joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406820
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov byte [esp], dl
mov esi, eax
mov dl, 1
mov eax, esi
call fcn.00406744
mov edi, eax
mov dword [esp + 4], edi
mov eax, esi
call fcn.004032f4
mov ebp, eax
lea ebx, [edi + 1]
cmp ebp, ebx
jl 0x40687f
mov al, byte [esi + ebx - 1]
call fcn.004066b0
test al, al
je 0x406869
cmp byte [esp], 0
je 0x406862
mov edi, ebx
jmp 0x406866
mov edi, dword [esp + 4]
inc ebx
jmp 0x40687b
mov edx, ebx
mov eax, esi
call fcn.00406680
add ebx, eax
mov eax, ebx
jmp 0x417645
cmp ebp, ebx
jge 0x40684b
mov eax, edi
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x406888
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffff004
push eax
add esp, 0xfffffffc
mov edi, edx
mov esi, eax
push esp
lea eax, [esp + 8]
push eax
push 0x1000
mov eax, esi
call fcn.00403414
push eax
call sub.kernel32.dll_GetFullPathNameA
mov ebx, eax
test ebx, ebx
jle 0x4068ce
cmp ebx, 0x1000
jge 0x4068ce
lea edx, [esp + 4]
mov eax, edi
mov ecx, ebx
call fcn.00403278
jmp fcn.004068d7
mov eax, edi
mov edx, esi
jmp loc.00414aaa

Function at 0x4068e4
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, eax
xor ebp, ebp
mov eax, esi
jmp loc.00416778

Function at 0x4069dc
Capabilities:
Get file attributes
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x406a24
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00406978
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
jmp loc.00417ea3

Function at 0x406a58
Capabilities:
Packed with generic packer
Query environment variable

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov eax, ebx
mov edx, 0xff
call fcn.004034f0
mov eax, dword [ebx]
call fcn.004032f4
push eax
mov eax, dword [ebx]
jmp loc.00414c77

Function at 0x406bd0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x406c1b
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetCommandLineA_1
lea edx, [ebp - 4]
jmp loc.004162c6

Function at 0x406c2c
Capabilities:
Accept command line arguments
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x406cba
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x406c77
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
jmp loc.004167e4
call sub.kernel32.dll_GetCommandLineA_1
cmp byte [eax], 0
jne 0x406c8b
lea eax, [ebp - 4]
call fcn.00403198
jmp 0x406c9a
lea edx, [ebp - 4]
call fcn.00406af0
test ebx, ebx
je 0x406c9a
dec ebx
jmp 0x406c7c
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040322c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406cc1
lea eax, [ebp - 4]
call fcn.00403198
ret
Function at 0x406cc8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00404dd0
add esp, 0x104
pop ebx
ret

Function at 0x406e10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x406f48
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
jmp loc.00417835

Function at 0x406f68
Capabilities:
Check for trap flag exception
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
cmp al, 2
jne fcn.00406f79
jmp loc.00416df6

Function at 0x406fa0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov ebx, eax
push edx
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x407012
push dword fs:[eax]
mov dword fs:[eax], esp
jmp loc.004151cd

Function at 0x407024
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x407129
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x40713c
push 0x407158
call sub.kernel32.dll_GetModuleHandleA_1
push eax
call sub.kernel32.dll_GetProcAddress
mov ebx, eax
test ebx, ebx
je 0x407067
call ebx
mov ebx, eax
jmp 0x40710b
jmp loc.00417ae1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407130
lea eax, [ebp - 0x10]
call fcn.00403198
lea eax, [ebp - 8]
call fcn.00403198
ret

Function at 0x40720c
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, eax
call fcn.0040569c
mov ebx, eax
test ebx, ebx
jne 0x40722f
mov eax, esi
mov edx, 0x407270
call fcn.0040322c
jmp 0x40725d
mov eax, ebx
mov edx, 0x404650
call fcn.0040296c
test al, al
je 0x40724b
mov edx, esi
mov eax, dword [ebx + 4]
call fcn.004071d0
jmp 0x40725d
mov edx, esp
mov eax, dword [ebx]
call fcn.0040286c
mov edx, esp
mov eax, esi
jmp 0x415bfc
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x407890
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x40c55c
mov eax, esi
mov edx, 8
test al, 1
je 0x4078ac
shr eax, 1
xor eax, 0xedb88320
jmp 0x4078ae
shr eax, 1
dec edx
jne 0x40789f
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x407898
pop esi
ret

Function at 0x407eb8
Capabilities:
Packed with generic packer

Disassembly:
push ebx
mov ebx, eax
xor eax, eax
mov dword [ebx + 0x64], eax
mov eax, dword [ebx + 0x60]
test eax, eax
je fcn.00407ed9
push 0x8000
push 0
push eax
call sub.kernel32.dll_VirtualFree_1
jmp loc.00417686
Function at 0x408164
Capabilities:
Packed with generic packer

Disassembly:
push ebx
mov ebx, edx
movzx ecx, word [eax]
mov edx, dword [ebx + 8]
shr edx, 0xb
imul edx, ecx
cmp edx, dword [ebx + 0xc]
jbe 0x4081b3
mov dword [ebx + 8], edx
mov ecx, 0x800
movzx edx, word [eax]
sub ecx, edx
sar ecx, 5
add word [eax], cx
cmp dword [ebx + 8], 0x1000000
jae 0x4081af
mov eax, ebx
call fcn.00408084
and eax, 0xff
mov edx, dword [ebx + 0xc]
shl edx, 8
or eax, edx
mov dword [ebx + 0xc], eax
shl dword [ebx + 8], 8
xor eax, eax
pop ebx
ret
sub dword [ebx + 8], edx
sub dword [ebx + 0xc], edx
movzx edx, word [eax]
sar edx, 5
sub word [eax], dx
cmp dword [ebx + 8], 0x1000000
jae 0x4081e5
mov eax, ebx
call fcn.00408084
mov ecx, dword [ebx + 0xc]
xor edx, edx
jmp loc.004146ec
mov eax, 1
pop ebx
ret

Function at 0x4081ec
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebp, ecx
mov dword [esp], edx
mov edi, eax
mov ebx, 1
mov esi, dword [esp]
test esi, esi
je 0x408219
lea eax, [edi + ebx*2]
mov edx, ebp
jmp loc.00414fac
mov ecx, dword [esp]
mov eax, 1
shl eax, cl
push eax
mov eax, ebx
pop edx
sub eax, edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4082a0
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov byte [esp], cl
mov edi, edx
mov esi, eax
mov ebx, 1
jmp loc.0041641d

Function at 0x408aa8
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], ecx
mov ebx, eax
cmp edx, 0x50
je 0x408abe
mov eax, 1
jmp 0x408af0
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0040838c
test eax, eax
jne 0x408af0
mov ecx, dword [ebx]
mov edx, 0x300
add ecx, dword [ebx + 4]
shl edx, cl
mov ecx, dword [ebp + 0xc]
add edx, 0x736
add edx, edx
mov dword [ecx], edx
mov edx, dword [ebp + 8]
jmp 0x416a2f
pop ebx
pop ecx
pop ebp
ret 0xc

Function at 0x408da8
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
jmp loc.004171ba

Function at 0x408fbc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
jmp loc.0041518f

Function at 0x409034
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00408f70
test al, al
jne 0x409054
mov byte [ebp - 1], 0
jmp 0x40909a
xor eax, eax
push ebp
push 0x40908a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
jmp loc.00414f7f
mov al, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4090a4
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x40913d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x40914c
push 0x40916c
call sub.kernel32.dll_GetModuleHandleA_1
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x40cccc], eax
push 0x40917c
push 0x40916c
call sub.kernel32.dll_GetModuleHandleA_1
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x40ccd0], eax
cmp dword [0x40cccc], 0
je 0x409100
cmp dword [0x40ccd0], 0
jne 0x409104
xor eax, eax
jmp 0x409106
mov al, 1
jmp 0x417b92

Function at 0x409648
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4096eb
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetLastError_1
mov esi, eax
lea eax, [ebp - 4]
push eax
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x40c95c]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x14]
mov eax, esi
call fcn.00404c84
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x18]
mov eax, esi
call fcn.00407284
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov ecx, 2
mov al, 0x67
call fcn.00408da8
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, 0x404650
jmp loc.00414f1a

Function at 0x4096fc
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x40975b
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0040569c
mov edx, 0x4046a0
call fcn.0040296c
test al, al
jne fcn.00409745
push 0x10
mov eax, dword [0x40ca84]
push eax
lea eax, [ebp - 4]
call fcn.0040720c
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
jmp loc.00415c71

Function at 0x4099a4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409a77
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409a90
push ebx
push 0x409a9c
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409a24
mov al, 0x69
call fcn.00409648
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp loc.00415f15

Function at 0x409b30
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
jmp loc.004141d0
Function at 0x409bec
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push 0xa
push 0x2b67
push 0
call sub.kernel32.dll_FindResourceA
mov ebx, eax
test ebx, ebx
jne 0x409c06
call fcn.00409aa0
push ebx
push 0
call sub.kernel32.dll_SizeofResource
cmp eax, 0x2c
je 0x409c18
jmp 0x415c23
push ebx
push 0
call sub.kernel32.dll_LoadResource
mov ebx, eax
test ebx, ebx
jne 0x409c2b
call fcn.00409aa0
push ebx
call sub.kernel32.dll_LockResource
mov ebx, eax
test ebx, ebx
jne 0x409c3c
jmp 0x41747e
mov eax, ebx
pop ebx
ret

Function at 0x414864
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
xor eax, eax
mov ecx, 0x11
push edi
push ebx
mov edi, edx
mov al, 0x30
and eax, 0xfffffff0
add esp, 8
leave
popal
popfd
jmp fcn.0040357c

Function at 0x41576a
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4050a0
push 0x401cd0
push eax
push ebx
push edi
xor edx, edx
mov dl, ah
mov ecx, eax
and ecx, 0xff
shl ecx, 8
add ecx, edx
shr eax, 0x10
pop ecx
test eax, eax
add esp, 0x14
leave
popal
popfd
mov esi, 0x40c95c
jmp loc.00408e05

Function at 0x416f8d
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push ebx
push edi
push 0x20
push 0x8001
push 8
push 0x2b4
push eax
push 0x40861c
push 0x408604
push 0x4685a0
push eax
mov edi, 0x4c10a0
push edi
mov eax, edi
add esp, 0x30
leave
popal
popfd
mov dword [esp + 0x19c], ebx
jmp loc.004057b3
Function at 0x408e5c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41003c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004056d6
and dword [ebp - 0x14], 0
cmp dword [0x411ca0], 0
mov dword [ebp - 0x18], eax
jne 0x408f0f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x408fb7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x408fb7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x411ca0], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x411ca4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x411ca8], eax
call edi
push eax
call esi
mov dword [0x411cb0], eax
test eax, eax
je 0x408f0f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x411cac], eax
mov eax, dword [0x411cac]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x408f68
cmp dword [0x411cb0], ecx
je 0x408f68
push eax
call esi
push dword [0x411cb0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x408f68
test ebx, ebx
je 0x408f68
call edi
test eax, eax
je 0x408f5f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x408f5f
test byte [ebp - 8], 1
jne 0x408f68
or dword [ebp + 0x10], 0x200000
jmp 0x408f9b
mov eax, dword [0x411ca4]
cmp eax, dword [ebp - 0x18]
je 0x408f9b
push eax
call esi
test eax, eax
je 0x408f9b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x408f9b
mov eax, dword [0x411ca8]
cmp eax, dword [ebp - 0x18]
je 0x408f9b
push eax
call esi
test eax, eax
je 0x408f9b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x411ca0]
call esi
test eax, eax
je 0x408fb7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x408fb9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402d39
leave
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x141c6c83
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..data
mov ebx, 0x42f314
nop
nop
mov ecx, 0x14ad6ac3
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43206c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x6d2770
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.006d34b0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.006d34b0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x6d27d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x6d7070]
test esi, esi
jle 0x6d28f0
mov eax, dword [0x6d7074]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x6d2804
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x6d2887
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x6d27f0
mov dword [esp], ebx
call fcn.006d31c0
mov edi, eax
test eax, eax
je 0x6d2917
mov eax, dword [0x6d7074]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.006d3300
mov edx, dword [0x6d7074]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x6d28f7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x6d2880
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x6d2890
add dword [0x6d7070], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x6d7074]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x6d2880
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.006d2770
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x6d280e
mov eax, dword [0x6d7074]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.006d2770
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.006d2770
lea esi, [esi]
nop
Function at 0x6d2e30
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x6d708c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x6d7084]
sub esp, 4
test ebx, ebx
je 0x6d2e85
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x6d2e7e
test esi, esi
je 0x6d2e7e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6d2e60
mov dword [esp], 0x6d708c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6d31c0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x6d31e5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x6d31f0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x6d31e5
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x6d3238
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x6d322e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x6d323a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x6d3220
xor eax, eax
pop ebx
pop esi
ret
Function at 0x4021f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, edx
mov edx, ecx
push edi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], edx
mov eax, dword [edx + 0x3c]
mov ebx, dword [eax + edx + 0x78]
mov eax, dword [eax + edx + 0x7c]
add ebx, edx
mov dword [ebp - 0x10], eax
mov eax, esi
shr eax, 0x10
test eax, eax
je 0x402262
mov esi, dword [ebx + 0x20]
xor edi, edi
mov eax, dword [ebx + 0x24]
add esi, edx
add eax, edx
mov dword [ebp - 4], eax
cmp dword [ebx + 0x18], edi
jbe 0x402262
mov ecx, dword [esi]
add ecx, edx
xor edx, edx
cmp byte [ecx], dl
je 0x402247
nop word [eax + eax]
inc edx
cmp byte [edx + ecx], 0
jne 0x402240
push ecx
call fcn.00403ee0
mov edx, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
je 0x402274
add dword [ebp - 4], 2
inc edi
add esi, 4
cmp edi, dword [ebx + 0x18]
jb 0x402230
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], 0
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 4]
movzx ecx, word [eax]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov ecx, dword [eax + edx]
add ecx, edx
cmp ecx, ebx
jbe 0x402299
mov eax, ecx
sub eax, ebx
cmp eax, dword [ebp - 0x10]
jae 0x402299
call fcn.004020c0
mov ecx, eax
mov eax, dword [ebp + 8]
add ecx, 2
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x402760
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x433004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov byte [ebp - 0x60], 0
lea ecx, [ebp - 0x60]
mov byte [ebp - 0x5f], 0x2b
mov byte [ebp - 0x5e], 0x34
mov byte [ebp - 0x5d], 0x6f
mov byte [ebp - 0x5c], 0x34
mov byte [ebp - 0x5b], 0x12
mov byte [ebp - 0x5a], 0x34
mov byte [ebp - 0x59], 0x73
mov byte [ebp - 0x58], 0x34
mov byte [ebp - 0x57], 0x6f
mov byte [ebp - 0x56], 0x34
mov byte [ebp - 0x55], 0x64
mov byte [ebp - 0x54], 0x34
mov byte [ebp - 0x53], 0x75
mov byte [ebp - 0x52], 0x34
mov byte [ebp - 0x51], 0x2e
mov byte [ebp - 0x50], 0x34
mov byte [ebp - 0x4f], 0x10
mov byte [ebp - 0x4e], 0x34
mov byte [ebp - 0x4d], 0x28
mov byte [ebp - 0x4c], 0x34
mov byte [ebp - 0x4b], 0x64
mov byte [ebp - 0x4a], 0x34
mov byte [ebp - 0x49], 0x64
mov byte [ebp - 0x48], 0x34
mov byte [ebp - 0x47], 0x34
mov byte [ebp - 0x46], 0x34
mov al, byte [ebp - 0x5f]
call fcn.004028e0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov edi, dword [eax + 0x10]
mov esi, edi
mov esi, dword [esi]
cmp dword [esi + 0x18], 0
je 0x40284d
mov edx, dword [esi + 0x30]
xor eax, eax
cmp word [edx], ax
je 0x402829
nop dword [eax]
cmp eax, 0x3f
jae 0x402824
mov cl, byte [edx + eax*2]
mov byte [ebp + eax - 0x44], cl
inc eax
cmp word [edx + eax*2], 0
jne 0x402810
cmp eax, 0x40
jae 0x402864
xor edx, edx
mov byte [ebp + eax - 0x44], 0
cmp byte [ebp - 0x44], dl
je 0x40283d
inc edx
cmp byte [ebp + edx - 0x44], 0
jne 0x402835
push ecx
lea ecx, [ebp - 0x44]
call fcn.00403ee0
cmp eax, 0x240dfbc0
je 0x402851
cmp edi, esi
jne 0x4027f7
mov ecx, dword [ebp - 4]
mov eax, dword [esi + 0x18]
xor ecx, ebp
pop edi
pop esi
call fcn.0041b142
mov esp, ebp
pop ebp
ret
call fcn.0041b276
int3