joyce8/EMBER2024-capa huggingface dataset:
Function at 0x68a09000
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
mov ebx, ecx
push edi
mov edi, edx
test ebx, ebx
je 0x68a090c9
test edi, edi
je 0x68a090c9
push esi
push dword [0x68ab0490]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x68a0904f
push 0x2000
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x68a090c8
push esi
push dword [0x68ab0490]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x68a09068
cmp edi, 6
jb 0x68a09068
push 5
push str.data:
push ebx
call fcn.68a40140
add esp, 0xc
test eax, eax
je 0x68a090c8
cmp edi, 0x7ffffffe
jbe 0x68a09077
xor eax, eax
mov word [esi], ax
jmp 0x68a090ae
mov edx, ebx
add edi, 0xfffff000
mov ecx, 0x1000
sub edx, esi
lea eax, [edi + ecx]
test eax, eax
je 0x68a090a1
movzx eax, word [edx + esi]
test ax, ax
je 0x68a090a1
mov word [esi], ax
add esi, 2
sub ecx, 1
jne 0x68a09086
test ecx, ecx
lea eax, [esi - 2]
cmovne eax, esi
xor ecx, ecx
mov word [eax], cx
push ebx
push str.Setting_last_url:__s
push 0x1f8
push 0x68a60164
push 3
call fcn.68a2de70
add esp, 0x14
pop esi
pop edi
pop ebx
ret

Function at 0x68a092b0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x68aaf040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
push ebx
push esi
mov esi, dword [0x68ab13e4]
mov ebx, edx
push edi
mov dword [ebp - 0x30], ecx
mov esi, dword [eax + esi*4]
mov eax, dword [0x68ab34a8]
cmp eax, dword [esi + 4]
jle 0x68a09323
push 0x68ab34a8
call fcn.68a39824
add esp, 4
cmp dword [0x68ab34a8], 0xffffffff
jne 0x68a09323
push str.RtlRandomEx
push 0x68a60528
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x68ab34a8
mov dword [0x68ab34ac], eax
call fcn.68a397d3
add esp, 4
push 0x10
lea eax, [ebp - 0x24]
push eax
push str.AswJsFltTestMode
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ecx, eax
xor eax, eax
cmp eax, ecx
mov al, 1
sbb edi, edi
and edi, 0x186a0
test ebx, ebx
je 0x68a093c4
cmp dword [ebx], 3
jne 0x68a093c4
test ecx, ecx
jne 0x68a093c4
xor al, al
mov byte [ebp - 0x25], al
cmp dword [0x68ab34ac], ecx
je 0x68a093c4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [ebp - 0x30]
lea ecx, [ebp - 0x25]
xor esi, eax
add ecx, ebx
xor esi, ecx
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], esi
mov esi, dword [0x68ab34ac]
mov ecx, esi
push eax
call dword [0x68a57338]
call esi
xor edx, edx
mov ecx, 0x186a0
div ecx
cmp ebx, 0x1a
ja case.0x68a0939d.10
jmp dword [ebx*4 + 0x68a093d8]
mov edi, 0x2710
jmp case.0x68a0939d.10
mov edi, 0x1388
jmp case.0x68a0939d.10
mov edi, 0x3e8
jmp case.0x68a0939d.10
mov edi, ecx
mov al, 1
cmp edx, edi
jb 0x68a093c4
mov al, byte [ebp - 0x25]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.68a3943b
mov esp, ebp
pop ebp
ret
Function at 0x68a09990
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 0x18]
mov ebx, edx
push edi
mov dword [ebp - 4], ecx
mov edi, dword [esi + 0x288]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
test edi, edi
je 0x68a099e4
lea edx, [esi + 0x14]
mov ecx, edi
push edx
push dword [esi + 0x2c]
push dword [esi + 0x28]
push 1
push dword [ebp + 0x14]
push dword [esi + 4]
push dword [esi + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
push dword [ebp - 4]
call dword [0x68a57338]
call edi
mov esi, eax
jmp 0x68a099e9
mov esi, 0x80004003
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 4]
mov ecx, str.true
mov edi, str.false
cmp byte [edx], 0
cmove ecx, edi
sub eax, dword [ebp - 8]
push ecx
push esi
push eax
push ebx
push str.ScanScript_url:__s__took:__d__ms___result:_0x_08x__block_:__s
push 0x49f
push 0x68a60164
push 3
call fcn.68a2de70
add esp, 0x20
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x68a09a30
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [0x68ab0234]
mov ebx, ecx
push edi
mov edi, edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
test esi, esi
je 0x68a09a89
push 0x68aaffbc
push dword [0x68aaffd4]
mov ecx, esi
push dword [0x68aaffd0]
push 1
push dword [ebp + 0x14]
push dword [0x68aaffac]
push dword [0x68aaffb0]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
push ebx
call dword [0x68a57338]
call esi
mov esi, eax
jmp 0x68a09a8e
mov esi, 0x80004003
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp byte [ebx], 0
mov edx, str.false
mov ecx, str.true
cmove ecx, edx
sub eax, dword [ebp - 4]
push ecx
push esi
push eax
push edi
push str.ScanScript_url:__s__took:__d__ms___result:_0x_08x__block_:__s
push 0x49f
push 0x68a60164
push 3
call fcn.68a2de70
add esp, 0x20
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x68a09c20
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
push 0x3f
push esi
mov dword [ebp - 8], edx
call fcn.68a3ad00
mov edi, eax
add esp, 8
test edi, edi
je 0x68a09c46
sub edi, esi
jmp 0x68a09c49
mov edi, dword [ebp + 0xc]
xor ecx, ecx
mov eax, edi
add eax, 0x21
setb cl
neg ecx
or ecx, eax
push ecx
call fcn.68a3fe40
add esp, 4
test eax, eax
je 0x68a09d03
push edi
push dword [ebp + 8]
mov esi, eax
add eax, 0x20
push eax
mov dword [ebp - 4], eax
call fcn.68a3b1d0
mov eax, dword [ebp - 4]
add esp, 0xc
mov byte [eax + edi], 0
mov eax, dword [ebp - 8]
mov dword [esi + 8], 0
mov dword [esi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi + 0x18], edi
lea edi, [ebx + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [ebp - 4]
push edi
mov dword [esi + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebx]
test eax, eax
jne 0x68a09cd8
lea eax, [ebx + 4]
push eax
push 0
push ebx
push 0x68a09b30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebx], eax
test eax, eax
je 0x68a09cf3
mov eax, dword [ebx + 0xc]
lea ecx, [ebx + 0xc]
mov dword [esi], eax
mov dword [esi + 4], ecx
mov dword [eax + 4], esi
push dword [ebx + 8]
mov dword [ecx], esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
call fcn.68a3fe50
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x68a119a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x68aaf040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0xc], eax
xor eax, eax
mov cl, byte [ebp + eax - 0xc]
xor byte [ebp + eax - 8], cl
inc eax
mov ecx, 4
sub ecx, eax
cmp ecx, 1
jae 0x68a119c4
movzx eax, byte [0x68aaffff]
mov dword [ebp - 0xc], eax
movzx eax, byte [0x68aafffe]
mov dword [ebp - 0x10], eax
movzx eax, byte [0x68aafffd]
mov dword [ebp - 0x14], eax
movzx eax, byte [0x68aafffc]
push ebx
movzx ebx, byte [0x68aafff9]
mov dword [ebp - 0x18], eax
movzx eax, byte [0x68aafffb]
push esi
mov dword [ebp - 0x1c], eax
movzx eax, byte [0x68aafffa]
push edi
movzx edi, byte [0x68aafff8]
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push ebx
push edi
push esi
push eax
push dword [ebp - 8]
push str.SSP_SESSION_ID
push str._s_08lX__04hX__04hX__02hhX_02hhX__02hhX_02hhX_02hhX_02hhX_02hhX_02hhX
push 0x40
push dword [ebp - 0x24]
call fcn.68a09db0
mov ecx, dword [ebp - 4]
add esp, 0x3c
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.68a3943b
mov esp, ebp
pop ebp
ret
Function at 0x68a11a80
Capabilities:
Encode data using xor
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x68aaf040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x80
lea eax, [ebp - 0x84]
mov ebx, ecx
push 0
push eax
call fcn.68a3b750
add esp, 0xc
lea eax, [ebp - 0x84]
push 0x40
push eax
push str.SSP_SESSION_ID
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0x3e
ja 0x68a11bad
push esi
lea eax, [ebp - 0x84]
push 0x68a8e020
push eax
call fcn.68a3aece
mov esi, eax
add esp, 8
test esi, esi
je 0x68a11b98
push edi
push 0x10
lea eax, [ebp - 0x90]
mov dword [ebp - 0x90], 0
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.68a411d1
add esp, 0xc
mov edi, eax
mov dword [ebp - 0x8c], edi
call fcn.68a40217
cmp dword [eax], 0
jne 0x68a11b82
cmp dword [ebp - 0x90], esi
jne 0x68a11b82
lea eax, [edi - 1]
cmp eax, 0xfffffffd
ja 0x68a11b82
mov eax, dword [0x68aaffb0]
xor ecx, ecx
mov dword [ebp - 0x88], eax
nop dword [eax + eax]
mov al, byte [ebp + ecx - 0x88]
xor byte [ebp + ecx - 0x8c], al
inc ecx
mov eax, 4
sub eax, ecx
cmp eax, 1
jae 0x68a11b40
mov esi, dword [ebp - 0x8c]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
jne 0x68a11b82
pop edi
mov dword [ebx], esi
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.68a3943b
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x80070057
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.68a3943b
mov esp, ebp
pop ebp
ret
pop esi
mov eax, 0x80070057
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.68a3943b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0x80070057
xor ecx, ebp
pop ebx
call fcn.68a3943b
mov esp, ebp
pop ebp
ret
Function at 0x68a11bd0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x68aaf040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x68ab023c], 0
jne 0x68a11ccc
push 0x68ab0240
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [0x68ab023c], 0
jne 0x68a11cc1
mov eax, dword [0x68ab0238]
push esi
mov esi, dword [eax + 4]
test esi, esi
je 0x68a11cc0
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
push 0
push esi
push 0x68a2b040
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x68a11c3b
mov dword [esi + 0x2c], eax
jmp 0x68a11c51
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x68a11c4f
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x68a11cb5
mov eax, dword [esi + 0x28]
push 0
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0x24]
push 0
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push 1
push eax
push 2
call dword [sym.imp.ntdll.dll_ZwWaitForMultipleObjects]
test eax, eax
js 0x68a11c78
cmp eax, 2
jb 0x68a11c86
cmp eax, 0x80
jl 0x68a11cb5
cmp eax, 0x82
jae 0x68a11cb5
mov eax, dword [ebp + eax*4 - 0xc]
cmp eax, dword [esi + 0x24]
jne 0x68a11cb3
push 0
push 0
push dword [esi + 0x2c]
call dword [sym.imp.ntdll.dll_ZwWaitForSingleObject]
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x2c], 0
mov eax, 0xc0000703
jmp 0x68a11cb5
xor eax, eax
test eax, eax
js 0x68a11cc0
mov byte [0x68ab023c], 1
pop esi
push 0x68ab0240
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.68a3943b
mov esp, ebp
pop ebp
ret
Function at 0x68a182a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x68aabab0
push 0x68a3aba0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x68aaf040]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, edx
push 0x1c
lea eax, [ebp - 0x38]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [ebp - 4], 0
mov eax, 0x5a4d
mov ecx, dword [ebp - 0x34]
cmp word [ecx], ax
jne 0x68a18343
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x68a18343
mov esi, dword [edx + ecx + 0xd8]
lea eax, [esi + ecx]
cmp edi, eax
jb 0x68a18343
mov eax, dword [edx + ecx + 0xdc]
add eax, esi
add eax, ecx
cmp edi, eax
jae 0x68a18343
mov dword [ebp - 4], 0xfffffffe
mov al, 1
jmp 0x68a1834c
mov dword [ebp - 4], 0xfffffffe
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.68a3943b
mov esp, ebp
pop ebp
ret
Function at 0x68a18560
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x68aaf040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
lea ecx, [esi - 0x10000]
movzx eax, cx
mov edi, ecx
sub edi, eax
test eax, eax
cmove edi, ecx
cmp edi, ebx
jbe 0x68a18629
lea eax, [edi - 0x70000000]
cmp eax, 0x10000000
ja 0x68a185a6
sub edi, 0x8000000
jmp 0x68a18621
push 0x1c
lea eax, [ebp - 0x20]
mov dword [ebp - 8], 0
xorps xmm0, xmm0
push eax
push edi
movups xmmword [ebp - 0x20], xmm0
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x68a18629
cmp dword [ebp - 0x10], 0x10000
jne 0x68a1860c
cmp dword [ebp - 0x14], 0x10000
jb 0x68a1860c
push 0x40
push 0x3000
push 0x10000
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x68a186de
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x677
je 0x68a18629
sub edi, 0x10000
jmp 0x68a18621
mov ecx, dword [ebp - 0x1c]
add ecx, 0xffff0000
mov edi, ecx
movzx eax, di
sub edi, eax
test eax, eax
cmove edi, ecx
cmp edi, ebx
ja 0x68a18591
movzx eax, si
test eax, eax
je 0x68a18638
sub esi, eax
add esi, 0x10000
mov edi, dword [ebp + 8]
cmp esi, edi
jae 0x68a186dc
lea eax, [esi - 0x70000000]
cmp eax, 0x10000000
ja 0x68a1865b
add esi, 0x8000000
jmp 0x68a186d4
push 0x1c
lea eax, [ebp - 0x20]
mov dword [ebp - 8], 0
xorps xmm0, xmm0
push eax
push esi
movups xmmword [ebp - 0x20], xmm0
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x68a186dc
cmp dword [ebp - 0x10], 0x10000
mov ecx, dword [ebp - 0x14]
jne 0x68a186bf
cmp ecx, 0x10000
jb 0x68a186bf
push 0x40
push 0x3000
push 0x10000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x68a186de
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x677
je 0x68a186dc
add esi, 0x10000
jmp 0x68a186d4
mov esi, dword [ebp - 0x20]
add esi, ecx
movzx ecx, si
test ecx, ecx
je 0x68a186d4
mov eax, 0x10000
sub eax, ecx
add esi, eax
cmp esi, edi
jb 0x68a18643
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.68a3943b
mov esp, ebp
pop ebp
ret
Function at 0x68a186f0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebx
push esi
push edi
cmp ecx, 0x7ff80000
jbe 0x68a18710
lea esi, [ecx - 0x7ff80000]
cmp ecx, 0x80000000
jb 0x68a18715
mov ebx, 0xfff80000
jmp 0x68a1871b
mov esi, 0x80000
lea ebx, [ecx + 0x7ff80000]
cmp byte [ecx], 0xe9
jne 0x68a18754
mov eax, dword [ecx + 1]
add eax, 5
add eax, ecx
cmp eax, ecx
jae 0x68a18742
cmp eax, 0x80000000
jae 0x68a1873b
lea ebx, [eax + 0x7ff80000]
jmp 0x68a18754
mov ebx, 0xfff80000
jmp 0x68a18754
lea esi, [eax - 0x7ff80000]
cmp eax, 0x7ff80000
ja 0x68a18754
mov esi, 0x80000
mov edx, dword [0x68ab1e18]
mov eax, dword [0x68ab1e10]
test edx, edx
jne 0x68a1876f
test eax, eax
je 0x68a18782
mov edx, eax
mov dword [0x68ab1e18], edx
mov edi, dword [edx + 8]
test edi, edi
je 0x68a18782
cmp edi, esi
jb 0x68a18782
cmp edi, ebx
jbe 0x68a18810
mov edx, eax
mov dword [0x68ab1e18], edx
test eax, eax
je 0x68a187b4
mov edi, eax
test eax, eax
je 0x68a187a3
mov eax, dword [edi + 8]
test eax, eax
je 0x68a187a3
cmp eax, esi
jb 0x68a187a3
cmp eax, ebx
jbe 0x68a18810
mov edx, dword [edx + 4]
mov edi, edx
mov dword [0x68ab1e18], edx
mov eax, edx
test edi, edi
jne 0x68a18790
push ebx
and ecx, 0xffff0000
mov edx, esi
call fcn.68a18560
mov edx, eax
add esp, 4
test edx, edx
je 0x68a18837
mov dword [edx], 0x52727464
xor ecx, ecx
mov dword [edx + 8], 0
mov edi, 0x38b
mov eax, dword [0x68ab1e10]
mov dword [edx + 4], eax
lea eax, [edx + 0xffa8]
mov dword [0x68ab1e18], edx
mov dword [0x68ab1e10], edx
nop dword [eax]
mov dword [eax + 0x40], ecx
mov ecx, eax
sub eax, 0x48
sub edi, 1
jne 0x68a18800
mov dword [edx + 8], ecx
mov edi, dword [edx + 8]
cmp edi, esi
jb 0x68a18837
cmp edi, ebx
ja 0x68a18837
mov ecx, dword [edi + 0x40]
push 0x48
push 0xcc
push edi
mov dword [edx + 8], ecx
call fcn.68a3b750
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x68a18840
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x68aaf040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x68ab1e1c], 0
jne 0x68a188dd
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
mov edx, 0x68ab1e1c
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x68a188dd
push esi
mov esi, dword [0x68ab1e10]
mov dword [0x68ab1e00], eax
mov dword [0x68ab1e08], eax
mov dword [0x68ab1e14], eax
test esi, esi
je 0x68a188ad
nop
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x68a188c3
mov esi, dword [esi + 4]
test esi, esi
jne 0x68a18890
xor eax, eax
mov dword [0x68ab1e20], eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.68a3943b
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x68ab1e20], eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.68a3943b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0x10dd
xor ecx, ebp
call fcn.68a3943b
mov esp, ebp
pop ebp
ret
Function at 0x68a18d50
Capabilities:
Suspend thread

Disassembly:
mov eax, dword [0x68ab1e20]
push esi
mov esi, ecx
test eax, eax
jne 0x68a18dbe
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp esi, eax
jne 0x68a18d6a
xor eax, eax
pop esi
ret
push edi
push 8
call fcn.68a397a3
add esp, 4
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x68a18dab
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 8
push edi
call fcn.68a39763
add esp, 8
mov dword [0x68ab1e20], esi
mov eax, esi
mov dword [0x68ab1e14], 0
pop edi
pop esi
ret
mov eax, dword [0x68ab1e08]
mov dword [edi], eax
xor eax, eax
mov dword [edi + 4], esi
mov dword [0x68ab1e08], edi
pop edi
pop esi
ret
Function at 0x68a1c5f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x68aabb10
push 0x68a3aba0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x68aaf040]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, ecx
mov dword [ebp - 4], 0
test edx, edx
jne 0x68a1c69f
cmp dword [ebp + 8], 0x20
jbe 0x68a1c69f
lea ecx, [edx + 8]
call fcn.68a091b0
test al, al
je 0x68a1c69f
call fcn.68a08f80
mov edx, eax
test edx, edx
je 0x68a1c69f
mov byte [ebp - 0x1d], 0
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x68a1c660
sub ecx, edi
sar ecx, 1
push ecx
push 0x23
push dword [ebp + 8]
push ebx
push ecx
lea ecx, [ebp - 0x1d]
call fcn.68a09a30
cmp byte [ebp - 0x1d], 0
je 0x68a1c69f
push 5
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x68a1c69f
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.68a3943b
mov esp, ebp
pop ebp
ret

Function at 0x68a1c940
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x68aaf040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 0x210], edx
push edi
mov edi, 0x80004002
mov eax, dword [esi + 4]
test al, 1
je 0x68a1ca2d
push ebx
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
lea ebx, [esi + 0xc]
mov edi, 0x80070003
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x68a1c998
mov dword [esi], eax
xor edi, edi
test edi, edi
jns 0x68a1ca13
push 0x208
lea eax, [ebp - 0x20c]
mov edi, 0x80070003
push 0
push eax
call fcn.68a3b750
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push str.SSLKEYLOGFILE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0x102
ja 0x68a1ca13
push dword [esi + 8]
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.68a40140
add esp, 0xc
test eax, eax
jne 0x68a1ca13
push eax
push 0x80
push 3
push eax
push 3
push 0xc0000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x68a1ca13
mov dword [esi], eax
xor edi, edi
mov eax, dword [esi + 4]
mov edx, dword [ebp - 0x210]
and eax, 0xfffffffe
mov dword [esi + 4], eax
pop ebx
test edi, edi
jns 0x68a1ca2d
or eax, 2
mov dword [esi + 4], eax
test al, 2
jne 0x68a1ca47
mov eax, dword [esi]
pop edi
mov dword [edx], eax
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.68a3943b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.68a3943b
mov esp, ebp
pop ebp
ret
Function at 0x68a1d420
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
sub esp, 0x14
mov eax, 1
cmp ecx, 3
ja case.default.0x68a1d438
push esi
jmp dword [ecx*4 + 0x68a1d58c]
mov ecx, dword [ebp + 8]
call fcn.68a1d160
pop esi
mov esp, ebp
pop ebp
ret 0xc
push 0x2000
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x68a1d57d
push esi
push dword [0x68ab0490]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x68a1d57d
movups xmm0, xmmword [str.A_script_started_by]
push 0xfeb
movups xmmword [esi], xmm0
movups xmm0, xmmword [0x68a60478]
movups xmmword [esi + 0x10], xmm0
movq xmm0, qword [0x68a60488]
movq qword [esi + 0x20], xmm0
mov ax, word [0x68a60490]
mov word [esi + 0x28], ax
lea eax, [esi + 0x28]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0xc
push dword [0x68ab0490]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x68a1d57d
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0xc
push edi
mov edi, 0x68ab09c0
movups xmm0, xmmword [edi]
psrldq xmm0, 0xc
movd esi, xmm0
mov ecx, esi
call dword [0x68a57338]
call esi
add edi, 0x14
cmp edi, 0x68ab0a9c
jne 0x68a1d4f0
pop edi
xor ecx, ecx
call fcn.68a24050
push 0x68ab1e54
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x68ab1e6c
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x68aaffd8
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push dword [0x68ab0490]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x68a1d551
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [0x68ab0490]
call dword [sym.imp.KERNEL32.dll_TlsFree]
push dword [0x68ab1e50]
mov dword [0x68ab0490], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x68ab1e50], 0
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0xc