], eax
test eax, eax
jne 0xf037d23
push 0x148
push ebx
call esi
push eax
push edi
call fcn.0f02cb1f
call fcn.0f03696a
mov esi, 0x640
jmp 0xf037d3d
push 0xf001d82
push 3
push 7
call fcn.0f02c789
push esi
call fcn.0f005706
mov dword [0xf082cbc], eax
pop ecx
test eax, eax
je 0xf037d2f
pop edi
pop esi
pop ebx
jmp fcn.0f0364b4
pop edi
pop esi
pop ebx
ret
Function at 0xf03989a
Capabilities:
Allocate or change rwx memory
Map section object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [0xf0ad1b8]
mov dword [ebp + 0xc], ecx
test esi, esi
je 0xf0398d3
mov dx, word [ebp + 8]
cmp word [esi + 8], dx
jne 0xf0398c8
cmp ecx, dword [esi]
jne 0xf0398c8
mov eax, dword [ebp + 0x10]
cmp eax, dword [esi + 4]
je 0xf0398cf
mov esi, dword [esi + 0x10]
test esi, esi
jne 0xf0398b6
test esi, esi
jne 0xf0398e5
push 0x1e7
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0xf0399bb
mov eax, dword [esi + 4]
and dword [ebp - 4], 0
add ecx, 0xfff40000
mov dword [ebp - 8], ecx
movzx ecx, dx
sub ecx, 0xfffa
push edi
mov dword [ebp + 8], eax
je 0xf039932
dec ecx
dec ecx
je 0xf039912
push 0x1e7
jmp 0xf03999a
push 0x40
push 0x1000
lea eax, [ebp + 8]
push eax
push 0
lea eax, [ebp + 0xc]
push eax
push 0xffffffffffffffff
call sub.ntdll.dll_NtAllocateVirtualMemory
test eax, eax
jge 0xf0399a4
push 0xe
jmp 0xf03999a
shr eax, 0xc
movzx edi, ax
jmp 0xf039955
push dword [ebp + 0xc]
push 0xffffffffffffffff
call sub.ntdll.dll_NtUnmapViewOfSection
test eax, eax
jl 0xf039998
add edi, 0xffff
add dword [ebp + 0xc], 0x1000
test di, di
ja 0xf03993a
mov eax, dword [esi]
push 0x40
push 0x40000000
push 2
sub eax, 0xc0000
mov dword [ebp - 8], eax
mov eax, dword [esi]
lea ecx, [ebp + 8]
push ecx
mov dword [ebp + 0xc], eax
mov eax, dword [esi + 4]
lea ecx, [ebp - 8]
push ecx
push eax
push 0
mov dword [ebp + 8], eax
lea eax, [ebp + 0xc]
push eax
push 0xffffffffffffffff
push dword [0xf0ad1b4]
call sub.ntdll.dll_NtMapViewOfSection
test eax, eax
jge 0xf0399a4
push 5
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0xf0399ba
push dword [esi + 4]
mov eax, 0xfffd
push dword [esi]
mov word [esi + 8], ax
call fcn.0f056bc2
xor eax, eax
inc eax
pop edi
pop esi
leave
ret 0xc
Function at 0xf0399c5
Capabilities:
Allocate or change rwx memory
Map section object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [0xf0ad1b8]
mov dword [ebp + 8], edx
test edi, edi
je 0xf039a0b
mov eax, dword [ebp + 0xc]
mov ecx, 0xfffa
cmp word [edi + 8], cx
jne 0xf039a00
mov ecx, dword [edi]
mov ebx, dword [edi + 4]
lea esi, [edx + eax]
add ebx, ecx
cmp ebx, esi
jb 0xf039a00
cmp ecx, esi
jbe 0xf039a07
mov edi, dword [edi + 0x10]
test edi, edi
jne 0xf0399e3
test edi, edi
jne 0xf039a1d
push 0x1e7
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0xf039abe
mov ecx, edx
sub ecx, dword [edi]
and dword [ebp - 8], 0
xor ebx, ebx
shr eax, 0xc
movzx eax, ax
shr ecx, 0xc
inc ebx
add edx, 0xfff40000
shl ebx, cl
mov esi, 0x1000
mov dword [ebp - 4], esi
mov dword [ebp + 0xc], eax
mov dword [ebp - 0xc], edx
test ax, ax
jbe 0xf039abb
test dword [edi + 0xc], ebx
jne 0xf039a6e
push 0x40
push esi
lea eax, [ebp - 4]
push eax
push 0
lea eax, [ebp + 8]
push eax
push 0xffffffffffffffff
call sub.ntdll.dll_NtAllocateVirtualMemory
test eax, eax
jl 0xf039ac5
or dword [edi + 0xc], ebx
jmp 0xf039aa5
push dword [ebp + 8]
push 0xffffffffffffffff
call sub.ntdll.dll_NtUnmapViewOfSection
test eax, eax
jl 0xf039acc
push 0x40
push 0x40000000
push 2
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push 0
lea eax, [ebp + 8]
push eax
push 0xffffffffffffffff
push dword [0xf0ad1b4]
call sub.ntdll.dll_NtMapViewOfSection
test eax, eax
jl 0xf039ac5
add dword [ebp + 0xc], 0xffff
add dword [ebp - 0xc], esi
add dword [ebp + 8], esi
add ebx, ebx
cmp word [ebp + 0xc], 0
ja 0xf039a4c
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8
push 0xe
jmp 0xf039a10
push 5
jmp 0xf039a10
Function at 0xf039ad8
Capabilities:
Allocate or change rwx memory
Map section object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [0xf0ad1b8]
push edi
mov dword [ebp + 8], eax
test esi, esi
je 0xf039b1e
mov ecx, dword [ebp + 0xc]
mov edx, 0xfffa
cmp word [esi + 8], dx
jne 0xf039b13
mov edx, dword [esi]
mov ebx, dword [esi + 4]
lea edi, [eax + ecx]
add ebx, edx
cmp ebx, edi
jb 0xf039b13
cmp edx, edi
jbe 0xf039b1a
mov esi, dword [esi + 0x10]
test esi, esi
jne 0xf039af6
test esi, esi
jne 0xf039b30
push 0x1e7
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0xf039bb1
shr ecx, 0xc
movzx edx, cx
mov ebx, 0x1000
mov ecx, eax
mov dword [ebp - 4], ebx
sub ecx, dword [esi]
and dword [ebp - 8], 0
sub eax, dword [esi]
xor edi, edi
shr ecx, 0xc
inc edi
shl edi, cl
mov dword [ebp + 0xc], edx
mov dword [ebp - 0xc], eax
test dx, dx
jbe 0xf039bae
test dword [esi + 0xc], edi
je 0xf039b98
push dword [ebp + 8]
push 0xffffffffffffffff
call sub.ntdll.dll_NtUnmapViewOfSection
test eax, eax
jl 0xf039bb8
push 0x40
push 0x40000000
push 2
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp + 8]
push eax
push 0xffffffffffffffff
push dword [0xf0ad1b4]
call sub.ntdll.dll_NtMapViewOfSection
test eax, eax
jl 0xf039bb8
add dword [ebp + 0xc], 0xffff
add dword [ebp - 0xc], ebx
add dword [ebp + 8], ebx
add edi, edi
cmp word [ebp + 0xc], 0
ja 0xf039b5b
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8
push 5
jmp 0xf039b23