joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b9f00
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x5011f0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x5011e8]
sub esp, 4
test ebx, ebx
je 0x4b9f55
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4b9f4e
test esi, esi
je 0x4b9f4e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4b9f30
mov dword [esp], 0x5011f0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4ba280
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x4ba2a5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x4ba2b0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x4ba2a5
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test esi, esi
je 0x4ba2f8
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x4ba2ee
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x4ba2fa
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x4ba2e0
xor eax, eax
pop ebx
pop esi
ret
Function at 0xbf5058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00bf51a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xbf507e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbf506a
add dl, dl
jne 0xbf5089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbf50dc
xor eax, eax
add dl, dl
jne 0xbf5096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbf517d
add dl, dl
jne 0xbf50a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbf50b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbf50bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbf50c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xbf50d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xbf5075
mov eax, 1
add dl, dl
jne 0xbf50ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbf50f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbf50e1
sub eax, ebx
mov ebx, 1
jne 0xbf5128
mov ecx, 1
add dl, dl
jne 0xbf510e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xbf5119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbf5105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbf5075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xbf513f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xbf514a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbf5136
cmp eax, 0x7d00
jae 0xbf516d
cmp eax, 0x500
jb 0xbf5168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbf5075
cmp eax, 0x7f
ja 0xbf5170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbf5075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xbf519e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xbf5075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x40201e
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40205d
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40205d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40205d
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40205d
cmp dword [ecx + 0x74], 0xe
jbe 0x40205d
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x696150
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, edx
dec eax
test eax, eax
jb 0x69617d
inc eax
movzx edx, byte [ebx]
mov esi, dword [ecx]
and esi, 0xff
xor edx, esi
mov edx, dword [edx*4 + 0x6e96b0]
mov esi, dword [ecx]
shr esi, 8
xor edx, esi
mov dword [ecx], edx
inc ebx
dec eax
jne 0x69615c
pop esi
pop ebx
ret
Function at 0x699f90
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe70
push ebx
push esi
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x190]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, ebx
call fcn.00405dc4
push eax
call sub.wsock32.dll_gethostbyname
mov ebx, eax
test ebx, ebx
je 0x699fdf
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, esi
call fcn.00405b2c
xor eax, eax
mov dword [esi + 0x38], eax
jmp 0x699ff0
mov eax, esi
call fcn.00405924
call sub.wsock32.dll_WSAGetLastError
neg eax
mov dword [esi + 0x38], eax
call sub.wsock32.dll_WSACleanup
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x69b174
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
xor edx, edx
mov eax, dword [esi + 0x3b8]
call fcn.0049cfc4
call sub.KERNEL32.DLL_GetTickCount_1
mov ebx, eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x699d00]
call fcn.0047a0d0
mov eax, dword [esi + 0x37c]
call fcn.005a94ec
cmp dword [0x6e9ad0], 0
je 0x69b1d7
mov eax, dword [0x6e9ad0]
call fcn.0069b85c
jmp 0x69b1d7
mov eax, dword [0x6eb15c]
mov eax, dword [eax]
call fcn.004d184c
call sub.KERNEL32.DLL_GetTickCount_1
sub eax, ebx
cmp eax, 0x1388
ja 0x69b1e0
cmp byte [0x6e9ab8], 0
je 0x69b1bd
pop esi
pop ebx
pop ebp
ret

Function at 0x69b660
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
mov ebx, eax
push pe_nt_image_headers32
lea eax, [ebp - 0x100]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
mov eax, ebx
lea edx, [ebp - 0x100]
mov ecx, pe_nt_image_headers32
call fcn.00405ba4
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6a3f40
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405db4
xor eax, eax
push ebp
push 0x6a4099
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
cmp dword [ebp - 4], 0
je 0x6a407e
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00462e98
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.004059bc
mov eax, dword [ebp - 4]
test eax, eax
je 0x6a3f94
sub eax, 4
mov eax, dword [eax]
cmp eax, 3
jge 0x6a3f9d
mov al, 1
jmp 0x6a3fa5
mov eax, dword [ebp - 4]
call fcn.0045d1f0
test al, al
je 0x6a3fad
mov al, 1
jmp 0x6a3fc6
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0045d4d0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00405d5c
sete al
test al, al
jne 0x6a407e
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0045d4d0
mov eax, dword [ebp - 0x10]
call fcn.006a3f40
mov ebx, eax
test bl, bl
je 0x6a407e
mov eax, dword [ebp - 4]
call fcn.006ac278
test al, al
je 0x6a404a
lea eax, [ebp - 0x14]
mov ecx, 0x6a40b0
mov edx, dword [ebp - 4]
call fcn.00405c4c
mov eax, dword [ebp - 0x14]
call fcn.006ac278
test al, al
je 0x6a4023
mov eax, dword [ebp - 4]
call fcn.00405dc4
push eax
call sub.KERNEL32.DLL_DeleteFileA
jmp 0x6a404a
lea eax, [ebp - 0x18]
mov ecx, 0x6a40b0
mov edx, dword [ebp - 4]
call fcn.00405c4c
mov eax, dword [ebp - 0x18]
call fcn.00405dc4
push eax
mov eax, dword [ebp - 4]
call fcn.00405dc4
push eax
call sub.KERNEL32.DLL_MoveFileA
mov esi, 3
mov eax, dword [ebp - 4]
call fcn.0045d6f4
test al, al
jne 0x6a406b
call sub.KERNEL32.DLL_GetLastError_1
cmp eax, 0xb7
je 0x6a406b
xor ebx, ebx
jmp 0x6a406d
mov bl, 1
test bl, bl
jne 0x6a407e
mov eax, 0x32
call fcn.005217ac
dec esi
jne 0x6a404f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a40a0
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00405948
ret
Function at 0x6a8a90
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x6a8b67
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0045f40c
fstp qword [ebp - 0x10]
wait
push dword [ebp - 0xc]
push dword [ebp - 0x10]
mov edx, dword [0x6eada0]
mov edx, dword [edx]
lea eax, [ebp - 8]
call fcn.0046000c
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.0045d504
push dword [ebp - 0x14]
push 0x6a8b7c
push dword [ebp - 8]
push 0x6a8b90
lea eax, [ebp - 4]
mov edx, 4
call fcn.00405cc8
mov eax, dword [ebp - 4]
call fcn.006ac358
test al, al
jne 0x6a8b06
mov eax, dword [ebp - 4]
call fcn.0045d6f4
mov eax, dword [ebp - 4]
call fcn.006ac358
test al, al
je 0x6a8b3f
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.0045d558
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
call fcn.00405c00
push 0
mov eax, dword [ebp - 4]
call fcn.00405dc4
push eax
mov eax, ebx
call fcn.00405dc4
push eax
call sub.KERNEL32.DLL_CopyFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a8b6e
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00405948
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405948
ret

Function at 0x6a97f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, edx
dec eax
test eax, eax
jb 0x6a981d
inc eax
movzx edx, byte [ebx]
mov esi, dword [ecx]
and esi, 0xff
xor edx, esi
mov edx, dword [edx*4 + 0x6ea138]
mov esi, dword [ecx]
shr esi, 8
xor edx, esi
mov dword [ecx], edx
inc ebx
dec eax
jne 0x6a97fc
pop esi
pop ebx
ret

Function at 0x6ac278
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, eax
mov edx, esi
mov eax, 0x6ac354
call fcn.00405f14
mov ebx, eax
test ebx, ebx
jle 0x6ac329
cmp ebx, 0xa
jge 0x6ac329
mov eax, dword [0x6ead30]
cmp byte [eax], 0
je 0x6ac329
mov eax, dword [0x6eaf50]
mov eax, dword [eax]
call fcn.004db790
xor edx, edx
push ebp
push 0x6ac322
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x6eaf50]
mov eax, dword [eax]
mov edx, esi
call fcn.004db528
mov ebx, eax
test ebx, ebx
jl 0x6ac303
mov eax, dword [0x6eaf50]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov edx, ebx
mov ecx, dword [eax]
call dword [ecx + 0x74]
mov eax, dword [eax + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x6ac2fc
sub eax, 4
mov eax, dword [eax]
test eax, eax
setg al
jmp 0x6ac305
xor eax, eax
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6ac341
mov eax, dword [0x6eaf50]
mov eax, dword [eax]
call fcn.004db7b8
ret
push esi
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x6ac338
test al, 0x10
je 0x6ac33c
xor eax, eax
jmp 0x6ac33e
mov al, 1
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x6ac358
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x6ac3df
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x6ac377
xor ebx, ebx
jmp 0x6ac3c9
mov edx, ebx
mov eax, edx
test eax, eax
je 0x6ac384
sub eax, 4
mov eax, dword [eax]
cmp byte [ebx + eax - 1], 0x5c
jne 0x6ac3b4
mov esi, edx
test esi, esi
je 0x6ac396
sub esi, 4
mov esi, dword [esi]
lea eax, [ebp - 4]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, ebx
call fcn.00405e30
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
jmp 0x6ac3ba
push ebx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x6ac3c3
test al, 0x10
jne 0x6ac3c7
xor ebx, ebx
jmp 0x6ac3c9
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6ac3e6
lea eax, [ebp - 4]
call fcn.00405924
ret

Function at 0x6ac3f0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x6ac4b0
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
test ebx, ebx
je 0x6ac49a
xor ecx, ecx
push ebp
push 0x6ac48e
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov edx, ebx
mov eax, edx
test eax, eax
je 0x6ac42d
sub eax, 4
mov eax, dword [eax]
cmp byte [ebx + eax - 1], 0x5c
jne 0x6ac462
mov edi, edx
test edi, edi
je 0x6ac43f
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 4]
push eax
mov ecx, edi
dec ecx
mov edx, 1
mov eax, ebx
call fcn.00405e30
mov eax, dword [ebp - 4]
call fcn.00405dc4
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
jmp 0x6ac46f
mov eax, ebx
call fcn.00405dc4
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x6ac484
test al, 0x10
je 0x6ac47f
mov esi, 1
jmp 0x6ac484
mov esi, 2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6ac49a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6ac4b7
lea eax, [ebp - 4]
call fcn.00405924
ret

Function at 0x6ad8dc
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
push 4
push 0x2002
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x6ad95e
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalLock
xor edx, edx
push ebp
push 0x6ad94d
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, eax
lea eax, [ebp - 4]
mov ecx, 4
call fcn.00403438
mov eax, dword [ebp - 8]
push eax
push 0x10
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6ad954
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalUnlock
ret
Function at 0x6c4198
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0xb0
push eax
call sub.KERNEL32.DLL_EnterCriticalSection
xor eax, eax
push ebp
push 0x6c4219
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
test ebx, ebx
jne 0x6c41cf
call fcn.00405328
jmp 0x6c4220
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0051c4c4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc8]
push eax
push 0xc8
call sub.KERNEL32.DLL_TlsSetValue_1
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0051c298
test eax, eax
setge byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6c4220
mov eax, dword [ebp - 4]
add eax, 0xb0
push eax
call sub.KERNEL32.DLL_LeaveCriticalSection
ret
movzx eax, byte [ebp - 5]
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x6c422c
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0xb0
push eax
call sub.KERNEL32.DLL_EnterCriticalSection
xor eax, eax
push ebp
push 0x6c42ba
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
test ebx, ebx
jne 0x6c4266
call fcn.00405328
jmp 0x6c42c1
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.006c3a4c
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.0051c4c4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc8]
push eax
push 0xc8
call sub.KERNEL32.DLL_TlsSetValue_1
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0051c298
test eax, eax
setge byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6c42c1
mov eax, dword [ebp - 4]
add eax, 0xb0
push eax
call sub.KERNEL32.DLL_LeaveCriticalSection
ret
movzx eax, byte [ebp - 5]
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x6c42cc
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
add eax, 0xb0
push eax
call sub.KERNEL32.DLL_EnterCriticalSection
xor eax, eax
push ebp
push 0x6c437c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00405924
test ebx, ebx
jne 0x6c4311
call fcn.00405328
jmp 0x6c4383
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.006c3a4c
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0051c4c4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc8]
push eax
push 0xc8
call sub.KERNEL32.DLL_TlsSetValue_1
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0051c298
test eax, eax
jl 0x6c4360
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x58]
cmp esi, eax
jg 0x6c4360
mov ecx, edi
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.006c48d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6c4383
mov eax, dword [ebp - 4]
add eax, 0xb0
push eax
call sub.KERNEL32.DLL_LeaveCriticalSection
ret
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x6c438c
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
add eax, 0xb0
push eax
call sub.KERNEL32.DLL_EnterCriticalSection
xor eax, eax
push ebp
push 0x6c4437
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
test ebx, ebx
jne 0x6c43cb
call fcn.00405328
jmp 0x6c443e
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.006c3a4c
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.0051c4c4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc8]
push eax
push 0xc8
call sub.KERNEL32.DLL_TlsSetValue_1
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0051c298
test eax, eax
jl 0x6c441b
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x58]
cmp esi, eax
jg 0x6c441b
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.0051bc58
inc eax
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6c443e
mov eax, dword [ebp - 4]
add eax, 0xb0
push eax
call sub.KERNEL32.DLL_LeaveCriticalSection
ret
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x6c444c
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0xb0
push eax
call sub.KERNEL32.DLL_EnterCriticalSection
xor eax, eax
push ebp
push 0x6c44c8
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp byte [eax + 0xd6], 0
je 0x6c4488
call fcn.00405328
jmp 0x6c44cf
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc8]
push eax
push 0xc8
call sub.KERNEL32.DLL_TlsSetValue_1
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0051c298
test eax, eax
setge byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6c44cf
mov eax, dword [ebp - 4]
add eax, 0xb0
push eax
call sub.KERNEL32.DLL_LeaveCriticalSection
ret
movzx eax, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret

Function at 0x6c44d8
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0xb0
push eax
call sub.KERNEL32.DLL_EnterCriticalSection
xor eax, eax
push ebp
push 0x6c4545
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc8]
push eax
push 0xc8
call sub.KERNEL32.DLL_TlsSetValue_1
mov edx, ebx
dec edx
mov eax, dword [ebp - 4]
call fcn.0051c298
test eax, eax
setge byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6c454c
mov eax, dword [ebp - 4]
add eax, 0xb0
push eax
call sub.KERNEL32.DLL_LeaveCriticalSection
ret
Function at 0x6c6004
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
mov ebx, edx
lea edx, [ebp - 0x105]
push edx
push 0
push 0
push eax
push 0
call sub.SHFolder.dll_SHGetFolderPathA
test eax, 0x80000000
sete al
neg al
sbb eax, eax
test eax, eax
je 0x6c6047
mov eax, ebx
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.00405ba4
jmp 0x6c604e
mov eax, ebx
call fcn.00405924
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x409f72
Capabilities:
Move file

Disassembly:
mov eax, 0x40bca7
call fcn.0040a890
sub esp, 0x14
push ebx
push esi
push edi
push ecx
mov eax, esp
xor ebx, ebx
mov dword [ebp - 0x20], esp
push eax
mov dword [ebp - 0x10], ebx
call fcn.0040129d
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], ebx
push eax
call fcn.00401db0
mov dword [ebp - 4], 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 1
lea eax, [ebp - 0x1c]
pop edi
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
call fcn.0040659c
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
push eax
call fcn.0040a684
mov byte [ebp - 4], 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp - 0x14]
mov esi, 0x40faa4
push eax
push esi
call fcn.00408c13
test al, al
je 0x40a019
mov ecx, dword [ebp + 8]
push esi
call fcn.00406638
mov dword [ebp - 0x10], edi
jmp 0x40a0d2
push ecx
lea eax, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
call fcn.0040659c
mov byte [ebp - 4], 4
call fcn.00401228
cmp eax, ebx
jne 0x40a046
mov ecx, dword [ebp + 8]
push esi
call fcn.00406638
mov dword [ebp - 0x10], edi
jmp 0x40a0d2
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
call fcn.0040659c
mov byte [ebp - 4], 6
nop
nop
nop
nop
nop
nop
push 0x40f964
push 0x40f960
lea ecx, [ebp - 0x18]
call fcn.00406da0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea ecx, [ebp - 0x18]
call fcn.004062b4
push eax
lea ecx, [ebp - 0x14]
call fcn.004062b4
push eax
call dword [sym.imp.MSVCRT.dll_rename]
pop ecx
test eax, eax
pop ecx
jne 0x40a0b7
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
call fcn.0040659c
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], 4
call fcn.00406565
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.00406565
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], bl
call fcn.00406565
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x5daf6220
nop
nop
nop
nop
test eax, eax
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
mov ecx, 0x486b121e
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219