joyce8/EMBER2024-capa huggingface dataset:
Function at 0x992bf4
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
push 0
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov esi, eax
call sub.KERNEL32.DLL_GetCurrentThreadId
xor edx, edx
push edx
push eax
mov eax, esi
cdq
cmp edx, dword [esp + 4]
jne 0x992c1f
cmp eax, dword [esp]
pop edx
pop eax
je 0x992c7a
push 0xffffffffffffffff
push esi
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
call sub.user32.dll_AttachThreadInput
test bl, bl
je 0x992c63
jmp 0x992c43
mov eax, dword [0xa403fc]
mov eax, dword [eax]
call fcn.00548840
cmp dword [edi + 0x46c], 0xa
jge 0x992c6c
cmp byte [0xa4a778], 0
je 0x992c37
jmp 0x992c6c
mov eax, dword [0xa403fc]
mov eax, dword [eax]
call fcn.00548840
cmp dword [edi + 0x468], 2
jl 0x992c57
push 0
push esi
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
call sub.user32.dll_AttachThreadInput
pop edi
pop esi
pop ebx
ret

Function at 0x9955d8
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
mov eax, dword [0xa40b08]
cmp dword [eax], 2
jne 0x99561e
call fcn.0099553c
test al, al
je 0x9955fe
push 0
movzx eax, bx
push eax
call sub.user32.dll_ExitWindowsEx
jmp 0x995633
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, 0x995644
call fcn.009ab2ac
pop ebx
pop ebp
ret
mov eax, dword [0xa40b08]
cmp dword [eax], 1
jne 0x995633
push 0
movzx eax, bx
push eax
call sub.user32.dll_ExitWindowsEx
pop ebx
pop ebp
ret
Function at 0x99a270
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov edi, ecx
mov esi, edx
xor eax, eax
push ebp
push 0x99a514
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 0x99a528
call sub.gdi32.dll_CreateDCW
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
xor ecx, ecx
mov edx, 0x10
call fcn.004057e8
mov eax, dword [ebp + 0x14]
sub eax, esi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
sub eax, edi
mov dword [ebp - 0xc], eax
mov dl, 1
mov eax, dword [0x47ac7c]
call fcn.00483d3c
mov dword [ebp - 8], eax
push 0x26
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_GetDeviceCaps
and eax, 0x100
cmp eax, 0x100
jne 0x99a345
mov eax, 0x404
call fcn.004048f0
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x404
call fcn.004057e8
mov word [ebx], 0x300
lea eax, [ebx + 4]
push eax
push pe_nt_image_headers32
push 0
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_GetSystemPaletteEntries
mov word [ebx + 2], ax
cmp word [ebx + 2], 0
je 0x99a33e
mov eax, ebx
push eax
call sub.gdi32.dll_CreatePalette
mov edx, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, ebx
call fcn.0040490c
xor eax, eax
push ebp
push 0x99a3ea
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x40cc0020
push edi
push esi
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x24]
push eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x30]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.0048465c
call fcn.0047ed34
push eax
call sub.gdi32.dll_BitBlt
cmp byte [ebp + 8], 0
je 0x99a3d3
mov eax, dword [0xa4a62c]
call fcn.004ad7c0
push eax
call sub.user32.dll_OpenClipboard
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x70]
push eax
push 2
call sub.user32.dll_SetClipboardData
call sub.user32.dll_CloseClipboard
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x99a3f1
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
ret
Function at 0x9a3e1c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x244], edx
mov dword [ebp - 0x24c], edx
mov dword [ebp - 0x248], edx
mov dword [ebp - 0x234], edx
mov dword [ebp - 0x240], edx
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x23c], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00409208
xor eax, eax
push ebp
push 0x9a3f9d
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
xor edx, edx
mov eax, 2
call fcn.0078160c
mov esi, eax
mov dword [ebp - 0x230], 0x22c
lea edx, [ebp - 0x230]
mov eax, esi
call fcn.0078162c
mov ebx, eax
jmp 0x9a3f69
lea eax, [ebp - 0x23c]
lea edx, [ebp - 0x20c]
mov ecx, 0x104
call fcn.0040a334
mov eax, dword [ebp - 0x23c]
lea edx, [ebp - 0x238]
call fcn.00424e94
mov eax, dword [ebp - 0x238]
lea edx, [ebp - 0x234]
call fcn.00422c98
mov eax, dword [ebp - 0x234]
push eax
lea edx, [ebp - 0x240]
mov eax, dword [ebp - 4]
call fcn.00422c98
mov edx, dword [ebp - 0x240]
pop eax
call fcn.0040a67c
je 0x9a3f40
lea eax, [ebp - 0x248]
lea edx, [ebp - 0x20c]
mov ecx, 0x104
call fcn.0040a334
mov eax, dword [ebp - 0x248]
lea edx, [ebp - 0x244]
call fcn.00422c98
mov eax, dword [ebp - 0x244]
push eax
lea edx, [ebp - 0x24c]
mov eax, dword [ebp - 4]
call fcn.00422c98
mov edx, dword [ebp - 0x24c]
pop eax
call fcn.0040a67c
jne 0x9a3f5a
push 0
mov eax, dword [ebp - 0x228]
push eax
push 0
push 1
call sub.KERNEL32.DLL_OpenProcess
push eax
call sub.KERNEL32.DLL_TerminateProcess
mov edi, eax
lea edx, [ebp - 0x230]
mov eax, esi
call fcn.0078164c
mov ebx, eax
test ebx, ebx
jne 0x9a3e9b
push esi
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x9a3fa4
lea eax, [ebp - 0x24c]
mov edx, 7
call fcn.00409184
lea eax, [ebp - 4]
call fcn.00409124
ret
Function at 0x9b9504
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbb0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x450], ebx
mov dword [ebp - 0x44c], ebx
mov dword [ebp - 0x448], ebx
mov dword [ebp - 0x444], ebx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov ebx, eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00409208
mov eax, dword [ebp + 0x14]
call fcn.00409208
xor eax, eax
push ebp
push 0x9b96f6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x2a]
xor ecx, ecx
mov edx, 0x1e
call fcn.004057e8
mov eax, dword [0xa403fc]
mov eax, dword [eax]
mov eax, dword [eax + 0x178]
mov dword [ebp - 0x2a], eax
mov word [ebp - 0x1a], 0x10
push edi
push 1
push 0
lea eax, [ebp - 0x444]
push eax
mov ecx, esi
mov edx, 0x9b9718
mov eax, ebx
call fcn.0097f92c
mov eax, dword [ebp - 0x444]
mov edx, 0x9b9740
call fcn.0040a67c
je 0x9b95ad
or word [ebp - 0x1a], 0x614
mov eax, dword [ebp - 8]
mov dword [ebp - 0x26], eax
push edi
push 1
push 0
lea eax, [ebp - 0x448]
push eax
mov ecx, esi
mov edx, 0x9b9750
mov eax, ebx
call fcn.0097f92c
mov eax, dword [ebp - 0x448]
mov edx, 0x9b9740
call fcn.0040a67c
je 0x9b95e4
or word [ebp - 0x1a], 8
lea eax, [ebp - 0x234]
xor ecx, ecx
mov edx, 0x20a
call fcn.004057e8
mov eax, dword [ebp - 4]
call fcn.0040a278
mov edx, eax
lea eax, [ebp - 0x234]
call fcn.00425528
lea eax, [ebp - 0x234]
mov dword [ebp - 0x22], eax
lea eax, [ebp - 0x43e]
xor ecx, ecx
mov edx, 0x20a
call fcn.004057e8
mov eax, dword [ebp + 0x14]
call fcn.0040a278
mov edx, eax
lea eax, [ebp - 0x43e]
call fcn.00425528
lea eax, [ebp - 0x43e]
mov dword [ebp - 0x1e], eax
lea eax, [ebp - 0x2a]
push eax
call sub.shell32.dll_SHFileOperationW
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
cmp eax, 1
sbb eax, eax
neg eax
mov edx, dword [ebp + 0x10]
mov byte [edx], al
push esi
push edi
push 0
push 0
push 0
push 0x9b977c
lea ecx, [ebp - 0x44c]
mov eax, dword [ebp + 0x10]
movzx eax, byte [eax]
mov dl, 1
call fcn.0042408c
mov ecx, dword [ebp - 0x44c]
mov edx, 0x9b9798
mov eax, ebx
call fcn.0097edfc
push esi
push edi
push 0
push 0
push 0
push 0x9b977c
lea edx, [ebp - 0x450]
mov eax, dword [ebp - 0xc]
call fcn.00423b58
mov ecx, dword [ebp - 0x450]
mov edx, 0x9b97b8
mov eax, ebx
call fcn.0097edfc
xor eax, eax
mov dword [ebp - 0x22], eax
xor eax, eax
mov dword [ebp - 0x1e], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x9b96fd
lea eax, [ebp - 0x450]
mov edx, 4
call fcn.00409184
lea eax, [ebp - 4]
call fcn.00409124
lea eax, [ebp + 0x14]
call fcn.00409124
ret
Function at 0x66ac85e2
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x674e3014]
mov dword [ebp - 0xc], eax
jmp 0x66ac8680
jmp 0x66ac8710
jmp 0x66ac87a0
jmp 0x66ac8830
jmp 0x66ac88c0
jmp 0x66ac8950
jmp 0x66ac89e0
jmp 0x66ac8a70
jmp 0x66ac8b00
jmp 0x66ac8b90
jmp 0x66ac8c20
jmp 0x66ac8cb0
jmp 0x66ac8d40
jmp 0x66ac8dd0
jmp 0x66ac8e60
jmp 0x66ac8ef0
jmp 0x66ac8f80
jmp 0x66ac9010
jmp 0x66ac90a0
jmp 0x66ac9130
jmp 0x66ac91c0
jmp 0x66ac9250
jmp 0x66ac92e0
jmp 0x66ac9370
jmp 0x66ac9400
cmp dword [ebp - 0xc], 0
je 0x66accc9c
mov eax, dword [0x674e3014]
mov dword [0x674e300c], eax
jmp 0x66ac94a4
jmp 0x66ac9534
jmp 0x66ac95c4
jmp 0x66ac9654
jmp 0x66ac96e4
jmp 0x66ac9774
jmp 0x66ac9804
jmp 0x66ac9894
jmp 0x66ac9924
jmp 0x66ac99b4
jmp 0x66ac9a44
jmp 0x66ac9ad4
jmp 0x66ac9b64
jmp 0x66ac9bf4
jmp 0x66ac9c84
jmp 0x66ac9d14
jmp 0x66ac9da4
jmp 0x66ac9e34
jmp 0x66ac9ec4
jmp 0x66ac9f54
jmp 0x66ac9fe4
jmp 0x66aca074
jmp 0x66aca104
jmp 0x66aca194
jmp 0x66aca224
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 0xc]
add eax, edx
mov dword [0x674e3008], eax
jmp 0x66aca2c4
jmp 0x66aca354
jmp 0x66aca3e4
jmp 0x66aca474
jmp 0x66aca504
jmp 0x66aca594
jmp 0x66aca624
jmp 0x66aca6b4
jmp 0x66aca744
jmp 0x66aca7d4
jmp 0x66aca864
jmp 0x66aca8f4
jmp 0x66aca984
jmp 0x66acaa14
jmp 0x66acaaa4
jmp 0x66acab34
jmp 0x66acabc4
jmp 0x66acac54
jmp 0x66acace4
jmp 0x66acad74
jmp 0x66acae04
jmp 0x66acae94
jmp 0x66acaf24
jmp 0x66acafb4
jmp 0x66acb044
mov eax, dword [0x674e3008]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x10], eax
jmp 0x66acb0df
jmp 0x66acb16f
jmp 0x66acb1ff
jmp 0x66acb28f
jmp 0x66acb31f
jmp 0x66acb3af
jmp 0x66acb43f
jmp 0x66acb4cf
jmp 0x66acb55f
jmp 0x66acb5ef
jmp 0x66acb67f
jmp 0x66acb70f
jmp 0x66acb79f
jmp 0x66acb82f
jmp 0x66acb8bf
jmp 0x66acb94f
jmp 0x66acb9df
jmp 0x66acba6f
jmp 0x66acbaff
jmp 0x66acbb8f
jmp 0x66acbc1f
jmp 0x66acbcaf
jmp 0x66acbd3f
jmp 0x66acbdcf
jmp 0x66acbe5f
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call eax
sub esp, 0x10
mov dword [0x674e3004], eax
jmp 0x66acbf1c
jmp 0x66acbfac
jmp 0x66acc03c
jmp 0x66acc0cc
jmp 0x66acc15c
jmp 0x66acc1ec
jmp 0x66acc27c
jmp 0x66acc30c
jmp 0x66acc39c
jmp 0x66acc42c
jmp 0x66acc4bc
jmp 0x66acc54c
jmp 0x66acc5dc
jmp 0x66acc66c
jmp 0x66acc6fc
jmp 0x66acc78c
jmp 0x66acc81c
jmp 0x66acc8ac
jmp 0x66acc93c
jmp 0x66acc9cc
jmp 0x66acca5c
jmp 0x66accaec
jmp 0x66accb7c
jmp 0x66accc0c
jmp 0x66accc9c
nop
leave
ret
Function at 0x66ace903
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x674e3008]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x674e3008]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
jmp 0x66ace9b3
jmp 0x66acea43
jmp 0x66acead3
jmp 0x66aceb63
jmp 0x66acebf3
jmp 0x66acec83
jmp 0x66aced13
jmp 0x66aceda3
jmp 0x66acee33
jmp 0x66aceec3
jmp 0x66acef53
jmp 0x66acefe3
jmp 0x66acf073
jmp 0x66acf103
jmp 0x66acf193
jmp 0x66acf223
jmp 0x66acf2b3
jmp 0x66acf343
jmp 0x66acf3d3
jmp 0x66acf463
jmp 0x66acf4f3
jmp 0x66acf583
jmp 0x66acf613
jmp 0x66acf6a3
jmp 0x66acf733
mov dword [ebp - 0x14], 0
jmp 0x66acf7ca
jmp 0x66acf85a
jmp 0x66acf8ea
jmp 0x66acf97a
jmp 0x66acfa0a
jmp 0x66acfa9a
jmp 0x66acfb2a
jmp 0x66acfbba
jmp 0x66acfc4a
jmp 0x66acfcda
jmp 0x66acfd6a
jmp 0x66acfdfa
jmp 0x66acfe8a
jmp 0x66acff1a
jmp 0x66acffaa
jmp 0x66ad003a
jmp 0x66ad00ca
jmp 0x66ad015a
jmp 0x66ad01ea
jmp 0x66ad027a
jmp 0x66ad030a
jmp 0x66ad039a
jmp 0x66ad042a
jmp 0x66ad04ba
jmp 0x66ad054a
mov dword [ebp - 0x18], 0
jmp 0x66ad05e1
jmp 0x66ad0671
jmp 0x66ad0701
jmp 0x66ad0791
jmp 0x66ad0821
jmp 0x66ad08b1
jmp 0x66ad0941
jmp 0x66ad09d1
jmp 0x66ad0a61
jmp 0x66ad0af1
jmp 0x66ad0b81
jmp 0x66ad0c11
jmp 0x66ad0ca1
jmp 0x66ad0d31
jmp 0x66ad0dc1
jmp 0x66ad0e51
jmp 0x66ad0ee1
jmp 0x66ad0f71
jmp 0x66ad1001
jmp 0x66ad1091
jmp 0x66ad1121
jmp 0x66ad11b1
jmp 0x66ad1241
jmp 0x66ad12d1
jmp 0x66ad1361
mov dword [ebp - 0x10], 0
jmp 0x66ad13f8
jmp 0x66ad1488
jmp 0x66ad1518
jmp 0x66ad15a8
jmp 0x66ad1638
jmp 0x66ad16c8
jmp 0x66ad1758
jmp 0x66ad17e8
jmp 0x66ad1878
jmp 0x66ad1908
jmp 0x66ad1998
jmp 0x66ad1a28
jmp 0x66ad1ab8
jmp 0x66ad1b48
jmp 0x66ad1bd8
jmp 0x66ad1c68
jmp 0x66ad1cf8
jmp 0x66ad1d88
jmp 0x66ad1e18
jmp 0x66ad1ea8
jmp 0x66ad1f38
jmp 0x66ad1fc8
jmp 0x66ad2058
jmp 0x66ad20e8
jmp 0x66ad2178
mov dword [ebp - 0x10], 0
jmp 0x66ad681a
jmp 0x66ad2214
jmp 0x66ad22a4
jmp 0x66ad2334
jmp 0x66ad23c4
jmp 0x66ad2454
jmp 0x66ad24e4
jmp 0x66ad2574
jmp 0x66ad2604
jmp 0x66ad2694
jmp 0x66ad2724
jmp 0x66ad27b4
jmp 0x66ad2844
jmp 0x66ad28d4
jmp 0x66ad2964
jmp 0x66ad29f4
jmp 0x66ad2a84
jmp 0x66ad2b14
jmp 0x66ad2ba4
jmp 0x66ad2c34
jmp 0x66ad2cc4
jmp 0x66ad2d54
jmp 0x66ad2de4
jmp 0x66ad2e74
jmp 0x66ad2f04
jmp 0x66ad2f94
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [0x674e3004]
add eax, edx
mov dword [ebp - 0x14], eax
jmp 0x66ad3035
jmp fcn.66ad30c5
mov eax, dword [0x674e3008]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x10]
ja 0x66ad2184
nop
leave
ret

Function at 0x66afe7f0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], 0x674e2040
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.66afe850
Function at 0x66afe850
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x674e3378]
test esi, esi
jle 0x66afe93d
mov edi, dword [0x674e337c]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x66afe884
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x66afe936
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x66afe870
mov dword [esp], eax
mov esi, eax
call fcn.66afeff0
test eax, eax
mov edi, eax
je 0x66afe97a
mov esi, dword [0x674e337c]
lea ebx, [ebx + ebx*2]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call fcn.66aff100
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x674e337c]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x66afe95a
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x66afe92f
sub eax, 0x40
and eax, 0xffffffbf
je 0x66afe92f
mov eax, dword [esp + 0x20]
add ebx, dword [0x674e337c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x66afe944
add dword [0x674e3378], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor ebx, ebx
jmp 0x66afe88e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.66afe7f0
mov eax, dword [0x674e337c]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.66afe7f0
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.66afe7f0
lea esi, [esi]

Function at 0x66afec60
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x674e3388
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x674e3380]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x66afecb5
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x66afecae
test esi, esi
je 0x66afecae
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x66afec90
mov dword [esp], 0x674e3388
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x1009e30b
Capabilities:
Encode data using xor

Disassembly:
call 0x1009e284
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or eax, dword [ebx - 0x178f73c]
xor esi, 0xde5af04
add eax, esi
lea esp, [esp - 0xe]
mov esi, dword [esp + 0xe]
lea esp, [esp + 0x12]
xor esi, dword [esp]
push eax
sub eax, 0xf24f2b00
mov eax, esp
or dword [eax - 0x22], ebx
pop eax
jmp 0x1009e2b4
xor dword [esp], esi
xor eax, 0
mov dword [esp], esi
add esp, 4
add esi, dword [ebp + 8]
push ebp
add ebp, 0xc
mov ecx, dword [ebp]
pop ebp
ja 0x1009e2d0
xor edx, 0
jmp 0x1009e2db
xor edx, edx
jmp 0x1009e2f2
jmp 0x1009e2fe
xor eax, eax
push 0x8427d7c0
call 0x1009e30b
stc
add esp, 8
add esi, 0
cmp ecx, 0
je 0x1009e347
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0x1009e320
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
or eax, edx
xor eax, eax
add eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
xchg dword [esp], ecx
mov dword [esp], ecx
lea esp, [esp + 4]
pop edx
leave
je 0x1009e35e
add eax, 0
jno 0x1009e363
add esi, 0
ret 0x10
Function at 0x4083f1
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
mov eax, dword [0x410144]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [ebp + 8]
mov edx, 0x104
push ebx
push esi
push edi
push ecx
push ecx
xor edi, edi
mov dword [esp + 0x1c], eax
push ecx
lea ecx, [esp + 0x24]
mov dword [eax], edi
mov dword [eax + 4], edi
call fcn.00407168
push 0x402634
lea ecx, [esp + 0x1c]
call fcn.004070c4
lea eax, [esp + 0x18]
push eax
push edi
push 0x1f0003
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
mov esi, eax
test esi, esi
jne 0x408475
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 2
je 0x4084af
mov ecx, dword [ebp + 4]
mov edx, 0xc0
push 0x4025e0
call fcn.004080ac
mov edi, eax
jmp 0x4084af
lea edx, [esp + 0x10]
mov dword [esp + 0x10], edi
mov ecx, esi
call fcn.004082d4
mov ebx, eax
test ebx, ebx
jns 0x4084a1
mov ecx, dword [ebp + 4]
mov edx, 0xc6
push ebx
push 0x4025e0
call fcn.0040808f
mov edi, ebx
jmp 0x4084af
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cdq
mov dword [ecx], eax
mov dword [ecx + 4], edx
test esi, esi
je 0x4084b9
push esi
call fcn.0040814d
mov ecx, dword [esp + 0x224]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040dad0
mov esp, ebp
pop ebp
ret 8

Function at 0x40dc5d
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
cmp edx, esi
je 0x40dc9a
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [edx + 0xc]
jb 0x40dc93
mov eax, dword [edx + 8]
add eax, dword [edx + 0xc]
cmp ecx, eax
jb 0x40dc9f
add edx, 0x28
cmp edx, esi
jne 0x40dc84
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x40dc9c

Function at 0x4184bf
Capabilities:
Encode data using xor

Disassembly:
call 0x418438
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or eax, dword [ebx - 0x178f73c]
xor esi, 0xde5af04
add eax, esi
lea esp, [esp - 0xe]
mov esi, dword [esp + 0xe]
lea esp, [esp + 0x12]
xor esi, dword [esp]
push eax
sub eax, 0xf24f2b00
mov eax, esp
or dword [eax - 0x22], ebx
pop eax
jmp 0x418468
xor dword [esp], esi
xor eax, 0
mov dword [esp], esi
add esp, 4
add esi, dword [ebp + 8]
push ebp
add ebp, 0xc
mov ecx, dword [ebp]
pop ebp
ja 0x418484
xor edx, 0
jmp 0x41848f
xor edx, edx
jmp 0x4184a6
jmp 0x4184b2
xor eax, eax
push 0x8427d7c0
call 0x4184bf
stc
add esp, 8
add esi, 0
cmp ecx, 0
je 0x4184fb
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0x4184d4
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
or eax, edx
xor eax, eax
add eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
xchg dword [esp], ecx
mov dword [esp], ecx
lea esp, [esp + 4]
pop edx
leave
je 0x418512
add eax, 0
jno 0x418517
add esi, 0
ret 0x10
Function at 0x419280
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp - 0x63]
mov dword [esp + 0x5f], ebx
lea esp, [esp + 0x5f]
mov ebx, 0x8dff8662
xchg dword [esp], ebx
and dword [esp], ebp
jmp 0x4192a2
add ebx, 0
or dword [esp], ebp
mov ebp, esp
push eax
push edi
lea esp, [esp - 4]
xchg dword [esp], ecx
pop ecx
lea esp, [esp - 4]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp + 0x14]
ja 0x419444
cmp edi, dword [ebp + 0x10]
jb 0x419444
lea esi, [esi]
sub esi, 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
sub esp, 0x6a
mov dword [esp + 0x66], 0xc2ccbc3c
add esp, 0x66
mov dword [esp], edi
or edi, 0xffffffff
and edi, 0xcedcf875
xor edi, 0xce9c140e
xchg dword [esp], edi
push edx
mov edx, esp
xor edx, 0
add edx, 0
push ebx
lea ebx, [edx + 4]
mov dword [ebx], eax
pop ebx
pop edx
push edi
call fcn.00418d6c
inc edi
jmp 0x41932b
jmp 0x419338
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.00418d6c
inc edi
and dword [esp - 0x4e], ecx
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.00418d6c
inc edi
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push 0
sub esi, 0
add dword [esp], edx
xor edx, edx
je 0x41938c
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or edx, 0x13e27bd2
push ebx
add ebx, esi
mov ebx, esp
xor dword [ebx - 0x2a], edi
fdiv qword [ecx]
jnp 0x419370
pop ebx
xor edx, 0x1b7d0cc
add edx, 0xedeb415d
xchg dword [esp], edx
push edx
mov edx, esp
call int.004193ba
add dword [eax], 0x39
jle 0x419396
sub al, 0xf5
mov ch, al
call fcn.004193cf
mov dword [edi], eax
pop ecx
pop edi
pop eax
leave
ret 0x10

Function at 0x41b0a7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push ecx
push edx
push 0
sub esi, esi
shr esi, 9
and dword [esp - 0x69], ebx
jbe 0x41b0bd
add edi, 0
shr esi, 0x17
or esi, dword [esp]
add esp, 4
add esi, dword [ebp + 8]
xor eax, eax
xor edx, edx
cld
and dword [esp - 0x46], edx
xor ecx, ecx
rol edx, 7
and dword [esp - 0x4b], edx
xor dl, al
mov al, byte [esi]
inc esi
or al, al
jne 0x41b0ce
mov eax, edx
pop edx
pop ecx
pop esi
mov esp, ebp
mov ebp, dword [esp]
add esp, 4
push 0x54
call fcn.0041b10f
std
inc ebx
sar cl, 0x3e
lahf
in al, dx
mov ch, 0x4a
mov ebx, 0x971631d8
test byte [ebp - 0x5e], ch
xor eax, dword [ebx + 0x2b5108c4]
add esp, 8
push ecx
sub ecx, eax
mov ecx, esp
cmp dword [ecx - 0x51], edx