joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5f6a20
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x62c720
mov eax, dword [ebp + 8]
mov edi, ecx
lea ecx, [ebp - 0x18]
mov esi, dword fs:[0]
mov dword [ebp - 0x18], esi
mov dword fs:[0], ecx
lea ecx, [ebp - 0x28]
push eax
call fcn.005de730
add esp, 4
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
test ecx, ecx
je 0x5f6b05
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], edx
lea edx, [ebp - 0x28]
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x40]
push 1
call fcn.005e4640
add esp, 4
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
test eax, eax
je 0x5f6b02
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x34], edx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x28]
push esi
call fcn.005de730
add esp, 4
mov ecx, dword [ebp - 0x28]
mov edi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
test ecx, ecx
je 0x5f6b0f
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x40]
lea edx, [ebp - 0x28]
push 1
call fcn.005e4640
add esp, 4
mov esi, dword [ebp - 0x40]
mov edi, dword [ebp - 0x3c]
test esi, esi
je 0x5f6b0c
push 1
push esi
mov ebx, dword [ebp - 0x2c]
push ebx
call dword [sym.imp.kernel32.dll_MoveFileExW]
test eax, eax
je 0x5f6b1c
mov eax, dword [ebp - 0x30]
mov byte [eax], 4
test edi, edi
jne 0x5f6b2f
jmp 0x5f6b3b
mov eax, dword [ebp - 0x38]
mov dword [edi], edx
mov dword [edi + 4], eax
jmp 0x5f6b4d
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x30]
mov ebx, dword [ebp - 0x2c]
mov dword [ecx], edi
mov dword [ecx + 4], eax
jmp 0x5f6b3b
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, dword [ebp - 0x30]
mov byte [ecx], 0
mov dword [ecx + 4], eax
test edi, edi
je 0x5f6b3b
mov ecx, esi
mov edx, 2
call fcn.00404240
cmp dword [ebp - 0x34], 0
je 0x5f6b4d
mov ecx, ebx
mov edx, 2
call fcn.00404240
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5f7a40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0xa708c0]
test eax, eax
je 0x5f7aca
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x5f7a65
cmp dword [eax + 4], 0
mov edi, eax
je 0x5f7a65
add edi, 8
jmp 0x5f7a7d
mov eax, dword [0xa708c0]
test eax, eax
je 0x5f7ad9
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
xor edi, edi
cmp eax, 1
jne 0x5f7a82
mov eax, edi
pop esi
pop edi
ret
mov esi, eax
test eax, eax
jne 0x5f7aee
movzx eax, byte [0xa71040]
mov ecx, 0xc
mov edx, 4
call fcn.004041e0
test eax, eax
je 0x5f7b28
mov dword [eax], 0xa708c0
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0xa708c0]
test eax, eax
jne 0x5f7ae5
mov ecx, 0xa708c0
call fcn.00642bc0
jmp 0x5f7ae6
mov ecx, 0xa708c0
call fcn.00642bc0
jmp 0x5f7a4c
mov ecx, 0xa708c0
call fcn.00642bc0
jmp 0x5f7a6f
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
call fcn.006432a0
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], eax
je 0x5f7a7d
test ecx, ecx
je 0x5f7a7d
lock dec dword [ecx]
jne 0x5f7a7d
call fcn.005f7b40
jmp 0x5f7a7d
mov ecx, 4
mov edx, 0xc
call fcn.0063c970
ud2

Function at 0x5f7ce0
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0xa708e0]
test eax, eax
je 0x5f7dc5
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x5f7d11
mov esi, eax
mov eax, dword [eax]
or eax, dword [esi + 4]
jne 0x5f7dba
mov eax, dword [0xa708e0]
test eax, eax
je 0x5f7dd4
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x5f7d97
mov esi, eax
test eax, eax
jne 0x5f7d77
movzx eax, byte [0xa71040]
mov ecx, 0x20
mov edx, 8
call fcn.004041e0
test eax, eax
je 0x5f7def
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x18], 0xa708e0
mov esi, eax
mov eax, dword [0xa708e0]
test eax, eax
je 0x5f7de3
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
xorps xmm0, xmm0
mov eax, esp
movaps xmmword [esp], xmm0
push 2
push 0x10
push eax
push 0
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x5f7d9b
movaps xmm0, xmmword [esp]
jmp 0x5f7da9
xor esi, esi
jmp 0x5f7dbd
lea ecx, [esp + 0x10]
call fcn.005f1840
movups xmm0, xmmword [esp + 0x10]
mov dword [esi + 4], 0
mov dword [esi], 1
movups xmmword [esi + 8], xmm0
add esi, 8
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
mov ecx, 0xa708e0
call fcn.00642bc0
jmp 0x5f7cf8
mov ecx, 0xa708e0
call fcn.00642bc0
jmp 0x5f7d1f
mov ecx, 0xa708e0
call fcn.00642bc0
jmp 0x5f7d6f
mov ecx, 8
mov edx, 0x20
call fcn.0063c970
ud2
Function at 0x5f8293
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
sub esp, 0x14
mov esi, ecx
mov ecx, 0xa70a14
call fcn.004b2dd8
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x5f82be
cmp dword [eax + 4], 0
je 0x5f82be
add eax, 8
jmp 0x5f8365
mov ecx, 0xa70a14
call fcn.004b2dd8
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x5f8363
mov edi, eax
test eax, eax
jne 0x5f8304
push 0x1c
pop ecx
call fcn.00566a96
mov dword [eax], 0xa70a14
and dword [eax + 4], 0
mov ecx, 0xa70a14
mov edi, eax
call fcn.004b2dd8
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
test esi, esi
je 0x5f832f
mov eax, dword [esi]
and dword [esi], 0
test eax, eax
je 0x5f832f
mov eax, dword [esi + 0x14]
movsd xmm0, qword [esi + 4]
movsd xmm1, qword [esi + 0xc]
mov dword [esp + 0x10], eax
movsd qword [esp + 8], xmm1
movsd qword [esp], xmm0
jmp 0x5f833b
and dword [esp + 0x10], 0
xorps xmm0, xmm0
movups xmmword [esp], xmm0
mov dword [edi + 4], 1
lea eax, [edi + 8]
movsd xmm0, qword [esp]
movsd xmm1, qword [esp + 8]
movsd qword [edi + 8], xmm0
movsd qword [edi + 0x10], xmm1
mov ecx, dword [esp + 0x10]
mov dword [edi + 0x18], ecx
jmp 0x5f8365
xor eax, eax
add esp, 0x14
pop esi
pop edi
ret

Function at 0x5f83b2
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push edi
push esi
mov esi, ecx
mov ecx, 0xa70914
call fcn.004b2dd8
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x5f83da
cmp dword [eax + 4], 0
mov ebx, eax
je 0x5f83da
add ebx, 8
jmp 0x5f8453
mov ecx, 0xa70914
call fcn.004b2dd8
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x5f8451
mov edi, eax
test eax, eax
jne 0x5f841c
push 0xc
pop ecx
call fcn.00566a96
mov dword [eax], 0xa70914
and dword [eax + 4], 0
mov ecx, 0xa70914
mov edi, eax
call fcn.004b2dd8
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
test esi, esi
je 0x5f8433
mov eax, dword [esi]
and dword [esi], 0
mov edx, dword [esi + 4]
test eax, eax
jne 0x5f8435
xor ecx, ecx
call fcn.005f8080
xor edx, edx
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
mov dword [edi + 4], 1
mov dword [edi + 8], edx
lea ebx, [edi + 8]
mov edx, eax
call fcn.005f8080
jmp 0x5f8453
xor ebx, ebx
mov eax, ebx
pop esi
pop edi
pop ebx
ret
Function at 0x5fb138
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov ecx, 0xa70948
call fcn.004b2dd8
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x5fb15b
cmp dword [eax + 4], 0
je 0x5fb15b
add eax, 8
jmp 0x5fb1c9
mov ecx, 0xa70948
call fcn.004b2dd8
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x5fb1b6
mov edi, dword [esp + 0xc]
mov esi, eax
test eax, eax
jne 0x5fb1a4
push 0xc
pop ecx
push 4
pop edx
call fcn.004a3937
mov dword [eax], 0xa70948
and dword [eax + 4], 0
mov ecx, 0xa70948
mov esi, eax
call fcn.004b2dd8
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
test edi, edi
je 0x5fb1ba
mov ecx, dword [edi]
and dword [edi], 0
test ecx, ecx
je 0x5fb1bc
mov ecx, dword [edi + 4]
jmp 0x5fb1bc
xor eax, eax
jmp 0x5fb1c9
xor ecx, ecx
mov dword [esi + 4], 1
lea eax, [esi + 8]
mov dword [esi + 8], ecx
pop esi
pop edi
ret

Function at 0x5fb208
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov ecx, 0xa70958
call fcn.004b2dd8
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x5fb22b
cmp dword [eax + 4], 0
je 0x5fb22b
add eax, 8
jmp 0x5fb299
mov ecx, 0xa70958
call fcn.004b2dd8
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x5fb286
mov edi, dword [esp + 0xc]
mov esi, eax
test eax, eax
jne 0x5fb274
push 0xc
pop ecx
push 4
pop edx
call fcn.004a3937
mov dword [eax], 0xa70958
and dword [eax + 4], 0
mov ecx, 0xa70958
mov esi, eax
call fcn.004b2dd8
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
test edi, edi
je 0x5fb28a
mov ecx, dword [edi]
and dword [edi], 0
test ecx, ecx
je 0x5fb28c
mov ecx, dword [edi + 4]
jmp 0x5fb28c
xor eax, eax
jmp 0x5fb299
xor ecx, ecx
mov dword [esi + 4], 1
lea eax, [esi + 8]
mov dword [esi + 8], ecx
pop esi
pop edi
ret
Function at 0x6007c4
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
mov edx, eax
xor edx, 3
lock cmpxchg dword [ecx], edx
jne 0x6007c6
test al, 1
je 0x6007dd
test al, 2
jne 0x6007ec
xor eax, 3
ret
push 0x23
pop edx
mov ecx, str.assertion_failed:_prev.is_running__
push 0xa10ba4
jmp 0x6007f9
push 0x25
pop edx
mov ecx, 0xa10bb4
push 0xa10bdc
call fcn.0063cd70
pop eax
ud2

Function at 0x600f08
Capabilities:
Set socket configuration

Disassembly:
push ebx
push esi
push eax
mov bl, byte [esp + 0x10]
mov esi, ecx
mov ecx, edx
call fcn.0060008d
mov eax, dword [eax]
movzx ecx, bl
mov edx, esp
mov dword [edx], ecx
push 4
push edx
push 1
push 6
push eax
call sub.ws2_32.dll_setsockopt
mov cl, 4
cmp eax, 0xffffffff
jne 0x600f49
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
and word [esi + 1], 0
xor ecx, ecx
mov byte [esi + 3], 0
mov dword [esi + 4], eax
mov byte [esi], cl
add esp, 4
pop esi
pop ebx
ret
Function at 0x6011a5
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x34
mov dword [esp], ecx
xor ecx, ecx
mov eax, dword [esp + 0x50]
cmp dword [edx + 0xc], 0xffffffff
lea ebp, [edx + 0xc]
mov edi, 0x7fffffff
mov esi, edx
mov dword [esp + 0x24], edx
cmove ebp, ecx
cmp eax, edi
cmovb edi, eax
mov dword [esp + 0x28], edi
lea edi, [esp + 0xc]
mov edx, dword [esi + 8]
mov ecx, edi
push dword [esp + 0x48]
call fcn.00600efa
pop eax
mov edx, dword [esp + 0xc]
cmp edx, 2
je 0x601315
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
test edx, edx
jne 0x60131d
mov dword [esp + 0x2c], ecx
mov ecx, ebp
mov edx, 0xa0f658
mov dword [esp + 0x30], eax
call fcn.00411f2d
push 0
push dword [esp + 0x2c]
push dword [esp + 0x54]
push dword [ebp]
call sub.ws2_32.dll_send
cmp eax, 0xffffffff
je 0x60123c
mov dword [esp + 8], eax
mov byte [esp + 4], 4
jmp 0x6012d0
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov esi, eax
xor eax, eax
lea ecx, [esp + 4]
mov byte [esp + 4], al
and word [esp + 5], 0
mov byte [esp + 7], al
mov dword [esp + 8], esi
call fcn.004cee18
cmp al, 0xd
jne 0x6012d0
mov eax, dword [ebp + 4]
test eax, eax
je 0x6012c3
mov dword [esp + 0x20], esi
mov esi, dword [eax + 4]
mov edx, dword [eax]
lock inc dword [esi]
jle 0x60133f
add edx, 8
mov ecx, edi
push dword [eax + 0xc]
push dword [eax + 8]
push esi
call fcn.0056cf32
add esp, 0xc
push 4
pop ecx
call fcn.005db180
cmp byte [esp + 0xc], 4
je 0x6012d0
mov ebx, dword [esp + 0xc]
mov edx, dword [esp + 0x20]
cmp bl, 4
je 0x6012d0
mov esi, dword [esp + 0x10]
xor ecx, ecx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], esi
call fcn.005db180
jmp 0x6012e5
and dword [esp + 0x10], 0
mov dword [esp + 0xc], 4
mov ebx, dword [esp + 4]
mov esi, dword [esp + 8]
cmp bl, 4
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], ebx
je 0x601327
lea ecx, [esp + 0x18]
call fcn.0044ed78
cmp al, 0xd
jne 0x60132f
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x24]
lea edx, [esp + 0x2c]
mov dword [esp + 0xc], ebx
mov ecx, esi
call fcn.00600cd0
push edi
call fcn.00626548
pop eax
jmp 0x6011d7
mov eax, dword [esp]
mov byte [eax], 5
jmp 0x601337
mov edx, dword [esp]
mov dword [edx], ecx
mov dword [edx + 4], eax
jmp 0x601337
mov eax, dword [esp]
mov byte [eax], 4
jmp 0x601334
mov eax, dword [esp]
mov dword [eax], ebx
mov dword [eax + 4], esi
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
ud2
Function at 0x601367
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
push eax
mov ecx, 0xa70938
call fcn.004b2dd8
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x60138d
cmp dword [eax + 4], 0
mov edi, eax
je 0x60138d
add edi, 4
jmp 0x6013ed
mov ecx, 0xa70938
call fcn.004b2dd8
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x6013eb
mov esi, eax
test eax, eax
jne 0x6013d2
push 8
pop ecx
push 4
pop edx
call fcn.004a3937
mov dword [eax], 0xa70938
and dword [eax + 4], 0
mov ecx, 0xa70938
mov esi, eax
call fcn.004b2dd8
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
lea edi, [esi + 4]
call fcn.005ff08e
mov edx, dword [esi + 4]
mov ecx, esp
mov dword [ecx], edx
mov dword [esi + 4], eax
call fcn.005ff0b2
jmp 0x6013ed
xor edi, edi
mov eax, edi
add esp, 4
pop esi
pop edi
ret
Function at 0x606c60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
sub esp, 0x14
mov ecx, 0xa70a04
call fcn.004b2dd8
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x606c88
cmp dword [eax + 4], 0
mov edi, eax
je 0x606c88
add edi, 8
jmp 0x606d04
mov ecx, 0xa70a04
call fcn.004b2dd8
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x606d02
mov esi, eax
test eax, eax
jne 0x606cca
push 0x18
pop ecx
call fcn.00566a96
mov dword [eax], 0xa70a04
and dword [eax + 4], 0
mov ecx, 0xa70a04
mov esi, eax
call fcn.004b2dd8
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov eax, dword [esi + 0x14]
mov ecx, esp
lea edi, [esi + 8]
mov dword [ecx + 0x10], eax
movsd xmm0, qword [esi + 4]
movsd xmm1, qword [esi + 0xc]
movsd qword [ecx + 8], xmm1
movsd qword [ecx], xmm0
mov dword [esi + 4], 1
and dword [esi + 8], 0
and dword [esi + 0xc], 0
mov byte [esi + 0x14], 1
call fcn.00605d69
jmp 0x606d04
xor edi, edi
mov eax, edi
add esp, 0x14
pop esi
pop edi
ret

Function at 0x6087fb
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov ecx, 0xa70a48
call fcn.004b2dd8
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x608827
mov ecx, dword [eax]
or ecx, dword [eax + 4]
je 0x608827
add eax, 8
jmp 0x6088d9
mov ecx, 0xa70a48
call fcn.004b2dd8
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x6088d7
mov edi, eax
test eax, eax
jne 0x608874
push 0x20
pop ecx
push 8
pop edx
call fcn.004a3937
and dword [eax + 4], 0
and dword [eax], 0
mov ecx, 0xa70a48
mov edi, eax
mov dword [eax + 0x18], 0xa70a48
call fcn.004b2dd8
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov cl, 3
test esi, esi
je 0x6088a7
mov eax, dword [esi]
mov edx, dword [esi + 4]
and dword [esi + 4], 0
and dword [esi], 0
or edx, eax
je 0x6088a7
mov al, byte [esi + 0x17]
mov ebx, dword [esi + 8]
mov ebp, dword [esi + 0xc]
mov edx, dword [esi + 0x10]
mov cl, byte [esi + 0x14]
movzx esi, word [esi + 0x15]
mov byte [esp + 2], al
mov word [esp], si
jmp 0x6088ad
xor edx, edx
xor ebx, ebx
xor ebp, ebp
and dword [edi + 4], 0
mov dword [edi], 1
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebp
mov dword [edi + 0x10], edx
mov byte [edi + 0x14], cl
lea eax, [edi + 8]
movzx ecx, word [esp]
mov word [edi + 0x15], cx
mov cl, byte [esp + 2]
mov byte [edi + 0x17], cl
jmp 0x6088d9
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x60aa3c
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov esi, ecx
mov ecx, 0xa70a28
call fcn.004b2dd8
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x60aa61
cmp dword [eax + 4], 0
je 0x60aa61
add eax, 8
jmp 0x60aacb
mov ecx, 0xa70a28
call fcn.004b2dd8
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x60aab8
mov edi, eax
test eax, eax
jne 0x60aaa6
push 0xc
pop ecx
push 4
pop edx
call fcn.004a3937
mov dword [eax], 0xa70a28
and dword [eax + 4], 0
mov ecx, 0xa70a28
mov edi, eax
call fcn.004b2dd8
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
test esi, esi
je 0x60aabc
mov ecx, dword [esi]
and dword [esi], 0
test ecx, ecx
je 0x60aabe
mov ecx, dword [esi + 4]
jmp 0x60aabe
xor eax, eax
jmp 0x60aacb
xor ecx, ecx
mov dword [edi + 4], 1
lea eax, [edi + 8]
mov dword [edi + 8], ecx
pop esi
pop edi
ret
Function at 0x60d388
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, ecx
mov ecx, 0xa70a38
call fcn.004b2dd8
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x60d3b7
cmp dword [eax + 4], 0
mov esi, eax
je 0x60d3b7
add esi, 8
jmp 0x60d4a0
mov ecx, 0xa70a38
call fcn.004b2dd8
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x60d441
mov esi, eax
test eax, eax
jne 0x60d3fc
push 0x18
pop ecx
push 4
pop edx
call fcn.004a3937
mov dword [eax], 0xa70a38
and dword [eax + 4], 0
mov ecx, 0xa70a38
mov esi, eax
call fcn.004b2dd8
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
xor ebp, ebp
lea ebx, [esi + 4]
inc ebp
test edi, edi
je 0x60d445
movsd xmm0, qword [edi]
mov eax, dword [edi + 0x10]
movsd xmm1, qword [edi + 8]
and dword [edi], 0
movsd qword [esp + 4], xmm0
mov dword [esp + 0x14], eax
movsd qword [esp + 0xc], xmm1
cmp dword [esp + 4], 0
je 0x60d452
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 8]
mov ebp, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov dword [esp], ecx
jmp 0x60d466
xor esi, esi
jmp 0x60d4a0
xor eax, eax
xor edx, edx
mov dword [esp], 0
jmp 0x60d466
lea ecx, [esp + 4]
mov dword [esp], 0
call fcn.0060d4aa
xor eax, eax
xor edx, edx
mov edi, dword [ebx + 0x10]
lea ecx, [esp + 4]
mov dword [ecx + 0x10], edi
movsd xmm0, qword [ebx]
movsd xmm1, qword [ebx + 8]
movsd qword [ecx + 8], xmm1
movsd qword [ecx], xmm0
mov dword [esi + 4], 1
mov dword [esi + 8], edx
mov edx, dword [esp]
mov dword [esi + 0xc], ebp
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
add esi, 8
call fcn.0060d4aa
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x615672
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push edi
push esi
sub esp, 0x10
movzx edi, byte [ecx + 3]
mov eax, dword [esp + 0x20]
mov esi, ecx
test edi, edi
je 0x6156ca
movzx ecx, word [esi]
cmp ecx, eax
ja 0x61571f
cmp edi, 1
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ecx
je 0x615704
cmp edi, 3
movss dword [esp], xmm0
jne 0x615709
add ecx, 2
mov word [esi], cx
lea ecx, [esp + 4]
call fcn.0060e3bf
movss xmm1, dword [esp]
test ax, ax
je 0x61571f
movsx eax, dx
jmp 0x615726
movzx ecx, word [esi]
cmp ecx, eax
jae 0x61571f
mov bl, byte [edx + ecx]
inc ecx
mov word [esi], cx
mov ecx, ebx
and cl, 0x3f
inc cl
test bl, 0x40
mov byte [esi + 2], cl
sete cl
xor cl, 3
xor edi, edi
inc edi
test bl, bl
movzx ecx, cl
cmovs ecx, edi
mov byte [esi + 3], cl
mov ecx, esi
push eax
call fcn.00615672
pop ecx
jmp 0x61573a
xorps xmm0, xmm0
jmp 0x61572e
inc ecx
mov word [esi], cx
lea ecx, [esp + 4]
call fcn.0060eef4
movss xmm1, dword [esp]
test al, 1
jne 0x615723
xor eax, eax
jmp 0x61573a
movsx eax, dl
cvtsi2ss xmm0, eax
mulss xmm0, xmm1
dec byte [esi + 2]
jne 0x615737
mov byte [esi + 3], 0
xor eax, eax
inc eax
add esp, 0x10
pop esi
pop edi
pop ebx
ret
Function at 0x625984
Capabilities:
Log keystrokes

Disassembly:
push edi
push esi
mov al, byte [esp + 0x10]
mov esi, ecx
xor ecx, ecx
mov edi, 0xe000
test al, al
cmove edi, ecx
or edi, dword [esp + 0xc]
cmp dx, 0x10
je 0x6259ba
movzx ecx, dx
cmp ecx, 0x11
je 0x6259c7
cmp ecx, 0x12
jne 0x6259d2
movzx edx, al
or edx, 0xa4
jmp 0x625a22
push 3
push edi
call dword [sym.imp.user32.dll_MapVirtualKeyA]
mov edx, eax
jmp 0x625a22
movzx edx, al
or edx, 0xa2
jmp 0x625a22
cmp edi, 0x45
je 0x6259ee
cmp edi, 0x46
je 0x625a07
cmp edi, 0xe01d
je 0x625a10
cmp edi, 0xe046
je 0x6259fc
jmp 0x625a22
cmp dx, 0x13
je 0x6259fc
cmp ecx, 0xff
jne 0x625a1f
mov edi, 0xe059
mov dx, 0x13
jmp 0x625a22
push 0x46
pop edi
mov dx, 0x91
jmp 0x625a22
xor eax, eax
mov edi, 0xe01d
cmp dx, 0x13
jne 0x625a22
jmp 0x625a2c
push 0x45
pop edi
xor eax, eax
mov word [esi + 4], dx
mov dword [esi + 8], edi
inc eax
mov dword [esi], eax
pop esi
pop edi
ret

Function at 0x626160
Capabilities:
Get keyboard layout

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x208
push 0
call dword [sym.imp.user32.dll_GetKeyboardLayout]
mov ecx, eax
xchg dword [0xa71034], ecx
mov dword [esp + 4], eax
cmp eax, ecx
jne 0x626194
mov al, byte [0xa71038]
test al, al
jne 0x626226
jmp 0x62623f
mov esi, 0x100
lea edi, [esp + 8]
push esi
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov word [edi + 0x11], 0x8080
lea eax, [esp + 0x108]
push esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov ebx, dword [esp + 4]
mov cl, 1
xor ebp, ebp
test cl, 1
je 0x626237
cmp ebp, 0xff
lea esi, [ebp + 1]
lea ecx, [esp + 0x108]
mov edx, ebp
cmove esi, ebp
setne byte [esp + 3]
push ebx
call fcn.00626766
pop ecx
mov edi, eax
lea ecx, [esp + 8]
mov edx, ebp
push ebx
call fcn.00626766
mov cl, byte [esp + 7]
add esp, 4
cmp edi, eax
mov ebp, esi
je 0x6261ca
cmp edi, 0x110000
mov ebp, esi
je 0x6261ca
cmp eax, 0x110000
mov ebp, esi
je 0x6261ca
mov al, 1
xchg byte [0xa71038], al
mov ecx, 0xa5
call fcn.00626755
mov ebx, eax
xor bl, 1
jmp 0x626241
xor eax, eax
xchg byte [0xa71038], al
mov bl, 1
push 0x10
pop ecx
call fcn.00626755
movzx esi, al
lea ebp, [esi*4]
push 0x11
pop ecx
call fcn.00626755
lea edi, [esi*4 + 0x20]
test al, al
cmove edi, ebp
test bl, bl
cmove edi, ebp
push 0x12
pop ecx
call fcn.00626755
lea esi, [edi + 0x100]
test al, al
cmove esi, edi
test bl, bl
cmove esi, edi
push 0x5b
pop ecx
call fcn.00626755
test al, al
jne 0x62629c
push 0x5c
pop ecx
call fcn.00626755
test al, al
je 0x6262a2
or esi, 0x800
mov eax, esi
add esp, 0x208
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x626755
Capabilities:
Log keystrokes via polling

Disassembly:
movzx eax, cx
push eax
call dword [sym.imp.user32.dll_GetKeyState]
movzx eax, ax
shr eax, 0xf
ret

Function at 0x628c06
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push edi
push esi
xor edx, edx
mov esi, ecx
mov ecx, 0x100
inc edx
call fcn.005779fb
mov edi, eax
mov ebx, edx
push eax
call dword [sym.imp.user32.dll_GetKeyboardState]
lea eax, [edi + 0x100]
mov dword [esi], edi
mov dword [esi + 4], ebx
mov dword [esi + 8], edi
mov dword [esi + 0xc], eax
and dword [esi + 0x10], 0
pop esi
pop edi
pop ebx
ret