joyce8/EMBER2024-capa huggingface dataset:
Function at 0x63b640
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push eax
push ebx
cmp ecx, 0
je 0x63b71f
and ebp, 0xfffffff8
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
je 0x63b6b5
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.0063ae00
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x63b67f
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x63b7d6
call 0x63b6c7
pop edx
lea ecx, [edx + 0x139]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x63b777
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.0063b220
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x63b72c
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x63b7d6
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.0063b220
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x63b7d4
jmp 0x63b7d6
mov ecx, dword [esp + 0x3c]
add esp, 0x18
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x63baf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [esp + 0x64]
mov ebx, dword [esp + 0x60]
mov edi, dword [eax]
mov eax, dword [esp + 0x60]
mov ebx, dword [ebx + 4]
mov eax, dword [eax]
mov edx, ebx
mov dword [esp + 0x18], ebx
mov ecx, eax
mov dword [esp + 0x1c], eax
bswap edx
mov ebp, edx
bswap ecx
mov esi, ecx
movzx eax, cl
mov dword [esp + 0x28], ecx
shr esi, 0x10
movzx ecx, ch
shl eax, 8
mov dword [esp + 0x2c], edx
or eax, ecx
mov ecx, esi
shr ebp, 0x10
movzx esi, cl
shl eax, 8
mov ebx, ebp
or eax, esi
movzx ebx, bl
movzx esi, byte [esp + 0x1c]
shl eax, 8
mov ebp, eax
movzx eax, dl
movzx edx, dh
shl eax, 8
or ebp, esi
or eax, edx
mov edx, dword [esp + 0x58]
mov dword [esp + 0x20], ebp
mov ecx, eax
shl ecx, 8
or ecx, ebx
movzx ebx, byte [esp + 0x18]
shl ecx, 8
or ecx, ebx
mov dword [esp + 0x24], ecx
test edx, edx
je 0x63bca3
mov esi, dword [esp + 0x50]
mov ebp, dword [esp + 0x54]
mov dword [esp + 0x1c], 0
jmp 0x63bbbe
add ebp, 1
movzx eax, byte [esi]
xor al, byte [esp + edi + 0x20]
add esi, 1
mov byte [ebp - 1], al
mov eax, dword [esp + 0x50]
add edi, 1
and edi, 7
sub eax, esi
add eax, dword [esp + 0x58]
je 0x63bc48
test edi, edi
jne 0x63bb98
mov eax, dword [esp + 0x5c]
mov dword [esp + 4], eax
lea eax, [esp + 0x28]
mov dword [esp], eax
call fcn.0063ae00
movzx edx, byte [esp + 0x28]
mov ebx, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
movzx ebx, bh
shl edx, 8
add dword [esp + 0x1c], 1
shr eax, 0x10
or edx, ebx
mov ebx, dword [esp + 0x2c]
shr ecx, 0x10
movzx eax, al
shl edx, 8
movzx ecx, cl
or edx, eax
movzx eax, byte [esp + 0x2c]
movzx ebx, bh
shl eax, 8
or eax, ebx
shl eax, 8
or eax, ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x28]
shld edx, eax, 8
mov eax, dword [esp + 0x18]
mov ecx, edx
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x20], ecx
shld eax, edx, 8
mov dword [esp + 0x24], eax
jmp 0x63bb98
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x63bca3
mov ebp, dword [esp + 0x28]
mov esi, dword [esp + 0x2c]
mov ebx, ebp
mov eax, ebp
mov ecx, esi
shr eax, 0x10
movzx edx, bl
mov ebx, ebp
shr ecx, 0x10
movzx ebx, bh
shl edx, 8
movzx eax, al
movzx ecx, cl
or edx, ebx
mov ebx, esi
shl edx, 8
movzx ebx, bh
or edx, eax
mov eax, esi
movzx eax, al
shld edx, ebp, 8
shl eax, 8
or eax, ebx
shl eax, 8
or eax, ecx
shld eax, esi, 8
mov ebx, eax
mov eax, dword [esp + 0x60]
mov dword [eax], edx
mov dword [eax + 4], ebx
mov eax, dword [esp + 0x64]
mov dword [eax], edi
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x63bcc0
Capabilities:
Encode data using xor
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
mov esi, 0x6d80a0
push ebx
sub esp, 0x3c
mov edx, dword [0x6d80a0]
mov ebx, dword [esp + 0x50]
mov eax, dword [esp + 0x54]
mov ebp, dword [esp + 0x58]
mov dword [ebx], edx
mov edx, dword [0x6d90e4]
lea edi, [ebx + 4]
and edi, 0xfffffffc
mov dword [ebx + 0x1044], edx
mov edx, ebx
sub edx, edi
sub esi, edx
lea ecx, [edx + 0x1048]
mov edx, 0x48
shr ecx, 2
cmp eax, edx
rep movsd dword es:[edi], dword [esi]
cmovg eax, edx
lea edx, [ebx + 0x48]
mov dword [esp + 0x50], ebx
mov dword [esp + 0x1c], edx
mov esi, ebx
mov ebx, edx
lea edi, [ebp + eax]
mov eax, ebp
lea esi, [esi]
lea ecx, [eax + 1]
movzx eax, byte [eax]
cmp ecx, edi
cmovae ecx, ebp
shl eax, 8
lea edx, [ecx + 1]
movzx ecx, byte [ecx]
or eax, ecx
cmp edx, edi
cmovae edx, ebp
shl eax, 8
lea ecx, [edx + 1]
movzx edx, byte [edx]
or edx, eax
cmp ecx, edi
cmovae ecx, ebp
shl edx, 8
lea eax, [ecx + 1]
movzx ecx, byte [ecx]
or ecx, edx
cmp eax, edi
cmovae eax, ebp
xor dword [esi], ecx
add esi, 4
cmp ebx, esi
jne 0x63bd28
mov ebx, dword [esp + 0x50]
mov dword [esp + 0x28], 0
lea edi, [esp + 0x28]
mov dword [esp + 0x2c], 0
mov ebp, dword [esp + 0x1c]
mov esi, ebx
lea esi, [esi]
mov dword [esp + 4], ebx
add esi, 8
mov dword [esp], edi
call fcn.0063ae00
movq xmm1, qword [esp + 0x28]
movq qword [esi - 8], xmm1
cmp ebp, esi
jne 0x63bd90
mov esi, dword [esp + 0x1c]
lea ebp, [ebx + 0x1048]
lea esi, cs:[esi]
mov dword [esp + 4], ebx
add esi, 8
mov dword [esp], edi
call fcn.0063ae00
movq xmm0, qword [esp + 0x28]
movq qword [esi - 8], xmm0
cmp esi, ebp
jne 0x63bdc0
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x63be70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [esp + 0x34]
mov esi, dword [esp + 0x38]
mov eax, dword [ebx + 4]
mov edx, dword [esi + 4]
cmp eax, edx
jge 0x63be91
mov eax, edx
mov edx, ebx
mov ebx, esi
mov esi, edx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call fcn.0045c2d0
test eax, eax
je 0x63bf18
mov eax, dword [esi + 4]
test eax, eax
jle 0x63bf28
mov eax, dword [esp + 0x30]
mov ebp, dword [ebx]
mov edi, dword [esi]
mov ecx, dword [eax]
xor eax, eax
lea esi, cs:[esi]
mov edx, dword [ebp + eax*4]
xor edx, dword [edi + eax*4]
mov dword [ecx + eax*4], edx
add eax, 1
cmp dword [esi + 4], eax
jg 0x63bec0
mov edx, dword [ebx + 4]
cmp edx, eax
jle 0x63bef8
mov edi, dword [esp + 0x30]
mov esi, dword [ebx]
mov ecx, dword [edi]
lea esi, [esi]
mov edx, dword [esi + eax*4]
mov dword [ecx + eax*4], edx
mov edx, dword [ebx + 4]
add eax, 1
cmp edx, eax
jg 0x63bee8
mov eax, dword [esp + 0x30]
mov dword [eax + 4], edx
mov dword [esp], eax
call fcn.0045c530
add esp, 0x1c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x1c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
jmp 0x63bed2
Function at 0x63f2f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [esp + 0x64]
mov ebx, dword [esp + 0x60]
mov edi, dword [eax]
mov eax, dword [esp + 0x60]
mov ebx, dword [ebx + 4]
mov eax, dword [eax]
mov edx, ebx
mov dword [esp + 0x18], ebx
mov ecx, eax
mov dword [esp + 0x1c], eax
bswap edx
mov ebp, edx
bswap ecx
mov esi, ecx
movzx eax, cl
mov dword [esp + 0x28], ecx
shr esi, 0x10
movzx ecx, ch
shl eax, 8
mov dword [esp + 0x2c], edx
or eax, ecx
mov ecx, esi
shr ebp, 0x10
movzx esi, cl
shl eax, 8
mov ebx, ebp
or eax, esi
movzx ebx, bl
movzx esi, byte [esp + 0x1c]
shl eax, 8
mov ebp, eax
movzx eax, dl
movzx edx, dh
shl eax, 8
or ebp, esi
or eax, edx
mov edx, dword [esp + 0x58]
mov dword [esp + 0x20], ebp
mov ecx, eax
shl ecx, 8
or ecx, ebx
movzx ebx, byte [esp + 0x18]
shl ecx, 8
or ecx, ebx
mov dword [esp + 0x24], ecx
test edx, edx
je 0x63f4a3
mov esi, dword [esp + 0x50]
mov ebp, dword [esp + 0x54]
mov dword [esp + 0x1c], 0
jmp 0x63f3be
add ebp, 1
movzx eax, byte [esi]
xor al, byte [esp + edi + 0x20]
add esi, 1
mov byte [ebp - 1], al
mov eax, dword [esp + 0x50]
add edi, 1
and edi, 7
sub eax, esi
add eax, dword [esp + 0x58]
je 0x63f448
test edi, edi
jne 0x63f398
mov eax, dword [esp + 0x5c]
mov dword [esp + 4], eax
lea eax, [esp + 0x28]
mov dword [esp], eax
call fcn.0063e600
movzx edx, byte [esp + 0x28]
mov ebx, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
movzx ebx, bh
shl edx, 8
add dword [esp + 0x1c], 1
shr eax, 0x10
or edx, ebx
mov ebx, dword [esp + 0x2c]
shr ecx, 0x10
movzx eax, al
shl edx, 8
movzx ecx, cl
or edx, eax
movzx eax, byte [esp + 0x2c]
movzx ebx, bh
shl eax, 8
or eax, ebx
shl eax, 8
or eax, ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x28]
shld edx, eax, 8
mov eax, dword [esp + 0x18]
mov ecx, edx
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x20], ecx
shld eax, edx, 8
mov dword [esp + 0x24], eax
jmp 0x63f398
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x63f4a3
mov ebp, dword [esp + 0x28]
mov esi, dword [esp + 0x2c]
mov ebx, ebp
mov eax, ebp
mov ecx, esi
shr eax, 0x10
movzx edx, bl
mov ebx, ebp
shr ecx, 0x10
movzx ebx, bh
shl edx, 8
movzx eax, al
movzx ecx, cl
or edx, ebx
mov ebx, esi
shl edx, 8
movzx ebx, bh
or edx, eax
mov eax, esi
movzx eax, al
shld edx, ebp, 8
shl eax, 8
or eax, ebx
shl eax, 8
or eax, ecx
shld eax, esi, 8
mov ebx, eax
mov eax, dword [esp + 0x60]
mov dword [eax], edx
mov dword [eax + 4], ebx
mov eax, dword [esp + 0x64]
mov dword [eax], edi
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x641520
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [esp + 0x74]
mov esi, dword [esp + 0x64]
mov eax, dword [eax]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x70]
mov edx, dword [eax + 4]
mov eax, dword [eax]
mov ecx, eax
mov edi, eax
mov dword [esp + 0x2c], edx
shr edi, 0x10
mov dword [esp + 0x24], edx
movzx ebp, cl
mov dword [esp + 0x3c], edx
mov edx, ecx
mov ebx, edi
shr edx, 0x18
movzx edi, bl
mov dword [esp + 0x28], eax
shl edx, 8
mov dword [esp + 0x20], eax
or edx, edi
mov dword [esp + 0x38], eax
movzx edi, ch
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x2c]
shl edx, 8
shr eax, 0x10
or edx, edi
movzx edi, byte [esp + 0x2c]
shr ecx, 0x18
movzx eax, al
shl edx, 8
shl ecx, 8
mov ebx, edx
or ecx, eax
mov eax, dword [esp + 0x2c]
or ebx, ebp
shl ecx, 8
mov dword [esp + 0x30], ebx
movzx eax, ah
or ecx, eax
mov eax, dword [esp + 0x68]
shl ecx, 8
or ecx, edi
mov dword [esp + 0x34], ecx
test eax, eax
je 0x641646
mov ebp, dword [esp + 0x60]
mov ebx, dword [esp + 0x1c]
xor ecx, ecx
mov edx, dword [esp + 0x68]
mov edi, ebp
jmp 0x6415ef
add esi, 1
movzx eax, byte [ebp]
xor al, byte [esp + ebx + 0x30]
add ebp, 1
mov byte [esi - 1], al
mov eax, edi
add ebx, 1
sub eax, ebp
and ebx, 7
add eax, edx
je 0x641630
test ebx, ebx
jne 0x6415d0
mov eax, dword [esp + 0x6c]
mov dword [esp + 8], 1
mov dword [esp + 0x68], edx
mov dword [esp + 4], eax
lea eax, [esp + 0x38]
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call fcn.00595840
movq xmm0, qword [esp + 0x38]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x68]
movq qword [esp + 0x30], xmm0
add ecx, 1
jmp 0x6415d0
mov dword [esp + 0x1c], ebx
test ecx, ecx
je 0x641646
mov eax, dword [esp + 0x70]
movq xmm1, qword [esp + 0x38]
movq qword [eax], xmm1
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x74]
mov dword [eax], esi
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x64fdb0
Capabilities:
Get common file path

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x25c
mov eax, dword [0x74dfcc]
mov dword [esp + 0x24], str.getaddrinfo
movzx ebx, word [esp + 0x270]
mov dword [esp + 0x28], 0x64ffc0
mov dword [esp + 0x2c], str.getnameinfo
mov dword [esp + 0x30], 0x650380
mov dword [esp + 0x34], str.freeaddrinfo
mov dword [esp + 0x38], fcn.0064ff70
test eax, eax
je 0x64fe10
mov eax, dword [ebx*8 + 0x661244]
add esp, 0x25c
pop ebx
pop esi
pop edi
pop ebp
ret 4
lea esi, [esp + 0x3f]
mov dword [esp + 4], 0x104
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
sub esp, 8
test eax, eax
jne 0x64fe40
mov dword [0x74dfcc], 1
jmp 0x64fdfb
lea edi, [esp + 0x144]
mov dword [esp + 4], esi
mov dword [esp], edi
call sub.msvcrt.dll_strcpy
mov dword [esp], edi
call sub.msvcrt.dll_strlen
mov dword [edi + eax], 0x3273775c
mov dword [edi + eax + 4], 0x32335f
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esp], edi
mov dword [esp + 0x1c], eax
call eax
sub esp, 4
mov ebp, eax
test eax, eax
je 0x64fefc
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 4], str.getaddrinfo
mov dword [esp + 0x18], eax
call eax
sub esp, 8
test eax, eax
je 0x64fef0
lea esi, [esp + 0x24]
lea edi, [esp + 0x3c]
mov eax, dword [esi]
mov dword [esp], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x18]
call eax
mov dword [esi + 4], eax
sub esp, 8
test eax, eax
je 0x64ff56
add esi, 8
cmp esi, edi
jne 0x64fea6
mov eax, dword [esp + 0x28]
mov dword [0x661244], eax
mov eax, dword [esp + 0x30]
mov dword [0x66124c], eax
mov eax, dword [esp + 0x38]
mov dword [fcn.0064ff70], eax
jmp 0x64fe2c
mov dword [esp], ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
sub esp, 4
mov dword [esp + 4], esi
mov dword [esp], edi
call sub.msvcrt.dll_strcpy
mov dword [esp], edi
call sub.msvcrt.dll_strlen
mov dword [edi + eax], 0x6873775c
mov dword [edi + eax + 4], 0x367069
mov eax, dword [esp + 0x1c]
mov dword [esp], edi
call eax
sub esp, 4
mov ebp, eax
test eax, eax
je 0x64fe2c
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 4], str.getaddrinfo
mov dword [esp + 0x18], eax
call eax
sub esp, 8
test eax, eax
jne 0x64fe9e
mov dword [esp], ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
sub esp, 4
jmp 0x64fe2c
Function at 0x650900
Capabilities:
Resolve dns

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [esp + 0x50]
mov ebx, dword [esp + 0x54]
mov esi, dword [esp + 0x4c]
mov ebp, dword [esp + 0x48]
mov dword [ebx], 0
mov byte [eax], 0
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call dword [sym.imp.WSOCK32.DLL_gethostbyname]
sub esp, 4
test eax, eax
je 0x6509d8
cmp dword [eax + 8], 0x40002
mov ecx, eax
jne 0x6509a4
mov edi, dword [eax + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x6509a4
mov dword [esp + 0x1c], ecx
movzx esi, si
jmp 0x650964
add edi, 4
lea ebx, [eax + 0x1c]
mov eax, dword [edi]
test eax, eax
je 0x6509a0
mov eax, dword [eax]
mov dword [esp + 8], esi
mov dword [esp + 4], ebp
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x44]
mov dword [esp], eax
call fcn.006506b0
mov dword [ebx], eax
sub esp, 0x10
test eax, eax
jne 0x650958
add esp, 0x2c
mov eax, 8
pop ebx
pop esi
pop edi
pop ebp
ret 0x18
mov ecx, dword [esp + 0x1c]
mov dword [esp + 8], 0x400
mov eax, dword [ecx]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x50]
mov dword [esp], eax
call sub.msvcrt.dll_strncpy
mov eax, dword [esp + 0x50]
mov byte [eax + 0x400], 0
add esp, 0x2c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret 0x18
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
lea edx, [eax - 0x2afa]
cmp edx, 3
mov edx, 0x2af9
cmovae eax, edx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret 0x18

Function at 0x650c70
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.0065ec90
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.0065ec90
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]
Function at 0x650cd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x74dffc]
test esi, esi
jle 0x650df0
mov eax, dword [0x74e000]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x650d04
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x650d87
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x650cf0
mov dword [esp], ebx
call fcn.006516c0
mov edi, eax
test eax, eax
je 0x650e17
mov eax, dword [0x74e000]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00651800
mov edx, dword [0x74e000]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x650df7
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x650d80
lea edx, [eax - 0x40]
and edx, 0xffffffbf
jne 0x650d90
add dword [0x74dffc], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x74e000]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x650d80
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00650c70
lea esi, cs:[esi]
nop
xor esi, esi
jmp 0x650d0e
mov eax, dword [0x74e000]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00650c70
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00650c70
lea esi, cs:[esi]
nop

Function at 0x651330
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x74e018
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x74e010]
sub esp, 4
test ebx, ebx
je 0x651385
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
mov esi, eax
sub esp, 4
call edi
test esi, esi
je 0x65137e
test eax, eax
jne 0x65137e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x651360
mov dword [esp], 0x74e018
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6516c0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x6516e5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x6516f0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x6516e5
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x651738
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x65172e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x65173a
add ecx, 1
add eax, 0x28
cmp esi, ecx
jne 0x651720
xor eax, eax
pop ebx
pop esi
ret
Function at 0x4027fd
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
push ebx
push esi
push edi
push 0
push 3
mov esi, ecx
push 2
call dword [0x406610]
cmp eax, 0xffffffff
mov dword [esi + 0xa], eax
je 0x4028f0
lea eax, [ebp - 0x144]
push 0x100
push eax
call dword [0x40660c]
cmp eax, 0xffffffff
je 0x4028f0
lea eax, [ebp - 0x144]
push eax
call dword [0x406608]
mov edi, eax
mov eax, dword [ebp + 8]
push eax
mov dword [esi + 0xe], eax
mov word [ebp - 0x1c], 2
call dword [0x406604]
mov word [ebp - 0x1a], ax
movsx eax, word [edi + 0xa]
push eax
mov eax, dword [edi + 0xc]
push dword [eax]
lea eax, [ebp - 0x18]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x1c]
push 0x10
push eax
push dword [esi + 0xa]
call dword [0x406600]
cmp eax, 0xffffffff
je 0x4028f0
push 1
mov edi, dword [0x4065fc]
pop ebx
lea eax, [ebp - 4]
push 4
push eax
push 4
push 0xffff
push dword [esi + 0xa]
mov dword [ebp - 4], ebx
call edi
lea eax, [ebp - 4]
push 4
push eax
push 2
push 0
mov dword [ebp - 4], ebx
push dword [esi + 0xa]
call edi
cmp eax, 0xffffffff
je 0x4028f0
xor edi, edi
lea eax, [ebp - 0xc]
push edi
push edi
push eax
lea eax, [ebp - 0x44]
push 0x28
push eax
lea eax, [ebp - 8]
push 4
push eax
push 0x98000001
push dword [esi + 0xa]
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], edi
call dword [0x4065f8]
cmp eax, 0xffffffff
jne 0x4028f8
call dword [0x4065ec]
jmp 0x402929
push edi
push edi
push esi
push 0x402791
push edi
push edi
mov byte [esi + 8], bl
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
mov dword [esi + 4], eax
jne 0x402927
push dword [esi + 0xa]
and byte [esi + 8], 0
call dword [0x4065f4]
or eax, 0xffffffff
mov dword [esi + 0xa], eax
jmp 0x402929
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x402930
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
and byte [esi + 8], 0
test eax, eax
je 0x402954
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi + 4], 0
mov esi, dword [esi + 0xa]
test esi, esi
je 0x402962
push esi
call dword [0x4065f4]
pop esi
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x41e699
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x41e6a8
pop dword [ebp - 0x30]
mov eax, 0x41e6a8
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x45c05
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x465e
mov esi, eax
mov edx, 0xa2fc0351
add edx, 0x5d53f4af
add edx, dword [ebp - 0x30]
mov edi, 0xddeaaefa
add edi, 0xfe961679
xor dword [ebp - 4], ebx
mov ebx, dword [edx]
xor ebx, edi
sub dword [ebp - 0x2c], edi
mov dword [esi], ebx
add dword [ebp - 0xc], ecx
add esi, 0x5ab2dc9b
add esi, 0xa54d2369
add edx, 0x5cb96cf6
sub edx, 0x5cb96cf2
loop 0x41e6f7
add eax, 0x1556162a
add eax, 0xeaaaf621
mov ebx, eax
add eax, 0x86ed4ab5
sub eax, 0x86ed4ab0
mov ecx, 0x1d936478
sub ecx, 0x1d536478
add ecx, dword [ebp - 0x30]
call ebx
leave
ret