joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7743cf9a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x7743cfe4
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x7743cf8b
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x7743cf9a
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x77842c3d
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x7743cfeb
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.77423e61
cmp eax, dword [ebp + 0xc]
pop eax
je 0x7743d08a
add edi, 4
add eax, 2
dec ecx
jne 0x7743cfd0
call 0x7743d037
loope 0x7743d02d
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x7743d087
mov dh, pe_nt_image_headers32
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x7743d098
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x7743d04b
cmp eax, ecx
ja 0x7743d04b
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x7743d0d5
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x7743d0cb
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.77424340
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x4014f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov edx, ecx
sub esp, 8
mov eax, dword [edx + 0x3c]
cmp dword [eax + edx + 0x7c], 0
jne 0x401508
xor eax, eax
mov esp, ebp
pop ebp
ret
mov eax, dword [eax + edx + 0x78]
test eax, eax
je 0x401502
mov ecx, dword [eax + edx + 0x24]
add ecx, edx
push ebx
mov ebx, dword [eax + edx + 0x20]
mov dword [ebp - 4], ecx
add ebx, edx
mov ecx, dword [eax + edx + 0x1c]
push esi
mov esi, dword [eax + edx + 0x18]
add ecx, edx
push edi
mov dword [ebp - 8], ecx
xor edi, edi
xor ecx, ecx
dec esi
mov eax, dword [ebx + ecx*4]
add eax, edx
cmp byte [eax], 0x47
jne 0x40158c
cmp byte [eax + 1], 0x65
jne 0x40158c
cmp byte [eax + 2], 0x74
jne 0x40158c
cmp byte [eax + 3], 0x50
jne 0x40158c
cmp byte [eax + 4], 0x72
jne 0x40158c
cmp byte [eax + 5], 0x6f
jne 0x40158c
cmp byte [eax + 6], 0x63
jne 0x40158c
cmp byte [eax + 7], 0x41
jne 0x40158c
cmp byte [eax + 8], 0x64
jne 0x40158c
cmp byte [eax + 9], 0x64
jne 0x40158c
cmp byte [eax + 0xa], 0x72
jne 0x40158c
cmp byte [eax + 0xb], 0x65
jne 0x40158c
cmp byte [eax + 0xc], 0x73
jne 0x40158c
cmp byte [eax + 0xd], 0x73
je 0x40159a
inc ecx
cmp ecx, esi
jbe 0x401534
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov edi, dword [ebp - 8]
movzx eax, word [eax + ecx*2]
mov edi, dword [edi + eax*4]
add edi, edx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402816
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsAlloc
push 0x40d210
push str.FlsAlloc
push 0
call fcn.00402796
mov esi, eax
add esp, 0x10
test esi, esi
je 0x402848
push dword [ebp + 8]
mov ecx, esi
call fcn.00401ed6
call esi
pop esi
pop ebp
ret
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x40288a
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsSetValue
push 0x40d240
push str.FlsSetValue
push 3
call fcn.00402796
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x4028be
mov ecx, esi
call fcn.00401ed6
call esi
jmp 0x4028c4
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop ebp
ret

Function at 0x4057ee
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004054ae
Function at 0x5e9f03
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ax, bp
dec edx
jg 0x5e9eed
bswap edx
jmp 0x5e9f3f

Function at 0x5e9fd3
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop ebx
jmp 0x5e9fd5
jmp 0x5e9fbd
mov ebx, dword [esp]
mov bl, 0x91
sub edx, eax
jo 0x5ea011
jno 0x5e9ff7
mov byte [ebx], bl
mov ebp, esi
sbb eax, 0x127cdead
jne 0x5e9f6f
add ecx, ecx
push 0x121c8d8b
rol ebx, 0x18
mov bx, word [esp]
mov ebx, eax
bswap ebx
jmp 0x5ea185
mov ebx, esi

Function at 0x5ea263
Capabilities:
Execute anti-debugging instructions

Disassembly:
setnp dl
mov ah, byte [esp]
mov ebp, 0xd1a51d52
xchg dword [esp], ebx
Function at 0x6d65ac
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ebx, reloc.WINMM.dll_midiStreamOut
jmp 0x6d65d6
mov dx, word [esp + 0x13]
mov word [esp + 1], bx
xchg dword [esp + 0x10], eax
not edx
mov dx, bx
mov bx, 0xce03
jmp 0x6d6624
not eax
push dword [esp + 0x1e]
lea esp, [esp + 0x43]
mov ax, sp
jmp 0x6d6640
pushal
sbb dx, 0x56
setp bh
not bx
push ebp
mov dx, word [esp + 0x17]
jmp 0x6d660e
mov ax, word [esp]
mov bh, 0x11
not bx
mov bx, 0x6312
lea ebx, [ebp*4]
mov dx, bx
jmp 0x6d669b
rdtsc
mov edx, 0x70535c13
mov al, bh
cld
lea edx, [eax + edx]
bsf eax, ecx
jmp 0x6d66c6
mov dl, 0x85
clc
lea edx, [edi*4]
lea edx, reloc.WINMM.dll_midiStreamOut
cld
not bh
jmp 0x6d6685
add esp, 0x13
add dx, dx
rdtsc
add esp, 9
xchg dx, bx
jmp 0x6d66db
rdtsc
pushal
mov eax, 0xb2d8069a
push dword [esp + 0x15]
not eax
mov dx, word [esp + 0x20]
jmp 0x6d66b0
push dword [esp + 6]
mov bh, byte [esp + 1]
add esp, 1
mov dx, word [esp + 3]
xchg bh, bl
jmp 0x6d6725
neg ebx
mov al, byte [esp + 4]
xchg byte [esp + 5], bl
neg edx
bsr bx, bx
jmp 0x6d6737
mov dx, 0x7d0d
mov dx, word [esp + 4]
xchg ebx, eax
xchg bx, dx
cmc
pop ebx
jmp 0x6d670f
stc
mov ah, 0x18
mov ebx, ecx
pop word [esp + 2]
pop edx
sub esp, 0xd
jmp 0x6d6b96
mov bx, bp
mov edx, dword [esp + 7]
pop eax
sub edx, 0xb150c4dd
jmp 0x6d6b0c
push dword [esp + 8]
pop dword [esp + 5]
xchg word [esp + 1], dx
neg al
xchg byte [esp + 9], al
lea edx, [ebx + ebx]
jmp 0x6d6765
push dword [esp]
xchg byte [esp + 0xb], bh
mov bx, word [esp + 5]
pop dx
xchg word [esp + 6], ax
mov dh, 0x28
jmp 0x6d677b
lea esp, [esp + 5]
call fcn.006d6916
mov dx, word [esp + 0xc]
mov ax, word [esp + 7]
bswap eax
sub esp, 9
jmp 0x6d6b5a
lea eax, reloc.WINMM.dll_midiStreamOut
cld
mov dword [esp + 4], ebp
jmp 0x6d6b6c
pop bx
push dword [esp + 9]
mov eax, dword [esp + 5]
neg ax
mov al, 0x48
pop eax
jmp 0x6d6b44
lea edx, [ebx*4]
mov ah, byte [esp + 0xb]
xchg bl, dh
xchg word [esp + 3], ax
add esp, 0x19
mov ax, 0xdf87
jmp 0x6d6f88
pop bx
pop word [esp + 5]
not edx
xchg byte [esp + 8], bl
seto dh
lea edx, [ebp*4]
jmp 0x6d679b
push word [esp + 0xc]
mov ax, word [esp + 0x19]
lea ebx, reloc.WINMM.dll_midiStreamOut
jmp 0x6d6bf3
xchg byte [esp + 0xe], bl
mov dx, cx
rcr bl, 2
mov al, 0x83
mov dl, al
mov eax, 0xab1740a
jmp 0x6d6bb2
add esp, 0
inc ah
dec eax
call fcn.006d6bdd
jmp dword [esi - 0xc]
mov bx, word [esp + 0x10]
pop word [esp + 5]
pop ax
pop eax
mov dx, bp
mov byte [esp + 2], dl
jmp 0x6d6bc8
mov bl, byte [esp + 0x1a]
not ax
xchg bx, ax
xchg bx, dx
lea ebx, [eax + eax]
add esp, 0
jmp 0x6d6c11
xchg ebx, eax
pop ebx
xchg dl, dh
xchg ebx, edx
lea edx, reloc.WINMM.dll_midiStreamOut
mov byte [esp + 0x14], cl
jmp 0x6d6cc4
dec dx
rdtsc
pushal
lea edx, [edi*4]
push word [esp + 0x10]
dec al
jmp 0x6d6d89
Function at 0x6d663b
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop ax
rdtsc
xor dh, ah
mov eax, dword [esp + 0x17]
xchg byte [esp + 0xc], dl
rdtsc
jmp 0x6d65c2
xchg edx, ebx
push word [esp + 4]
not edx
mov dx, bp
xchg dword [esp], edx
mov bh, 4
jmp 0x6d6559
rdtsc
mov ebx, 0xf0e60fbb
not eax
bswap ebx
sub edx, 0xd2d8c14f
mov dl, byte [esp + 0x1c]
jmp 0x6d656f
xchg edx, eax
pop eax
mov byte [esp + 0x16], cl
pop dword [esp + 0xd]
xchg word [esp + 0x10], bx
call fcn.006d65ac
lea esp, [esp + 0xc]
mov dl, bl
bts edx, edi
bswap eax
pop word [esp + 0xb]
mov byte [esp + 0xb], bh
jmp 0x6d6595
xchg edx, eax
ror dh, cl
jmp 0x6d65f8

Function at 0x6d6839
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap eax
lea eax, [ebx - 0x8b]
rcl al, cl
mov bx, di
rcl dl, cl
jmp 0x6d6810
not dx
rdtsc
mov byte [esp], bh
bt ax, bx
setge bh
mov dx, si
jmp 0x6d67b2
inc dx
push word [esp + 8]
mov edx, ebp
pushfd
mov dword [esp + 1], eax
add esp, 0xe
jmp 0x6d67c8
setnp dl
mov ah, 0x66
pop dx
sub esp, 0xa
mov word [esp + 7], di
jmp 0x6d681f
mov edx, dword [esp]
cld
rdtsc
rdtsc
mov ah, 0x1e
sub esp, 0xc
jmp 0x6d67fa
lea ebx, reloc.WINMM.dll_midiStreamOut
pop bx
lea esp, [esp + 0xc]
lea ebx, [ecx + edi]
xchg ebx, eax
mov ax, si
jmp 0x6d6896
mov byte [esp + 3], dl
push ax
pop dword [esp + 2]
jmp 0x6d67e7
and bx, bx
rdtsc
bswap edx
pop dx
sete al
mov edx, dword [esp]
jmp 0x6d686c
not bx
mov bx, word [esp]
sub esp, 2
xchg ah, dl
neg ebx
cld
jmp 0x6d6845
xchg bx, ax
clc
mov byte [esp], ch
rdtsc
bsr dx, bp
rdtsc
call fcn.006d68d4
xchg byte [esp + 3], dh
xchg word [esp + 2], dx
mov dh, 0xcc
dec al
clc
jmp 0x6d68bb
rol dx, cl
dec bl
add esp, 6
pushfd
rcr edx, 0x1f
pop eax
jmp 0x6d685b
or ebx, 0xae5bc96a
mov dx, word [esp + 1]
xchg dword [esp], edx
jmp 0x6d68ec
mov ax, 0xde8c
btc ebx, eax
push dword [esp]
mov edx, ecx
btr eax, ebp
jmp 0x6d68a5
lea ebx, [ecx*4]
lea ebx, [ebx*4]
jmp 0x6d6a9d
xchg dword [esp + 4], ebx
dec bx
pushal
push dword [esp + 0x21]
push dword [esp + 0x25]
mov byte [esp + 7], ch
jmp 0x6d68d6
rdtsc
mov al, byte [esp]
xchg edx, ebx
call fcn.006d693a
lea esp, [esp + 0x51]
mov ebx, eax
bsf edx, esp
clc
mov dl, 0xba
mov eax, ecx
jmp 0x6d6956
mov dh, byte [esp + 0x2d]
mov ah, cl
xchg byte [esp + 0x17], al
push dword [esp + 0xc]
pop eax
pushal
jmp 0x6d6985
Function at 0x6da7ea
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov di, word [esp + 5]
jmp 0x6da7f5
rcl edx, 0x14
mov cx, 0xd8c1
xchg word [esp + 0xb], dx
jmp 0x6da833
setae bh
mov ax, word [esp + 1]
mov esi, 0x797943a5
mov byte [esp + 7], bl
jmp 0x6da860
lea edi, [ebp*4]
mov dx, sp
mov esi, dword [esp + 6]
pop si
mov dword [esp], edx
mov dl, 0xba
jmp 0x6da81c
sub esp, 0x13
xchg ecx, eax
mov bp, di
lea edx, [esi + ebp]
push dword [esp + 8]
not ecx
jmp 0x6da87d
pop word [esp + 4]
lea esp, [esp + 9]
rdtsc
lea eax, [ecx*4]
mov edx, 0xbd15a0cf
mov cl, byte [esp + 1]
jmp 0x6da84a
not dx
cld
sub esp, 0xa
xchg ah, al
mov bp, word [esp + 0x10]
mov cl, byte [esp + 0x1b]
jmp 0x6da993
cpuid
bts di, bx
mov dh, dl
rdtsc
lea esi, reloc.WINMM.dll_midiStreamOut
call fcn.006da901
xchg ecx, eax
adc byte [ebx - 0x61425af6], dl
mov dword [reloc.WINMM.dll_midiStreamOut], eax
and al, 0xb
mov ebp, 0xccc0a39e
push dword [esp + 0xb]
rcl bp, cl
lea esp, [esp + 2]
neg ax
bswap edi
jmp 0x6da8ba
bsf cx, di
add esp, 8
pop eax
mov ch, 0x76
setae dl
setle dl
jmp 0x6da8d4
rdtsc
mov dh, byte [esp + 0x1a]
xchg dx, ax
neg eax
neg di
lea esi, [esp + ebp]
jmp 0x6da93e
Function at 0x6daabe
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg esi, ebx
mov cl, dl
lea esp, [esp + 1]
jmp 0x6daaf8
mov al, byte [esp + 1]
cpuid
ror dh, 3
lea esi, [ebp*4]
pushal
xchg dword [esp + 0xa], eax
jmp 0x6daae2

Function at 0x6db21c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dh, ah
sub bp, ax
rdtsc
add esp, 7
lea ecx, [eax + 0x39]
jmp 0x6db220
bswap ebp
jmp 0x6db206
pop word [esp]
mov ecx, 0x1592f291
cld
inc cl
sub esp, 0x14
jmp 0x6db25f
add esp, 8
mov dl, bl
clc
mov ebx, 0x66c678a8
pop edi
clc
jmp 0x6db249

Function at 0x6db276
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg esi, eax
pop edx
bt eax, edi
cpuid
rol ecx, 0x15
ror di, cl
jmp 0x6db19c
mov esi, 0x27c63896
xchg dword [esp], ebx
rol ebp, cl
rdtsc
inc cl
mov di, si
jmp 0x6db157
mov edx, dword [esp]
call fcn.006db1ad
cmp dword [edi + reloc.WINMM.dll_midiStreamOut], esi
sub ch, byte [ebp + esi + 0x7f]
pop ebp
push 0x45
hlt
mov ch, byte [esp]
mov bh, ah
bswap ebp
bt edi, ebx
bt esi, esp
bswap esi
jmp 0x6db186
lea esp, [esp + 5]
dec bl
neg bl
mov dl, 0x2a
rdtsc
add esp, 1
jmp 0x6db173
pop word [esp + 1]
xchg ebp, edx
jmp 0x6db1c8

Function at 0x6db72d
Capabilities:
Check for peb beingdebugged flag
Packed with generic packer

Disassembly:
call fcn.006db02d
lea esp, [esp + 1]
push word [esp + 1]
mov dword [esp], esp
lea esp, [esp + 3]
jmp 0x6db7ce
mov eax, dword [eax + 8]
push eax
jmp 0x6db028
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0x6db773
lea esp, [esp + 2]
mov dword [esp + 0x28], edi
lea esp, [esp + 0x28]
mov eax, dword fs:[0x30]
jmp 0x6db791
Function at 0x105b5058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.105b51a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x105b507e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105b506a
add dl, dl
jne 0x105b5089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105b50dc
xor eax, eax
add dl, dl
jne 0x105b5096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105b517d
add dl, dl
jne 0x105b50a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105b50b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105b50bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105b50c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x105b50d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x105b5075
mov eax, 1
add dl, dl
jne 0x105b50ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105b50f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x105b50e1
sub eax, ebx
mov ebx, 1
jne 0x105b5128
mov ecx, 1
add dl, dl
jne 0x105b510e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x105b5119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x105b5105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x105b5075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x105b513f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x105b514a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x105b5136
cmp eax, 0x7d00
jae 0x105b516d
cmp eax, 0x500
jb 0x105b5168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x105b5075
cmp eax, 0x7f
ja 0x105b5170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x105b5075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x105b519e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x105b5075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x69a564d2
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6a616008]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x6a616008]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
jmp 0x69a565b7
jmp 0x69a5667c
jmp 0x69a56741
jmp 0x69a56806
jmp 0x69a568cb
jmp 0x69a56990
jmp 0x69a56a55
jmp 0x69a56b1a
jmp 0x69a56bdf
jmp 0x69a56ca4
jmp 0x69a56d69
jmp 0x69a56e2e
jmp 0x69a56ef3
jmp 0x69a56fb8
jmp 0x69a5707d
jmp 0x69a57142
jmp 0x69a57207
jmp 0x69a572cc
jmp 0x69a57391
jmp 0x69a57456
jmp 0x69a5751b
jmp 0x69a575e0
jmp 0x69a576a5
jmp 0x69a5776a
jmp 0x69a5782f
jmp 0x69a578f4
jmp 0x69a579b9
jmp 0x69a57a7e
jmp 0x69a57b43
mov dword [ebp - 0x14], 0
jmp 0x69a57c0f
jmp 0x69a57cd4
jmp 0x69a57d99
jmp 0x69a57e5e
jmp 0x69a57f23
jmp 0x69a57fe8
jmp 0x69a580ad
jmp 0x69a58172
jmp 0x69a58237
jmp 0x69a582fc
jmp 0x69a583c1
jmp 0x69a58486
jmp 0x69a5854b
jmp 0x69a58610
jmp 0x69a586d5
jmp 0x69a5879a
jmp 0x69a5885f
jmp 0x69a58924
jmp 0x69a589e9
jmp 0x69a58aae
jmp 0x69a58b73
jmp 0x69a58c38
jmp 0x69a58cfd
jmp 0x69a58dc2
jmp 0x69a58e87
jmp 0x69a58f4c
jmp 0x69a59011
jmp 0x69a590d6
jmp 0x69a5919b
mov dword [ebp - 0x18], 0
jmp 0x69a59267
jmp 0x69a5932c
jmp 0x69a593f1
jmp 0x69a594b6
jmp 0x69a5957b
jmp 0x69a59640
jmp 0x69a59705
jmp 0x69a597ca
jmp 0x69a5988f
jmp 0x69a59954
jmp 0x69a59a19
jmp 0x69a59ade
jmp 0x69a59ba3
jmp 0x69a59c68
jmp 0x69a59d2d
jmp 0x69a59df2
jmp 0x69a59eb7
jmp 0x69a59f7c
jmp 0x69a5a041
jmp 0x69a5a106
jmp 0x69a5a1cb
jmp 0x69a5a290
jmp 0x69a5a355
jmp 0x69a5a41a
jmp 0x69a5a4df
jmp 0x69a5a5a4
jmp 0x69a5a669
jmp 0x69a5a72e
jmp 0x69a5a7f3
mov dword [ebp - 0x10], 0
jmp 0x69a5a8bf
jmp 0x69a5a984
jmp 0x69a5aa49
jmp 0x69a5ab0e
jmp 0x69a5abd3
jmp 0x69a5ac98
jmp 0x69a5ad5d
jmp 0x69a5ae22
jmp 0x69a5aee7
jmp 0x69a5afac
jmp 0x69a5b071
jmp 0x69a5b136
jmp 0x69a5b1fb
jmp 0x69a5b2c0
jmp 0x69a5b385
jmp 0x69a5b44a
jmp 0x69a5b50f
jmp 0x69a5b5d4
jmp 0x69a5b699
jmp 0x69a5b75e
jmp 0x69a5b823
jmp 0x69a5b8e8
jmp 0x69a5b9ad
jmp 0x69a5ba72
jmp 0x69a5bb37
jmp 0x69a5bbfc
jmp 0x69a5bcc1
jmp 0x69a5bd86
jmp 0x69a5be4b
mov dword [ebp - 0x10], 0
jmp 0x69a62e32
jmp 0x69a5bf1c
jmp 0x69a5bfe1
jmp 0x69a5c0a6
jmp 0x69a5c16b
jmp 0x69a5c230
jmp 0x69a5c2f5
jmp 0x69a5c3ba
jmp 0x69a5c47f
jmp 0x69a5c544
jmp 0x69a5c609
jmp fcn.69a5c6ce
mov eax, dword [0x6a616008]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x10]
ja 0x69a5be57
nop
leave
ret

Function at 0x69aa2180
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], 0x6a615040
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.69aa21e0
Function at 0x69aa21e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x6a616378]
test esi, esi
jle 0x69aa22cd
mov edi, dword [0x6a61637c]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x69aa2214
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x69aa22c6
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x69aa2200
mov dword [esp], eax
mov esi, eax
call fcn.69aa2980
test eax, eax
mov edi, eax
je 0x69aa230a
mov esi, dword [0x6a61637c]
lea ebx, [ebx + ebx*2]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call fcn.69aa2a90
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x6a61637c]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x69aa22ea
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x69aa22bf
sub eax, 0x40
and eax, 0xffffffbf
je 0x69aa22bf
mov eax, dword [esp + 0x20]
add ebx, dword [0x6a61637c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x69aa22d4
add dword [0x6a616378], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor ebx, ebx
jmp 0x69aa221e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.69aa2180
mov eax, dword [0x6a61637c]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.69aa2180
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.69aa2180
lea esi, [esi]

Function at 0x69aa25f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x6a616388
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x6a616380]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x69aa2645
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x69aa263e
test esi, esi
je 0x69aa263e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x69aa2620
mov dword [esp], 0x6a616388
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x452e27
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x452e27
lcall 0x5de5, 0x8b10c483
jmp loc.03455c64
Function at 0x10036b3
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov eax, dword [0x100d344]
xor ebx, ebx
cmp eax, ebx
je 0x100372d
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp + 8]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10036e1
push ebx
lea ecx, [ebp - 4]
push ecx
sub eax, esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
push dword [ebp + 8]
push dword [0x100d344]
call esi
test eax, eax
je 0x1003730
mov ecx, 0x1002370
mov eax, ecx
push edi
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x1003710
push ebx
lea edx, [ebp - 4]
push edx
sub eax, edi
push eax
push ecx
push dword [0x100d344]
call esi
test eax, eax
pop edi
je 0x1003730
xor ebx, ebx
inc ebx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
mov eax, ebx
pop ebx
leave
ret 4

Function at 0x1003af8
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x1003b33
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x1003b1a
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x1003b2b
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x1003b35
inc edi
add eax, 0x28
cmp edi, esi
jb 0x1003b10
xor eax, eax
pop edi
pop esi
ret

Function at 0x1003e9a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and dh, al
inc ebp
sahf
sub eax, 0x119f45c6
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.01003ac8
call dword [eax + 0x56]