joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb3a584
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0xa
add esp, 0xfffff004
push eax
dec eax
jne 0xb3a58d
mov eax, dword [ebp - 4]
add esp, 0xffffffc8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xa03c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0xb3aa54
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0xe], 0
lea eax, [ebp - 0x18]
call fcn.00a14dc8
xor ecx, ecx
mov dl, 1
mov eax, dword [0xb09150]
call fcn.00b0b0c8
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0xb3aa27
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [ebp - 0x20]
call fcn.00b0b1b4
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 4]
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], 0xb3a580
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 4]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0xb3a564
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 4]
mov dword [eax + 0x8c], edx
mov dword [eax + 0x88], 0xb3a568
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x90]
mov dl, byte [0xb3aa68]
call fcn.00b0a588
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00aecd1c
test al, al
je 0xb3a664
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x20]
call fcn.00b0aa20
jmp 0xb3a672
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x20]
call fcn.00b0aaa0
mov eax, dword [ebp - 4]
movzx edx, word [eax + 0xc]
mov eax, dword [ebp - 0x20]
call fcn.00b0ab20
xor eax, eax
push ebp
push 0xb3a6d9
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
mov dl, 1
mov eax, dword [ebp - 0x20]
call fcn.00b0a9e0
jmp 0xb3a6c1
push 0x1f4
call sub.kernel32.dll_Sleep_1
mov eax, dword [0xb74238]
mov eax, dword [eax]
call fcn.00a779e0
mov eax, dword [ebp - 0x20]
cmp byte [eax + 0x30], 0
jne 0xb3a6cf
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp eax, 0xfa0
jbe 0xb3a6a2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0xb3a6e3
call fcn.017aaa55
mov dword [0x81c94ad2], eax
jle 0xb3a696
mov al, 0xb6
stosb byte es:[edi], al
nop
push ebx
mov ecx, 0xbd20b68f
dec esp
dec ecx
xchg ebx, eax
push esp
dec edi
mov bl, 0xb6
cld
cmp al, 0x5b
mov al, 0x36
lodsd eax, dword [esi]
xchg ebx, eax
push ds
cld
mov ch, 0x36
cld
or byte [ecx + ecx*8 + 0x56], 0xe1
sbb eax, 0x8b69eb70
lahf
invalid
Function at 0xb4dc60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [esi], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 0x40
call fcn.00b4d4f4
test al, al
jne 0xb4dc9c
push 0xd
call sub.kernel32.dll_SetLastError
jmp 0xb4e060
mov dword [esi], 1
mov dword [ebp - 0xc], edi
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x5a4d
je 0xb4dcbe
push 0xc1
call sub.kernel32.dll_SetLastError
jmp 0xb4e060
mov dword [esi], 2
push dword [ebp + 0x10]
push dword [ebp + 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x3c]
add eax, 0xf8
cdq
push edx
push eax
call fcn.00b4d4f4
test al, al
jne 0xb4dced
push 0xd
call sub.kernel32.dll_SetLastError
jmp 0xb4e060
mov dword [esi], 3
mov eax, edi
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0x4550
je 0xb4dd27
push 0xc1
call sub.kernel32.dll_SetLastError
jmp 0xb4e060
mov dword [esi], 4
mov eax, dword [ebp - 0x10]
cmp word [eax + 4], 0x14c
je 0xb4dd47
push 0xc1
call sub.kernel32.dll_SetLastError
jmp 0xb4e060
mov dword [esi], 5
mov eax, dword [ebp - 0x10]
test byte [eax + 0x38], 1
je 0xb4dd65
push 0xc1
call sub.kernel32.dll_SetLastError
jmp 0xb4e060
mov dword [esi], 6
xor eax, eax
push ebp
push 0xb4e04b
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.017ad86c
jle 0xb4dd50
invalid
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0xb5eb04
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0xb5eb0c
push ecx
push ebx
push esi
mov eax, 0xb5e49c
call fcn.00a17398
mov esi, dword [0xb74238]
xor eax, eax
push ebp
push 0xb5ecde
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00a130b0
cmp eax, 2
jne 0xb5eb9d
lea edx, [ebp - 0x14]
mov eax, 1
call fcn.00a13118
mov eax, dword [ebp - 0x14]
xor edx, edx
call fcn.00a19da8
call fcn.00aef62c
mov ebx, 0x64
lea edx, [ebp - 0x18]
mov eax, 2
call fcn.00a13118
mov eax, dword [ebp - 0x18]
call fcn.00a15298
push eax
call sub.kernel32.dll_DeleteFileA
lea edx, [ebp - 0x1c]
mov eax, 2
call fcn.00a13118
mov eax, dword [ebp - 0x1c]
call fcn.00a1a260
test al, al
je 0xb5eb9d
push 0xa
call sub.kernel32.dll_Sleep_1
dec ebx
jne 0xb5eb5f
mov al, byte [0xb5ecec]
push eax
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0x24]
xor eax, eax
call fcn.00a13118
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov edx, 0xb5ecf8
call fcn.00a1f388
mov eax, dword [ebp - 0x20]
call fcn.00a15298
push eax
push 0
push 0
call fcn.00a17700
mov ebx, eax
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
jne 0xb5ec14
push 0x40
push 0xb5ecfc
lea edx, [ebp - 0x2c]
mov eax, dword [0xb7431c]
call fcn.00a170c8
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.00ad11d0
mov eax, dword [ebp - 0x28]
call fcn.00a15298
push eax
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0xb5ecc3
mov dl, 1
mov eax, dword [0xa29c7c]
call fcn.00a13f2c
mov edx, dword [0xb74230]
mov dword [edx], eax
mov eax, dword [0xb74230]
mov eax, dword [eax]
call fcn.00aec1e4
test al, al
jne 0xb5ec46
mov eax, dword [0xb74230]
mov eax, dword [eax]
call fcn.00a13f5c
jmp 0xb5ecc3
mov eax, dword [esi]
call fcn.00a77b04
lea edx, [ebp - 0x34]
mov eax, dword [esi]
call fcn.00a7825c
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x30]
call fcn.00a1a6b4
mov eax, dword [ebp - 0x30]
call fcn.00a1aa08
mov ecx, dword [0xb74070]
mov eax, dword [esi]
mov edx, dword [0xb50334]
call fcn.00a77b1c
mov ecx, dword [0xb743f4]
mov eax, dword [esi]
mov edx, dword [0xb5d398]
call fcn.00a77b1c
mov ecx, dword [0xb74108]
mov eax, dword [esi]
mov edx, dword [0xb5c59c]
call fcn.00a77b1c
mov ecx, dword [0xb742d4]
mov eax, dword [esi]
mov edx, dword [0xb5b5fc]
call fcn.00a77b1c
mov eax, dword [esi]
call fcn.00a77b9c
push ebx
call sub.kernel32.dll_ReleaseMutex
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xb5ece5
lea eax, [ebp - 0x34]
mov edx, 9
call fcn.00a14dec
ret
Function at 0x1774f21
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + ecx - 0x7baaf4b1], 0x8205f115
xor dl, bl
sar ecx, 0x9c
sbb cx, word [esp + ecx - 6]
rol dl, 1
inc dl
shr ecx, cl
rol ecx, 0xf
shl ecx, 0x33
not dl
adc dl, 0x29
xor bl, dl
push ecx
movzx eax, byte [esp + ecx*2 + 1]
shl eax, 0x4b
lea edx, [esp + edx + 8]
sete cl
xor cl, ah
add ax, word [edx + ecx*4 - 4]
jmp 0x1778b53
movzx edx, cx
lea esi, [esi + ecx*4 - 6]
dec cx
mov word [esi + ecx*4], ax
sal dl, 0xe6
mov eax, dword [ecx + edi]
inc ecx
neg ecx
push ecx
lea edi, [edi + edx*4 - 0xfc]
sub edx, ecx
jno 0x17aa473
xor eax, ebx
not dl
inc eax
bswap eax
xchg byte [esp + edx - 0xb6], dl
bswap edx
inc eax
shl cx, 0xc1
call fcn.0186639d

Function at 0x1787fbf
Capabilities:
Encode data using base64

Disassembly:
ror eax, 0x18
adc ecx, dword [edi + ecx*2]
lea edi, [edi + eax*8 - 0xbffc]
xor ecx, ebx
xadd eax, edx
ror ecx, 2
neg ecx
bswap ecx
rol ecx, 1
xor ebx, ecx
mov dword [esp + edx - 0x1800], edx
call fcn.017b7e0b

Function at 0x1794992
Capabilities:
Encode data using base64

Disassembly:
add esi, 4
xor edx, ebx
neg edx
call fcn.017a1828
or cx, ax
call fcn.01778691
mov eax, 0x63bc23b1
push eax
jmp 0x17dfb32
push edx
xchg word [esp + edx*4 - 0x7fffb], cx
mov dword [esp + edx*8 - 0x100000], ebp
ret 4
mov edx, dword [eax + edi - 0x63bc23b1]
movsx ecx, al
ror ecx, 0xe1
jae 0x17d420f
movzx ax, byte [edx + eax - 0x63bc23b1]
movzx edx, word [esp]
jno 0x184b86a
mov edx, edi
mov eax, 0xca33d08a
movzx ecx, al
lea edi, [ecx + edi - 0x8c]
mov word [edi + ecx*8 - 0x450], dx
mov edx, dword [esi + ecx*2 - 0x114]
and ecx, ecx
ror eax, cl
xor al, ah
lea esi, [ecx + esi - 0x86]
xor edx, ebx
xor ecx, 0x5088818e
neg edx
sub al, al
xor edx, 0x40ba5787
call fcn.01775bad
lea edi, [edi + edx - 0x23af]
xor cl, cl
add ecx, dword [esp + edx*2 - 0x4762]
mov word [edi + ecx - 0x63bc22b1], ax
xchg dx, cx
call fcn.017b9eeb

Function at 0x179596d
Capabilities:
Encode data using base64

Disassembly:
xor eax, 0x56beed13
call fcn.01846d6c

Function at 0x179a2be
Capabilities:
Encode data using base64

Disassembly:
rol eax, 1
inc eax
push edx
call fcn.0178cd2f

Function at 0x17a2f77
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0xef2f1533
mov dword [ebp + 4], eax
inc dword [esp]
mov edx, dword [esi]
jno 0x181f741
mov eax, 0xbb29d90e
shl eax, 0x4e
mov ax, word [esi + eax - 0x76438000]
jns 0x184330f
jmp 0x178efea
movzx ecx, dl
mov word [edx + esi], ax
movzx eax, dl
or al, dl
setnp al
lea edi, [edi + ecx*2 - 4]
push eax
sbb dl, 0xc
add ecx, dword [edi + edx*2 - 0x1e8]
jmp 0x17ecf33
mov edx, 0xaeae2e04
mov cl, byte [esi + 2]
sbb edx, edx
sar edx, 0xc6
adc edx, edx
lea esi, [esi + edx*2 + 2]
jb 0x17b7d82
sal ax, cl
sar dx, 0xcc
je 0x17f7e3f

Function at 0x17b699a
Capabilities:
Encode data using xor

Disassembly:
pushfd
mov ecx, edx
shr cl, 0xfd
push esi
mov ecx, dword [esp + ecx - 0x4e34e6f0]
mov dword [esp + 0x10], 0x65946765
mov edx, dword [esp + edx - 0x4e34e732]
mov esi, 0x8da0e934
xor si, 0x1cae
cmp esi, 0x14a7f491
je 0x17b699b
call fcn.01802ac2
call fcn.0183b9d8
not edx
adc ecx, 0x9dbc14a1
call fcn.017d9061
Function at 0x17b7d45
Capabilities:
Encode data using base64

Disassembly:
ror edx, 3
inc dword [esp + ecx*2 - 2]
neg edx
lea ecx, [ecx + ecx + 0x71998d3d]
not edx
sub edx, 0xe8afb98c
ror byte [esp + ecx - 0x71998d3c], 0xe1
jno 0x17c9393
mov edx, dword [ebp]
mov al, byte [ebp + 4]
add ebp, 6
mov dword [esp], 0x1c89ff98
sar dword [esp], 0xdd
mov byte [edx], al
mov edx, dword [esi]
inc dword [esp]
mov ecx, dword [esp]
lea esi, [ecx + esi + 3]
mov eax, dword [esp + ecx - 1]
rol byte [esp + ecx*2 - 2], cl
jge 0x17c90bc
xor edx, ebx
jmp 0x17a9022
ror edx, 1
sub edx, eax
xor edx, 0x1d27622b
pop ecx
xor ebx, edx
add edi, edx
shl ax, 0xe9
and ecx, eax
or ecx, edi
jmp ecx

Function at 0x17bba68
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + eax - 0x2b], edx
jmp 0x17dcdaf
Function at 0x17ec047
Capabilities:
Encode data using base64

Disassembly:
add edi, eax
dec dl
jne 0x184b88a
pop edx
pop edx
pop eax
jmp edi
push edx
shr dl, 0x24
and cx, ax
mov word [ebp], cx
jmp 0x17c9e13
movzx edx, cx
lea esi, [esi + ecx - 0x25af58b7]
mov dword [esp + ecx - 0x25af58bb], edx
xor eax, ebx
neg eax
bswap eax
bswap edx
rol eax, 1
xor eax, 0x10ab4f35
sub dword [esp + ecx - 0x25af58bb], edx
push ecx
sbb dx, word [esp + ecx*2 - 0x4b5eb172]
xor ebx, eax
add edx, edx
jp 0x177a1cc
mov ecx, 0xadb059aa
movsx edx, cl
sub esi, 4
call fcn.018659d1
not ax
jb 0x17ea4f3
mov cx, word [ebp + edx - 0x76b14e87]
mov ax, word [edx + ebp - 0x76b14e85]
add edx, edx
rol edx, 5
add ebp, 2
rol dx, 0x2e
not cx
jb 0x1806009

Function at 0x17f933e
Capabilities:
Encode data using base64

Disassembly:
mov edx, 0xb5a055b3
call fcn.01809f8f

Function at 0x18072a5
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + 8], 0x80bb6bcb
lea esp, [esp + 8]
call fcn.018664b7

Function at 0x1812377
Capabilities:
Encode data using xor

Disassembly:
rol edx, 1
bswap edx
call fcn.0180d4e3

Function at 0x18184de
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + eax - 0x9c0], 0x6db02107
mov word [edi + eax*8 - 0x4e00], dx
jp 0x180d5c9
call fcn.0184741a
shl word [esp + eax*2 - 0x6d40ee08], 0x4c
not edx
and al, 0x2a
sub dword [esp + eax*2 - 0x6d40ee00], eax
pop eax
or ecx, edx
jmp 0x183f3a9
not ecx
sbb ax, 0xe33b
jbe 0x17ea1b0
movsx eax, dl
lea ecx, [edx + ecx + 0x3a61595]
neg ecx
pop edx
sub ecx, 0xde9e6f07
rol ecx, 2
xor byte [esp + eax*2 + 1], ah
jbe 0x17dc2e0
bswap eax
xor ebx, ecx
movsx edx, ax
not word [esp + eax + 3]
call fcn.0178ff07
neg ax
mov edx, dword [ebp + eax*2 - 0x6d40b5e0]
shl al, 0x85
lea ebp, [ebp + eax - 0x36a05a3c]
jne 0x17f9348
mov eax, 0x6c912122
call fcn.0178e57b

Function at 0x183026f
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + ecx*2 + 0x645ffe12]
add dword [esp], 0xfe7d0c88
push dword [esp + 8]
popfd
lea esp, [esp + 0x18]
call fcn.018664b7
mov edx, dword [eax + edi - 0xa0]
sub ecx, eax
cmovl eax, dword [esp + eax - 0xa0]
xor edx, ebx
inc edx
rol edx, 3
shr word [esp + 1], 0xaf
neg edx
or cl, cl
sub ecx, ecx
ror edx, 1
lea edx, [eax + edx + 0x1066fc87]
not dword [esp + ecx*8]
xor ebx, edx
xchg dword [esp + ecx], eax
call fcn.0180d231
neg ecx
shl ecx, cl
not cl
jb 0x1798a94

Function at 0x1837cb4
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + 0x14], 0x4385889f
lea esp, [esp + 0x14]
call fcn.00b4e10e
Function at 0x1837d26
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [ebp]
rol dl, 0x25
push eax
cmovb ax, dx
mov dx, word [ecx]
jae 0x1867b96
xor ecx, ebx
bswap ecx
pop eax
dec dl
not dl
dec ecx
xchg word [esp + edx - 0x7030f1cb], dx
rol word [esp + edx - 0x7030702a], 0xa3
rol ecx, 3
lea edx, [edx - 0x746d0bc1]
mov dword [esp], edx
dec byte [esp + 5]
dec ecx
xor edx, edx
dec dword [esp + edx + 1]
ror ecx, 2
bswap ecx
lea eax, [edx*4 - 0x6c595c5c]
xchg dword [esp + edx + 4], edx
inc ecx
xor ebx, ecx
add edi, ecx
rol dword [esp + edx - 0x61ffff37], 0x22
cmovae edx, eax
jae 0x1795977
adc ebp, 2
mov word [ebp], dx
pop eax
pop ecx
pop ecx
or ecx, edi
jmp ecx

Function at 0x184323d
Capabilities:
Encode data using base64

Disassembly:
lea edx, [eax + edx - 0x21b2eb91]
add ecx, 0xf6187b83
call fcn.017b3188
Function at 0x62b8a570
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.62b9ab80
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.62b9ab80
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x62b8a5d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x62cae054]
test esi, esi
jle 0x62b8a6f0
mov eax, dword [0x62cae058]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x62b8a604
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x62b8a687
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x62b8a5f0
mov dword [esp], ebx
call fcn.62b8ad30
mov edi, eax
test eax, eax
je 0x62b8a717
mov eax, dword [0x62cae058]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.62b8ae70
mov edx, dword [0x62cae058]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x62b8a6f7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x62b8a680
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x62b8a690
add dword [0x62cae054], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x62cae058]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x62b8a680
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.62b8a570
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x62b8a60e
mov eax, dword [0x62cae058]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.62b8a570
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.62b8a570
lea esi, [esi]
nop
Function at 0x62b8a9b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x62cae064
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x62cae05c]
sub esp, 4
test ebx, ebx
je 0x62b8aa05
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x62b8a9fe
test esi, esi
je 0x62b8a9fe
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x62b8a9e0
mov dword [esp], 0x62cae064
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x62b8ad30
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x62b80000], 0x5a4d
jne 0x62b8ad55
mov ecx, dword [0x62b8003c]
cmp dword [ecx + 0x62b80000], 0x4550
lea edx, [ecx + 0x62b80000]
je 0x62b8ad60
ret
cmp word [ecx + 0x62b80018], 0x10b
jne 0x62b8ad55
push esi
movzx eax, word [ecx + 0x62b80014]
push ebx
movzx esi, word [ecx + 0x62b80006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x62b80000
test esi, esi
je 0x62b8ada8
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x62b8ad9e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x62b8adaa
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x62b8ad90
xor eax, eax
pop ebx
pop esi
ret

Function at 0x62b8b320
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [0x62cae060]
test eax, eax
jne 0x62b8aa30
ret
push ebx
sub esp, 0x18
mov dword [esp + 4], 0xc
mov dword [esp], 1
call sub.msvcrt.dll_calloc
mov ebx, eax
test eax, eax
je 0x62b8aa90
mov eax, dword [esp + 0x20]
mov dword [esp], 0x62cae064
mov dword [ebx], eax
mov eax, dword [esp + 0x24]
mov dword [ebx + 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x62cae05c]
mov dword [0x62cae05c], ebx
sub esp, 4
mov dword [ebx + 8], eax
mov dword [esp], 0x62cae064
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
sub esp, 4
add esp, 0x18
pop ebx
ret
or eax, 0xffffffff
jmp 0x62b8aa8b
push esi
push ebx
sub esp, 4
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x62b8b350
mov dword [esi], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
add esp, 4
pop ebx
pop esi
jmp 0x62b9ad80
add esp, 4
pop ebx
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esp + 8]
test eax, eax
jne 0x62b9ad90
xor eax, eax
ret
jmp 0x62b8aa20

Function at 0x62b8b390
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret
Function at 0x62b8b3d0
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x62b8b3f8
xor eax, eax
add esp, 0x1c
ret
add esp, 0x1c
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x62b9add8
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub esp, 0x5c
mov eax, dword [esp + 0x60]
mov dword [esp + 0x1c], eax
mov eax, dword [0x62cae02c]
mov dword [esp + 0x4c], eax
xor eax, eax
mov dword [esp], 1
mov eax, dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
call eax
sub esp, 4
test eax, eax
sete al
test al, al
je 0x62b9ae40
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.62be9900
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x2b]
mov dword [esp + 4], edx
mov dword [esp], 0x62c68432
mov ecx, eax
call fcn.62c26b20
sub esp, 8
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.62be9930
jmp 0x62b9afb0
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_OpenClipboard]
call eax
sub esp, 4
test eax, eax
sete al
test al, al
je 0x62b9ae92
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.62be9900
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x2b]
mov dword [esp + 4], edx
mov dword [esp], 0x62c68432
mov ecx, eax
call fcn.62c26b20
sub esp, 8
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.62be9930
jmp 0x62b9afb0
mov dword [esp], 1
mov eax, dword [sym.imp.USER32.dll_GetClipboardData]
call eax
sub esp, 4
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x2c], 0
jne 0x62b9aeed
mov eax, dword [sym.imp.USER32.dll_CloseClipboard]
call eax
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.62be9900
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x2b]
mov dword [esp + 4], edx
mov dword [esp], 0x62c68432
mov ecx, eax
call fcn.62c26b20
sub esp, 8
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.62be9930
jmp 0x62b9afb0
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GlobalLock]
call eax
sub esp, 4
mov dword [esp + 0x30], eax
cmp dword [esp + 0x30], 0
jne 0x62b9af45
mov eax, dword [sym.imp.USER32.dll_CloseClipboard]
call eax
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.62be9900
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x2b]
mov dword [esp + 4], edx
mov dword [esp], 0x62c68432
mov ecx, eax
call fcn.62c26b20
sub esp, 8
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.62be9930
jmp 0x62b9afb0
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.62be9900
lea eax, [esp + 0x34]
lea edx, [esp + 0x2b]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x30]
mov dword [esp], edx
mov ecx, eax
call fcn.62c26b20
sub esp, 8
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.62be9930
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call eax
sub esp, 4
mov eax, dword [sym.imp.USER32.dll_CloseClipboard]
call eax
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x34]
mov dword [esp], edx
mov ecx, eax
call fcn.62c26a50
sub esp, 4
lea eax, [esp + 0x34]
mov ecx, eax
call fcn.62c27640
mov eax, dword [esp + 0x4c]
sub eax, dword [0x62cae02c]
je 0x62b9afc1
call fcn.62b815c0
mov eax, dword [esp + 0x1c]
add esp, 0x5c
ret