joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409020
Capabilities:
Check for debugger via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], str.Waiting_for_debugger_to_attach._n
call dbg.printf
mov dword [esp], 0x3e8
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
lea eax, [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
call eax
sub esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4090b3
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
test eax, eax
jg 0x409077
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
jmp 0x409086
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0x10], eax
mov dword [esp], 2
mov eax, dword [sym.___acrt_iob_func]
call eax
mov edx, dword [ebp - 0x10]
mov dword [esp + 8], edx
mov dword [esp + 4], str.CheckRemoteDebuggerPresent_failed:__x_n
mov dword [esp], eax
call dbg.fprintf
mov eax, dword [ebp - 0x10]
jmp 0x4090cf
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x409032
mov dword [esp], str.Debugger_attached__resuming_n
call dbg.printf
mov eax, 0
leave
ret

Function at 0x4090d4
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_ResumeThread]
call eax
sub esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x409143
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
test eax, eax
jg 0x409107
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
jmp 0x409116
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0x10], eax
mov dword [esp], 2
mov eax, dword [sym.___acrt_iob_func]
call eax
mov edx, dword [ebp - 0x10]
mov dword [esp + 8], edx
mov dword [esp + 4], str.Failed_to_resume_target_thread:__x_n
mov dword [esp], eax
call dbg.fprintf
mov eax, dword [ebp - 0x10]
jmp 0x409148
mov eax, 0
leave
ret
Function at 0x409458
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 8], 0
jne 0x409482
mov dword [esp + 8], 0xb
mov dword [esp + 4], str..._inject_options.c
mov dword [esp], str.f___NULL
mov eax, dword [sym.imp.msvcrt.dll__assert]
call eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b8
mov dword [esp + 4], 1
mov dword [esp], str.Usage:_inject__options__program_args..._nAll_options_must_precede_the_program_name._n_nThe_following_options_are_understood:_n_n_h_tPrint_this_message._n_n_d_tAttach_to_target_as_a_debugger_and_print_debug_messages._n_n_p_tPause_the_target_until_a_debugger_attaches_to_it._n___tCannot_be_used_with__d._n_n_w_tWait_for_target_to_terminate._n___tCannot_be_used_with__d._n_n_k_dll_tInject_the_named_DLL_into_the_target_process._n___tCan_be_specified_more_than_once._n_n
call sym._fwrite
nop
leave
ret
Function at 0x407c70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x407c7f
pop dword [ebp - 0x30]
mov eax, 0x407c7f
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x3fad6
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x4f88
xor edi, edi
add edi, eax
mov esi, 0xd7cef99e
sub esi, 0xd78ba59e
add esi, dword [ebp - 0x30]
mov ebx, 0x81a89fd5
add dword [ebp - 0x24], 0x82fe84e4
mov edx, dword [esi]
xor dword [ebp - 0x20], eax
xor edx, ebx
sub dword [ebp - 0x24], esi
mov dword [edi], edx
add edi, 0xaae88815
sub edi, 0xaae88811
add esi, 0xe50b3ea6
sub esi, 0xe50b3ea2
loop 0x407cca
add eax, 0xff3e43b2
add eax, 0xc2ed41
xor ebx, ebx
add ebx, eax
add eax, 0x88b5fc4a
add eax, 0x774a03bb
mov ecx, 0x400000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x5ef11f
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esi + eax*4 + 0x3abdb300], eax
invalid
in al, 0x5e
xchg dx, ax
neg dword [edi + 0x79]
or byte [esi], dl
push eax
push cs
leave
jbe 0x5ef0ee
cmp dword [bp + si], 0x17e94520
scasd eax, dword es:[edi]
sar byte [ebx], cl
push esi
jo 0x5ef18c
invalid
cmc
push edi
outsb dx, byte [esi]
dec ebp
mov eax, 0x93353df2
daa
adc byte [esi + 0x29943cdf], 0x64
lahf
ljmp 0xb136

Function at 0x5f6890
Capabilities:
Encode data using xor

Disassembly:
pop edx
pop ebx
fst qword [edi + ebp + 0x51]
or eax, 0xdc5b49fa
salc
or esi, dword [edx + 0x4c]
sbb eax, 0xbea85370
inc esp
cmp byte [edx], ah
dec ebx
push esi
dec edx
adc al, 0xdd
insd dword es:[edi], dx
xlatb
cmpsd dword [esi], dword es:[edi]
mov ds, word [ecx]
and eax, 0x5b45d5a9
invalid
Function at 0x5fec60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9d8
mov eax, dword [0x7566d8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x3d8], 0x13
mov byte [ebp - 0x3d7], 0x87
mov byte [ebp - 0x3d6], 0x4d
mov byte [ebp - 0x3d5], 0x7c
mov byte [ebp - 0x3d4], 0xaa
mov byte [ebp - 0x3d3], 0xfc
mov byte [ebp - 0x3d2], 0x73
mov byte [ebp - 0x3d1], 0x5a
mov byte [ebp - 0x3d0], 0xef
mov byte [ebp - 0x3cf], 0x12
mov byte [ebp - 0x3ce], 0xc0
mov byte [ebp - 0x3cd], 0x66
mov byte [ebp - 0x3cc], 0x3f
mov byte [ebp - 0x3cb], 0xf0
mov byte [ebp - 0x3ca], 0x11
mov byte [ebp - 0x3c9], 0x46
mov byte [ebp - 0x3c8], 0x73
mov byte [ebp - 0x3c7], 0x83
mov byte [ebp - 0x24c], 0x54
mov byte [ebp - 0x24b], 0x54
mov byte [ebp - 0x24a], 0x54
mov byte [ebp - 0x249], 0x54
mov byte [ebp - 0x248], 0x54
mov byte [ebp - 0x247], 0x54
mov byte [ebp - 0x246], 0x54
mov byte [ebp - 0x245], 0x54
mov byte [ebp - 0x244], 0x54
mov byte [ebp - 0x243], 0x54
mov byte [ebp - 0x242], 0x54
mov byte [ebp - 0x241], 0x54
mov byte [ebp - 0x240], 0x54
mov byte [ebp - 0x23f], 0x54
mov byte [ebp - 0x23e], 0x54
mov byte [ebp - 0x23d], 0x54
mov byte [ebp - 0x23c], 0x54
mov byte [ebp - 0x23b], 0x54
mov byte [ebp - 0x23a], 0x54
mov byte [ebp - 0x239], 0x54
mov byte [ebp - 0x238], 0x54
mov byte [ebp - 0x237], 0x54
mov byte [ebp - 0x236], 0x54
mov byte [ebp - 0x235], 0x54
mov byte [ebp - 0x234], 0x54
mov byte [ebp - 0x233], 0x54
mov byte [ebp - 0x232], 0x54
mov byte [ebp - 0x231], 0x54
mov byte [ebp - 0x230], 0x54
mov byte [ebp - 0x118], 2
mov byte [ebp - 0x117], 0x90
call dword [eax - 0x1157a3a]
invalid
dec dword [ecx - 0x3a]
test ebx, ebp
invalid
invalid
invalid
jns 0x5fed9d
test esp, ebp
invalid
invalid
dec dword [esi - 0x1127a3a]
invalid
invalid
jmp 0x5fedab
test esi, ebp
invalid
invalid
dec dword [esi + eax*8 - 0x7b]
out dx, eax
invalid
invalid
dec dword [ebx - 0x3a]
test eax, esi
invalid
invalid
jmp ebp
mov byte [ebp - 0x10f], 2
mov byte [ebp - 0x10e], 0xd6
mov byte [ebp - 0x10d], 0x58
mov byte [ebp - 0x10c], 0x29
mov byte [ebp - 0x10b], 0xca
mov byte [ebp - 0x10a], 0x7e
mov byte [ebp - 0x5f8], 0x52
mov byte [ebp - 0x5f7], 0x52
mov byte [ebp - 0x5f6], 0x52
mov byte [ebp - 0x5f5], 0x52
mov byte [ebp - 0x5f4], 0x52
mov byte [ebp - 0x5f3], 0x52
mov byte [ebp - 0x5f2], 0x52
mov byte [ebp - 0x5f1], 0x52
mov byte [ebp - 0x5f0], 0x52
mov byte [ebp - 0x5ef], 0x52
mov byte [ebp - 0x5ee], 0x52
mov byte [ebp - 0x5ed], 0x52
mov byte [ebp - 0x5ec], 0x52
mov byte [ebp - 0x5eb], 0x52
adc eax, 0x52fffffa
Function at 0x60016d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x9b3], 0x47
mov byte [ebp - 0x9b2], 0x47
mov byte [ebp - 0x9b1], 0x47
mov byte [ebp - 0x9b0], 0x47
mov byte [ebp - 0x9af], 0x47
mov byte [ebp - 0x9ae], 0x47
mov byte [ebp - 0x9ad], 0x47
mov byte [ebp - 0x9ac], 0x47
mov byte [ebp - 0x9ab], 0x47
mov byte [ebp - 0x9aa], 0x47
mov byte [ebp - 0x9a9], 0x47
mov byte [ebp - 0x9a8], 0x47
mov byte [ebp - 0x9a7], 0x47
mov byte [ebp - 0x9a6], 0x47
mov byte [ebp - 0x9a5], 0x47
pop ebx
idiv bh
inc dword [edi - 0x3a]
test dword [esi + esi*8 - 1], ebx
inc dword [edi - 0x3a]
test dword [ebp - 0xa], ebx
invalid
inc dword [edi - 0x3a]
test dword [esi - 0xa], ebx
invalid
inc dword [edi - 0x3a]
test dword [edi - 0xa], ebx
invalid
inc dword [edi - 0x3a]
test dword [eax - 0xa], esp
invalid
inc dword [edi - 0x3a]
test dword [ecx - 0xa], esp
invalid
inc dword [edi - 0x3a]
test dword [edx - 0xa], esp
invalid
inc dword [edi - 0x3a]
test dword [ebx - 0xa], esp
invalid
inc dword [edi - 0x3a]
test dword [esi + esi*8 - 1], esp
inc dword [edi - 0x3a]
test dword [ebp - 0xa], esp
invalid
inc dword [edi - 0x3a]
inc ebp
mov byte [edx], cl
mov byte [ebp - 0x77], 0x87
mov byte [ebp - 0x76], 0x5e
mov byte [ebp - 0x75], 0x76
mov byte [ebp - 0x74], 0x9f
mov byte [ebp - 0x73], 0xe2
mov byte [ebp - 0x72], 0x2f
mov byte [ebp - 0x71], 0xb
mov byte [ebp - 0x70], 0x8a
mov byte [ebp - 0x7f0], 0x6c
jmp [esi + eax*8 - 0x7b]
adc eax, edi
invalid
jmp [esi + eax*8 - 0x7b]
adc bh, al
invalid
jmp [esi + eax*8 - 0x7b]
adc edi, eax
invalid
jmp [esi + eax*8 - 0x7b]
adc al, 0xf8
invalid
jmp [esi + eax*8 - 0x7b]
adc eax, 0x6cfffff8
mov byte [ebp - 0x7ea], 0x6c
mov byte [ebp - 0x7e9], 0x6c
mov byte [ebp - 0x7e8], 0x6c
mov byte [ebp - 0x7e7], 0x6c
mov byte [ebp - 0x7e6], 0x6c
mov byte [ebp - 0x7e5], 0x6c
mov byte [ebp - 0x7e4], 0x6c
mov byte [ebp - 0x7e3], 0x6c
mov byte [ebp - 0x7e2], 0x6c
mov byte [ebp - 0x7e1], 0x6c
mov byte [ebp - 0x7e0], 0x6c
mov byte [ebp - 0x7df], 0x6c
mov byte [ebp - 0x7de], 0x6c
mov byte [ebp - 0x7dd], 0x6c
mov byte [ebp - 0x6a0], 0x12
mov byte [ebp - 0x69f], 0x87
mov byte [ebp - 0x69e], 0x58
mov byte [ebp - 0x69d], 0x5d
mov byte [ebp - 0x69c], 0x88
mov byte [ebp - 0x69b], 0xfc
mov byte [ebp - 0x69a], 0x73
mov byte [ebp - 0x699], 0x4b
mov byte [ebp - 0x698], 0xc7
mov byte [ebp - 0x697], 0xe
mov byte [ebp - 0x696], 0xd7
mov byte [ebp - 0x695], 0x4e
mov byte [ebp - 0x694], 0x5a
mov byte [ebp - 0x914], 0x6f
mov byte [ebp - 0x913], 0x6f
outsd dx, dword [esi]
mov byte [ebp - 0x912], 0x6f
mov byte [ebp - 0x911], 0x6f
mov byte [ebp - 0x910], 0x6f
mov byte [ebp - 0x90f], 0x6f
mov byte [ebp - 0x90e], 0x6f
mov byte [ebp - 0x90d], 0x6f
mov byte [ebp - 0x90c], 0x6f
mov byte [ebp - 0x90b], 0x6f
mov byte [ebp - 0x90a], 0x6f
mov byte [ebp - 0x909], 0x6f
mov byte [ebp - 0x908], 0x6f
mov byte [ebp - 0x907], 0x6f
mov byte [ebp - 0x906], 0x6f
mov byte [ebp - 0x905], 0x6f
mov byte [ebp - 0x904], 0x6f
mov byte [ebp - 0x903], 0x6f
mov byte [ebp - 0x902], 0x6f
mov byte [ebp - 0x901], 0x6f
invalid
invalid
Function at 0x600334
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x9b3], 0x47
mov byte [ebp - 0x9b2], 0x47
mov byte [ebp - 0x9b1], 0x47
mov byte [ebp - 0x9b0], 0x47
mov byte [ebp - 0x9af], 0x47
mov byte [ebp - 0x9ae], 0x47
mov byte [ebp - 0x9ad], 0x47
mov byte [ebp - 0x9ac], 0x47
mov byte [ebp - 0x9ab], 0x47
mov byte [ebp - 0x9aa], 0x47
mov byte [ebp - 0x9a9], 0x47
mov byte [ebp - 0x9a8], 0x47
mov byte [ebp - 0x9a7], 0x47
mov byte [ebp - 0x9a6], 0x47
mov byte [ebp - 0x9a5], 0x47
pop ebx
idiv bh
inc dword [edi - 0x3a]
test dword [esi + esi*8 - 1], ebx
inc dword [edi - 0x3a]
test dword [ebp - 0xa], ebx
invalid
inc dword [edi - 0x3a]
test dword [esi - 0xa], ebx
invalid
inc dword [edi - 0x3a]
test dword [edi - 0xa], ebx
invalid
inc dword [edi - 0x3a]
test dword [eax - 0xa], esp
invalid
inc dword [edi - 0x3a]
test dword [ecx - 0xa], esp
invalid
inc dword [edi - 0x3a]
test dword [edx - 0xa], esp
invalid
inc dword [edi - 0x3a]
test dword [ebx - 0xa], esp
invalid
inc dword [edi - 0x3a]
test dword [esi + esi*8 - 1], esp
inc dword [edi - 0x3a]
test dword [ebp - 0xa], esp
invalid
inc dword [edi - 0x3a]
inc ebp
mov byte [edx], cl
mov byte [ebp - 0x77], 0x87
mov byte [ebp - 0x76], 0x5e
mov byte [ebp - 0x75], 0x76
mov byte [ebp - 0x74], 0x9f
mov byte [ebp - 0x73], 0xe2
mov byte [ebp - 0x72], 0x2f
mov byte [ebp - 0x71], 0xb
mov byte [ebp - 0x70], 0x8a
mov byte [ebp - 0x7f0], 0x6c
jmp [esi + eax*8 - 0x7b]
adc eax, edi
invalid
jmp [esi + eax*8 - 0x7b]
adc bh, al
invalid
jmp [esi + eax*8 - 0x7b]
adc edi, eax
invalid
jmp [esi + eax*8 - 0x7b]
adc al, 0xf8
invalid
jmp [esi + eax*8 - 0x7b]
adc eax, 0x6cfffff8
mov byte [ebp - 0x7ea], 0x6c
mov byte [ebp - 0x7e9], 0x6c
mov byte [ebp - 0x7e8], 0x6c
mov byte [ebp - 0x7e7], 0x6c
mov byte [ebp - 0x7e6], 0x6c
mov byte [ebp - 0x7e5], 0x6c
mov byte [ebp - 0x7e4], 0x6c
mov byte [ebp - 0x7e3], 0x6c
mov byte [ebp - 0x7e2], 0x6c
mov byte [ebp - 0x7e1], 0x6c
mov byte [ebp - 0x7e0], 0x6c
mov byte [ebp - 0x7df], 0x6c
mov byte [ebp - 0x7de], 0x6c
mov byte [ebp - 0x7dd], 0x6c
mov byte [ebp - 0x6a0], 0x12
mov byte [ebp - 0x69f], 0x87
mov byte [ebp - 0x69e], 0x58
mov byte [ebp - 0x69d], 0x5d
mov byte [ebp - 0x69c], 0x88
mov byte [ebp - 0x69b], 0xfc
mov byte [ebp - 0x69a], 0x73
mov byte [ebp - 0x699], 0x4b
mov byte [ebp - 0x698], 0xc7
mov byte [ebp - 0x697], 0xe
mov byte [ebp - 0x696], 0xd7
mov byte [ebp - 0x695], 0x4e
mov byte [ebp - 0x694], 0x5a
mov byte [ebp - 0x914], 0x6f
mov byte [ebp - 0x913], 0x6f
outsd dx, dword [esi]
mov byte [ebp - 0x912], 0x6f
mov byte [ebp - 0x911], 0x6f
mov byte [ebp - 0x910], 0x6f
mov byte [ebp - 0x90f], 0x6f
mov byte [ebp - 0x90e], 0x6f
mov byte [ebp - 0x90d], 0x6f
mov byte [ebp - 0x90c], 0x6f
mov byte [ebp - 0x90b], 0x6f
mov byte [ebp - 0x90a], 0x6f
mov byte [ebp - 0x909], 0x6f
mov byte [ebp - 0x908], 0x6f
mov byte [ebp - 0x907], 0x6f
mov byte [ebp - 0x906], 0x6f
mov byte [ebp - 0x905], 0x6f
mov byte [ebp - 0x904], 0x6f
mov byte [ebp - 0x903], 0x6f
mov byte [ebp - 0x902], 0x6f
mov byte [ebp - 0x901], 0x6f
invalid
invalid
Function at 0x603ce9
Capabilities:
Get number of processors

Disassembly:
je 0x603d08
mov edx, dword [ebp - 4]
add edx, 8
push edx
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp

Function at 0x60481c
Capabilities:
Get number of processors

Disassembly:
mov dword [esi + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esi], ecx
cmp eax, dword [ecx + 0xc]
jbe 0x604832
push eax
add ecx, 4
call fcn.005ef11f
mov eax, esi
pop esi
leave

Function at 0x6058e5
Capabilities:
Parse pe header

Disassembly:
or al, 0x8b
mov al, cl
add byte [eax], al
add byte [ecx + 0xc88e], cl
add byte [ebx + 0xcc88], cl
add byte [ecx + 0xcc8e], cl
add byte [ebx + 0xd088], cl
rol byte [eax], 1
add byte [eax], al
mov dword [esi + 0xd0], ecx
mov ecx, dword [eax + 0xd4]
mov dword [esi + 0xd4], ecx
mov edi, dword [eax + 0x44]
test edi, edi

Function at 0x605907
Capabilities:
Parse pe header

Disassembly:
or al, 0x8b
mov al, cl
add byte [eax], al
add byte [ecx + 0xc88e], cl
add byte [ebx + 0xcc88], cl
add byte [ecx + 0xcc8e], cl
add byte [ebx + 0xd088], cl
rol byte [eax], 1
add byte [eax], al
mov dword [esi + 0xd0], ecx
mov ecx, dword [eax + 0xd4]
mov dword [esi + 0xd4], ecx
mov edi, dword [eax + 0x44]
test edi, edi
Function at 0x605bdc
Capabilities:
Check os version
Get number of processors
Link many functions at runtime

Disassembly:
push es
add byte [eax], al
add bh, al
test eax, ebx
stc
invalid

Function at 0x606357
Capabilities:
Link function at runtime on windows

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x7572b8], eax
mov dword [ebp - 0x338], 0x46
mov dword [ebp - 0x404], 0xc6
mov ecx, dword [ebp - 0x338]
cmp ecx, dword [ebp - 0x404]
jle 0x6063d8
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0xc], 0
jne 0x606397
xor eax, eax
jmp 0x6063d5
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xc]
call edx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x6063ac
xor eax, eax
jmp 0x6063d5
push 0x468554
mov eax, dword [ebp - 4]
mov edx, dword [eax]
mov ecx, dword [ebp - 4]
mov eax, dword [edx + 4]
call eax
test eax, eax
jne 0x6063d2
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 4]
mov eax, dword [edx]
call eax
xor eax, eax
jmp 0x6063d5
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
mov dword [ebp - 0x6ec], 0x33
mov dword [ebp - 0x400], 0x71
mov edx, dword [ebp - 0x6ec]
invalid
Function at 0x6066d4
Capabilities:
Check os version
Get number of processors
Link many functions at runtime

Disassembly:
pop ebp
mov dword [ebp - 0x54c], 0x62
mov dword [ebp - 0x898], 0x7f
mov edx, dword [ebp - 0x54c]
cmp edx, dword [ebp - 0x898]
jle 0x606573
push 0xffffffffffffffff
push 0x5bffc4
mov eax, dword fs:[0]
lea eax, [ebp - 0x540]
push eax
lea ecx, [ebp - 0x78]
mov byte [ecx - 1], dl
adc eax, sym.imp.KERNEL32.dll_GetModuleHandleA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x75728c], eax
mov dword [ebp - 0x548], 0x47
mov dword [ebp - 0x95c], 0x93
mov edx, dword [ebp - 0x548]
cmp edx, dword [ebp - 0x95c]
jle 0x606710
push ecx
push ecx
push esi
call fcn.00600b8e
mov esi, eax
test esi, esi
je 0x60670e
mov edx, dword [esi + 0x5c]
mov eax, dword [0x467bac]
push edi
mov edi, dword [ebp + 8]
mov ecx, edx
push ebx
cmp dword [ecx], edi
je 0x6065e9
mov ebx, eax
imul ebx, ebx, 0xc
add ecx, 0xc
add ebx, edx
cmp ecx, ebx
jb 0x6065d7
imul eax, eax, 0xc
add eax, edx
cmp ecx, eax
jae 0x6065fa
cmp dword [ecx], edi
jne 0x6065fa
mov eax, ecx
jmp 0x6065fc
xor eax, eax
test eax, eax
je 0x60660a
mov ebx, dword [eax + 8]
mov dword [ebp - 4], ebx
test ebx, ebx
jne 0x606611
xor eax, eax
jmp 0x60670c
cmp ebx, 5
jne 0x606622
cmp ebx, 1
je 0x606709
mov ecx, dword [esi + 0x60]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0x60], ecx
mov ecx, dword [eax + 4]
cmp ecx, 8
jne 0x6066fb
mov ecx, dword [0x467ba0]
mov edi, dword [0x467ba4]
mov edx, ecx
add edi, ecx
cmp edx, edi
jge 0x60667b
imul ecx, ecx, 0xc
mov edi, dword [esi + 0x5c]
and dword [ecx + edi + 8], 0
mov edi, dword [0x467ba0]
mov ebx, dword [0x467ba4]
inc edx
add ebx, edi
add ecx, 0xc
cmp edx, ebx
jl 0x60665a
mov ebx, dword [ebp - 4]
mov eax, dword [eax]
mov edi, dword [esi + 0x64]
cmp eax, 0xc000008e
jne 0x606690
mov dword [esi + 0x64], 0x83
jmp 0x6066ee
cmp eax, 0xc0000090
jne 0x6066a0
mov dword [esi + 0x64], 0x81
jmp 0x6066ee
cmp eax, 0xc0000091
jne 0x6066b0
mov dword [esi + 0x64], 0x84
jmp 0x6066ee
cmp eax, 0xc0000093
jne 0x6066c0
mov dword [esi + 0x64], 0x85
jmp 0x6066ee
cmp eax, 0xc000008d
jne 0x6066d0
mov dword [esi + 0x64], 0x82
jmp 0x6066ee
cmp eax, 0xc000008f
jne 0x6066e0
mov dword [esi + 0x64], 0x86
jmp 0x6066ee
cmp eax, 0xc0000092
jne 0x6066ee
mov dword [esi + 0x64], 0x8a
push dword [esi + 0x64]
push 8
call ebx
pop ecx
mov dword [esi + 0x64], edi
jmp 0x606702
and dword [eax + 8], 0
push ecx
call ebx
mov eax, dword [ebp - 8]
pop ecx
mov dword [esi + 0x60], eax
or eax, 0xffffffff
Function at 0x606fb7
Capabilities:
Check os version

Disassembly:
mov dword [esi + 8], eax
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
xor bl, bl
cmp byte [ecx + 0x51], bl
je 0x606fd8
mov dword [eax], eax
mov esi, dword [esi + 4]
mov dword [esi + 8], esi
pop edi
pop esi
pop ebx
pop ebp
lea edx, [ebp - 0x598]
push edx
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call dword [edx - 0x73]
inc ebp
mov byte [eax - 1], dl
adc eax, sym.imp.KERNEL32.dll_GetModuleHandleA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x7572d4], eax
mov dword [ebp - 0x1c0], 0x5a
mov dword [ebp - 0x614], 0xc6
mov ecx, dword [ebp - 0x1c0]
cmp ecx, dword [ebp - 0x614]
jle 0x607058
sub esp, 4
push ebx
push ecx
mov eax, dword [ebp + 0xc]
add eax, 0xc
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebp
push dword [ebp + 0x10]
mov ecx, dword [ebp + 0x10]
mov ebp, dword [ebp - 4]
call fcn.00608b27
push esi
push edi
call eax
pop edi
pop esi
mov ebx, ebp
pop ebp
mov ecx, dword [ebp + 0x10]
push ebp
mov ebp, ebx
cmp ecx, 0x100
jne 0x60704e
mov ecx, 2
push ecx
call fcn.00608b27
pop ebp
pop ecx
pop ebx
leave
mov dword [ebp - 0x2e4], 0x3f
mov dword [ebp - 0x2c], 0x65
mov edx, dword [ebp - 0x2e4]
cmp edx, dword [ebp - 0x2c]
jle 0x607084
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x40], ecx
mov esp, ebp
pop ebp
mov dword [ebp - 0x138], 2
mov dword [ebp - 0x28], 0xa5
mov eax, dword [ebp - 0x138]
cmp eax, dword [ebp - 0x28]
jle 0x6070f4
push ebx
push esi
xor esi, esi
cmp dword [0x517878], esi
mov ebx, eax
jne 0x6070b4
mov dword [0x517878], esi
lea eax, [ebx + 0x20]
push eax
push 0x517848
call fcn.0058298c
cmp dword [ebp + 0x14], esi
movzx eax, ax
jne 0x6070d1
mov dword [ebp + 0x14], 0x56000000
cmp dword [ebp + 0x10], esi
jne 0x6070d9
mov dword [ebp + 0x10], esi
push eax
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0059df91
pop esi
pop ebx
pop ebp
mov dword [ebp - 0x134], 0x30
mov dword [ebp - 0x24], 0x66
mov ecx, dword [ebp - 0x134]
cmp ecx, dword [ebp - 0x24]
jle 0x607125
cmp dword [ebp + 8], 0
je 0x607124
push dword [ebp + 8]
push 0
push dword [ecx + 4]
call dword [0x66e630b0]
pop ebp
mov dword [ebp - 0x828], 0x24
mov dword [ebp - 0x130], 0xa1
mov edx, dword [ebp - 0x828]
cmp edx, dword [ebp - 0x130]

Function at 0x607463
Capabilities:
Check os version

Disassembly:
mov word [eax + ebp*4], fs
add byte [eax], al
add bh, bh
adc eax, 0x6494726c

Function at 0x607cf4
Capabilities:
Get number of processors
Link many functions at runtime

Disassembly:
mov dword [ebp - 0x258], 0xaf
mov edx, dword [ebp - 0x6e4]
cmp edx, dword [ebp - 0x258]
jle 0x607d84
sub esp, 0x14
mov eax, dword [0x6779a718]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [0x6779a000]
Function at 0x607fcd
Capabilities:
Get number of processors
Link many functions at runtime

Disassembly:
dec dword [ebx - 0x7074f38b]
lodsb al, byte [esi]
add dword [eax], eax
add byte [ecx + 0x53], dl

Function at 0x608377
Capabilities:
Get number of processors

Disassembly:
or al, 0x8b
jbe 0x6083cf
or al, 0xff
push eax
sub byte [ebx], bh
inc ebp
or al, 0x75
or dword [ebx], edi
push ebp
adc byte [ebp + 4], dh
Function at 0x60877e
Capabilities:
Get number of processors

Disassembly:
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x7572a0], eax
mov dword [ebp - 0x3e4], 0x19
cld
invalid
call [ecx]
add byte [eax], al
add bh, al
test eax, edx
cld
invalid
invalid
mov ecx, 0x8b000000
lea ebx, [esp + edi*8]
invalid
invalid
cmp ecx, dword [ebp - 0x330]
jle 0x608870
add byte [eax], al
invalid
push esi
push edi
mov edi, dword [ebp + 8]
push edi
mov esi, ecx
Function at 0x608812
Capabilities:
Get number of processors

Disassembly:
add byte [ecx - 0x7d], bl
rcl byte [eax + edx*2], 0x68
cmpsd dword [esi], dword es:[edi]
cmp al, byte [eax]
add byte [edi - 1], dl
adc eax, 0x10043920

Function at 0x60895f
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
add dword [eax], 0
add bl, ch
cmp ecx, 0xc0000090

Function at 0x6098f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
mov dword [ebp - 0xa4], 0x64
mov dword [ebp - 0xa0], 0xad
mov eax, dword [ebp - 0xa4]
cmp eax, dword [ebp - 0xa0]
jle 0x6099c9
push ecx
push ebx
mov ebx, dword [0x60e1021c]
push esi
mov esi, dword [ebp + 0x1c]
push edi
test esi, esi
je 0x60994c
cmp word [esi], 0
mov dword [ebp + 0x1c], 0xa
Function at 0x60b56a
Capabilities:
Encode data using base64

Disassembly:
rol byte [edx + eax], 0
add byte [ebp + 0x1443084], cl
add byte [eax], al
Function at 0x60f811
Capabilities:
Authenticate hmac

Disassembly:
jg 0x60f85a
xor byte [esi + 0xf], ah
jg 0x60f85f
inc eax
cld