joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46e8b0
Capabilities:
Get number of processors

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x498900
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, ecx
mov eax, dword [edi]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x46ea57
mov ecx, dword [0x4de554]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], ecx
mov ecx, dword [eax - 8]
mov bl, 1
test ecx, ecx
mov byte [esp + 0x28], bl
jle 0x46e9ac
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push edi
push ecx
mov ecx, esi
call fcn.0046d5d0
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 2
call fcn.00488a43
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], bl
call fcn.00488956
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x4dd2fc
call fcn.004889c4
lea edx, [esp + 0x14]
push 0x3d
push edx
lea eax, [esp + 0x24]
push edi
push eax
mov ecx, esi
call fcn.0046d990
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x2c], 3
call fcn.00488a43
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], bl
call fcn.00488956
lea ecx, [esp + 0xc]
call fcn.00488e1e
mov ecx, dword [esp + 0xc]
push 0x4ddd3c
push ecx
call fcn.00477b94
add esp, 8
test eax, eax
je 0x46e9d4
mov edx, dword [edi]
mov ecx, dword [esp + 0x10]
mov eax, dword [edx - 8]
cmp ecx, eax
jl 0x46e90d
mov esi, dword [esp + 0x34]
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 0
call fcn.00488956
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.00488956
jmp 0x46ea5b
lea eax, [esp + 0x30]
mov ecx, esi
push eax
call fcn.0046e650
test eax, eax
push 0
je 0x46ea3f
lea ecx, [esp + 0x34]
push 0x64
push ecx
mov ecx, esi
call fcn.0046ccf0
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x46ea25
cmp eax, 0x64
jg 0x46ea13
mov edx, dword [esp + 0x38]
push eax
push 0x64
push edx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x46e9b0
push 0x64
push eax
mov eax, dword [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x46e9b0
cmp eax, 0x64
jge 0x46e9ac
mov ecx, dword [esp + 0x34]
push 0x64
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x46e9b0
mov edx, dword [esp + 0x3c]
lea eax, [esp + 0x34]
push edx
push eax
mov ecx, esi
call fcn.0046ccf0
mov esi, eax
jmp 0x46e9b0
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
cmp esi, eax
jl 0x46ea65
mov eax, esi
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret 0x10
Function at 0x48ad3a
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x48ad72
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00488db1
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00488d89
jmp 0x48ad7e
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x48c428
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x48c46a
call fcn.004924b4
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x48c46a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x48c461
xor eax, eax
jmp 0x48c472
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0048c478
pop edi
pop esi
pop ebx
ret 4

Function at 0x4929e4
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x492a12
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x492a30
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0049294a
jmp 0x492a30
mov eax, dword [esi + 0x14]
test eax, eax
je 0x492a30
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0049294a
test edi, edi
mov eax, edi
jne 0x492a1a
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x71cc2430
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa1960b21
mov ecx, 0x18b71962
rorx edx, eax, 0xb
sarx ecx, ecx, ecx
mulx eax, edx, ecx
xor eax, edx
mov ecx, 0xf5f7ffbe
pext eax, eax, ecx
cmp eax, 0x22f270c
sete al
ret

Function at 0x71cc8460
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x71d5a008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x120]
mov dword [ebp - 0x124], 0
push eax
mov esi, ecx
mov dword [ebp - 0x120], 0x114
xor ebx, ebx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x110], 2
jne 0x71cc8503
cmp dword [ebp - 0x11c], 6
jae 0x71cc84b6
mov eax, str.D:_A__GA___WD__A__GA___AN_
jmp 0x71cc84cb
jne 0x71cc84c6
cmp dword [ebp - 0x118], 2
mov eax, str.D:_A__GA___WD__A__GA___AN_S:_ML__NW___LW_
jb 0x71cc84cb
mov eax, str.D:_A__GA___WD__A__GA___AN__A__GA___S_1_15_2_1_S:_ML__NW___LW_
push 0
lea ecx, [ebp - 0x124]
push ecx
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
mov eax, dword [ebp - 0x124]
test eax, eax
je 0x71cc8503
mov dword [ebp - 0x128], ebx
lea ebx, [ebp - 0x130]
mov dword [ebp - 0x130], 0xc
mov dword [ebp - 0x12c], eax
sub esp, 0x18
mov edx, ebx
call fcn.71cc7dc0
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x71cc8523
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x71cc85c0
push 0
push 0
push 0
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 8], eax
test eax, eax
jne 0x71cc854b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [esi]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x71cc85c0
push ecx
push 0
sub esp, 8
mov ecx, ebx
call fcn.71cc7c90
add esp, 0x10
mov dword [esi + 4], eax
test eax, eax
jne 0x71cc857d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [esi + 8]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x71cc85c0
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push ecx
cmp dword [eax], 0x12345678
je 0x71cc85b3
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 2
jmp 0x71cc85c0
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov dword [esi + 0xc], 1
mov eax, dword [ebp - 0x124]
test eax, eax
je 0x71cc85d1
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.71cf548b
mov esp, ebp
pop ebp
ret
Function at 0x71cc8d80
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x71d573b0
push 0x71cf6ba0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x71d5a008]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x30], edx
mov ebx, ecx
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 0
test ebx, ebx
je 0x71cc8ef6
test edx, edx
je 0x71cc8ef6
push 0x14
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x71cc8ef6
xor esi, esi
mov dword [ebp - 0x2c], esi
nop
lea edi, [ebx + esi]
mov ecx, edi
call fcn.71cc8c70
test eax, eax
jne 0x71cc8ef6
mov ecx, edi
call fcn.71cc89c0
add esi, eax
mov dword [ebp - 0x2c], esi
cmp esi, 5
jl 0x71cc8df0
push 0x40
push 0x1000
push 0x1c
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
mov dword [ebp - 0x28], edi
test edi, edi
je 0x71cc8ef6
mov dword [edi + 0x14], esi
mov dword [edi + 0x18], ebx
push esi
push ebx
mov edx, 0x14
mov ecx, edi
call fcn.71cc9ea0
add esp, 8
lea eax, [esi + edi]
mov word [eax], 0x25ff
lea ecx, [eax + 6]
mov dword [eax + 2], ecx
lea eax, [ebx + esi]
mov dword [ecx], eax
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
push 0x40
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x71cc8e7d
push 0x8000
push eax
push edi
jmp 0x71cc8ef0
mov eax, dword [ebp - 0x20]
cmp eax, 4
je 0x71cc8ea3
cmp eax, 0x40
je 0x71cc8ea3
cmp eax, 0x80
je 0x71cc8ea3
lea eax, [ebp - 0x24]
push eax
push 0x20
push 0x1c
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0x20]
mov byte [ebx], 0xe9
mov ecx, dword [ebp - 0x30]
sub ecx, ebx
sub ecx, 5
mov dword [ebx + 1], ecx
lea ecx, [ebp - 0x20]
push ecx
push eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov dword [ebp - 4], 0xfffffffe
mov eax, edi
jmp 0x71cc8eff
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.71cf548b
mov esp, ebp
pop ebp
ret
Function at 0x71cc8f70
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x71d573d0
push 0x71cf6ba0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x71d5a008]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, ecx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x71cc902d
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
push 0x40
push dword [ebx + 0x14]
push dword [ebx + 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x71cc902d
mov edx, dword [ebx + 0x14]
push edx
push ebx
mov ecx, dword [ebx + 0x18]
call fcn.71cc9ea0
add esp, 8
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push dword [ebx + 0x14]
push dword [ebx + 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [ebx + 0x14]
mov edi, dword [ebx + 0x18]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
push 0x8000
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [ebp - 4], 0xfffffffe
mov eax, 1
jmp 0x71cc9036
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.71cf548b
mov esp, ebp
pop ebp
ret
Function at 0x71cc9380
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x71d5a008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
push ebx
push esi
mov esi, dword [0x71d78674]
mov ebx, ecx
push edi
mov edi, edx
mov esi, dword [eax + esi*4]
mov eax, dword [0x71d7ab2c]
cmp eax, dword [esi + 4]
jle 0x71cc93f2
push 0x71d7ab2c
call fcn.71cf5946
add esp, 4
cmp dword [0x71d7ab2c], 0xffffffff
jne 0x71cc93f2
push str.RtlRandomEx
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x71d7ab2c
mov dword [0x71d7ab30], eax
call fcn.71cf58fc
add esp, 4
mov cl, 1
mov byte [ebp - 0x25], cl
test edi, edi
je 0x71cc94e7
cmp dword [edi], 3
jne 0x71cc94e7
push 0x10
lea eax, [ebp - 0x24]
push eax
push str.AswJsFltTestMode
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne case.0x71cc946e.9
xor cl, cl
mov byte [ebp - 0x25], cl
cmp dword [0x71d7ab30], eax
je 0x71cc94e7
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, eax
lea ecx, [ebp - 0x25]
add ecx, ebx
lea eax, [ebp - 0x2c]
xor esi, ecx
mov dword [ebp - 0x2c], esi
mov esi, dword [0x71d7ab30]
mov ecx, esi
push eax
call dword [0x71d122ac]
call esi
xor edx, edx
mov ecx, 0x186a0
div ecx
cmp ebx, 0x17
ja case.0x71cc946e.9
jmp dword [ebx*4 + 0x71cc94fc]
movzx ecx, byte [ebp - 0x25]
mov eax, 0x2710
cmp edx, eax
mov esi, 1
pop edi
cmovb ecx, esi
pop esi
mov al, cl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.71cf548b
mov esp, ebp
pop ebp
ret
movzx ecx, byte [ebp - 0x25]
mov eax, 0x3e8
cmp edx, eax
mov esi, 1
pop edi
cmovb ecx, esi
pop esi
mov al, cl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.71cf548b
mov esp, ebp
pop ebp
ret
mov eax, ecx
mov esi, 1
movzx ecx, byte [ebp - 0x25]
cmp edx, eax
pop edi
cmovb ecx, esi
pop esi
mov al, cl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.71cf548b
mov esp, ebp
pop ebp
ret
mov cl, byte [ebp - 0x25]
mov al, cl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.71cf548b
mov esp, ebp
pop ebp
ret
Function at 0x71cc9a90
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 0x18]
mov ebx, edx
push edi
mov dword [ebp - 4], ecx
mov edi, dword [esi + 0x288]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
test edi, edi
je 0x71cc9ae4
lea edx, [esi + 0x14]
mov ecx, edi
push edx
push dword [esi + 0x2c]
push dword [esi + 0x28]
push 1
push dword [ebp + 0x14]
push dword [esi + 4]
push dword [esi + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
push dword [ebp - 4]
call dword [0x71d122ac]
call edi
mov esi, eax
jmp 0x71cc9ae9
mov esi, 0x80004003
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 4]
mov ecx, str.true
mov edi, str.false
cmp byte [edx], 0
cmove ecx, edi
sub eax, dword [ebp - 8]
push ecx
push esi
push eax
push ebx
push str.ScanScript_url:__s__took:__d__ms___result:_0x_08x__block_:__s
push 0x48f
push 0x71d1ae04
push 3
call fcn.71cec390
add esp, 0x20
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x71cc9b30
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [0x71d77974]
mov ebx, ecx
push edi
mov edi, edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
test esi, esi
je 0x71cc9b89
push 0x71d776fc
push dword [0x71d77714]
mov ecx, esi
push dword [0x71d77710]
push 1
push dword [ebp + 0x14]
push dword [0x71d776ec]
push dword [0x71d776f0]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
push ebx
call dword [0x71d122ac]
call esi
mov esi, eax
jmp 0x71cc9b8e
mov esi, 0x80004003
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp byte [ebx], 0
mov edx, str.false
mov ecx, str.true
cmove ecx, edx
sub eax, dword [ebp - 4]
push ecx
push esi
push eax
push edi
push str.ScanScript_url:__s__took:__d__ms___result:_0x_08x__block_:__s
push 0x48f
push 0x71d1ae04
push 3
call fcn.71cec390
add esp, 0x20
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x71cc9ca0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
push 0x3f
push esi
mov dword [ebp - 8], edx
call fcn.71cf6d00
mov edi, eax
add esp, 8
test edi, edi
je 0x71cc9cc6
sub edi, esi
jmp 0x71cc9cc9
mov edi, dword [ebp + 0xc]
xor ecx, ecx
mov eax, edi
add eax, 0x21
setb cl
neg ecx
or ecx, eax
push ecx
call fcn.71cfbe20
add esp, 4
test eax, eax
je 0x71cc9d82
push edi
push dword [ebp + 8]
mov esi, eax
add eax, 0x20
push eax
mov dword [ebp - 4], eax
call fcn.71cf71a0
mov eax, dword [ebp - 4]
add esp, 0xc
mov byte [eax + edi], 0
mov eax, dword [ebp - 8]
mov dword [esi + 8], 0
mov dword [esi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi + 0x18], edi
lea edi, [ebx + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [ebp - 4]
push edi
mov dword [esi + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [ebx], 0
jne 0x71cc9d57
lea eax, [ebx + 4]
push eax
push 0
push ebx
push 0x71cc9bd0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebx], eax
test eax, eax
je 0x71cc9d72
mov eax, dword [ebx + 0xc]
lea ecx, [ebx + 0xc]
mov dword [esi], eax
mov dword [esi + 4], ecx
mov dword [eax + 4], esi
push dword [ebx + 8]
mov dword [ecx], esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
call fcn.71cfbe30
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x71cca110
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x71d5a008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x71cca21e
cmp byte [0x71d7796c], 0
je 0x71cca160
push 0x104
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 0x104
jbe 0x71cca238
jmp 0x71cca17d
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x20c]
call fcn.71cca010
add esp, 4
test eax, eax
jns 0x71cca238
push ecx
push str.A_script_started_by
push ecx
mov edi, 0x104
lea ecx, [ebp - 0x20c]
mov edx, edi
call fcn.71ccc380
test eax, eax
js 0x71cca2bb
push edi
lea eax, [ebp - 0x414]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
mov edx, edi
lea eax, [ebp - 0x20c]
je 0x71cca1f0
nop dword [eax]
cmp word [eax], 0
je 0x71cca1d5
add eax, 2
sub edx, 1
jne 0x71cca1c0
mov eax, 0x80070057
jmp 0x71cca230
push ecx
lea eax, [ebp - 0x414]
sub edi, edx
push eax
push ecx
lea ecx, [ebp - 0x20c]
lea ecx, [ecx + edi*2]
call fcn.71ccc380
jmp 0x71cca230
cmp word [eax], 0
je 0x71cca205
add eax, 2
sub edx, 1
jne 0x71cca1f0
mov eax, 0x80070057
jmp 0x71cca230
push ecx
sub edi, edx
push 0x71d1dba4
push ecx
lea ecx, [ebp - 0x20c]
lea ecx, [ecx + edi*2]
call fcn.71ccc380
jmp 0x71cca230
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x71cca232
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x71cca2bb
mov ecx, 0x7ffffffe
lea eax, [ebp - 0x20c]
cmp word [eax], 0
je 0x71cca255
add eax, 2
sub ecx, 1
jne 0x71cca243
xor eax, eax
jmp 0x71cca25c
mov eax, 0x7ffffffe
sub eax, ecx
lea edi, [eax + 1]
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
push ebx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.71cf5a1c
add esp, 4
mov esi, eax
test edi, edi
je 0x71cca2cb
cmp edi, 0x7fffffff
ja 0x71cca2cb
push ecx
lea eax, [ebp - 0x20c]
mov edx, edi
push eax
push ecx
mov ecx, esi
call fcn.71ccc380
mov ebx, eax
test eax, eax
js 0x71cca2af
mov ecx, dword [0x71d78d94]
mov dword [0x71d78d94], esi
mov esi, ecx
push esi
call fcn.71cf5a25
add esp, 4
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.71cf548b
mov esp, ebp
pop ebp
ret
mov eax, 0x80070057
mov ebx, eax
test edi, edi
je 0x71cca29b
xor eax, eax
mov word [esi], ax
jmp 0x71cca2af
Function at 0x71cdd7c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
sub esp, 0x14
mov eax, 1
cmp ecx, 3
ja case.default.0x71cdd7d8
push esi
jmp dword [ecx*4 + 0x71cdd92c]
mov ecx, dword [ebp + 8]
call fcn.71cdd500
pop esi
mov esp, ebp
pop ebp
ret 0xc
push 0x2000
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x71cdd91d
push esi
push dword [0x71d77bac]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x71cdd91d
movups xmm0, xmmword [str.A_script_started_by]
push 0xfeb
movups xmmword [esi], xmm0
movups xmm0, xmmword [0x71d1af00]
movups xmmword [esi + 0x10], xmm0
movq xmm0, qword [0x71d1af10]
movq qword [esi + 0x20], xmm0
mov ax, word [0x71d1af18]
mov word [esi + 0x28], ax
lea eax, [esi + 0x28]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0xc
push dword [0x71d77bac]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x71cdd91d
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0xc
push edi
mov edi, 0x71d780a8
movups xmm0, xmmword [edi]
psrldq xmm0, 0xc
movd esi, xmm0
mov ecx, esi
call dword [0x71d122ac]
call esi
add edi, 0x14
cmp edi, 0x71d78170
jne 0x71cdd890
xor ecx, ecx
call fcn.71ce5b10
push 0x71d7949c
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x71d794b8
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x71d77718
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push dword [0x71d77bac]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop edi
test eax, eax
je 0x71cdd8f1
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [0x71d77bac]
call dword [sym.imp.KERNEL32.dll_TlsFree]
push dword [0x71d79498]
mov dword [0x71d77bac], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x71d79498], 0
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x71ce11e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x71d5a008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov byte [ebp - 9], dl
lea ecx, [ebp - 8]
mov byte [ebp - 0xa], 0
push ecx
push 0x40
mov ebx, dword [edi + 4]
mov eax, dword [edi]
mov esi, eax
push ebx
push eax
mov dword [ebp - 8], 0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x71ce1322
cmp byte [ebp - 9], 0
je 0x71ce12cc
mov edx, dword [edi + 0xc]
lea ebx, [esi + 5]
mov ecx, edx
mov eax, esi
sub eax, edx
sub ecx, esi
cmp edx, esi
cmovae eax, ecx
cmp eax, 0x7fff0000
mov eax, ebx
jbe 0x71ce1286
lea edx, [edi + 0x10]
sub eax, edx
mov ecx, edx
sub ecx, ebx
cmp ebx, edx
cmova ecx, eax
cmovbe ebx, ebx
mov eax, edx
sub eax, ebx
mov dword [ebp - 0x10], eax
lea eax, [esi + 1]
cmp ecx, 0x7fff0000
ja 0x71ce12b6
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x14]
mov byte [esi], 0xe9
lea esi, [eax + 4]
mov dword [eax], ecx
jmp 0x71ce12e0
sub eax, edx
mov ecx, edx
sub ecx, ebx
cmp ebx, edx
cmova ecx, eax
cmovbe ebx, ebx
mov eax, edx
sub eax, ebx
mov dword [ebp - 0x10], eax
lea eax, [esi + 1]
cmp ecx, 0x7fff0000
ja 0x71ce12b6
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x14]
mov byte [esi], 0xe9
lea esi, [eax + 4]
mov dword [eax], ecx
jmp 0x71ce12e0
mov ebx, dword [ebp - 0x14]
mov byte [eax], 0x25
lea eax, [esi + 6]
mov dword [eax], edx
mov dword [esi + 2], eax
mov byte [esi], 0xff
lea esi, [eax + 4]
jmp 0x71ce12e0
xor ecx, ecx
cmp dword [edi + 4], ecx
jbe 0x71ce12e0
mov al, byte [edi + ecx + 0x50]
mov byte [ecx + esi], al
inc ecx
cmp ecx, dword [edi + 4]
jb 0x71ce12d3
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov esi, dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 8]
push ecx
push esi
push ebx
push dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
movzx eax, byte [ebp - 9]
mov dword [edi + 8], eax
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.71cf548b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0xa]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.71cf548b
mov esp, ebp
pop ebp
ret