joyce8/EMBER2024-capa huggingface dataset:
Function at 0x660290
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x68f238
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
mov dword [esi], 0x691080
lea ebx, [esi + 0x10]
xor edi, edi
mov ecx, ebx
mov dword [esp + 0x50], edi
call fcn.0064dc20
lea ebp, [esi + 0x28]
mov ecx, ebp
call fcn.0064dc20
push edi
push edi
push edi
push edi
push edi
push edi
lea ecx, [esp + 0x30]
mov dword [esi], 0x69f42c
mov dword [esi + 4], edi
mov dword [esi + 8], edi
call fcn.0064dc40
mov ecx, dword [eax]
push edi
mov dword [ebx], ecx
mov edx, dword [eax + 4]
mov dword [ebx + 4], edx
mov ecx, dword [eax + 8]
mov dword [ebx + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [ebx + 0xc], edx
mov ecx, dword [eax + 0x10]
push edi
push edi
mov dword [ebx + 0x10], ecx
mov edx, dword [eax + 0x14]
push edi
push edi
push edi
lea ecx, [esp + 0x48]
mov dword [ebx + 0x14], edx
call fcn.0064dc40
mov ecx, dword [eax]
mov dword [ebp], ecx
mov edx, dword [eax + 4]
mov dword [ebp + 4], edx
mov ecx, dword [eax + 8]
mov dword [ebp + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [ebp + 0xc], edx
mov ecx, dword [eax + 0x10]
mov dword [ebp + 0x10], ecx
mov edx, dword [eax + 0x14]
mov dword [ebp + 0x14], edx
mov dword [esi + 0x48], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x74], edi
mov dword [esi], 0x6a4b58
mov dword [esi + 0x40], edi
mov dword [esi + 4], 1
lea eax, [esi + 0x90]
mov ecx, 3
mov dword [eax - 0x18], edi
mov dword [eax - 0x14], edi
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 0x20], edi
mov dword [eax + 0x24], edi
add eax, 8
dec ecx
jne 0x660386
mov ecx, dword [esp + 0x48]
mov dword [esi + 0xc8], edi
mov dword [esi + 0xcc], edi
mov dword [esi + 0xa8], edi
mov dword [esi + 0xac], edi
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x660c00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x68f268
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov dword [esi], 0x691080
lea ebx, [esi + 0x10]
xor edi, edi
mov ecx, ebx
mov dword [esp + 0x50], edi
call fcn.0064dc20
lea ebp, [esi + 0x28]
mov ecx, ebp
call fcn.0064dc20
push edi
push edi
push edi
push edi
push edi
push edi
lea ecx, [esp + 0x30]
mov dword [esi], 0x69f42c
mov dword [esi + 4], edi
mov dword [esi + 8], edi
call fcn.0064dc40
mov ecx, dword [eax]
push edi
mov dword [ebx], ecx
mov edx, dword [eax + 4]
mov dword [ebx + 4], edx
mov ecx, dword [eax + 8]
mov dword [ebx + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [ebx + 0xc], edx
mov ecx, dword [eax + 0x10]
push edi
push edi
mov dword [ebx + 0x10], ecx
mov edx, dword [eax + 0x14]
push edi
push edi
push edi
lea ecx, [esp + 0x48]
mov dword [ebx + 0x14], edx
call fcn.0064dc40
mov ecx, dword [eax]
mov dword [ebp], ecx
mov edx, dword [eax + 4]
mov dword [ebp + 4], edx
mov ecx, dword [eax + 8]
mov dword [ebp + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [ebp + 0xc], edx
mov ecx, dword [eax + 0x10]
mov dword [ebp + 0x10], ecx
mov edx, dword [eax + 0x14]
mov dword [ebp + 0x14], edx
lea ecx, [esi + 0x40]
mov dword [esp + 0x50], 1
mov dword [esp + 0x14], ecx
mov dword [ecx + 4], edi
mov dword [ecx + 0x10], edi
mov dword [ecx + 0xc], edi
mov dword [ecx + 8], edi
push 0xa
push edi
mov byte [esp + 0x58], 2
mov dword [ecx], 0x69dc40
call fcn.00472ab0
mov dword [esi + 0x2f50], edi
mov dword [esi + 0x2f58], edi
mov dword [esi + 0x2f60], edi
mov dword [esi + 0x2f54], edi
mov dword [esi + 0x2f5c], edi
mov dword [esi + 0x2f64], edi
mov dword [esi], 0x6a4b80
mov dword [esi + 0x54], edi
mov ecx, dword [esp + 0x48]
mov dword [esi + 0x2f38], edi
mov dword [esi + 0x2f40], edi
mov dword [esi + 0x2f44], edi
mov dword [esi + 0x2f48], edi
mov dword [esi + 0x2f3c], 0x10
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x6616d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x68f2c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
mov dword [esi], 0x691080
lea edi, [esi + 0x10]
xor ebp, ebp
mov ecx, edi
mov dword [esp + 0x50], ebp
call fcn.0064dc20
lea ebx, [esi + 0x28]
mov ecx, ebx
call fcn.0064dc20
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
lea ecx, [esp + 0x30]
mov dword [esi], 0x69f42c
mov dword [esi + 4], ebp
mov dword [esi + 8], ebp
call fcn.0064dc40
mov ecx, dword [eax]
push ebp
mov dword [edi], ecx
mov edx, dword [eax + 4]
mov dword [edi + 4], edx
mov ecx, dword [eax + 8]
mov dword [edi + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [edi + 0xc], edx
mov ecx, dword [eax + 0x10]
push ebp
push ebp
mov dword [edi + 0x10], ecx
mov edx, dword [eax + 0x14]
push ebp
push ebp
push ebp
lea ecx, [esp + 0x48]
mov dword [edi + 0x14], edx
call fcn.0064dc40
mov ecx, dword [eax]
pop edi
mov dword [ebx], ecx
mov edx, dword [eax + 4]
mov dword [ebx + 4], edx
mov ecx, dword [eax + 8]
mov dword [ebx + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [ebx + 0xc], edx
mov ecx, dword [eax + 0x10]
mov dword [ebx + 0x10], ecx
mov edx, dword [eax + 0x14]
mov ecx, dword [esp + 0x44]
mov dword [ebx + 0x14], edx
mov dword [esi], 0x6a4ba4
mov dword [esi + 0x40], ebp
mov dword [esi + 0x54], 1
mov dword [esi + 0x48], ebp
mov dword [esi + 0x44], ebp
mov dword [esi + 0x50], ebp
mov dword [esi + 0x4c], ebp
mov eax, esi
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x8123da
Capabilities:
Contain obfuscated stackstrings
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
push ebx
push esi
push edi
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll__lcreat]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x812400
jmp 0x812516
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0xffffffff
jne 0x812420
jmp 0x812516
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov al, byte [ebp - 4]
mov byte [ebp - 0x1c], al
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0081733d
add esp, 4
mov dword [0x8200a0], 0
mov dword [ebp - 0x420], 0x646c6f47
mov dword [ebp - 0x41c], 0x6f736e65
mov byte [ebp - 0x418], 0x66
mov dword [ebp - 0x20], 0
jmp 0x81246d
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 9
jge 0x81248d
mov eax, dword [ebp - 0x20]
movsx eax, byte [eax + ebp - 0x420]
xor al, byte [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov byte [ecx + ebp - 0x420], al
jmp 0x81246a
mov al, byte [ebp - 0x1c]
mov byte [ebp - 0x417], al
push 0xa
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll__lwrite]
push 0x400
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll__lread]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x8124f5
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.00816ee0
add esp, 8
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll__lwrite]
jmp 0x8124a9
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, dword [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x81277c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
nop
nop
leave
add esp, 4
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop eax
leave
add esp, 4
push ebp
mov ebp, esp
sub esp, 0x20
push edi
push esi
push edx
push ecx
push ebx
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0xc], 0
je 0x8127c5
mov eax, dword [ebp - 0xc]
add dword [eax + 8], 0xa
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jne 0x812868
mov dword [ebp - 0x18], 0
jmp 0x8127f3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1e
jge 0x812868
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
cmp dword [eax*4 + 0x8200a4], ecx
jne 0x812866
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx*4 + 0x8201b2]
cmp dword [eax*4 + 0x82013a], ecx
jb 0x812855
mov eax, dword [ebp - 0x10]
cmp dword [0x8200a0], eax
je 0x812843
mov eax, dword [ebp - 0x18]
mov al, byte [eax + 0x82011c]
push eax
call fcn.0081733d
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [0x8200a0], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.00816e94
add esp, 8
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x18]
add dword [ecx*4 + 0x82013a], eax
jmp 0x812868
jmp 0x8127f0
pop ebx
pop ecx
pop edx
pop esi
pop edi
mov eax, dword [ebp - 0x14]
leave
ret 0x14
Function at 0x812879
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
nop
leave
add esp, 4
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop eax
leave
add esp, 4
push ebp
mov ebp, esp
sub esp, 0x20
push edi
push esi
push edx
push ecx
push ebx
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
jmp 0x8128c7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1e
jge 0x812929
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
cmp dword [eax*4 + 0x8200a4], ecx
jne 0x812927
mov eax, dword [ebp - 0xc]
cmp dword [0x8200a0], eax
je 0x812901
mov eax, dword [ebp - 0x18]
mov al, byte [eax + 0x82011c]
push eax
call fcn.0081733d
add esp, 4
mov eax, dword [ebp - 0xc]
mov dword [0x8200a0], eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.00816ee0
add esp, 8
mov dword [ebp - 0x10], 1
cmp dword [ebp - 8], 0
je 0x812925
mov eax, dword [ebp - 8]
add dword [eax + 8], 0xa
jmp 0x812929
jmp 0x8128c4
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x10], 0
je 0x812957
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.00816e94
add esp, 8
pop ebx
pop ecx
pop edx
pop esi
pop edi
mov eax, dword [ebp - 0x14]
leave
ret 0x14
Function at 0x81a071
Capabilities:
Encrypt data using rc6

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, 0x1ff
mov eax, dword [esi]
mov al, byte [eax]
and eax, 0xff
cmp dword [esi + 0xc], edi
mov dword [esp + 0x14], eax
je 0x819f2a
mov eax, 0x1fbd4
jmp 0x81a0b9
mov eax, dword [0x820ca0]
cmp eax, 0xa
jne 0x819f44
mov eax, dword [esi + 4]
push dword [eax]
call fcn.0081a0be
pop ecx
mov dword [0x820ca0], eax
push 1
pop ebx
cmp word [esp + 0x14], bx
jne 0x819fdd
sub eax, 0
je 0x819f87
dec eax
je 0x819fc6
dec eax
je 0x819fa9
dec eax
je 0x819fb4
dec eax
je 0x819f97
dec eax
je 0x819f74
dec eax
jne 0x819fd1
mov word [0x820ca4], 2
jmp 0x819f7b
mov word [0x820ca4], bx
push 2
call fcn.0081a1bf
test eax, eax
pop ecx
je 0x819fdd
mov word [0x820ca4], di
push ebx
call fcn.0081a1bf
pop ecx
jmp 0x819fd5
push ebx
mov word [0x820ca4], di
call fcn.0081a1bf
test eax, eax
pop ecx
je 0x819fdd
mov word [0x820ca4], 2
jmp 0x819fcd
push ebx
mov word [0x820ca4], di
call fcn.0081a1bf
test eax, eax
pop ecx
je 0x819fdd
mov word [0x820ca4], bx
push 2
jmp 0x819f8f
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x81a0b9
mov eax, dword [0x820cc8]
test eax, eax
je 0x81a0b4
cmp eax, ebx
je 0x81a0b4
movzx eax, word [0x820ca4]
push esi
mov dword [esi + 0xc], eax
call fcn.0081a503
pop ecx
push esi
call dword [0x820ccc]
mov ebp, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, eax
test edi, edi
je 0x81a08d
mov eax, dword [0x820ca0]
cmp eax, 3
je 0x81a02f
cmp eax, 4
je 0x81a02f
cmp eax, 5
je 0x81a02f
cmp eax, 6
jne 0x81a08d
push dword [0x820cc8]
call ebp
and dword [0x820cc8], 0
push esi
call fcn.0081a51d
mov eax, dword [0x820ca0]
pop ecx
cmp eax, 3
je 0x81a06e
cmp eax, 4
je 0x81a065
jbe 0x81a07d
cmp eax, 6
ja 0x81a07d
mov dword [esi + 0xc], 0x1ff
push ebx
jmp 0x81a073
push 2
pop eax
mov dword [esi + 0xc], eax
push eax
jmp 0x81a073
mov dword [esi + 0xc], ebx
push 2
call fcn.0081a1bf
test eax, eax
pop ecx
jne 0x81a0b9
push esi
call fcn.0081a503
pop ecx
push esi
call dword [0x820ccc]
mov edi, eax
cmp word [esp + 0x14], 2
jne 0x81a0a9
test edi, edi
jne 0x81a0a9
mov eax, dword [0x820cc8]
test eax, eax
je 0x81a0b4
cmp eax, ebx
je 0x81a0b4
push eax
call ebp
push esi
call fcn.0081a51d
pop ecx
mov eax, edi
jmp 0x81a0b9
mov eax, 0x27132
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x81a124
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0
push esi
push edi
push 0xc
mov esi, 0x820f9c
pop ecx
lea edi, [ebp - 0xe0]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 0x25
xor eax, eax
pop ecx
lea edi, [ebp - 0xaf]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor esi, esi
push 0xa
lea eax, [ebp - 0x18]
push esi
push eax
mov dword [ebp - 0xc], 4
call fcn.0081a177
push dword [ebp + 8]
lea eax, [ebp - 0x18]
push 0x820cd4
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xe0]
push eax
call fcn.0081a1a6
add esp, 0x20
lea eax, [ebp - 4]
push eax
push 1
lea eax, [ebp - 0xe0]
push esi
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x81a145
xor eax, eax
jmp 0x81a173
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push esi
push esi
push 0x820fcd
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
neg eax
sbb eax, eax
not eax
and eax, dword [ebp - 8]
pop edi
pop esi
leave
ret

Function at 0x81b0be
Capabilities:
Query or enumerate registry value

Disassembly:
call fcn.00813023
sbb esi, 0x61e80082
jg 0x81b0c0
invalid
jmp [esi - 0x24]

Function at 0x81b503
Capabilities:
Encode data using xor

Disassembly:
add al, ch
sahf
jnp 0x81b483
invalid
invalid
call fcn.00813023
cmpsb byte [esi], byte es:[edi]
loopne 0x81b47f
add al, ch
and byte [ebx - 1], bh
jmp [edi - 0x17ff7d20]

Function at 0x81b51d
Capabilities:
Encode data using xor

Disassembly:
call fcn.00813023
fucom st(2)
add byte [eax], 0xe8
invalid
add eax, 0x6effff7b
loop 0x81b4a3
add al, ch
cld
jp 0x81b525
invalid
invalid
Function at 0x100109cc
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x1005fbc8]
push esi
xor esi, esi
test eax, eax
jne 0x100109ec
push esi
push esi
push 1
push esi
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_CreateEventW]
mov dword [0x1005fbc8], eax
test eax, eax
je 0x10010a3e
push eax
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_ResetEvent]
lock inc dword [0x1005fa68]
push 0x1005fbd0
push esi
push 0x1005fbbc
push 0x10010530
push esi
push esi
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
mov dword [0x1005fbcc], eax
test eax, eax
je 0x10010a2c
push 0xffffffffffffffff
push dword [0x1005fbc8]
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
push dword [0x1005fbc8]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov dword [0x1005fbc8], esi
pop esi
ret

Function at 0x100156c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x1005f57c]
cmp eax, 0xffffffff
je 0x100156d5
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_TlsGetValue]
test eax, eax
jne 0x100156d6
ret
push eax
call fcn.10020cf8
add esp, 4
push 0
push dword [0x1005f57c]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_TlsSetValue]
ret

Function at 0x10016090
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x1005f57c]
push ebx
mov bl, cl
cmp eax, 0xffffffff
je 0x100160ec
push esi
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x100160b5
test bl, bl
jne 0x100160bb
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xc
call fcn.10020cc4
mov esi, eax
add esp, 4
mov dword [ebp - 4], esi
test esi, esi
je 0x100160f3
push edi
mov edi, esi
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop edi
push esi
push dword [0x1005f57c]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_TlsSetValue]
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
xor esi, esi
jmp 0x100160d7

Function at 0x1001647c
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push 0x20019
push ebx
push 0x10007f44
push 0x80000002
mov dword [ebp - 8], ebx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x100164e4
push esi
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], ebx
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x10007f78
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x100164e4
cmp dword [ebp - 8], ebx
setne bl
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100179b8
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x1005f2f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10060308]
push ebx
xor ebx, ebx
push esi
inc ebx
mov esi, ecx
push edi
cmp eax, ebx
jne 0x100179fd
mov eax, dword [0x1005fc1c]
cmp dword [eax], 0
jne 0x10027a83
and dword [esi], 0
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10021250
mov esp, ebp
pop ebp
ret
cmp dword [0x1006030c], ebx
jne 0x10017a47
mov edi, dword [0x10060324]
test edi, edi
jne 0x10027a73
test eax, eax
jne 0x10027a64
cmp dword [0x10060314], 5
jb 0x10027a5a
mov eax, dword fs:[0x30]
mov ecx, 0x10060308
mov eax, dword [eax + 0xa0]
add eax, 0xc
mov dword [0x1005fc1c], eax
mov eax, ebx
xchg dword [ecx], eax
jmp 0x100179d9
push ebx
jmp 0x10027a66
mov dword [0x10060308], 2
push 0x32
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetLastError]
xor eax, eax
jmp 0x100179ec
push esi
mov ecx, edi
call dword [0x100614f4]
call edi
jmp 0x100179ec
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentThreadId]
mov ecx, dword [0x1005fc1c]
cmp dword [ecx], eax
jne 0x100179e7
mov dword [esi], ebx
jmp 0x100179ea
Function at 0x1001cb30
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [0x1005f2f4]
xor eax, esp
mov dword [esp + 0x30], eax
cmp dword [0x1005fc84], 2
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
jne case.0x1001cbe4.6
cmp byte [0x100603ac], 0
jne 0x1001cc55
mov eax, dword [0x1005fa94]
test eax, eax
je 0x1001cc3e
cmp dword [eax + 0x2c], 0
je 0x1001cc55
mov cl, 1
cmp byte [0x100603ad], 0
mov esi, dword [ebp + 0xc]
jne 0x10029199
test cl, cl
je 0x1001cba1
push 0
push dword [ebp + 0x18]
mov edx, edi
xor cl, cl
push dword [ebp + 0x14]
push esi
call fcn.1001cc80
mov eax, dword [0x1005f57c]
cmp eax, 0xffffffff
je case.0x1001cbe4.6
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_TlsGetValue]
test eax, eax
jne 0x1001cbca
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10021250
mov esp, ebp
pop ebp
ret 0x1c
mov ebx, dword [eax]
test ebx, ebx
je case.0x1001cbe4.6
cmp esi, 0x13
ja case.0x1001cbe4.6
lea eax, [esi - 5]
cmp eax, 0xe
ja case.0x1001cbe4.6
movzx eax, byte [eax + 0x1001cc70]
jmp dword [eax*4 + 0x1001cc68]
xor eax, eax
lea edi, [ebx + 0xc0]
push 0x30
mov ecx, 8
push eax
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [esp + 0xc], 0x30
lea eax, [esp + 0xc]
push eax
push 0
call dword [sym.imp.USER32.dll_GetGUIThreadInfo]
cmp dword [ebx + 0x5c], 0
je case.0x1001cbe4.6
cmp dword [esp + 0x1c], 0
jne 0x1001cc5c
push 0
push 1
push 0
mov ecx, ebx
call fcn.1001a483
jmp case.0x1001cbe4.6
mov ecx, 0x1005fa90
call fcn.1001dd5b
mov eax, dword [0x1005fa94]
test eax, eax
jne 0x1001cb6f
xor cl, cl
jmp 0x1001cb7b
cmp esi, 0x13
jne 0x1001cc2c
jmp case.0x1001cbe4.6
mov eax, dword [ebp + 0x1c]
cmp eax, dword [0x100603c0]
je 0x1001cba1
jmp 0x1001cb8b

Function at 0x1001cc80
Capabilities:
Contain obfuscated stackstrings
Inspect section memory permissions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002428b
mov eax, dword fs:[0]
push eax
sub esp, 0x484
mov eax, dword [0x1005f2f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov dword [ebp - 0x46c], ebx
mov byte [ebp - 0x463], cl
cmp word [0x100600f0], 0
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x478], eax
je 0x1001d1f4
mov eax, dword [0x10060308]
mov dword [ebp - 0x470], 0
cmp eax, 1
jne 0x1001d251
mov eax, dword [0x1005fc1c]
cmp dword [eax], 0
jne 0x1001d1db
mov dword [ebp - 0x470], 0
mov ecx, dword fs:[0x30]
xor dl, dl
xor eax, eax
mov byte [ebp - 0x462], dl
mov ecx, dword [ecx + 0x1e4]
and ecx, 0x20000000
or eax, ecx
jne 0x100291ee
invalid
invalid
sbb ah, bh
invalid
Function at 0x1001dccb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.1001cd9c
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
invalid
jmp dword [ecx]
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
invalid
push dword [eax]

Function at 0x1001e262
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop esp
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
push edx