joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1022fc79
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x10]
jmp fcn.101b99a1
loopne 0x101bb3f8
xchg edx, eax
popfd
mov bl, 0x10
push edi
outsd dx, dword [esi]
xchg esp, eax
add ecx, dword [ebp - 0x4702eec2]
outsd dx, dword [esi]
push ebx
cmpxchg esi, eax
xchg edi, eax
push ebx
movsb byte es:[edi], byte [esi]
push ebx
popal
add dword [esi], 0x69
in eax, dx
inc ecx
shl dword [esi], 1
out 0x78, al
popal
outsb dx, byte [esi]
mov esp, 0xb3691002
das
test dword [ebx - 0x31], eax
mov esp, 0xbe82e91d
insd dword es:[edi], dx
shr dword [edx + 0x759cc6df], cl
add cl, byte [0x57b417ca]
fsubr dword [eax - 0xaf3febc]
out 0x5a, eax
rol esp, cl
pop ds
mov al, 0xa9
xchg ecx, eax
test eax, 0x6d7d4f91
inc ebx
sar al, 1
out dx, al
cdq
add byte [esi + ebp - 0xf747670], bl
js 0x101bb3a8
dec eax
pop ecx
jg 0x101bb406
mov byte [edx], al
cwde
loope 0x101bb392
rol bx, 1
dec eax
neg dword [esp]
inc dword [esp + 4]
add bh, bh
inc esp
and al, 4
dec bx
rol bx, 1
inc word [esp + 6]
push 0x1faab583
call fcn.101ded0d
xor al, 0xa7
sar ch, cl
loope 0x101bb3c7
adc esi, dword [ebx + 0x19]
inc esp
imul eax, dword [edi + 0x12adfb96], 0xd
sbb ebx, dword [edi + 0x4e]
xor ebx, dword [eax + edi*8]
jmp 0x992f8ef8
xor bx, di
jmp 0x101bb3ff
mov dword [esp], 0xc29ab286
not di
not dword [esp + 3]
not ax
dec word [esp + 1]
jp 0x102372a9
dec ecx
mov edx, dword [edi]
mov ebx, 0x921446b5
dec ecx
add edi, 8
dec ecx
sub ecx, 2
btr ebx, ebx
dec eax
imul ebx, ebx
dec eax
not ebx
inc ecx
movzx ebx, word [ecx]
push 0x2e98441e
jno 0x101fe10c
and di, ax
push 0x6275035
push 0xf32dba8
mov word [ebp], di
mov dword [esp + 8], 0xe8b0291e
jmp 0x101b5b65

Function at 0x1022fcc6
Capabilities:
Encode data using base64

Disassembly:
adc edi, 8
mov dword ss:[edx], ecx
jmp 0x1016cd19
jmp 0x1019cf74
jmp 0x10229e3c
lea esp, [esp + 4]
jmp fcn.101e22c9
jl 0x101676a0

Function at 0x102307ef
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x10]
jmp fcn.101e22c9

Function at 0x102307f8
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x14]
jmp fcn.101e22c9

Function at 0x10231391
Capabilities:
Encode data using base64

Disassembly:
mov word [ebp], di
jmp 0x101d4dff
push 0xcea9be89
lea esp, [esp + 8]
jmp fcn.10188d08
sub ebp, 2
jmp 0x10194f2a

Function at 0x10231b50
Capabilities:
Encode data using base64

Disassembly:
not dword [esp + 4]
lea esp, [esp + 8]
jmp fcn.101e22c9
mov dword [esp + 4], 0x1b09b42d
mov dword [edi], ebp
jmp 0x101fdc14
Function at 0x10231b77
Capabilities:
Encode data using base64

Disassembly:
jp 0x101e4b20
call fcn.101aba77
sahf
int1
ror dword [edx + 0x22], 1
mov edi, dword [edx]
into
lodsd eax, dword [esi]
jge 0x101a72c6
aaa
or cl, byte [ebx + esi - 0x612caa5c]
int1
rcl dword [esi + 0x174500a1]
or eax, 0x4afc73b9
xor eax, esp
mov eax, dword [0xad6a1408]
ret 0xcb17
ja 0x1022ccc1
add byte [eax], al
insd dword es:[edi], dx
insd dword es:[edi], dx
insd dword es:[edi], dx
outsd dx, dword [esi]
jbe 0x101a7314
add al, dl
loopne 0x101a7245
retf 0x24b5
wait
inc esi
int3
xchg ecx, eax
mov al, 0x3a
mov dh, 0x8b
push edx
add byte [ecx], ch
adc dword [esp + edi*8], ecx
cmp eax, dword [edi + 0x60]
sbb bl, ah
ja 0x101a7381
inc byte [ecx + eax*4 + 0x54c94f53]
jo 0x101a7396
loop 0x101a73ad
imul bl
invalid
scasd eax, dword es:[edi]
ja 0x101a734c
mov es, word [edx - 0x1d54ff1c]
mov al, 0x17
mov dword [ebx - 0xe], eax
cdq
test dword [ebx], edx
insb byte es:[edi], dx
ja 0x101a734c
imul dword [eax + 0x5cd0378a]
dec ebp
cmp bl, byte [edi]
movsb byte es:[edi], byte [esi]
cmp eax, 0x30374ab7
xchg esp, eax
mov dl, 0x8e
pop esi
popal
mov fs, word [edi]
fisub dword [edx + 0x4c56ea98]
invalid
imul edx, dword [esi], 0x5f
or ah, byte [ebx + 0x42]
or esp, edi
sub eax, 0x1e4d7dcc
jae 0x101a734f
sub dh, dl
pop eax
and eax, 0x17bbc53a
cli
int 0x73
mov ebx, 0x73cdfa17
add eax, 0x735649e9
push 0xffffffffffffffe6
div ecx
int1
and byte [edx], 0x3a
xor eax, 0xe3db8224
cmp ch, byte [edi + 0x55]
dec ecx
into
mov ah, 0x87
sti
test al, dh
push edx
dec esi
leave
mov bl, 0x85
clc
mov ebx, eax
add al, 0x87
int 0xa4
fsub dword [eax - 0x2d27f20e]
imul esi, eax, 0x40f4877a
jne 0x101a73a3
cmp al, 0xf0
pop esi
xchg ecx, eax
xchg byte [ebx], al
popfd
pop ss
or bl, byte [ecx - 0x50d30dce]
lodsd eax, dword [esi]
invalid
add ebp, 2
mov word [ebp], cx
jmp fcn.101b99a1
dec eax
lea esp, [esp + 0x80]
jnp fcn.101b835a
mov ecx, 0x8eb2998d
movzx eax, cx
inc cl
mov eax, dword [ebp + eax*2 - 0x1331a]
mov cx, word [eax]
jl 0x1018dc8e
push eax
ret
xor cl, ch
add eax, 0x450000c4
inc ebp
mov dword [esi], ebx
push 0x638fe36
jae 0x101a72a0
scasd eax, dword es:[edi]
lodsd eax, dword [esi]
out dx, al
lds edi, [edx - 0x1041ee55]
in al, dx
stosd dword es:[edi], eax
test al, 0x14
sub esi, 0x15b7aeef
pushfd
div dword [esi + 0x68]
loopne 0x10231b73
push 0xa394d5e0
sub eax, 0x75c27294
retf
xchg esp, eax
mov dword [0xc272942d], eax
jne 0x10231b71
or al, bh
fimul word [edx + 0x31fe80d2]
mov dword [0x69dfdaf0], eax
jno 0x10231b78
inc esi
mov eax, dword [esi - 0x18a3aaec]
sub dword [esi], 0xc8bedd3a
ja 0x10231b9b
mov dh, 0xc
xchg byte [ebx + 0x71c5fbe0], dh
test byte [ecx], 0xc8
inc ecx
iretd
Function at 0x10232590
Capabilities:
Encode data using base64

Disassembly:
jnp 0x101aa7df
and dword [esp], 0x9da22a8d
or cx, bp
push 0xa9a51f9c
mov word [edi], cx
push 0x7413581a
push 0x1a362217
push 0x3b309e16
lea esp, [esp + 0x14]
jmp fcn.101e22c9
add byte [ecx - 0x7f], cl
jmp 0x101aa796
movzx eax, byte [ecx]
inc ecx
mov esi, 0xd6b54489
inc eax
xor al, bh
inc ecx
push esi
dec edi
lea esi, [esi + esi*2 + 0x312eef90]
dec esp
imul esi, dword [esp]
dec al
rol byte [esp + 2], 0xc6
inc cx
not esi
dec ecx
dec esi
rol al, 1
dec eax
ror dword [esp], 0x32
inc al
jmp 0x101c653f
inc dword [esp]
call fcn.101b6d83
push eax
jl 0x101aa828
sub al, 0x96
andps xmm5, xmmword [edi + 0x20]
sub ebp, dword [edi + 0x1544752a]
xor byte [esi + 0x85b640f], al
mov edi, 0x5fd72291
cmpsd dword [esi], dword es:[edi]
jno 0x101aa78d
xor bl, byte [ecx - 0x5e]
int 0xa5
or eax, 0xa0eab7b6
arpl dx, cx
sbb al, 4
aas
or dword [eax + edx], edi
xor ebp, dword [0x1d2f1802]
adc byte [edi + edi], dh
sbb dword [eax], ebx
cmp dl, ah
ficomp word [ebp - 0x358c180]
cmpsd dword [esi], dword es:[edi]
cld
fst dword [ecx + esi*4 - 0x152a69f9]
mov ecx, 0xcca72e9e
jmp 0x101aa7c8
inc ecx
pop esi
xor al, 0xaa
inc eax
xor bh, al
dec eax
add eax, esp
inc bp
sub esi, esi
inc cx
ror esi, 0xed
inc ecx
push esi
inc esp
mov esi, dword [eax]
dec eax
neg dword [esp]
push 0x83147727
dec ecx
sbb edi, 3
inc ebp
mov dword [edi], esi
dec eax
lea esp, [esp + 0x10]
jmp fcn.1023df7c
adc edi, 1
mov dword [esp], 0xd184d18b
sal byte [esp], 0xe6
not cx
not bp
js 0x101780e0
push ecx
push edi
sub cl, byte [0x545730bd]
adc ecx, dword [eax]
mov esp, 0x16555a37
or dword [ecx + 0xb5a6b34], esi
mov al, 0x9a
cld
pop esi
invalid

Function at 0x102344e1
Capabilities:
Encode data using base64

Disassembly:
mov dword [edi], eax
push 0x8c011f9a
lea esp, [esp + 8]
jmp fcn.101e22c9

Function at 0x10234a98
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
push 0xc2b79230
dec ebp
mov edi, dword [edi]
dec eax
lea esp, [esp + 8]
jmp fcn.1023df7c
jno 0x101720f2
jmp 0x101cee19

Function at 0x1023530a
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x14]
jmp fcn.101e22c9

Function at 0x10236f4b
Capabilities:
Encode data using base64

Disassembly:
jmp 0x10195ffe
push 0x22179028
dec ecx
not esi
dec ecx
not eax
push 0x4f1dea04
dec eax
ror dword [esp + 0xc], 0x35
dec ebp
and esi, eax
dec ebp
mov dword [edi], esi
push 0x9b81e7b2
call fcn.10234ebc
mov ebp, 0xe18a03b9
fimul word [ebp - 0x36ee556]
invalid
call fcn.10173166
push 0xb9097339
dec ecx
add edi, 8
jmp 0x1018a0fa
jb 0x1020ba0b
adc edi, 4
call fcn.101b0ef6
jmp 0x101f5722

Function at 0x10236f61
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + 8], 0xa2855f10
shl dword [esp + 0xc], 0x45
xor al, 0xa2
and dword [esp + 0xb], 0x236c133
xor bl, al
call fcn.101d9d3c
cmc
cmp eax, esp
push 0x3b147f0a
dec al
jmp 0x10201a94

Function at 0x10239314
Capabilities:
Encode data using base64

Disassembly:
mov ebp, dword [ebp]
lea esp, [esp + 4]
jmp fcn.10188d08

Function at 0x1023b1a2
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp + 8], 0x2185dd01
inc bl
ror bl, 1
jmp 0x102010e1
Function at 0x1023b778
Capabilities:
Encode data using base64

Disassembly:
mov word [edi], ax
push 0xb083f39e
lea esp, [esp + 8]
jmp fcn.101e22c9

Function at 0x1023badc
Capabilities:
Encode data using base64

Disassembly:
mov word [edi], cx
push 0xd33cf9a8
mov dword [esp + 8], 0xc8a13b0
lea esp, [esp + 0xc]
jmp fcn.101e22c9

Function at 0x1023c5a3
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
mov word [ecx], di
push 0xdbb3fc22
lea esp, [esp + 0x28]
jae fcn.101b99a1
lea esp, [esp + 8]
jmp fcn.101e22c9
jmp fcn.101b99a1
mov cl, 0x81
in eax, dx
add al, byte [eax]
add byte [eax], al
call fcn.101e8651
push 0x1c9bdb35
jne 0x101a820f
mov bl, 0x70
jne 0x1023c57b
out 0x6b, eax
jp 0x1023c62e
pop eax
pushfd
lea ecx, [eax]
daa
imul edi, dword [edx + 0x1f], 0x49
pop ecx
pushal
sub byte [eax - 6], bl
nop
inc esp
push ebp
fdiv st(7)
loop 0x1023c584
cwde
lodsb al, byte [esi]
mov ebp, 0x9332b28
xor ecx, dword [ecx]
mov byte [0x8dccc717], al
inc ecx
inc eax
dec edi
insd dword es:[edi], dx
push 0xffffffffffffffb4
out dx, eax
sbb eax, 0x2931752a
push edx
mov dword [ebx - 0xa], edx
jecxz 0x1023c5d2
lahf
xor eax, 0xa91cdcf0
add ah, cl
int1
inc edx
fstp st(0)
xor eax, 0x5646c714
pop ebx
das
jno 0x1023c5d2
pop edx
pop eax
hlt
jb 0x1023c680
mov byte [0xf97004bc], al
jo 0x1023c629
retf
les eax, [edx + 0x1f]
dec edx
cmp eax, 0xbc1ed1fe
mov eax, 0x5cf53bb3
nop
or dl, 0x4e
retf

Function at 0x1023daa3
Capabilities:
Encode data using base64

Disassembly:
ror word [esp + 4], 0xa1
push 0xa319fd80
or cx, di
not cx
mov word [ebp], cx
call fcn.101c8357

Function at 0x1023dabe
Capabilities:
Encode data using base64

Disassembly:
dec ecx
sub edi, 8
call fcn.1017812b
jmp fcn.101b835a
lea esp, [esp + 0x20]
jns fcn.101e22c9
inc ecx
mov esi, 0x2033e61e
dec ebp
mov esi, edi
jmp 0x101aec43

Function at 0x1023f5ee
Capabilities:
Encode data using base64

Disassembly:
adc edi, 0xf7a73513
dec cl
shl edi, 0xa8
mov dword [esp + edi - 0x53453400], 0x70a9ad2b
ror dword [esp + edi - 0x53453400], 0xac
xor bl, cl
xor byte [esp + edi - 0x534533ff], 0x1a
xor edi, edi
mov word [esp + edi + 2], 0xe902
lea ecx, [esp + ecx + 4]
sar edi, 0xcd
lea edi, [edi + 0x4d87dd20]
shl word [esp + edi - 0x4d87dd1f], 0xa2
movzx di, byte [edi + ecx - 0x4d87dd20]
sbb ebp, 2
call fcn.101dfa5c

Function at 0x1023f649
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x14]
jmp fcn.101e22c9

Function at 0x10240403
Capabilities:
Encode data using base64

Disassembly:
div edi
push 0x332aee0a
mov dword [ebp], edx
call fcn.10208e37
jmp 0x10224bf1
Function at 0xf80370
Capabilities:
Decompress data using aplib

Disassembly:
call 0xf804c0
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xf80396
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xf80382
add dl, dl
jne 0xf803a1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xf803f4
xor eax, eax
add dl, dl
jne 0xf803ae
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xf80495
add dl, dl
jne 0xf803bd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf803c8
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf803d3
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf803de
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xf803ea
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xf8038d
mov eax, 1
add dl, dl
jne 0xf80402
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf8040d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xf803f9
sub eax, ebx
mov ebx, 1
jne 0xf80440
mov ecx, 1
add dl, dl
jne 0xf80426
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xf80431
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xf8041d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xf8038d
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xf80457
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xf80462
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xf8044e
cmp eax, 0x7d00
jae 0xf80485
cmp eax, 0x500
jb 0xf80480
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xf8038d
cmp eax, 0x7f
ja 0xf80488
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xf8038d
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xf804b6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xf8038d
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x41fe60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x13000]
push edi
jmp 0x41fe7a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41fe81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41fe70
mov eax, 1
add ebx, ebx
jne 0x41fe93
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41fe88
jne 0x41fea4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41fe88
xor ecx, ecx
sub eax, 3
jb 0x41feb8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41ff2a
mov ebp, eax
add ebx, ebx
jne 0x41fec3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41fed0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41fef4
inc ecx
add ebx, ebx
jne 0x41fee0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41fed5
jne 0x41fef1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41fed5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41ff14
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41ff05
jmp 0x41fe76
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41ff14
add edi, ecx
jmp 0x41fe76
pop esi
mov edi, esi
mov ecx, 0x91a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41ff32
cmp byte [edi], 9
jne 0x41ff32
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41ff37
lea edi, [esi + 0x1d000]
mov eax, dword [edi]
or eax, eax
je 0x41ffaf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x20e10]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x20ed8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41ff64
mov ecx, edi
jns 0x41ff93
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x20edc]
or eax, eax
je 0x41ffa9
mov dword [ebx], eax
add ebx, 4
jmp 0x41ff81
call dword [esi + 0x20eec]
mov ebp, dword [esi + 0x20ee0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x17f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41ffe3
sub esp, 0xffffff80
jmp 0x41382f
Function at 0x6298a570
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.6299ab80
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.6299ab80
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x6298a5d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x62aae054]
test esi, esi
jle 0x6298a6f0
mov eax, dword [0x62aae058]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x6298a604
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x6298a687
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x6298a5f0
mov dword [esp], ebx
call fcn.6298ad30
mov edi, eax
test eax, eax
je 0x6298a717
mov eax, dword [0x62aae058]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.6298ae70
mov edx, dword [0x62aae058]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x6298a6f7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x6298a680
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x6298a690
add dword [0x62aae054], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x62aae058]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x6298a680
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.6298a570
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x6298a60e
mov eax, dword [0x62aae058]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.6298a570
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.6298a570
lea esi, [esi]
nop
Function at 0x6298a9b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x62aae064
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x62aae05c]
sub esp, 4
test ebx, ebx
je 0x6298aa05
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x6298a9fe
test esi, esi
je 0x6298a9fe
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6298a9e0
mov dword [esp], 0x62aae064
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6298ad30
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x62980000], 0x5a4d
jne 0x6298ad55
mov ecx, dword [0x6298003c]
cmp dword [ecx + 0x62980000], 0x4550
lea edx, [ecx + 0x62980000]
je 0x6298ad60
ret
cmp word [ecx + 0x62980018], 0x10b
jne 0x6298ad55
push esi
movzx eax, word [ecx + 0x62980014]
push ebx
movzx esi, word [ecx + 0x62980006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x62980000
test esi, esi
je 0x6298ada8
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x6298ad9e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x6298adaa
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x6298ad90
xor eax, eax
pop ebx
pop esi
ret

Function at 0x6298b320
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [0x62aae060]
test eax, eax
jne 0x6298aa30
ret
push ebx
sub esp, 0x18
mov dword [esp + 4], 0xc
mov dword [esp], 1
call sub.msvcrt.dll_calloc
mov ebx, eax
test eax, eax
je 0x6298aa90
mov eax, dword [esp + 0x20]
mov dword [esp], 0x62aae064
mov dword [ebx], eax
mov eax, dword [esp + 0x24]
mov dword [ebx + 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x62aae05c]
mov dword [0x62aae05c], ebx
sub esp, 4
mov dword [ebx + 8], eax
mov dword [esp], 0x62aae064
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
sub esp, 4
add esp, 0x18
pop ebx
ret
or eax, 0xffffffff
jmp 0x6298aa8b
push esi
push ebx
sub esp, 4
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x6298b350
mov dword [esi], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
add esp, 4
pop ebx
pop esi
jmp 0x6299ad80
add esp, 4
pop ebx
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esp + 8]
test eax, eax
jne 0x6299ad90
xor eax, eax
ret
jmp 0x6298aa20

Function at 0x6298b390
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret
Function at 0x6298b3d0
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x6298b3f8
xor eax, eax
add esp, 0x1c
ret
add esp, 0x1c
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x6299b0d0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub esp, 0x5c
mov eax, dword [esp + 0x60]
mov dword [esp + 0x1c], eax
mov eax, dword [0x62aae02c]
mov dword [esp + 0x4c], eax
xor eax, eax
mov dword [esp], 1
mov eax, dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
call eax
sub esp, 4
test eax, eax
sete al
test al, al
je 0x6299b138
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.629e9c00
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x2b]
mov dword [esp + 4], edx
mov dword [esp], 0x62a68432
mov ecx, eax
call fcn.62a26e20
sub esp, 8
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.629e9c30
jmp 0x6299b2a8
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_OpenClipboard]
call eax
sub esp, 4
test eax, eax
sete al
test al, al
je 0x6299b18a
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.629e9c00
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x2b]
mov dword [esp + 4], edx
mov dword [esp], 0x62a68432
mov ecx, eax
call fcn.62a26e20
sub esp, 8
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.629e9c30
jmp 0x6299b2a8
mov dword [esp], 1
mov eax, dword [sym.imp.USER32.dll_GetClipboardData]
call eax
sub esp, 4
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x2c], 0
jne 0x6299b1e5
mov eax, dword [sym.imp.USER32.dll_CloseClipboard]
call eax
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.629e9c00
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x2b]
mov dword [esp + 4], edx
mov dword [esp], 0x62a68432
mov ecx, eax
call fcn.62a26e20
sub esp, 8
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.629e9c30
jmp 0x6299b2a8
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GlobalLock]
call eax
sub esp, 4
mov dword [esp + 0x30], eax
cmp dword [esp + 0x30], 0
jne 0x6299b23d
mov eax, dword [sym.imp.USER32.dll_CloseClipboard]
call eax
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.629e9c00
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x2b]
mov dword [esp + 4], edx
mov dword [esp], 0x62a68432
mov ecx, eax
call fcn.62a26e20
sub esp, 8
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.629e9c30
jmp 0x6299b2a8
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.629e9c00
lea eax, [esp + 0x34]
lea edx, [esp + 0x2b]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x30]
mov dword [esp], edx
mov ecx, eax
call fcn.62a26e20
sub esp, 8
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.629e9c30
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call eax
sub esp, 4
mov eax, dword [sym.imp.USER32.dll_CloseClipboard]
call eax
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x34]
mov dword [esp], edx
mov ecx, eax
call fcn.62a26d50
sub esp, 4
lea eax, [esp + 0x34]
mov ecx, eax
call fcn.62a27940
mov eax, dword [esp + 0x4c]
sub eax, dword [0x62aae02c]
je 0x6299b2b9
call fcn.629815c0
mov eax, dword [esp + 0x1c]
add esp, 0x5c
ret