joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ae180
Capabilities:
Get common file path

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [esp + 8]
push edi
test ecx, ecx
jg 0x5ae1aa
test ebx, ebx
je 0x5ae1a8
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5ae197
sub ecx, edx
sar ecx, 1
jmp 0x5ae1aa
xor ecx, ecx
add ecx, 0xd
cmp ecx, 0x104
jge 0x5ae1ba
mov ecx, 0x104
lea eax, [ecx + ecx]
push eax
call fcn.004463f0
mov edi, eax
add esp, 4
test edi, edi
jne 0x5ae1d4
pop edi
mov eax, 0x820003e8
pop ebx
ret
push esi
push edi
xor esi, esi
push esi
push 0x6a79b0
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x5ae205
push esi
push 0x4000100
push 2
push esi
push 1
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x5ae23c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
js 0x5ae243
jne 0x5ae224
push edi
xor esi, esi
call fcn.00446420
add esp, 4
mov eax, esi
pop esi
pop edi
pop ebx
ret
movzx esi, si
push edi
or esi, 0x83ff0000
call fcn.00446420
add esp, 4
mov eax, esi
pop esi
pop edi
pop ebx
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.00446420
add esp, 4
mov eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x5af940
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x644bb2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push 0x18
mov dword [esi], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x38], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x18], 0xffffffff
mov dword [esi + 0x1c], 1
mov byte [esi + 0x48], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
call fcn.004b2888
add esp, 4
mov dword [ebp - 0x10], eax
test eax, eax
je 0x5afa35
mov dword [eax], 0x6b0028
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
jmp 0x5afa37
xor eax, eax
push 4
mov dword [esi + 0x60], eax
call fcn.004b2888
add esp, 4
mov dword [ebp - 0x10], eax
test eax, eax
je 0x5afa53
mov dword [eax], 0
jmp 0x5afa55
xor eax, eax
push 0x40
mov dword [esi + 0x54], eax
call fcn.004b2888
add esp, 4
mov dword [ebp - 0x10], eax
test eax, eax
je 0x5afa72
mov ecx, eax
call fcn.005afad0
jmp 0x5afa74
xor eax, eax
push 0xe0
mov dword [esi + 0x58], eax
call fcn.004b2888
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x5afa9b
mov ecx, eax
call fcn.005d6960
jmp 0x5afa9d
xor eax, eax
push 0x6f2440
mov dword [ebp - 4], 0xffffffff
mov dword [esi + 0x5c], eax
call fcn.005b0f90
push 0x6f2530
call fcn.005b0f80
mov ecx, dword [ebp - 0xc]
add esp, 8
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5df250
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x645880
push eax
mov dword fs:[0], esp
sub esp, 0x28
push esi
mov esi, ecx
cmp dword [esi + 0xc], 0
jne 0x5df27e
cmp dword [esi + 0x10], 0
je 0x5df3c5
cmp byte [esi + 8], 0
jne 0x5df3c5
cmp byte [esi + 0x35], 0
je 0x5df2c1
push 0x20
push str.E_jp2.cpp_
lea ecx, [ebp - 0x20]
call fcn.005b0a70
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x20]
push 0x6b02f0
mov dword [ebp - 4], 0
call dword [eax + 8]
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0xffffffff
call fcn.005b0cb0
cmp dword [esi + 0x2c], 0
jl 0x5df302
jg 0x5df2cf
cmp dword [esi + 0x28], 0
jb 0x5df302
push 0x21
push str.E_jp2.cpp_
lea ecx, [ebp - 0x34]
call fcn.005b0a70
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x34]
push 0x6b02f0
mov dword [ebp - 4], 1
call dword [eax + 8]
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
call fcn.005b0cb0
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x5df30e
call fcn.005df250
mov ecx, esi
mov byte [esi + 8], 1
mov byte [esi + 0x35], 1
call fcn.005dff60
mov edx, dword [esi + 0x30]
test edx, edx
je 0x5df3c5
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x5df344
mov eax, dword [ecx]
push dword [esi + 0x18]
push edx
mov eax, dword [eax + 0x10]
call eax
test al, al
sete al
mov byte [esi + 0x34], al
jmp 0x5df3ac
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx + 8]
test eax, eax
je 0x5df377
push eax
push dword [esi + 0x18]
push 1
push edx
call fcn.00636939
mov ecx, dword [esi + 0xc]
add esp, 0x10
cmp eax, dword [esi + 0x18]
setne al
mov byte [esi + 0x34], al
mov eax, dword [esi + 0x18]
add dword [ecx + 0x18], eax
mov eax, dword [esi + 0x1c]
adc dword [ecx + 0x1c], eax
jmp 0x5df3ac
push edi
mov edi, dword [ecx + 0xc]
test edi, edi
je 0x5df399
mov eax, dword [edi]
mov ecx, edi
push dword [esi + 0x18]
push edx
mov eax, dword [eax + 0x10]
call eax
mov ecx, dword [esi + 0xc]
test al, al
sete al
mov byte [esi + 0x34], al
jmp 0x5df39f
cmp byte [ecx + 0x10], 0
je 0x5df3ab
mov eax, dword [esi + 0x18]
add dword [ecx + 0x18], eax
mov eax, dword [esi + 0x1c]
adc dword [ecx + 0x1c], eax
pop edi
push dword [esi + 0x30]
call fcn.004b28c1
add esp, 4
mov dword [esi + 0x14], 0
mov dword [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x5fbf40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, ecx
xor bl, bl
mov eax, dword [esi]
mov byte [esi + 0xea], 0
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x5fbfb9
mov ecx, dword [ecx + 0x21c]
mov eax, dword [ecx]
call dword [eax + 8]
test al, 2
je 0x5fbf72
mov eax, dword [esi]
lea ecx, [esi + 0x38]
push dword [eax + 0x18]
call fcn.005f7210
mov eax, dword [esi + 0x10]
mov ecx, esi
mov eax, dword [eax]
mov dword [esi + 0x14], eax
call fcn.005fa5c0
test al, al
jne 0x5fbfb9
mov bl, 1
mov ecx, dword [esi + 0x34]
mov byte [esi + 0xe9], 1
call fcn.005cfd80
mov eax, dword [esi]
cmp byte [eax + 0x159], 0
jne 0x5fbfa8
mov ecx, esi
call fcn.005fc8f0
test bl, bl
je 0x5fc103
mov ecx, esi
pop esi
pop ebx
jmp fcn.005f4490
mov ecx, dword [esi]
mov ecx, dword [ecx + 0xc]
call fcn.005b2540
test al, al
je 0x5fbf87
mov eax, dword [esi + 0x34]
test eax, eax
je 0x5fbfdc
push 0xb0
push eax
call fcn.004b22a2
add esp, 8
mov eax, dword [esi + 0xd0]
mov dword [esi + 0x34], 0
push edi
test eax, eax
je 0x5fc017
push 0x5f2300
push dword [eax - 4]
lea edi, [eax - 4]
push 0xbc
push eax
call fcn.004b21a4
imul eax, dword [edi], 0xbc
add eax, 4
push eax
push edi
call fcn.004b22b0
add esp, 8
mov ebx, dword [esi + 0xc8]
mov dword [esi + 0xd0], 0
mov dword [esi + 0xcc], ebx
test ebx, ebx
je 0x5fc09f
mov eax, dword [ebx + 0x24]
mov dword [esi + 0xc8], eax
mov eax, dword [ebx + 8]
test eax, eax
je 0x5fc04a
push eax
call fcn.004b28c1
add esp, 4
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x5fc05a
push eax
call fcn.004b28c1
add esp, 4
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x5fc084
push 0x5c79e0
push dword [eax - 4]
lea edi, [eax - 4]
push 0x6c
push eax
call fcn.004b21a4
imul eax, dword [edi], 0x6c
add eax, 4
push eax
push edi
call fcn.004b22b0
add esp, 8
push 0x28
push ebx
call fcn.004b22a2
mov ebx, dword [esi + 0xc8]
add esp, 8
mov dword [esi + 0xcc], ebx
test ebx, ebx
jne 0x5fc031
mov eax, dword [esi]
mov word [esi + 0x7c], 0
mov dword [esi + 0xeb], 0
mov byte [esi + 0xe9], 1
mov eax, dword [eax + 0x18]
pop edi
mov ecx, dword [eax + 0x20]
sub ecx, dword [esi + 0xd8]
mov edx, dword [eax + 0x24]
sbb edx, dword [esi + 0xdc]
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], edx
cmp edx, dword [eax + 0x2c]
jl 0x5fc0e6
jg 0x5fc0e0
cmp ecx, dword [eax + 0x28]
jbe 0x5fc0e6
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], edx
mov dword [esi + 0xd8], 0
mov ecx, esi
mov dword [esi + 0xdc], 0
pop esi
pop ebx
jmp fcn.005f7270
pop esi
pop ebx
ret
Function at 0x612510
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [0x73d790], 2
jge 0x612525
xor al, al
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 0x1c], 0
push ebx
push esi
push edi
je 0x6125ca
mov eax, 0x1f
sub eax, dword [ebp + 0x20]
movd xmm0, eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x10]
add ebx, ebx
mov edx, dword [ebp + 0xc]
pcmpeqd xmm2, xmm2
pcmpeqd xmm1, xmm1
psrld xmm1, 0x1f
movd xmm3, dword [ebp + 0x20]
pslld xmm2, xmm3
por xmm1, xmm2
mov edi, dword [edx]
add edi, ebx
mov ecx, dword [ebp + 0x14]
movdqa xmm4, xmmword [esi]
pxor xmm5, xmm5
pcmpgtd xmm5, xmm4
pxor xmm4, xmm5
psrad xmm4, xmm0
pand xmm5, xmm1
paddd xmm4, xmm5
movdqa xmm6, xmmword [esi + 0x10]
pxor xmm7, xmm7
pcmpgtd xmm7, xmm6
pxor xmm6, xmm7
psrad xmm6, xmm0
pand xmm7, xmm1
paddd xmm6, xmm7
packssdw xmm4, xmm6
movdqa xmmword [edi], xmm4
add esi, 0x20
add edi, 0x10
sub ecx, 8
jg 0x61256d
add edx, 4
sub eax, 1
jg 0x612566
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
fld dword [ebp + 0x24]
fmul qword [0x6b0b58]
mov eax, dword [ebp + 0x20]
fstp dword [ebp - 4]
fld dword [ebp - 4]
cmp eax, 0x1f
jg 0x6125fd
mov ecx, 0x1f
sub ecx, eax
mov eax, 1
shl eax, cl
mov dword [ebp - 4], eax
fild dword [ebp - 4]
fstp dword [ebp - 8]
fdiv dword [ebp - 8]
jmp 0x612613
lea ecx, [eax - 0x1f]
mov eax, 1
shl eax, cl
mov dword [ebp - 8], eax
fild dword [ebp - 8]
fstp dword [ebp - 8]
fmul dword [ebp - 8]
fstp dword [ebp - 8]
fld dword [ebp - 8]
fst dword [ebp - 0x18]
fst dword [ebp - 0x14]
fst dword [ebp - 0x10]
fstp dword [ebp - 0xc]
stmxcsr dword [ebp - 4]
mov eax, dword [ebp - 4]
and eax, 0xffff9fff
mov dword [ebp - 8], eax
ldmxcsr dword [ebp - 8]
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x10]
add ebx, ebx
mov edx, dword [ebp + 0xc]
movups xmm0, xmmword [ebp - 0x18]
pcmpeqd xmm2, xmm2
pcmpeqd xmm1, xmm1
psrld xmm1, 0x1f
pslld xmm2, 0x1f
por xmm1, xmm2
mov edi, dword [edx]
add edi, ebx
mov ecx, dword [ebp + 0x14]
movdqa xmm4, xmmword [esi]
pxor xmm5, xmm5
pcmpgtd xmm5, xmm4
pxor xmm4, xmm5
pand xmm5, xmm1
paddd xmm4, xmm5
cvtdq2ps xmm4, xmm4
mulps xmm4, xmm0
cvtps2dq xmm4, xmm4
movdqa xmm6, xmmword [esi + 0x10]
pxor xmm7, xmm7
pcmpgtd xmm7, xmm6
pxor xmm6, xmm7
pand xmm7, xmm1
paddd xmm6, xmm7
cvtdq2ps xmm6, xmm6
mulps xmm6, xmm0
cvtps2dq xmm6, xmm6
packssdw xmm4, xmm6
movdqa xmmword [edi], xmm4
add esi, 0x20
add edi, 0x10
sub ecx, 8
jg 0x612667
add edx, 4
sub eax, 1
jg 0x612660
ldmxcsr dword [ebp - 4]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x61c6b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x40]
mov eax, dword fs:[0]
sub esp, 0x40
push 0xffffffffffffffff
push 0x646d66
push eax
mov eax, dword [ebp + 0x4c]
mov dword fs:[0], esp
sub esp, 0x18c
cmp eax, 0x20
jbe 0x61c6e0
mov eax, 0x20
mov ecx, dword [ebp + 0x48]
push ebx
push esi
mov esi, ecx
neg esi
push edi
sbb esi, esi
and esi, eax
jbe 0x61c6fe
push esi
push ecx
lea eax, [ebp]
push eax
call fcn.004b3b20
add esp, 0xc
mov edi, 0x20
cmp esi, edi
jae 0x61c71f
mov eax, edi
sub eax, esi
push eax
lea eax, [ebp]
add eax, esi
push 0x6b1a50
push eax
call fcn.004b3b20
add esp, 0xc
mov eax, dword [ebp + 0x54]
cmp eax, 0x20
jbe 0x61c729
mov eax, edi
mov ecx, dword [ebp + 0x50]
mov esi, ecx
neg esi
sbb esi, esi
and esi, eax
jbe 0x61c744
push esi
push ecx
lea eax, [ebp - 0x2c]
push eax
call fcn.004b3b20
add esp, 0xc
cmp esi, edi
jae 0x61c75e
sub edi, esi
lea eax, [ebp - 0x2c]
push edi
add eax, esi
push 0x6b1a50
push eax
call fcn.004b3b20
add esp, 0xc
lea ecx, [ebp - 0x94]
call fcn.00452360
push 0x20
lea eax, [ebp]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x94]
call fcn.00452bb0
lea ecx, [ebp - 0x94]
call fcn.004523a0
mov ebx, dword [ebp + 0x6c]
mov esi, dword [ebp + 0x74]
mov ecx, dword [eax]
mov dword [ebp + 0x30], ecx
mov ecx, dword [eax + 4]
mov dword [ebp + 0x34], ecx
mov ecx, dword [eax + 8]
mov dword [ebp + 0x38], ecx
mov eax, dword [eax + 0xc]
mov dword [ebp + 0x3c], eax
cmp ebx, 3
jb 0x61c7f5
mov edi, 0x32
lea ecx, [ebp - 0x94]
call fcn.00452480
push esi
lea eax, [ebp + 0x30]
push eax
lea ecx, [ebp - 0x94]
call fcn.00452bb0
lea ecx, [ebp - 0x94]
call fcn.004523a0
mov ecx, dword [eax]
mov dword [ebp + 0x30], ecx
mov ecx, dword [eax + 4]
mov dword [ebp + 0x34], ecx
mov ecx, dword [eax + 8]
mov dword [ebp + 0x38], ecx
mov eax, dword [eax + 0xc]
mov dword [ebp + 0x3c], eax
sub edi, 1
jne 0x61c7b3
lea ecx, [ebp - 0x198]
call fcn.00431460
push esi
lea eax, [ebp + 0x30]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x198]
call fcn.004d6190
mov edi, dword [ebp + 0x58]
lea eax, [ebp - 0x2c]
push 0x20
push edi
push eax
lea ecx, [ebp - 0x198]
call fcn.004d6230
cmp ebx, 3
jb 0x61c877
mov ebx, 1
xor eax, eax
test esi, esi
je 0x61c84f
lea esp, [esp]
mov cl, byte [ebp + eax + 0x30]
xor cl, bl
mov byte [ebp + eax + 0x20], cl
inc eax
cmp eax, esi
jb 0x61c840
push esi
lea eax, [ebp + 0x20]
push eax
lea ecx, [ebp - 0x198]
call fcn.004d6190
push 0x20
push edi
push edi
lea ecx, [ebp - 0x198]
call fcn.004d6230
inc ebx
cmp ebx, 0x14
jl 0x61c833
mov ebx, dword [ebp + 0x6c]
push dword [ebp + 0x78]
push esi
push dword [ebp + 0x70]
push ebx
push dword [ebp + 0x68]
push dword [ebp + 0x64]
push dword [ebp + 0x60]
push dword [ebp + 0x5c]
push 0x20
push edi
push dword [ebp + 0x54]
push dword [ebp + 0x50]
call fcn.0061ce10
add esp, 0x30
lea ecx, [ebp - 0x198]
call fcn.00403120
lea ecx, [ebp - 0x94]
call fcn.00403120
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
lea esp, [ebp + 0x40]
pop ebp
ret
Function at 0x622b40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
push ebx
mov eax, ecx
push esi
push edi
mov esi, dword [eax + 0x1004]
lea esp, [esp]
cmp esi, 0x8000
jb 0x622b65
cmp dword [eax + 0x1018], 0
je 0x622c55
mov edi, dword [eax + 0x1008]
mov edx, esi
mov ecx, edi
cmp edi, 1
jge 0x622c24
cmp dword [eax + 0x1014], 1
je 0x622c24
mov ebx, dword [eax + 0x100c]
mov edx, dword [eax + 0x1010]
cmp ebx, edx
jae 0x622d22
mov cl, byte [ebx]
mov byte [esp + 0xf], cl
lea ecx, [ebx + 1]
cmp byte [esp + 0xf], 0xff
jne 0x622bfb
cmp ecx, edx
jae 0x622d0e
cmp byte [ecx], 0
jne 0x622be6
mov ecx, 8
mov edx, 0xff
sub ecx, edi
shl edx, cl
lea ecx, [ebx + 2]
or dword [eax + 0x1000], edx
xor edx, edx
mov dword [eax + 0x100c], ecx
lea ecx, [edi + 8]
mov dword [eax + 0x1014], edx
mov edx, dword [eax + 0x1004]
jmp 0x622c24
mov edx, 1
mov ecx, edi
mov dword [eax + 0x1014], edx
mov edx, dword [eax + 0x1004]
jmp 0x622c24
movzx edx, byte [esp + 0xf]
mov dword [eax + 0x100c], ecx
mov ecx, 8
sub ecx, edi
mov dword [eax + 0x1014], 0
shl edx, cl
lea ecx, [edi + 8]
or dword [eax + 0x1000], edx
mov edx, esi
shl dword [eax + 0x1000], 1
lea esi, [edx + edx]
dec ecx
mov dword [eax + 0x1004], esi
mov dword [eax + 0x1008], ecx
cmp esi, 0x10000
jne 0x622b50
mov dword [eax + 0x1018], 0
jmp 0x622b50
mov edx, dword [esp + 0x14]
mov ebx, dword [eax + 0x1000]
add edx, eax
push ebp
mov ecx, ebx
shr ecx, 0x10
movzx edi, byte [edx]
and edi, 0x7f
movsx ebp, word [edi*2 + 0x6f2d70]
sub esi, ebp
mov dword [eax + 0x1004], esi
cmp ecx, esi
jae 0x622cb0
mov bl, byte [edx]
movzx eax, bl
shr eax, 7
test esi, 0xffff8000
jne 0x622d06
and bl, 0x80
mov byte [edx], bl
cmp esi, ebp
jb 0x622cf3
mov ecx, eax
mov al, byte [edi + 0x6f2e58]
pop ebp
or al, bl
pop edi
pop esi
mov byte [edx], al
mov eax, ecx
pop ebx
pop ecx
ret 4
mov ecx, esi
mov dword [eax + 0x1004], ebp
shl ecx, 0x10
sub ebx, ecx
mov dword [eax + 0x1000], ebx
mov bl, byte [edx]
cmp esi, ebp
jae 0x622ce8
movzx ecx, bl
and bl, 0x80
mov byte [edx], bl
mov al, byte [edi + 0x6f2e58]
pop ebp
shr ecx, 7
or al, bl
pop edi
pop esi
mov byte [edx], al
mov eax, ecx
pop ebx
pop ecx
ret 4
movzx eax, bl
shr eax, 7
and bl, 0x80
mov byte [edx], bl
mov ecx, 1
sub ecx, eax
mov al, byte [edi + 0x6f2ed0]
xor al, bl
mov byte [edx], al
mov eax, ecx
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret 4
pop edi
pop esi
mov dword [eax + 0x1014], 3
or eax, 0xffffffff
pop ebx
pop ecx
ret 4
pop edi
pop esi
mov dword [eax + 0x1014], 2
or eax, 0xffffffff
pop ebx
pop ecx
ret 4
Function at 0x624c60
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x63ac60
push eax
mov dword fs:[0], esp
push esi
mov esi, ecx
mov eax, dword [esi + 0x28]
test eax, eax
je 0x624c8b
push eax
call fcn.00446420
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x634dd0
Capabilities:
Create thread

Disassembly:
sub esp, 0x14
push esi
mov esi, ecx
push edi
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
push 0
push 1
push 0
mov dword [esp + 0x18], 0x6d1508
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esp + 0x14], eax
lea eax, [esp + 0xc]
push eax
push 0
lea eax, [esp + 0x10]
mov dword [esp + 0x18], 0
push eax
push 0x636120
push 0
push 0
mov dword [esp + 0x30], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [esp + 0x10], eax
test eax, eax
je 0x634e49
push 0xffffffffffffffff
push dword [esp + 0x18]
call edi
mov ecx, dword [esp + 0xc]
jmp 0x634e4f
xor ecx, ecx
mov dword [esp + 0xc], ecx
mov eax, dword [esi + 8]
inc eax
mov dword [esp + 0x18], 0
mov dword [esi + 8], eax
test ecx, ecx
je 0x634e72
push esi
push 0
push dword [esp + 0x28]
push ecx
call dword [sym.imp.USER32.dll_PostThreadMessageW]
jmp 0x634eb6
mov ecx, dword [esp + 0x20]
cmp ecx, 0x8001
je 0x634e9e
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 4]
dec dword [esi + 8]
mov eax, dword [esi + 8]
test eax, eax
jg 0x634ea5
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 8]
jmp 0x634ea5
mov dword [esi + 0xc], 2
dec eax
mov dword [esi + 8], eax
test eax, eax
jg 0x634eb6
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0xffffffffffffffff
push dword [esi + 4]
call edi
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 8], 0x6d1508
test eax, eax
je 0x634ef6
push 0
push 0
push 0x12
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageW]
push 0xffffffffffffffff
push dword [esp + 0x14]
call edi
push dword [esp + 0x10]
mov dword [esp + 0x10], 0
call esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x634f01
push eax
call esi
pop edi
pop esi
add esp, 0x14
ret 4
Function at 0x100022b0
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x10079070]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x44
mov eax, 0x1003e8b7
call fcn.1002a30a
mov esi, ecx
call fcn.10001b79
lea ecx, [ebp - 0x40]
call fcn.10004d2b
mov eax, dword [esi + 0x74]
xor edi, edi
cmp eax, edi
mov dword [ebp - 4], edi
je 0x10002496
push eax
mov ecx, esi
call fcn.10008057
cmp eax, edi
je 0x10002496
lea ecx, [ebp - 0x40]
push ecx
push eax
call fcn.10006707
test eax, eax
pop ecx
pop ecx
je 0x10002496
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10004bab
mov esi, 0x104
push esi
lea eax, [ebp]
push edi
push eax
call fcn.10029ce0
push esi
lea eax, [ebp + 0x104]
push edi
push eax
call fcn.10029ce0
add esp, 0x20
lea eax, [ebp]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x1000248b
lea eax, [ebp + 0x104]
push eax
push edi
push 0x10042a30
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x1000248b
lea eax, [ebp + 0x104]
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.10002143
push 0x10042a28
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.10002106
push 0x1001
push dword [ebp - 0x18]
lea ecx, [ebp - 0x50]
call fcn.1000ff69
mov eax, dword [ebp - 0x14]
push dword [eax - 0xc]
lea ecx, [ebp - 0x50]
push eax
mov byte [ebp - 4], 4
call fcn.1000f439
lea ecx, [ebp - 0x50]
call fcn.1000f779
push 1
push edi
push edi
push dword [ebp - 0x18]
push str.Open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 1
push 0x7c
lea ecx, [ebp - 0x20]
call fcn.10001d0b
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 5
call fcn.1000204b
add esp, 0xc
lea ecx, [ebp + 0x104]
push ecx
push eax
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 6
call fcn.100020a2
add esp, 0xc
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.10001197
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
mov byte [ebp - 4], 9
call fcn.10001197
mov eax, dword [ebp - 0x1c]
push eax
mov dword [ebp - 0x24], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
push esi
call fcn.1000715a
pop ecx
push esi
mov ebx, eax
push edi
push ebx
call fcn.10029ce0
push esi
push dword [ebp - 0x24]
push ebx
call fcn.1002a5a0
add esp, 0x18
push edi
push edi
push edi
push edi
push ebx
push 0x100024cb
call fcn.10010c57
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.10001197
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 3
call fcn.1000f998
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.10001197
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.10001197
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.10004b4e
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.1002a2c8
add ebp, 0x20c
leave
ret
Function at 0x10003359
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x14]
and dword [ebp - 8], 0
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + 4]
mov eax, dword [eax]
cmp word [eax + 6], 0
mov dword [ebp - 4], ecx
movzx ecx, word [eax + 0x14]
push ebx
push esi
push edi
lea ecx, [ecx + eax + 0x18]
jbe 0x10003427
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea esi, [ecx + 0x10]
mov eax, dword [esi]
test eax, eax
jne 0x100033c9
mov eax, dword [ebp + 0x10]
mov edi, dword [eax + 0x38]
test edi, edi
jle 0x1000340f
mov eax, dword [esi - 4]
add eax, dword [ebp - 4]
push 4
push 0x1000
push edi
push eax
call ebx
test eax, eax
je 0x10003431
mov eax, dword [esi - 4]
add eax, dword [ebp - 4]
push edi
push 0
push eax
mov dword [esi - 8], eax
call fcn.1000325c
jmp 0x1000340c
mov ecx, dword [esi + 4]
add ecx, eax
push ecx
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
call fcn.1000333d
test eax, eax
je 0x10003431
mov eax, dword [esi - 4]
add eax, dword [ebp - 4]
push 4
push 0x1000
push dword [esi]
push eax
call ebx
test eax, eax
je 0x10003431
mov eax, dword [esi + 4]
push dword [esi]
mov edi, dword [esi - 4]
add eax, dword [ebp + 8]
add edi, dword [ebp - 4]
push eax
push edi
call fcn.1000327b
mov dword [esi - 8], edi
add esp, 0xc
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
movzx eax, word [eax + 6]
inc dword [ebp - 8]
add esi, 0x28
cmp dword [ebp - 8], eax
jl 0x10003390
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0x10
xor eax, eax
jmp 0x1000342a