joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8c6a60
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
sub esp, 0x540
push ebx
lea eax, [esp + 0x33c]
push 0x104
xor bl, bl
push eax
push 0
mov byte [esp + 0x13], bl
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
push 0
push 0
lea ecx, [esp + 0x13c]
push 0x104
lea edx, [esp + 0x348]
push ecx
push edx
call fcn.00858009
add esp, 4
inc eax
push eax
lea eax, [esp + 0x350]
push eax
push 0
push 0
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
lea ecx, [esp + 0x134]
push 0x5c
push ecx
call fcn.008612da
add esp, 8
test eax, eax
je 0x8c6acf
mov byte [eax], bl
lea edx, [esp + 8]
push edx
push 3
push 0
push 0xa391f0
call fcn.008c94e0
add esp, 4
push eax
push reloc.dsound.dll_DirectSoundCreate
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x8c6c44
push ebp
mov edx, dword [esp + 0xc]
push eax
push eax
mov ebx, dword [sym.imp.advapi32.dll_RegEnumValueA]
push eax
push eax
lea eax, [esp + 0x20]
lea ecx, [esp + 0x44]
push eax
push ecx
push 0
push edx
mov dword [esp + 0x30], 0x104
mov ebp, 1
call ebx
cmp eax, 0x103
je 0x8c6c2c
push esi
push edi
test eax, eax
jne 0x8c6bfa
lea edi, [esp + 0x3c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x244]
mov eax, ecx
mov esi, edi
mov edi, edx
push 0x5c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x248]
push ecx
call fcn.008612da
add esp, 8
test eax, eax
je 0x8c6b78
mov byte [eax], 0
lea edx, [esp + 0x140]
lea eax, [esp + 0x244]
push edx
push eax
call fcn.0086118f
add esp, 8
test eax, eax
jne 0x8c6bfa
lea ecx, [esp + 0x18]
lea edx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x18]
push edx
push eax
push eax
lea eax, [esp + 0x4c]
push eax
push ecx
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x8c6bfa
mov eax, dword [0xaeaa28]
test eax, eax
je 0x8c6be1
lea edx, [esp + 0x1c]
push edx
push 0xa391d8
call fcn.008c94e0
add esp, 4
push eax
mov eax, dword [0xaeaa28]
add eax, 0x24
push eax
call fcn.008c3720
add esp, 0xc
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x3c]
push ecx
push edx
call dword [sym.imp.advapi32.dll_RegDeleteValueA]
test eax, eax
jne 0x8c6bfa
mov byte [esp + 0x13], 1
push 0
push 0
push 0
lea ecx, [esp + 0x24]
push 0
lea edx, [esp + 0x4c]
mov eax, ebp
push ecx
push edx
push eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x34], 0x104
push eax
inc ebp
call ebx
cmp eax, 0x103
jne 0x8c6b31
pop edi
pop esi
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov al, byte [esp + 0xb]
pop ebp
pop ebx
add esp, 0x540
ret
mov al, bl
pop ebx
add esp, 0x540
ret
Function at 0x8c6c50
Capabilities:
Set registry value

Disassembly:
push ecx
lea eax, [esp]
push ebx
push eax
push 0xf003f
push 0
push 0xa39250
xor bl, bl
call fcn.008c94e0
add esp, 4
push eax
push closesocket
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x8c6cb1
lea ecx, [esp + 0xc]
push 4
push ecx
push 4
push eax
push 0xa39238
call fcn.008c94e0
mov edx, dword [esp + 0x18]
add esp, 4
push eax
push edx
call dword [sym.imp.advapi32.dll_RegSetValueExA]
test eax, eax
jne 0x8c6ca6
mov bl, 1
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov al, bl
pop ebx
pop ecx
ret

Function at 0x8c6d30
Capabilities:
Check mutex on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0xa392c4
call fcn.008c94e0
mov esi, dword [sym.imp.kernel32.dll_OpenFileMappingA]
add esp, 4
push eax
push 0
push 0xf001f
call esi
mov edi, eax
test edi, edi
mov dword [esp + 0x10], edi
jne 0x8c6d84
push 0xa392b8
call fcn.008c94e0
add esp, 4
push eax
push edi
push 0xf001f
call esi
test eax, eax
mov dword [esp + 0x10], eax
jne 0x8c6d80
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov edi, dword [esp + 0x10]
push 0x1000
push 0
push 0
push 0xf001f
push edi
call dword [sym.imp.kernel32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
jne 0x8c6dae
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
push 0xa392a4
call fcn.008c94e0
mov esi, dword [sym.imp.kernel32.dll_OpenMutexA]
add esp, 4
push eax
push 0
push 0x100000
call esi
mov ebp, eax
test ebp, ebp
jne 0x8c6e03
push 0xa39298
call fcn.008c94e0
add esp, 4
push eax
push ebp
push 0x100000
call esi
mov ebp, eax
test ebp, ebp
jne 0x8c6e03
push ebx
call dword [sym.imp.kernel32.dll_UnmapViewOfFile]
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
push 0xffffffffffffffff
push ebp
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov ecx, dword [ebx]
mov eax, ebx
test ecx, ecx
je 0x8c6e2c
add eax, ecx
mov ecx, eax
sub ecx, ebx
cmp ecx, 0xffc
jae 0x8c6e2a
mov ecx, dword [eax]
test ecx, ecx
jne 0x8c6e14
jmp 0x8c6e2c
mov eax, ebx
mov ecx, dword [esp + 0x1c]
mov edx, eax
mov esi, 0xffc
sub edx, ebx
sub esi, ecx
cmp edx, esi
jb 0x8c6e43
mov eax, ebx
jmp 0x8c6e61
mov esi, dword [esp + 0x18]
mov edx, ecx
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
add eax, ecx
push ebx
mov dword [eax], 0
call dword [sym.imp.kernel32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
push edi
call esi
push ebp
call dword [sym.imp.kernel32.dll_ReleaseMutex]
push ebp
call esi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x8c7270
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x10
lea eax, [esp + 8]
lea ecx, [esp + 4]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push 0xa393b8
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 4
mov dword [esp + 0x20], 0
call fcn.008c94e0
add esp, 4
push eax
push reloc.dsound.dll_DirectSoundCreate
call dword [sym.imp.advapi32.dll_RegCreateKeyExA]
test eax, eax
jne 0x8c733d
cmp dword [esp + 8], 2
jne 0x8c7332
lea edx, [esp + 0xc]
lea eax, [esp]
push edx
push eax
push 0
push 0
push 0xa393ac
call fcn.008c94e0
mov ecx, dword [esp + 0x18]
add esp, 4
push eax
push ecx
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
cmp dword [esp], 1
jb 0x8c7332
mov edx, dword [esp + 0x14]
push edx
push 1
call fcn.008c7350
mov eax, dword [esp + 0x14]
add esp, 8
lea ecx, [esp]
mov dword [esp], 0
push eax
push ecx
push 4
push 0
push 0xa393a0
call fcn.008c94e0
mov edx, dword [esp + 0x18]
add esp, 4
push eax
push edx
call dword [sym.imp.advapi32.dll_RegSetValueExA]
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, dword [esp]
add esp, 0x10
ret
Function at 0x8c7350
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov eax, dword [0xaea6e4]
sub esp, 0x26c
test eax, eax
push edi
jne 0x8c7579
xor eax, eax
mov ecx, 0x40
mov dword [esp + 5], eax
lea edi, [esp + 0x69]
mov dword [esp + 9], eax
mov byte [esp + 4], 0
mov dword [esp + 0xd], eax
mov word [esp + 0x11], ax
mov byte [esp + 0x13], al
mov byte [esp + 0x68], al
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, 0xaea920
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0xa
jb 0x8c73c8
push 0xaea920
push 0xa39450
call fcn.008c94e0
add esp, 4
lea ecx, [esp + 0x6c]
push eax
push ecx
call fcn.00858bf5
add esp, 0xc
jmp 0x8c7414
push ebp
lea edx, [esp + 0x6c]
push esi
push edx
push 0x104
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryA]
push 0xa39434
call fcn.008c94e0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x70]
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
pop ebp
lea eax, [esp + 0x68]
push 0
push eax
call fcn.008cb285
add esp, 8
cmp eax, 0xffffffff
je 0x8c7561
mov ecx, dword [esp + 0x274]
lea edx, [esp + 4]
push ecx
push 0xa39430
push edx
call fcn.00858bf5
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x179]
mov byte [esp + 0x178], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [esp + 0x284]
add esp, 0xc
stosb byte es:[edi], al
mov eax, dword [0xaea91c]
lea edx, [esp + 4]
and eax, 1
push eax
push ecx
lea eax, [esp + 0x70]
push edx
push eax
push 0xa39420
call fcn.008c94e0
add esp, 4
lea ecx, [esp + 0x17c]
push eax
push ecx
call fcn.00858bf5
xor edx, edx
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x3c]
mov dword [esp + 0x2c], edx
add esp, 0x18
rep stosd dword es:[edi], eax
mov dword [esp + 0x18], edx
lea eax, [esp + 0x14]
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], edx
push eax
push ecx
push edx
push edx
push edx
push edx
push edx
mov dword [esp + 0x3c], edx
push edx
lea edx, [esp + 0x18c]
push edx
push 0
mov dword [esp + 0x4c], 0x44
call dword [sym.imp.kernel32.dll_CreateProcessA]
test eax, eax
mov eax, dword [0xaeaa28]
jne 0x8c7520
test eax, eax
je 0x8c7579
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push 0xa39400
call fcn.008c94e0
add esp, 4
push eax
mov eax, dword [0xaeaa28]
add eax, 0x24
push eax
call fcn.008c3720
add esp, 0xc
pop edi
add esp, 0x26c
ret
test eax, eax
je 0x8c754c
lea ecx, [esp + 0x16c]
push ecx
push 0xa393ec
call fcn.008c94e0
mov edx, dword [0xaeaa28]
add esp, 4
add edx, 0x24
push eax
push edx
call fcn.008c3720
add esp, 0xc
mov eax, dword [esp + 0x14]
push 0xffffffffffffffff
push eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
pop edi
add esp, 0x26c
ret
mov ecx, dword [esp + 0x278]
mov edx, dword [esp + 0x274]
push ecx
push edx
call fcn.008c7590
add esp, 8
pop edi
add esp, 0x26c
ret
Function at 0x8c7590
Capabilities:
Set registry value

Disassembly:
sub esp, 0x2c
xor eax, eax
lea ecx, [esp + 8]
mov dword [esp + 8], eax
push ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
call dword [sym.imp.kernel32.dll_GetLocalTime]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x12]
mov ecx, dword [esp + 0x10]
and edx, 0xffff
and eax, 0xffff
push edx
mov edx, dword [esp + 0x12]
and ecx, 0xffff
push eax
mov eax, dword [esp + 0x12]
push ecx
mov ecx, dword [esp + 0x14]
and edx, 0xffff
and eax, 0xffff
push edx
and ecx, 0xffff
push eax
push ecx
lea edx, [esp + 0x30]
push 0xa394c4
push edx
call fcn.00858bf5
add esp, 0x20
lea eax, [esp + 4]
lea ecx, [esp]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push 0xa39488
call fcn.008c94e0
add esp, 4
push eax
push reloc.dsound.dll_DirectSoundCreate
call dword [sym.imp.advapi32.dll_RegCreateKeyExA]
test eax, eax
jne 0x8c7699
push esi
mov esi, dword [sym.imp.advapi32.dll_RegSetValueExA]
push edi
lea edx, [esp + 0x38]
push 4
push edx
push 4
push eax
mov eax, dword [esp + 0x18]
push 0xa3947c
push eax
call esi
mov edx, dword [esp + 0x3c]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [esp + 0xc]
push edx
push 1
push eax
push 0xa39470
push ecx
call esi
mov eax, dword [esp + 8]
lea edx, [esp + 0x20]
push 0x10
push edx
push 1
push 0
push 0xa39464
push eax
call esi
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.advapi32.dll_RegCloseKey]
pop edi
pop esi
add esp, 0x2c
ret
Function at 0x8c76c0
Capabilities:
Copy file
Get common file path
Parse pe header
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x240
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx], 0
je 0x8c76d5
call fcn.008c7880
push ebp
lea eax, [esp + 0x14c]
push 0x104
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
mov edi, 0xa384f8
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x14c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x254]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [ebx + 4]
push esi
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
push esi
push 0
push 0xa394e8
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
push 0
lea eax, [esp + 0x150]
push esi
push eax
call dword [sym.imp.kernel32.dll_CopyFileA]
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push esi
call dword [sym.imp.kernel32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x8c7833
lea ecx, [esp + 0x10]
push 0
push ecx
lea edx, [esp + 0x1c]
push 0x40
push edx
push edi
call dword [sym.imp.kernel32.dll_ReadFile]
cmp word [esp + 0x14], 0x5a4d
jne 0x8c782c
mov eax, dword [esp + 0x50]
mov ebp, dword [sym.imp.kernel32.dll_SetFilePointer]
push 0
push 0
push eax
push edi
call ebp
lea ecx, [esp + 0x10]
push 0
push ecx
lea edx, [esp + 0x5c]
push 0xf8
push edx
push edi
call dword [sym.imp.kernel32.dll_ReadFile]
cmp dword [esp + 0x54], 0x4550
jne 0x8c782c
cmp dword [esp + 0x88], 0x80000000
jbe 0x8c782c
mov eax, dword [esp + 0x50]
push 0
push 0
push eax
push edi
mov dword [esp + 0x98], 0x10000000
call ebp
lea ecx, [esp + 0x10]
push 0
push ecx
lea edx, [esp + 0x5c]
push 0xf8
push edx
push edi
call dword [sym.imp.kernel32.dll_WriteFile]
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov edi, dword [sym.imp.kernel32.dll_LoadLibraryExA]
push 8
push 0
push esi
call edi
test eax, eax
mov dword [ebx], eax
pop ebp
je 0x8c7858
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x240
ret 4
mov eax, dword [esp + 0x250]
push 8
push 0
push eax
mov byte [esi], 0
call edi
xor ecx, ecx
pop edi
test eax, eax
setne cl
mov dword [ebx], eax
pop esi
mov eax, ecx
pop ebx
add esp, 0x240
ret 4
Function at 0x8c79a0
Capabilities:
Parse pe header

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
mov eax, ebx
push esi
mov esi, dword [esp + 0xc]
push edi
shr eax, 1
push eax
push esi
push 0
call fcn.008c7a40
add esp, 0xc
and eax, 0xffff
cmp word [esi], 0x5a4d
jne 0x8c79d6
mov ecx, dword [esi + 0x3c]
add ecx, esi
mov edi, ecx
cmp dword [ecx], 0x4550
je 0x8c79da
mov edi, dword [esp + 0x14]
test edi, edi
jne 0x8c79e4
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov ecx, dword [edi + 0x58]
cmp ax, cx
jb 0x8c79f8
mov edx, ecx
and edx, 0xffff
sub eax, edx
jmp 0x8c7a00
sub eax, ecx
and eax, 0xffff
dec eax
shr ecx, 0x10
cmp ax, cx
jb 0x8c7a12
and ecx, 0xffff
sub eax, ecx
jmp 0x8c7a1a
sub eax, ecx
and eax, 0xffff
dec eax
test bl, 1
je 0x8c7a27
xor ecx, ecx
mov cl, byte [esi + ebx - 1]
add eax, ecx
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
add eax, ebx
mov dword [edx], eax
mov eax, dword [edi + 0x58]
mov dword [ecx], eax
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x8c8660
Capabilities:
Create pipe
Create two anonymous pipes

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
mov ecx, dword [esi + 4]
push edi
lea eax, [esi + 4]
cmp ecx, 0xffffffff
mov dword [esp + 0x10], eax
je 0x8c8682
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret
mov ebp, dword [sym.imp.kernel32.dll_GetStdHandle]
push 0xfffffffffffffff5
mov dword [esp + 0x18], 0xc
mov dword [esp + 0x20], 1
mov dword [esp + 0x1c], 0
call ebp
mov dword [esi + 0x163c], eax
lea eax, [esp + 0x14]
lea ebx, [esi + 0x164c]
push 0
lea edi, [esi + 0x1648]
push eax
push ebx
push edi
call dword [sym.imp.kernel32.dll_CreatePipe]
test eax, eax
jne 0x8c86d3
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret
mov ecx, dword [ebx]
push ecx
push 0xfffffffffffffff5
call dword [sym.imp.kernel32.dll_SetStdHandle]
test eax, eax
jne 0x8c86ec
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret
mov ebx, dword [sym.imp.kernel32.dll_GetCurrentProcess]
push 2
push 0
lea edx, [esi + 8]
push 0
push edx
call ebx
push eax
mov eax, dword [edi]
push eax
call ebx
push eax
call dword [sym.imp.kernel32.dll_DuplicateHandle]
test eax, eax
jne 0x8c8719
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret
mov ecx, dword [edi]
push ecx
call dword [sym.imp.kernel32.dll_CloseHandle]
push 0xfffffffffffffff6
call ebp
lea edx, [esp + 0x14]
mov dword [esi + 0x1638], eax
lea edi, [esi + 0x1644]
push 0
add esi, 0x1640
push edx
push edi
push esi
call dword [sym.imp.kernel32.dll_CreatePipe]
test eax, eax
jne 0x8c8755
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret
mov eax, dword [esi]
push eax
push 0xfffffffffffffff6
call dword [sym.imp.kernel32.dll_SetStdHandle]
test eax, eax
jne 0x8c876e
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret
mov ecx, dword [esp + 0x10]
push 2
push 0
push 0
push ecx
call ebx
mov edx, dword [edi]
push eax
push edx
call ebx
push eax
call dword [sym.imp.kernel32.dll_DuplicateHandle]
test eax, eax
jne 0x8c8796
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret
mov eax, dword [edi]
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x10
ret

Function at 0x8c87b0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
push edi
cmp dword [esi + 4], 0xffffffff
jne 0x8c87c1
pop edi
xor eax, eax
pop esi
pop ecx
ret
mov eax, dword [esi + 0x1638]
mov edi, dword [sym.imp.kernel32.dll_SetStdHandle]
push eax
push 0xfffffffffffffff6
call edi
test eax, eax
jne 0x8c87da
pop edi
pop esi
pop ecx
ret
mov ecx, dword [esi + 0x163c]
push ecx
push 0xfffffffffffffff5
call edi
test eax, eax
jne 0x8c87ed
pop edi
pop esi
pop ecx
ret
push 0
push 0
push 1
push 0
call dword [sym.imp.kernel32.dll_CreateEventA]
test eax, eax
mov dword [esi + 0x10], eax
jne 0x8c8806
pop edi
pop esi
pop ecx
ret
lea edx, [esp + 8]
push edx
push 0
push esi
push 0x8c88b0
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
mov ecx, dword [esp + 8]
mov dword [esi], eax
neg eax
sbb eax, eax
pop edi
and eax, ecx
pop esi
pop ecx
ret
Function at 0x8c8830
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 4], 0xffffffff
jne 0x8c883d
xor al, al
pop esi
ret
mov eax, dword [esi + 0x10]
test eax, eax
je 0x8c884b
push eax
call dword [sym.imp.kernel32.dll_SetEvent]
mov eax, dword [esi]
push edi
mov edi, dword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
je 0x8c887e
push 0x64
push eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x8c8873
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.kernel32.dll_TerminateThread]
mov ecx, dword [esi]
push ecx
call edi
mov dword [esi], 0
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x8c8890
push eax
call edi
mov dword [esi + 4], 0xffffffff
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x8c88a2
push eax
call edi
mov dword [esi + 8], 0xffffffff
pop edi
mov al, 1
pop esi
ret
Function at 0x8c93d0
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 8]
push edi
call dword [sym.imp.kernel32.dll_lstrlenA]
test eax, eax
je 0x8c9467
mov ecx, edi
push ebx
and ecx, 0xff
push esi
mov byte [0xaeab21], cl
mov byte [0xaeab20], 1
lea edx, [ecx + ecx*2 + 0x65]
lea ecx, [ecx + ecx*2 + 1]
mov dword [esp + 0x10], edx
mov esi, 4
lea ecx, [ecx + ecx*2]
lea edx, [ecx + 0x65]
inc ecx
test eax, eax
jle 0x8c943c
push ebp
sub edi, 0xaeab24
mov ebp, eax
mov bl, byte [edi + esi + 0xaeab20]
lea ecx, [ecx + ecx*2]
mov al, cl
add al, 0x65
xor bl, al
mov byte [esi + 0xaeab20], bl
inc esi
inc ecx
dec ebp
jne 0x8c9420
pop ebp
mov bl, byte [esp + 0x10]
lea ecx, [esi - 4]
mov eax, ecx
mov byte [esi + 0xaeab20], 0
sar eax, 8
xor al, bl
xor dl, cl
pop esi
mov byte [0xaeab22], al
pop ebx
mov byte [0xaeab23], dl
mov eax, 0xaeab20
pop edi
ret
mov eax, 0xaeab20
pop edi
ret

Function at 0x8c9470
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jne 0x8c9479
ret
cmp byte [eax], 1
jne 0x8c94d4
movsx ecx, byte [eax + 1]
push ebx
mov bl, byte [eax + 2]
lea ecx, [ecx + ecx*2]
push esi
mov dl, cl
push edi
add dl, 0x65
lea ecx, [ecx + ecx*2 + 3]
xor bl, dl
mov dl, cl
mov byte [eax + 2], bl
mov bl, byte [eax + 3]
add dl, 0x65
xor esi, esi
xor bl, dl
xor edx, edx
mov dh, byte [eax + 2]
inc ecx
mov dl, bl
mov byte [eax + 3], bl
mov edi, edx
test edi, edi
jle 0x8c94cd
mov bl, byte [esi + eax + 4]
lea ecx, [ecx + ecx*2]
mov dl, cl
add dl, 0x65
xor bl, dl
inc ecx
mov byte [esi + eax], bl
inc esi
cmp esi, edi
jl 0x8c94b6
mov byte [edi + eax], 0
pop edi
pop esi
pop ebx
ret
Function at 0x8c94e0
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [0xaeab18]
sub esp, 0x40c
test al, 1
push ebx
push edi
jne 0x8c9514
mov bl, al
push 0xaeaa78
or bl, 1
mov byte [0xaeab18], bl
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
push 0x8c96b0
call fcn.0085909d
add esp, 4
mov edi, dword [esp + 0x418]
test edi, edi
jne 0x8c952a
pop edi
xor eax, eax
pop ebx
add esp, 0x40c
ret
push ebp
push esi
push 0xaeaa78
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
cmp byte [edi], 1
jne 0x8c958c
movsx eax, byte [edi + 1]
mov dl, byte [edi + 2]
mov bl, byte [edi + 3]
lea eax, [eax + eax*2]
xor esi, esi
mov cl, al
add cl, 0x65
lea eax, [eax + eax*2 + 3]
xor dl, cl
xor ecx, ecx
mov byte [edi + 2], dl
mov ch, byte [edi + 2]
mov dl, al
add dl, 0x65
xor bl, dl
inc eax
mov cl, bl
mov byte [edi + 3], bl
mov ebp, ecx
test ebp, ebp
jle 0x8c9588
mov cl, byte [esi + edi + 4]
lea eax, [eax + eax*2]
mov dl, al
add dl, 0x65
xor cl, dl
inc eax
mov byte [esi + edi], cl
inc esi
cmp esi, ebp
jl 0x8c9571
mov byte [edi + ebp], 0
xor ebx, ebx
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
mov edx, 1
mov ecx, 0xaeaa9c
cmp dword [ecx], eax
je 0x8c95b0
add ecx, 4
inc edx
cmp ecx, 0xaeaac0
jl 0x8c959e
jmp 0x8c95b6
test edx, edx
mov ebx, edx
jne 0x8c95d1
mov ecx, dword [0xaeaf20]
cmp ecx, 9
jae 0x8c95d1
inc ecx
mov dword [0xaeaf20], ecx
mov ebx, ecx
mov dword [ecx*4 + 0xaeaa98], eax
mov esi, dword [ebx*4 + 0xaeaac0]
mov dword [ebx*4 + 0xaeaac0], edi
test esi, esi
je 0x8c968b
cmp esi, edi
je 0x8c968b
cmp byte [edi], 1
je 0x8c968b
cmp byte [esi], 1
je 0x8c968b
lea edx, [esp + 0x1c]
push esi
push edx
call dword [sym.imp.kernel32.dll_lstrcpyA]
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.kernel32.dll_lstrlenA]
test eax, eax
mov dword [esp + 0x18], eax
je 0x8c968b
lea ecx, [esp + 0x1c]
mov byte [esi], 1
and ecx, 0xff
mov ebp, 4
mov byte [esi + 1], cl
lea edx, [ecx + ecx*2 + 0x65]
lea ecx, [ecx + ecx*2 + 1]
mov dword [esp + 0x14], edx
xor edx, edx
lea ecx, [ecx + ecx*2]
lea ebx, [ecx + 0x65]
inc ecx
test eax, eax
mov dword [esp + 0x10], ebx
jle 0x8c9671
mov bl, byte [esp + edx + 0x1c]
lea ecx, [ecx + ecx*2]
mov al, cl
add al, 0x65
xor bl, al
mov eax, dword [esp + 0x18]
mov byte [esi + ebp], bl
inc ebp
inc ecx
inc edx
cmp edx, eax
jl 0x8c9652
mov ebx, dword [esp + 0x10]
mov dl, byte [esp + 0x14]
lea eax, [ebp - 4]
mov ecx, eax
mov byte [esi + ebp], 0
sar ecx, 8
xor cl, dl
xor bl, al
mov byte [esi + 2], cl
mov byte [esi + 3], bl
push 0xaeaa78
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
pop esi
mov eax, edi
pop ebp
pop edi
pop ebx
add esp, 0x40c
ret

Function at 0x8c9940
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
mov eax, ecx
push edi
xor esi, esi
mov edi, eax
mov edx, esi
mov ebx, 8
test dl, 1
je 0x8c995f
shr edx, 1
xor edx, 0xedb88320
jmp 0x8c9961
shr edx, 1
dec ebx
jne 0x8c9950
mov dword [edi], edx
inc esi
add edi, 4
cmp esi, 0x100
jl 0x8c9949
pop edi
pop esi
pop ebx
ret