joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406870
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00402544
xor eax, eax
push ebp
push 0x4068ed
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x48]
mov edx, 0x44
call fcn.00402d28
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 1
mov word [ebp - 0x18], 5
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0x220
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00402554
push eax
push 0
call sub.kernel32.dll_CreateProcessA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4068f4
lea eax, [ebp - 4]
call fcn.004021b8
ret

Function at 0x4068f8
Capabilities:
Copy file
Delete file
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x406aa6
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x409956], 0
jne 0x406a7e
cmp dword [0x4098bc], 0
je 0x406a7e
lea eax, [ebp - 4]
mov edx, 0x105
call fcn.00402680
push 0x105
mov eax, dword [ebp - 4]
call fcn.00402554
push eax
mov eax, dword [0x4096fc]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
mov eax, dword [ebp - 4]
call fcn.00402554
mov edx, eax
lea eax, [ebp - 0x14]
call fcn.004022e4
mov eax, dword [ebp - 0x14]
call fcn.0040235c
mov edx, eax
lea eax, [ebp - 4]
call fcn.00402680
mov eax, dword [0x4098c0]
test eax, eax
jne 0x40698b
lea eax, [ebp - 8]
call fcn.004036bc
jmp 0x406996
dec eax
jne 0x406996
lea eax, [ebp - 8]
call fcn.00403864
lea eax, [ebp - 0x18]
mov edx, 0x4098c4
call fcn.00402314
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 8]
call fcn.00402364
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.004024a0
je 0x406a7e
mov eax, dword [ebp - 8]
call fcn.00402554
mov ebx, eax
push ebx
call sub.kernel32.dll_DeleteFileA
push 0
push ebx
mov eax, dword [ebp - 4]
call fcn.00402554
push eax
call sub.kernel32.dll_CopyFileA
lea eax, [ebp - 0xc]
mov edx, 0x4098d9
call fcn.00402314
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push 0x406ab4
push 0x80000001
call sub.advapi32.dll_RegCreateKeyExA
mov eax, dword [ebp - 8]
call fcn.0040235c
inc eax
push eax
lea eax, [ebp - 0x1c]
mov ecx, 0x406aec
mov edx, dword [ebp - 8]
call fcn.004023a8
mov eax, dword [ebp - 0x1c]
call fcn.00402554
push eax
push 1
push 0
lea eax, [ebp - 0x20]
mov ecx, 0x406aec
mov edx, dword [ebp - 0xc]
call fcn.004023a8
mov eax, dword [ebp - 0x20]
call fcn.00402554
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey
mov eax, dword [ebp - 8]
call fcn.00406870
cmp dword [0x409950], 1
jne 0x406a77
call fcn.00404478
push 0
call sub.kernel32.dll_ExitProcess_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406aad
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.004021dc
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004021dc
ret
Function at 0x406af0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, eax
mov ebx, 0x4096e0
mov esi, 0x4096b8
xor eax, eax
push ebp
push 0x406c2a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [esi], 0x80
push 0x406c38
mov eax, dword [0x4096fc]
push eax
call sub.user32.dll_LoadIconA
mov dword [esi + 0x14], eax
mov dword [esi + 4], 0x406828
lea edx, [ebp - 4]
xor eax, eax
call fcn.00401394
mov eax, dword [ebp - 4]
call fcn.00402554
push eax
call sub.kernel32.dll_GetModuleHandleA_1
mov dword [esi + 0x10], eax
mov dword [esi + 0x1c], 0x10
mov eax, dword [0x4080a0]
call fcn.00402554
mov dword [esi + 0x24], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [esi + 0x18], eax
mov byte [0x409954], 0
mov byte [0x409955], 0
push esi
call sub.user32.dll_RegisterClassA
mov eax, dword [esi + 0x10]
mov dword [0x4096fc], eax
push 0xa
push 0xa
push 0
push 0
push 0
push 0
mov eax, dword [0x4096fc]
push eax
push 0
mov eax, dword [0x4080a4]
call fcn.00402554
push eax
mov eax, dword [0x4080a0]
call fcn.00402554
mov ecx, 0x80000
pop edx
call fcn.00402d30
mov dword [0x409700], eax
push edi
mov eax, dword [0x409700]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x409874]
test eax, eax
jne 0x406be1
call fcn.00404df0
jmp 0x406c00
dec eax
jne 0x406beb
call fcn.00405024
jmp 0x406c00
push 0
call sub.kernel32.dll_ExitProcess_1
push ebx
call sub.user32.dll_TranslateMessage
push ebx
call sub.user32.dll_DispatchMessageA
push 0
push 0
mov eax, dword [0x409700]
push eax
push ebx
call sub.user32.dll_GetMessageA
test eax, eax
jne 0x406bf4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406c31
lea eax, [ebp - 4]
call fcn.004021b8
ret

Function at 0x406c44
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00402544
xor eax, eax
push ebp
push 0x406cc7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00402554
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
push 0
push ebx
call sub.kernel32.dll_GetFileSize_1
mov esi, eax
mov eax, esi
call fcn.00401128
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push esi
push edi
push ebx
call sub.kernel32.dll_ReadFile_1
push ebx
call sub.kernel32.dll_CloseHandle_1
mov ebx, edi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406cce
lea eax, [ebp - 4]
call fcn.004021b8
ret
Function at 0x4071d0
Capabilities:
Persist via default file association registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x4072d6
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x409956], 0
call fcn.00403404
call fcn.004068f8
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push 0x4072e4
push 0x80000001
call sub.advapi32.dll_RegCreateKeyExA
lea edx, [ebp - 0xc]
xor eax, eax
call fcn.00401394
mov eax, dword [ebp - 0xc]
call fcn.0040235c
inc eax
push eax
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00401394
lea eax, [ebp - 0x10]
mov edx, 0x4072fc
call fcn.00402364
mov eax, dword [ebp - 0x10]
call fcn.00402554
push eax
push 1
push 0
push 0x407300
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
push 1
lea eax, [ebp - 4]
push eax
xor ecx, ecx
mov edx, 0x40730c
mov eax, 0x80000002
call fcn.004050b4
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.00401394
mov eax, dword [ebp - 0x14]
call fcn.00406c44
mov ebx, eax
call fcn.00406f10
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00406cd8
mov eax, ebx
call fcn.00401140
push 0
call sub.kernel32.dll_ExitProcess_1
Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x2aad6e2b
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
mov ecx, 0x160613ba
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x29e22156
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x432024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0x23405077
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x4035d3
Capabilities:
Create thread
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor edx, edx
mov ebx, 0x107
lea esi, [edi + 0xd4]
mov cl, byte [ebp + 0x10]
and esi, 0x1be
sub cl, 0x71
mov eax, esi
xor esi, 0x1c3
div ebx
cmp edi, 0x1b
mov ebx, edx
jne 0x403643
movzx ecx, cl
mov eax, ecx
xor edx, edx
mov edi, 0x1c4
push dword [ebp + 0x14]
div edi
xor edx, edx
or eax, ecx
or ax, 0x2c2
push eax
mov eax, dword [ebp + 8]
and eax, 0x16f
push eax
mov eax, dword [ebp + 0x14]
imul eax, eax, 0xa3
div dword [ebp + 0x14]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_UnlockFileEx]
jmp 0x403756
cmp edi, 0x25
jae 0x40365c
mov ebx, dword [ebp + 8]
and ebx, 0x23d
xor ebx, 0x2cf
jmp 0x403759
cmp edi, 0x4f
ja 0x403678
mov eax, dword [ebp + 0x14]
imul eax, eax, 0x1f4
and eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
jmp 0x403759
cmp edi, 0x16fc
jne 0x40370d
mov eax, dword [ebp + 0x10]
cmp eax, 0x36
jbe 0x4037d7
cmp eax, 0x4e
ja 0x4036a1
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x403759
cmp eax, 0x1f
ja 0x4036b1
lea esi, [ebx + 0x27a]
jmp 0x403759
cmp eax, 0xee38
jne 0x4036fc
mov eax, dword [ebp + 8]
xor edx, edx
add eax, 0x3db
xor eax, 0x1f
sub eax, 0x1be9
movzx ecx, cl
push eax
mov eax, 0xa0
div ecx
mov eax, edx
xor edx, edx
div ecx
add eax, 0xe39b
push eax
mov eax, ebx
imul eax, eax, 0x16fc
sub eax, 0xb6736
push eax
call fcn.00401400
add esp, 0xc
movzx esi, al
jmp 0x403759
cmp eax, 5
jae 0x403759
mov eax, ebx
imul eax, eax, 0x1c4
or esi, eax
jmp 0x403759
cmp edi, 6
jne 0x40371a
mov al, byte [ebp + 8]
jmp 0x4037d7
cmp edi, 0x2d
ja 0x403759
movzx edi, cl
xor edx, edx
lea eax, [edi + esi + 0x49caf]
and edi, 0x4a
push eax
mov eax, 0x11b5c
div ebx
or di, 0x335
push eax
mov eax, dword [ebp + 0xc]
imul eax, eax, 0x2a4
push dword [ebp + 0x10]
and eax, dword [ebp + 0x14]
push eax
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov al, cl
shl al, 1
or al, 0xf8
cmp al, 0x5e
ja 0x403770
xor ecx, 0x3af
mov ebx, ecx
jmp 0x4037d5
cmp al, 0xf8
jne 0x4037d5
cmp esi, 0xf3
jne 0x4037d5
cmp dword [ebp + 0x14], 0x28
jne 0x403787
lea ebx, [edi + 0x17]
jmp 0x4037d5
cmp dword [ebp + 0x14], 0x52
jne 0x4037bf
mov eax, 0x16b
xor edx, edx
div ebx
push edi
and edx, 0x3d0
push edx
push 0x3e
pop eax
xor edx, edx
div edi
lea eax, [ebx + edi]
and eax, 0x215
add edx, 0x26a
push edx
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x4037d5
cmp dword [ebp + 0x14], 0x45db
jne 0x4037d5
cmp ebx, 0x89
jne 0x4037d5
call fcn.00402ac4
mov al, bl
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x43c8ba
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x443fb8
cmp edx, dword [eax]
je 0x43c8dc
add eax, 8
inc ecx
cmp eax, 0x444048
jl 0x43c8cd
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x443fb8]
jne 0x43ca0a
mov eax, dword [0x444810]
cmp eax, 1
je 0x43c9e4
test eax, eax
jne 0x43c90d
cmp dword [0x443fb0], 1
je 0x43c9e4
cmp edx, 0xfc
je 0x43ca0a
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x43c944
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0043e100
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0043ca50
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x43c987
lea eax, [ebp - 0x1a4]
push eax
call fcn.0043ca50
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x440998
push edi
call fcn.0043e1f0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0043e100
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0043e110
lea eax, [ebp - 0xa0]
push 0x440978
push eax
call fcn.0043e110
push dword [esi + 0x443fbc]
lea eax, [ebp - 0xa0]
push eax
call fcn.0043e110
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0043e076
add esp, 0x2c
pop edi
jmp 0x43ca0a
lea eax, [ebp + 8]
lea esi, [esi + 0x443fbc]
push 0
push eax
push dword [esi]
call fcn.0043ca50
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x10020a92
Capabilities:
Packed with generic packer

Disassembly:
pushal
call fcn.10020aa1
adc byte [ecx], cl
add al, byte [eax]
jmp 0x10020ca7
popal
jmp fcn.1000706a

Function at 0x10020d48
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x10020f2d
mov ah, ah
lea edx, [edx]
xchg ebx, ebx
jmp 0x10020f35
jmp 0x10020f3d
Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..00cfg
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x9d03698
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x1450728e
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x66aca690
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.66ad92d0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.66ad92d0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x66aca6f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x66be7054]
test esi, esi
jle 0x66aca810
mov eax, dword [0x66be7058]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x66aca724
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x66aca7a7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x66aca710
mov dword [esp], ebx
call fcn.66acaee0
mov edi, eax
test eax, eax
je 0x66aca837
mov eax, dword [0x66be7058]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.66acb020
mov edx, dword [0x66be7058]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x66aca817
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x66aca7a0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x66aca7b0
add dword [0x66be7054], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x66be7058]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x66aca7a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.66aca690
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x66aca72e
mov eax, dword [0x66be7058]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.66aca690
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.66aca690
lea esi, [esi]
nop
Function at 0x66acab50
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x66be7064
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x66be705c]
sub esp, 4
test ebx, ebx
je 0x66acaba5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x66acab9e
test esi, esi
je 0x66acab9e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x66acab80
mov dword [esp], 0x66be7064
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x66acaee0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x66ac0000], 0x5a4d
jne 0x66acaf05
mov ecx, dword [0x66ac003c]
cmp dword [ecx + 0x66ac0000], 0x4550
lea edx, [ecx + 0x66ac0000]
je 0x66acaf10
ret
cmp word [ecx + 0x66ac0018], 0x10b
jne 0x66acaf05
push esi
movzx eax, word [ecx + 0x66ac0014]
push ebx
movzx esi, word [ecx + 0x66ac0006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x66ac0000
test si, si
je 0x66acaf58
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x66acaf4e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x66acaf5a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x66acaf40
xor eax, eax
pop ebx
pop esi
ret

Function at 0x66ad0290
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0x1c
mov dword [0x66be70c0], 0xffffffff
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0xffff
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
sub esp, 0x10
mov dword [0x66be70c4], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x66ad0300
mov dword [esp + 4], 0x66ad01a0
mov dword [esp], eax
mov dword [0x66be70bc], eax
call fcn.66ad9b50
test eax, eax
jne 0x66b96d79
add esp, 0x1c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x66ad02ea
Function at 0x66adc3c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ecx, 0x1a
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x80]
mov esi, 0x66ba0df5
push ebx
sub esp, 0x9c
mov eax, dword [str.not_enough_space_for_format_expansion__Please_submit_full_bug_report_at_https:__gcc.gnu.org_bugs__:_n]
mov dword [ebp - 0x81], eax
mov eax, dword [0x66ba0e59]
mov dword [ebp - 0x1c], eax
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp + 8]
lea eax, [edx + 0x84]
and eax, 0xfffffff0
call fcn.66acb1c0
mov ecx, 0x1a
sub esp, eax
lea esi, [ebp - 0x81]
lea ebx, [esp + 0x1b]
and ebx, 0xfffffff0
mov edi, ebx
lea eax, [ebx + 0x68]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 8], edx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x8c], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x8c]
mov byte [ebx + edx + 0x68], 0
mov dword [esp], ebx
call fcn.66b95980
nop
nop
nop
nop
nop
nop
nop
push edi
push esi
push ebx
sub esp, 0x20
cmp byte [0x66b9e248], 0
jne 0x66adc4e6
mov byte [0x66b9e248], 1
call fcn.66b937f0
test eax, eax
je 0x66adc4b4
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
sete al
mov dword [esp + 4], 0
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call fcn.66aca340
mov dword [esp], 2
mov esi, dword [fcn.66ad92d0]
mov edi, eax
call esi
mov dword [esp + 8], 0x30
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
call sub.msvcrt.dll_fwrite
mov edx, dword [esp + 0x1c]
mov dword [esp], 2
test edx, edx
je 0x66adc4a4
call esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x66ba15f9
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x66b96164
jmp 0x66b9615c
call esi
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
jmp 0x66adc46a
mov dword [esp], 2
call dword [0x66b9d0a0]
mov dword [esp + 8], 0x2d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
call sub.msvcrt.dll_fwrite
jmp 0x66b96157
mov dword [esp], 2
call dword [0x66b9d0a0]
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x66ba15a8
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
call sub.msvcrt.dll_abort
mov dword [esp], edi
call fcn.66ad9a38
call fcn.66b93b20
call fcn.66b936e0
call fcn.66b93820
jmp 0x66b96157
Function at 0x409a26
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x496bb0
call fcn.00437c90
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x10]
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov byte [esi + 0xc], bl
call fcn.0042a78c
mov byte [esi + 0x24], bl
lea ecx, [esi + 0x34]
push 0x4bad10
mov dword [ebp - 4], ebx
mov byte [esi + 0x25], bl
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], bl
call fcn.00423f94
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0045eee1
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x421416
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 8], 0
push ebx
push edi
mov edi, ecx
mov dword [ebp - 8], edi
jne 0x42143b
xor ebx, ebx
push ebx
push ebx
push ebx
push 2
call fcn.00422c84
xor al, al
jmp 0x421512
push esi
call fcn.004207b0
lea ecx, [edi + 4]
call fcn.004201ba
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
xor ebx, ebx
push 2
push ebx
push dword [ebp + 8]
call esi
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push ebx
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], eax
call esi
mov eax, dword [ebp - 4]
add esp, 0x1c
test eax, eax
jg 0x42147d
push ebx
push ebx
push ebx
push 0xc
jmp 0x4214ad
inc eax
push eax
call dword [sym.imp.mfc140u.dll_operator_1]
push dword [ebp + 8]
mov esi, eax
push 1
push dword [ebp - 4]
push esi
mov byte [esi], bl
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x14
cmp eax, 1
je 0x4214b8
push esi
call dword [sym.imp.mfc140u.dll_operator]
pop ecx
push ebx
push ebx
push ebx
push 2
mov ecx, edi
call fcn.00422c84
xor al, al
jmp 0x421511
mov edx, dword [ebp - 4]
mov eax, esi
mov ecx, esi
mov byte [esi + edx], bl
mov dl, byte [esi]
test dl, dl
je 0x4214f2
mov dword [ebp - 4], eax
lea edi, [ecx + 1]
inc eax
mov dword [ebp + 8], edi
cmp dl, 0xd
jne 0x4214e4
mov byte [ecx], 0xa
cmp byte [eax], 0xa
cmovne eax, dword [ebp - 4]
inc eax
jmp 0x4214e6
mov byte [ecx], dl
mov dl, byte [eax]
mov ecx, dword [ebp + 8]
test dl, dl
jne 0x4214c8
mov edi, dword [ebp - 8]
push dword [ebp + 0xc]
mov byte [ecx], bl
mov ecx, edi
mov eax, dword [edi]
push ebx
push esi
call dword [eax + 8]
push esi
call dword [sym.imp.mfc140u.dll_operator]
pop ecx
mov ecx, edi
call fcn.004204fb
xor al, 1
pop esi
pop edi
pop ebx
leave
ret 8

Function at 0x426017
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, ecx
sub esp, 0xc
cmp byte [edx + 4], 0
je 0x42604e
push esi
xor esi, esi
cmp dword [edx + 0x3cc], esi
jle 0x426049
mov ecx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
sub edi, ecx
mov al, byte [edi + ecx]
xor byte [ecx], al
inc ecx
inc esi
cmp esi, dword [edx + 0x3cc]
jl 0x426039
pop edi
pop esi
leave
ret 8
push dword [0x4f27c0]
lea ecx, [ebp - 0xc]
call fcn.00425f85
push 0x4dff50
lea eax, [ebp - 0xc]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3