joyce8/EMBER2024-capa huggingface dataset:
Function at 0x517270
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.0040eccc
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.00511220
test ebx, ebx
jne 0x5172c3
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.005170ec
mov ebx, eax
test ebx, ebx
je 0x5173b9
cmp esi, ebx
je 0x5172ec
mov eax, dword [esp]
sub eax, dword [ebx + 0x48]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x4c]
mov dword [esp + 0x118], eax
jmp 0x517301
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x517339
add eax, 0xffffff5f
sub eax, 2
jb 0x517351
dec eax
sub eax, 2
jb 0x517365
dec eax
sub eax, 2
jb 0x51735b
jmp 0x51736f
add eax, 0xfffffdff
sub eax, 2
jb 0x517351
dec eax
sub eax, 2
jb 0x517365
dec eax
sub eax, 2
jb 0x51735b
jmp 0x51736f
mov byte [esp + 0x120], 0
jmp 0x517377
mov byte [esp + 0x120], 2
jmp 0x517377
mov byte [esp + 0x120], 1
jmp 0x517377
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.004df27c
mov esi, eax
call fcn.0050dd20
or si, ax
mov word [esp + 0x121], si
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.00512c34
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x5173bb
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret
Function at 0x54a6f4
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x54a722
mov eax, ebx
call fcn.0054b1b0
cmp dword [ebx + 0x40], 0
je 0x54a71b
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x54a793
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x54a785
cmp dword [ebx + 8], 0
je 0x54a744
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x54a756
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x54a785
cmp dword [ebx + 8], 0
je 0x54a737
cmp eax, 3
je 0x54a769
dec eax
jne 0x54a737
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x54a737
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x54a737
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x54a7b1
cmp dword [ebx + 0x14], 0xcc
je 0x54a7b1
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0054a7bc
pop ebx
ret
Function at 0x402ba0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x54
push ebx
mov ebx, dword [esp + 0x60]
push edi
push 5
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x402bc3
pop edi
pop ebx
add esp, 0x54
ret
push ebp
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebp, eax
push ebp
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
mov dword [esp + 0x20], edi
je 0x402d1d
lea ecx, [edi + 0x40]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
je 0x402d1d
mov ecx, edi
mov edx, ecx
shr ecx, 2
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
push ebp
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeResource]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x28]
push ecx
call fcn.00402a70
add esp, 8
test eax, eax
je 0x402d13
mov ax, word [ebx + 2]
xor ecx, ecx
cmp ax, 0xffff
sete cl
cmp ax, 0xffff
mov dword [esp + 0x1c], ecx
jne 0x402c53
mov eax, dword [ebx + 0xc]
jmp 0x402c55
mov eax, dword [ebx]
xor edx, edx
and eax, 0x40
test ecx, ecx
setne dl
mov dword [esp + 0x18], eax
lea edx, [edx + edx + 1]
shl edx, 1
test ecx, ecx
mov ebp, edx
je 0x402c75
or dword [ebx + 0xc], 0x48
jmp 0x402c78
or dword [ebx], 0x48
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
lea edi, [ebp + eax*2 + 2]
call fcn.00402b50
mov esi, eax
mov eax, dword [esp + 0x1c]
add esp, 4
test eax, eax
je 0x402caa
lea ecx, [esi + ebp]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp + eax*2 + 2]
jmp 0x402cac
xor eax, eax
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
lea eax, [eax + esi + 3]
lea ecx, [esi + edi + 3]
and eax, 0xfffffffc
and ecx, 0xfffffffc
test edx, edx
je 0x402ccc
mov dx, word [ebx + 0x10]
jmp 0x402cd0
mov dx, word [ebx + 8]
mov word [esp + 0x18], dx
cmp edi, dword [esp + 0x14]
je 0x402cf7
cmp word [esp + 0x18], 0
jbe 0x402cf7
mov edx, ebx
sub edx, eax
add edx, dword [esp + 0x20]
push edx
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_memmove]
add esp, 0xc
mov ax, word [esp + 0x10]
sub edi, ebp
push edi
lea ecx, [esp + 0x28]
mov word [esi], ax
push ecx
add esi, ebp
push esi
call dword [sym.imp.MSVCRT.dll_memmove]
add esp, 0xc
pop esi
pop ebp
pop edi
mov eax, ebx
pop ebx
add esp, 0x54
ret
push ebp
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop esi
pop ebp
pop edi
xor eax, eax
pop ebx
add esp, 0x54
ret
Function at 0x402d30
Capabilities:
Inspect load icon resource

Disassembly:
sub esp, 0x30
push esi
push edi
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 8
mov dword [esp + 0x10], 0x100
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea ecx, [esp + 0x10]
push ecx
push 0x8002
push 0
call dword [sym.imp.USER32.dll_GetClassInfoW]
mov esi, dword [esp + 0x3c]
push 0x64
push esi
call dword [sym.imp.USER32.dll_LoadIconW]
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x38], 0x401298
call dword [sym.imp.USER32.dll_RegisterClassW]
push esi
push 0x64
call fcn.00402ba0
add esp, 8
push 0
push 0x401770
push 0
mov edi, eax
push edi
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
test edi, edi
je 0x402db7
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
push 0x401298
call dword [sym.imp.USER32.dll_UnregisterClassW]
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
xor eax, eax
pop esi
add esp, 0x30
ret 0x10
Function at 0x100dd1ae
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100dd024
Function at 0x401c20
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x407048
call sym._EnterCriticalSection_4
mov ebx, dword [0x407040]
sub esp, 4
test ebx, ebx
je 0x401c6b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401c64
test esi, esi
je 0x401c64
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401c40
mov dword [esp], 0x407048
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x401e50
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x401ea0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x401f78
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x401ede
cmp eax, 4
jne 0x401f00
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x401eee
cmp edx, 4
je 0x401eee
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00401e50
Function at 0x406040
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
call fcn.00401b20
mov eax, dword [0x464cc4]
test eax, eax
je 0x40605a
push eax
call fcn.00426e1f
add esp, 4
mov eax, dword [0x464cc8]
test eax, eax
je 0x40606c
push eax
call fcn.00426e1f
add esp, 4
mov eax, dword [0x464ccc]
test eax, eax
je 0x40607e
push eax
call fcn.00426e1f
add esp, 4
cmp dword [0x464cd0], 0
je 0x4060a4
push 0
call fcn.004156db
mov ecx, dword [0x464cd0]
add esp, 4
cmp ecx, eax
je 0x4060a4
push ecx
call fcn.00426e1f
add esp, 4
mov eax, dword [0x464cd4]
test eax, eax
je 0x4060b6
push eax
call fcn.00426e1f
add esp, 4
mov eax, dword [0x464cd8]
test eax, eax
je 0x4060c8
push eax
call fcn.00426e1f
add esp, 4
mov eax, dword [0x464cdc]
test eax, eax
je 0x4060da
push eax
call fcn.00426e1f
add esp, 4
push dword [ebp + 8]
call fcn.0043581e
int3
Function at 0x4083f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x466a28]
sub eax, 3
je 0x40842d
sub eax, 1
je 0x408427
push str._ASlink_Error_Internal_Version_Error
push 2
call fcn.004156db
add esp, 4
push eax
call fcn.00401010
add esp, 8
mov dword [ebp + 8], 3
pop ebp
jmp fcn.00406040
pop ebp
jmp fcn.00409720
pop ebp
jmp fcn.00408720
Function at 0x4426e3
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044246a

Function at 0x444899
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00444073

Function at 0x4448a4
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004442ae

Function at 0x44d01b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044cc20

Function at 0x44d026
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044cda1
Function at 0x100424a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x100424af
pop dword [ebp - 8]
mov eax, 0x901dc66d
add eax, 0x7fe65e42
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xce27d86b
sub dword [ebp - 0x18], 0x7fd59320
mov dword [ebp - 0x14], 0xf384d589
add dword [ebp - 0x14], 0x3eae76bc
mov dword [ebp - 0x10], 0xa283c49
add dword [ebp - 0x10], 0x422407e5
mov dword [ebp - 0xc], 0xc927d597
add dword [ebp - 0xc], 0x36d82a69
lea eax, [ebp - 0x18]
push eax
mov eax, 0x9f6314d1
add eax, 0x70a55b63
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xfe353e0f
sub dword [ebp - 0x18], 0x89c2d4b9
mov dword [ebp - 0x14], 0xdeb1683f
sub dword [ebp - 0x14], 0x9d4506ca
mov dword [ebp - 0x10], 0xd854b0b0
add dword [ebp - 0x10], 0x8b1abbbc
mov dword [ebp - 0xc], 0xca7a1a66
add dword [ebp - 0xc], 0x3585e59a
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0xe4c118bf
sub eax, 0xd4b8a89b
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3c85e
push 0
call eax
mov ecx, 0x7c0113d7
add ecx, 0x83ff301b
xor edi, edi
add edi, eax
mov ebx, 0xaf01d568
sub ebx, 0x9ef64568
add ebx, dword [ebp - 8]
mov edx, 0xe4881792
add dword [ebp - 4], edi
mov esi, dword [ebx]
add dword [ebp - 4], ecx
xor esi, edx
sub dword [ebp - 4], 0x2ae3c1e8
mov dword [edi], esi
sub dword [ebp - 4], edx
add edi, 0x8a1179c5
add edi, 0x75ee863f
add ebx, 0x1bca6784
sub ebx, 0x1bca6780
loop 0x100425cd
add eax, 0x9ed2640e
add eax, 0x612e9e8d
mov ebx, eax
add eax, 0x24d2073e
add eax, 0xdb2df8c7
mov ecx, 0xf1b7ed68
sub ecx, 0xe1b7ed68
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x10003ebf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x10003ece
pop dword [ebp - 0x2c]
mov eax, 0x10003ece
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x970810b9
sub dword [ebp - 0x3c], 0x48b5cb6e
mov dword [ebp - 0x38], 0x84b48b11
add dword [ebp - 0x38], 0xad7ec134
mov dword [ebp - 0x34], 0x2e57186b
sub dword [ebp - 0x34], 0xe20ad43d
mov dword [ebp - 0x30], 0x1a556a9
add dword [ebp - 0x30], 0xfe5aa957
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xc1f8f61f
sub dword [ebp - 0x3c], 0x4d868cc9
mov dword [ebp - 0x38], 0x64096120
sub dword [ebp - 0x38], 0x229cffab
mov dword [ebp - 0x34], 0x804163c7
sub dword [ebp - 0x34], 0x1cd1f75b
mov dword [ebp - 0x30], 0x75de3784
sub dword [ebp - 0x30], 0x75de3784
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x362ae
push 0
call eax
mov ecx, 0x4623
mov esi, eax
mov edx, 0xc5c2f0e2
sub edx, 0xb5c23ae2
add edx, dword [ebp - 0x2c]
mov edi, 0xfab2f46f
sub edi, 0x72d0f593
sub dword [ebp - 8], 0x71ceaa0f
mov ebx, dword [edx]
sub dword [ebp - 4], 0x64ccbcd
xor ebx, edi
sub dword [ebp - 0x28], edx
mov dword [esi], ebx
sub dword [ebp - 4], edi
add esi, 0xb5d5fd2f
sub esi, 0xb5d5fd2b
add edx, 4
loop 0x10003fdb
add eax, 0x10b5f
xor ebx, ebx
add ebx, eax
add eax, 0xec5bc4f
sub eax, 0xec5bc4a
mov ecx, 0x4d7930de
sub ecx, 0x3d7930de
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x10072260
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x100722fb
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x100722b2
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x100722b2
cmp esi, ebx
jge 0x100722b2
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x100722f5
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x100722f5
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100783dc]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x100783dc]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x1007230d
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc

Function at 0x10072530
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100bb864]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176174], 0
mov eax, dword [ebp + 8]
je 0x10072558
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x10072572
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.1005aebc
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.10076450
leave
ret 4

Function at 0x10072740
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100bb864]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176174], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x10072776
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x100727d5
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.1005aebc
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.1005aebc
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.1005aebc
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10076450
leave
ret 0x10
Function at 0x100727f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100bb864]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176174], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1007281c
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x1007284d
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x1007284b
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.1005aebc
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x1007284d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10076450
leave
ret 8
Function at 0x10026fe0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10063040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
imul esi, ecx, 0x2c
mov ebx, edx
mov dword [ebp - 8], 0
push edi
add esi, dword [0x10073210]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ecx, [ebp - 8]
push ecx
push pe_nt_image_headers32
lea eax, [eax*2 + 5]
push eax
push edi
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10027049
pop edi
pop esi
mov eax, 0xa
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002c362
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x1002706b
mov byte ds:[edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x1002708c
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x1002708c
mov eax, dword [esi + 0xc]
test byte [esi + 0x14], 1
mov dword [edi], eax
je 0x10027086
mov ax, word [esi + 0x10]
mov word [edi + 4], ax
mov al, byte [esi + 0x12]
mov byte [edi + 6], al
jmp 0x1002708c
mov al, byte [esi + 0x10]
mov byte [edi + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov cl, bl
xor eax, eax
add cl, cl
shl bl, 2
xor cl, byte [esi + 0x14]
and cl, 2
xor cl, byte [esi + 0x14]
xor bl, cl
and bl, 4
xor bl, cl
mov ecx, dword [ebp - 4]
pop edi
mov byte [esi + 0x14], bl
xor ecx, ebp
pop esi
pop ebx
call fcn.1002c362
mov esp, ebp
pop ebp
ret
Function at 0x412722
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x4186e0], 0
push ebx
push esi
mov esi, 0x4186e8
jne 0x41274e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x418700], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4186e0], 1
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x4127eb
push 0x14
push 8
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x412815
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4186e4]
test eax, eax
je 0x412790
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x4186e4], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x41281a
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x412815
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0xdc5adc
Capabilities:
Encode data using xor

Disassembly:
jmp 0xdc5ae6
pushal
call 0xdc5aec
pop ebp
sub ebp, 0x10
sub ebp, 0x9c5adc
jmp 0xdc5b02
mov eax, 0x9c5adc
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c4
mov edx, 0x6ea37233
xor byte [eax], dl
inc eax
dec ecx
jne 0xdc5b19
jmp 0xdc5b2c
mov eax, 0xfbab8fe
xor esi, dword [ebx]
xor esi, dword [edx + 0x3333cbf2]
xor esi, dword [eax]
dec byte [ebx + 0x33333336]
mov dword [ebx], ebx
xor esi, dword [ebx]
xor eax, esp
sal dword [eax], 1
sti
mov eax, 0x33333fb2
xor esi, dword [eax]
mul byte [ebx - 0x42]
push edi
pop ss
iretd