joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10037087
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x100370e0
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x10037087
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x10037096
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x1043cd39
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x100370e7
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.1001df5d
cmp eax, dword [ebp + 0xc]
pop eax
je 0x10037186
add edi, 4
add eax, 2
dec ecx
jne 0x100370cc
call 0x10037133
loope 0x10037129
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x10037183
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x10037194
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x10037147
cmp eax, ecx
ja 0x10037147
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x100371d1
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x100371c7
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.1001e43c
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x10037096
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x100370e0
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x10037087
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x10037096
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x1043cd39
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x100370e7
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.1001df5d
cmp eax, dword [ebp + 0xc]
pop eax
je 0x10037186
add edi, 4
add eax, 2
dec ecx
jne 0x100370cc
call 0x10037133
loope 0x10037129
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x10037183
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x10037194
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x10037147
cmp eax, ecx
ja 0x10037147
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x100371d1
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x100371c7
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.1001e43c
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x401de0
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call 0x401e50
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.00401350
mov dword [esp], eax
call sub.ucrtbase.dll_exit
nop
nop
nop
jmp dword [sym.imp.ucrtbase.dll___p___argc]
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..reloc
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
je 0x432072
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x48156efa
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x432060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
je 0x4320d2
nop
nop
nop
nop
mov ebx, 0x42f314
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x6abc0500
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x40686f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x460114], 0
jne 0x4068ad
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406883
mov dword [ecx*4 + 0x460110], eax
inc ecx
cmp ecx, 0x100
jl 0x40687e
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x4068da
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x460110]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4068bb
not eax
pop ebp
ret 0xc

Function at 0x4059f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x426d76
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x45190c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov eax, dword [ebp + 0x10]
mov dword [ebx], 0x428da8
mov dword [ebx + 4], edx
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], edx
mov dword [ebx + 0x10], edx
mov dword [ebx + 0x14], edx
mov dword [ebx + 0x18], edx
mov dword [ebx + 0x1c], edx
mov dword [ebx + 0x20], edx
mov dword [ebx + 0x24], edx
mov dword [ebx + 0x28], edx
or dword [ebx + 0x2c], 0xffffffff
mov dword [ebx + 0x30], edx
mov dword [ebx + 0x34], edx
mov dword [ebx + 0x38], edx
mov dword [ebx + 0x3c], edx
mov dword [ebx + 0x40], edx
mov dword [ebx + 0x44], edx
mov dword [ebx + 0x48], edx
mov dword [ebx + 0x4c], edx
mov dword [ebx + 0x50], eax
mov eax, dword [ebp + 8]
mov dword [ebx + 0x5c], eax
mov dword [ebx + 0x60], ecx
mov eax, dword [ecx + 4]
and dword [ebx + 0x8c], 0xffffffc0
and byte [ebx + 0x91], 0x80
or dword [ebx + 0x94], 0xffffffff
or dword [ebx + 0x98], 0xffffffff
mov dword [ebx + 0x64], eax
xor eax, eax
inc eax
mov dword [ebx + 0x68], edx
mov dword [ebx + 0x6c], edx
mov dword [ebx + 0x70], edx
mov dword [ebx + 0x74], edx
mov byte [ebx + 0x90], 0x4f
mov dword [ebx + 0x9c], eax
mov dword [ebx + 0xa0], eax
mov dword [ebx + 0xa4], edx
mov dword [ebx + 0xa8], edx
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x405acb
mov eax, dword [ecx + 0x24]
mov dword [ebx + 0x78], eax
mov dword [ecx + 0x24], ebx
mov eax, dword [ebx + 0x5c]
lea edi, [ebx + 0x58]
push 1
push edx
push edi
mov dword [eax + 4], ebx
lea esi, [ebx + 0x54]
mov ecx, dword [ebx + 0x60]
push esi
push ecx
mov eax, dword [ecx]
call dword [eax + 0x18]
push 4
push dword [esi]
mov esi, dword [0x4280f8]
push 6
call esi
push 8
push dword [edi]
mov dword [ebx + 0x7c], eax
push 2
call esi
mov ecx, dword [ebx + 0x7c]
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x88], eax
mov eax, ebx
mov dword [ebx + 0x84], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x69ec286e
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x56e711c7
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x401020
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov edi, eax
add eax, eax
mov dword [ebp - 0xc], 0x58d84e99
sub edi, 0xf5
mov eax, dword [ebp - 0xc]
mov ebx, 0x1698
mov ebx, dword [ebx + 0x404980]
push 0x5874
call ebx
sub edi, dword [ebp - 0x40]
and ecx, ebp
sub dword [ebp - 0x3f], eax
mov eax, 0xc6ef3720
mov edx, eax
sub edx, eax
sub edx, 0x3f
sub esi, 0x88
mov ebx, dword [ebp - 4]
mov esi, dword [ebp + 8]
mov edx, ebx
shr edx, 5
mov ecx, ebx
shl ecx, 4
xor edx, ecx
mov ecx, eax
shr ecx, 0xb
and ecx, 3
mov edi, dword [esi + ecx*4]
mov ecx, eax
xor ecx, ebx
add edx, edi
add edx, ecx
mov ecx, dword [ebp - 8]
sub ecx, edx
mov dword [ebp - 8], ecx
add eax, 0x61c88647
sub edi, 0x1e
mov esi, eax
add edx, eax
mov edi, dword [ebp + 8]
mov edx, ecx
shr edx, 5
mov esi, ecx
shl esi, 4
xor edx, esi
mov esi, eax
and esi, 3
add edx, dword [edi + esi*4]
mov esi, eax
xor esi, ecx
add edx, esi
sub ebx, edx
test eax, eax
mov dword [ebp - 4], ebx
jne 0x401077
mov esi, 0x41d0
mov esi, dword [esi + 0x401e48]
push 0x5fae
call esi
add dword [ebp - 0x4e], eax
add dword [ebp - 0x59], eax
add esi, ecx
mov esi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
pop edi
mov ecx, ebx
pop esi
mov dword [eax], ecx
mov dword [eax + 4], edx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4018d9
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
inc esi
cmp dword [0x419ad8], esi
push edi
jne 0x4018f9
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x419ad4], esi
mov byte [0x419ad0], al
jne 0x40195f
mov ecx, dword [0x42b608]
test ecx, ecx
je 0x401940
mov eax, dword [0x42b604]
sub eax, 4
cmp eax, ecx
jmp 0x401939
mov eax, dword [eax]
test eax, eax
je 0x40192b
call eax
mov eax, dword [0x42b604]
sub eax, 4
cmp eax, dword [0x42b608]
mov dword [0x42b604], eax
jae 0x401923
mov eax, 0x40801c
mov esi, 0x408020
cmp eax, esi
mov edi, eax
jae 0x40195f
mov eax, dword [edi]
test eax, eax
je 0x401958
call eax
add edi, 4
cmp edi, esi
jb 0x401950
mov eax, 0x408024
mov esi, 0x408028
cmp eax, esi
mov edi, eax
jae 0x40197e
mov eax, dword [edi]
test eax, eax
je 0x401977
call eax
add edi, 4
cmp edi, esi
jb 0x40196f
cmp dword [ebp + 0x10], 0
pop edi
pop esi
jne 0x401998
push dword [ebp + 8]
mov dword [0x419ad8], 1
call fcn.00401809
pop ebp
ret
Function at 0x402769
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x419bf4], ebx
push esi
push edi
jne 0x4027e9
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x402824
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x419bf4], eax
je 0x402824
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x419bf8], eax
call esi
cmp dword [0x419a98], 2
mov dword [0x419bfc], eax
jne 0x4027e9
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x419c04], eax
je 0x4027e9
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x419c00], eax
mov eax, dword [0x419c00]
test eax, eax
je 0x40282e
call eax
test eax, eax
je 0x402815
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x419c04]
test eax, eax
je 0x402815
test byte [ebp - 8], 1
jne 0x40282e
cmp dword [0x419aa4], 4
jb 0x402828
or byte [ebp + 0x12], 0x20
jmp 0x40284d
xor eax, eax
jmp 0x40285d
or byte [ebp + 0x12], 4
jmp 0x40284d
mov eax, dword [0x419bf8]
test eax, eax
je 0x40284d
call eax
mov ebx, eax
test ebx, ebx
je 0x40284d
mov eax, dword [0x419bfc]
test eax, eax
je 0x40284d
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x419bf4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x6a78a907
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6b18a008]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x6b18a008]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
jmp 0x6a78a999
jmp 0x6a78aa0b
jmp 0x6a78aa7d
jmp 0x6a78aaef
jmp 0x6a78ab61
jmp 0x6a78abd3
jmp 0x6a78ac45
jmp 0x6a78acb7
jmp 0x6a78ad29
jmp 0x6a78ad9b
jmp 0x6a78ae0d
jmp 0x6a78ae7f
jmp 0x6a78aef1
jmp 0x6a78af63
jmp 0x6a78afd5
jmp 0x6a78b047
jmp 0x6a78b0b9
jmp 0x6a78b12b
jmp 0x6a78b19d
jmp 0x6a78b20f
jmp 0x6a78b281
jmp 0x6a78b2f3
mov dword [ebp - 0x14], 0
jmp 0x6a78b36c
jmp 0x6a78b3de
jmp 0x6a78b450
jmp 0x6a78b4c2
jmp 0x6a78b534
jmp 0x6a78b5a6
jmp 0x6a78b618
jmp 0x6a78b68a
jmp 0x6a78b6fc
jmp 0x6a78b76e
jmp 0x6a78b7e0
jmp 0x6a78b852
jmp 0x6a78b8c4
jmp 0x6a78b936
jmp 0x6a78b9a8
jmp 0x6a78ba1a
jmp 0x6a78ba8c
jmp 0x6a78bafe
jmp 0x6a78bb70
jmp 0x6a78bbe2
jmp 0x6a78bc54
jmp 0x6a78bcc6
mov dword [ebp - 0x18], 0
jmp 0x6a78bd3f
jmp 0x6a78bdb1
jmp 0x6a78be23
jmp 0x6a78be95
jmp 0x6a78bf07
jmp 0x6a78bf79
jmp 0x6a78bfeb
jmp 0x6a78c05d
jmp 0x6a78c0cf
jmp 0x6a78c141
jmp 0x6a78c1b3
jmp 0x6a78c225
jmp 0x6a78c297
jmp 0x6a78c309
jmp 0x6a78c37b
jmp 0x6a78c3ed
jmp 0x6a78c45f
jmp 0x6a78c4d1
jmp 0x6a78c543
jmp 0x6a78c5b5
jmp 0x6a78c627
jmp 0x6a78c699
mov dword [ebp - 0x10], 0
jmp 0x6a78c712
jmp 0x6a78c784
jmp 0x6a78c7f6
jmp 0x6a78c868
jmp 0x6a78c8da
jmp 0x6a78c94c
jmp 0x6a78c9be
jmp 0x6a78ca30
jmp 0x6a78caa2
jmp 0x6a78cb14
jmp 0x6a78cb86
jmp 0x6a78cbf8
jmp 0x6a78cc6a
jmp 0x6a78ccdc
jmp 0x6a78cd4e
jmp 0x6a78cdc0
jmp 0x6a78ce32
jmp 0x6a78cea4
jmp 0x6a78cf16
jmp 0x6a78cf88
jmp 0x6a78cffa
jmp 0x6a78d06c
mov dword [ebp - 0x10], 0
jmp 0x6a7901ba
jmp 0x6a78d0ea
jmp 0x6a78d15c
jmp 0x6a78d1ce
jmp 0x6a78d240
jmp 0x6a78d2b2
jmp 0x6a78d324
jmp 0x6a78d396
jmp 0x6a78d408
jmp 0x6a78d47a
jmp 0x6a78d4ec
jmp 0x6a78d55e
jmp 0x6a78d5d0
jmp 0x6a78d642
jmp 0x6a78d6b4
jmp 0x6a78d726
jmp 0x6a78d798
jmp 0x6a78d80a
jmp 0x6a78d87c
jmp 0x6a78d8ee
jmp 0x6a78d960
jmp 0x6a78d9d2
jmp 0x6a78da44
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [0x6b18a004]
add eax, edx
mov dword [ebp - 0x14], eax
jmp 0x6a78dac7
jmp 0x6a78db39
jmp 0x6a78dbab
jmp 0x6a78dc1d
jmp 0x6a78dc8f
jmp 0x6a78dd01
jmp 0x6a78dd73
jmp 0x6a78dde5
jmp 0x6a78de57
jmp 0x6a78dec9
jmp 0x6a78df3b
jmp 0x6a78dfad
jmp 0x6a78e01f
jmp 0x6a78e091
jmp 0x6a78e103
jmp 0x6a78e175
jmp fcn.6a78e1e7
mov eax, dword [0x6b18a008]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x10]
ja 0x6a78d078
nop
leave
ret

Function at 0x6a7ac1a0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], 0x6b189040
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.6a7ac200
Function at 0x6a7ac200
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x6b18a378]
test esi, esi
jle 0x6a7ac2ed
mov edi, dword [0x6b18a37c]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x6a7ac234
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x6a7ac2e6
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x6a7ac220
mov dword [esp], eax
mov esi, eax
call fcn.6a7ac9a0
test eax, eax
mov edi, eax
je 0x6a7ac32a
mov esi, dword [0x6b18a37c]
lea ebx, [ebx + ebx*2]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call fcn.6a7acab0
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x6b18a37c]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x6a7ac30a
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x6a7ac2df
sub eax, 0x40
and eax, 0xffffffbf
je 0x6a7ac2df
mov eax, dword [esp + 0x20]
add ebx, dword [0x6b18a37c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x6a7ac2f4
add dword [0x6b18a378], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor ebx, ebx
jmp 0x6a7ac23e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.6a7ac1a0
mov eax, dword [0x6b18a37c]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.6a7ac1a0
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.6a7ac1a0
lea esi, [esi]

Function at 0x6a7ac610
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x6b18a388
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x6b18a380]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x6a7ac665
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x6a7ac65e
test esi, esi
je 0x6a7ac65e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6a7ac640
mov dword [esp], 0x6b18a388
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x401000
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0x40
push 0x1000
push 0x15000
push 0
call sub.user32.dll_GetCursor
call sub.kernel32.dll_VirtualAlloc
call fcn.0049f372
ret