joyce8/EMBER2024-capa huggingface dataset:
Function at 0x66f936d1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
or edi, 0x91fe
add edi, 0x1516c
add edi, 0x14168
pop edi
push ebx
add ebx, 0x152ca
add ebx, 0x2da5
jmp 0x66f9366d
jmp 0x66f93675
pop ebx
lea edx, [ebp - 0x1784]
mov dword [ebp - 0xca4], edx
mov eax, dword [ebp - 0x50c]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xca0], ecx
xor edx, edx
mov word [ebp - 0x214], dx
xor eax, eax
mov word [ebp - 0x110], ax
push ecx
push ecx
add esp, 4
xor ecx, 0x49ae
or ecx, 0x3d0f
call fcn.66f936c2
add byte [eax + 0x47], cl
cmp eax, 0x3e43483d
inc ebp
add esp, 4
call 0x66f936d1
add byte [ebp + 0x40], cl
xor al, 0x4c
cmp eax, dword [eax - 0x7d]
les eax, [ecx + ebx*2]
mov ecx, dword [ebp - 0xca0]
mov dx, word [ecx]
mov word [ebp - 0x103a], dx
mov eax, dword [ebp - 0xca0]
add eax, 2
mov dword [ebp - 0xca0], eax
mov cx, word [ebp - 0x103a]
mov word [ebp - 0x214], cx
mov edx, dword [ebp - 0xca4]
mov ax, word [edx]
mov word [ebp - 0x103c], ax
mov ecx, dword [ebp - 0xca4]
add ecx, 2
mov dword [ebp - 0xca4], ecx
mov dx, word [ebp - 0x103c]
mov word [ebp - 0x110], dx
push edi
call 0x66f9373d
add byte [ebx + ecx*2 + 0x50], al
inc esp
dec esp
inc edi
xor eax, dword [ebx + 0x535f04c4]
push eax
add esp, 4
and ebx, 0x10a45
sub ebx, 0x3e29
pop ebx
push eax
add eax, 0x192b
jmp 0x66f93760
pop eax
movzx eax, word [ebp - 0x110]
test eax, eax
jne 0x66f93784
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
sub ecx, edx
mov dword [ebp - 0x15f4], ecx
jmp 0x66f937e7
movzx eax, word [ebp - 0x214]
movzx ecx, word [ebp - 0x110]
cmp eax, ecx
je 0x66f936a3
movzx edx, word [ebp - 0x214]
xor edx, 0x20
movzx eax, word [ebp - 0x110]
cmp edx, eax
je 0x66f936a3
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
cmp ecx, edx
jge 0x66f937d1
mov dword [ebp - 0x15f0], 0xffffffff
jmp 0x66f937db
mov dword [ebp - 0x15f0], 1
mov eax, dword [ebp - 0x15f0]
mov dword [ebp - 0x15f4], eax
cmp dword [ebp - 0x15f4], 0
jne 0x66f93830
push ecx
xor ecx, 0x7468
xor ecx, 0x14f59
and ecx, 0x161a8
pop ecx
push ecx
push esi
add esp, 4
xor ecx, 0xc44b
call 0x66f9381e
add byte [0x4c434d4d], dh
cmp byte [edi], bh
cmp dword [edi - 0x7d], eax
les eax, [ecx + ebx*2]
mov ecx, dword [ebp - 0x50c]
mov dword [ebp - 0x754], ecx
jmp 0x66f93898
push esi
push esi
add esp, 4
add esi, 0x561c
sub esi, 0x14758
or esi, 0xd0b4
sub esi, 0x13f4
pop esi
push eax
sub eax, 0x55de
xor eax, 0x8179
or eax, 0x42f0
pop eax
mov edx, dword [ebp - 0x50c]
mov eax, dword [edx]
mov dword [ebp - 0x50c], eax
mov ecx, dword [ebp - 0x50c]
cmp ecx, dword [ebp - 0xca8]
je 0x66f9388e
mov edx, dword [ebp - 0x50c]
cmp dword [edx + 0x30], 0
jne 0x66f93644
mov dword [ebp - 0x754], 0
Function at 0x66f9373d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
or edi, 0x91fe
add edi, 0x1516c
add edi, 0x14168
pop edi
push ebx
add ebx, 0x152ca
add ebx, 0x2da5
jmp 0x66f9366d
jmp 0x66f93675
pop ebx
lea edx, [ebp - 0x1784]
mov dword [ebp - 0xca4], edx
mov eax, dword [ebp - 0x50c]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xca0], ecx
xor edx, edx
mov word [ebp - 0x214], dx
xor eax, eax
mov word [ebp - 0x110], ax
push ecx
push ecx
add esp, 4
xor ecx, 0x49ae
or ecx, 0x3d0f
call fcn.66f936c2
add byte [eax + 0x47], cl
cmp eax, 0x3e43483d
inc ebp
add esp, 4
call 0x66f936d1
add byte [ebp + 0x40], cl
xor al, 0x4c
cmp eax, dword [eax - 0x7d]
les eax, [ecx + ebx*2]
mov ecx, dword [ebp - 0xca0]
mov dx, word [ecx]
mov word [ebp - 0x103a], dx
mov eax, dword [ebp - 0xca0]
add eax, 2
mov dword [ebp - 0xca0], eax
mov cx, word [ebp - 0x103a]
mov word [ebp - 0x214], cx
mov edx, dword [ebp - 0xca4]
mov ax, word [edx]
mov word [ebp - 0x103c], ax
mov ecx, dword [ebp - 0xca4]
add ecx, 2
mov dword [ebp - 0xca4], ecx
mov dx, word [ebp - 0x103c]
mov word [ebp - 0x110], dx
push edi
call 0x66f9373d
add byte [ebx + ecx*2 + 0x50], al
inc esp
dec esp
inc edi
xor eax, dword [ebx + 0x535f04c4]
push eax
add esp, 4
and ebx, 0x10a45
sub ebx, 0x3e29
pop ebx
push eax
add eax, 0x192b
jmp 0x66f93760
pop eax
movzx eax, word [ebp - 0x110]
test eax, eax
jne 0x66f93784
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
sub ecx, edx
mov dword [ebp - 0x15f4], ecx
jmp 0x66f937e7
movzx eax, word [ebp - 0x214]
movzx ecx, word [ebp - 0x110]
cmp eax, ecx
je 0x66f936a3
movzx edx, word [ebp - 0x214]
xor edx, 0x20
movzx eax, word [ebp - 0x110]
cmp edx, eax
je 0x66f936a3
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
cmp ecx, edx
jge 0x66f937d1
mov dword [ebp - 0x15f0], 0xffffffff
jmp 0x66f937db
mov dword [ebp - 0x15f0], 1
mov eax, dword [ebp - 0x15f0]
mov dword [ebp - 0x15f4], eax
cmp dword [ebp - 0x15f4], 0
jne 0x66f93830
push ecx
xor ecx, 0x7468
xor ecx, 0x14f59
and ecx, 0x161a8
pop ecx
push ecx
push esi
add esp, 4
xor ecx, 0xc44b
call 0x66f9381e
add byte [0x4c434d4d], dh
cmp byte [edi], bh
cmp dword [edi - 0x7d], eax
les eax, [ecx + ebx*2]
mov ecx, dword [ebp - 0x50c]
mov dword [ebp - 0x754], ecx
jmp 0x66f93898
push esi
push esi
add esp, 4
add esi, 0x561c
sub esi, 0x14758
or esi, 0xd0b4
sub esi, 0x13f4
pop esi
push eax
sub eax, 0x55de
xor eax, 0x8179
or eax, 0x42f0
pop eax
mov edx, dword [ebp - 0x50c]
mov eax, dword [edx]
mov dword [ebp - 0x50c], eax
mov ecx, dword [ebp - 0x50c]
cmp ecx, dword [ebp - 0xca8]
je 0x66f9388e
mov edx, dword [ebp - 0x50c]
cmp dword [edx + 0x30], 0
jne 0x66f93644
mov dword [ebp - 0x754], 0
Function at 0x66f9381e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
or edi, 0x91fe
add edi, 0x1516c
add edi, 0x14168
pop edi
push ebx
add ebx, 0x152ca
add ebx, 0x2da5
jmp 0x66f9366d
jmp 0x66f93675
pop ebx
lea edx, [ebp - 0x1784]
mov dword [ebp - 0xca4], edx
mov eax, dword [ebp - 0x50c]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xca0], ecx
xor edx, edx
mov word [ebp - 0x214], dx
xor eax, eax
mov word [ebp - 0x110], ax
push ecx
push ecx
add esp, 4
xor ecx, 0x49ae
or ecx, 0x3d0f
call fcn.66f936c2
add byte [eax + 0x47], cl
cmp eax, 0x3e43483d
inc ebp
add esp, 4
call 0x66f936d1
add byte [ebp + 0x40], cl
xor al, 0x4c
cmp eax, dword [eax - 0x7d]
les eax, [ecx + ebx*2]
mov ecx, dword [ebp - 0xca0]
mov dx, word [ecx]
mov word [ebp - 0x103a], dx
mov eax, dword [ebp - 0xca0]
add eax, 2
mov dword [ebp - 0xca0], eax
mov cx, word [ebp - 0x103a]
mov word [ebp - 0x214], cx
mov edx, dword [ebp - 0xca4]
mov ax, word [edx]
mov word [ebp - 0x103c], ax
mov ecx, dword [ebp - 0xca4]
add ecx, 2
mov dword [ebp - 0xca4], ecx
mov dx, word [ebp - 0x103c]
mov word [ebp - 0x110], dx
push edi
call 0x66f9373d
add byte [ebx + ecx*2 + 0x50], al
inc esp
dec esp
inc edi
xor eax, dword [ebx + 0x535f04c4]
push eax
add esp, 4
and ebx, 0x10a45
sub ebx, 0x3e29
pop ebx
push eax
add eax, 0x192b
jmp 0x66f93760
pop eax
movzx eax, word [ebp - 0x110]
test eax, eax
jne 0x66f93784
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
sub ecx, edx
mov dword [ebp - 0x15f4], ecx
jmp 0x66f937e7
movzx eax, word [ebp - 0x214]
movzx ecx, word [ebp - 0x110]
cmp eax, ecx
je 0x66f936a3
movzx edx, word [ebp - 0x214]
xor edx, 0x20
movzx eax, word [ebp - 0x110]
cmp edx, eax
je 0x66f936a3
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
cmp ecx, edx
jge 0x66f937d1
mov dword [ebp - 0x15f0], 0xffffffff
jmp 0x66f937db
mov dword [ebp - 0x15f0], 1
mov eax, dword [ebp - 0x15f0]
mov dword [ebp - 0x15f4], eax
cmp dword [ebp - 0x15f4], 0
jne 0x66f93830
push ecx
xor ecx, 0x7468
xor ecx, 0x14f59
and ecx, 0x161a8
pop ecx
push ecx
push esi
add esp, 4
xor ecx, 0xc44b
call 0x66f9381e
add byte [0x4c434d4d], dh
cmp byte [edi], bh
cmp dword [edi - 0x7d], eax
les eax, [ecx + ebx*2]
mov ecx, dword [ebp - 0x50c]
mov dword [ebp - 0x754], ecx
jmp 0x66f93898
push esi
push esi
add esp, 4
add esi, 0x561c
sub esi, 0x14758
or esi, 0xd0b4
sub esi, 0x13f4
pop esi
push eax
sub eax, 0x55de
xor eax, 0x8179
or eax, 0x42f0
pop eax
mov edx, dword [ebp - 0x50c]
mov eax, dword [edx]
mov dword [ebp - 0x50c], eax
mov ecx, dword [ebp - 0x50c]
cmp ecx, dword [ebp - 0xca8]
je 0x66f9388e
mov edx, dword [ebp - 0x50c]
cmp dword [edx + 0x30], 0
jne 0x66f93644
mov dword [ebp - 0x754], 0
Function at 0x66f94ba6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push ebx
add esp, 4
call fcn.66f94ba6
add byte [edx], bh
cmp edi, dword [esi]
dec ebx
aaa
xor eax, dword [ebp + 0x3e]
xor al, 0x44
add esp, 4
call 0x66f94bb9
add byte [eax + 0x48], cl
xor bh, byte [esi]
xor al, 0x4b
dec ebp
xor cl, byte [ebp + 0x4f]
add esp, 4
sub edi, 0x610a
pop edi
lea eax, [ebp - 0x17a0]
mov dword [ebp - 0xcd0], eax
mov ecx, dword [ebp - 0x51c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xccc], edx
xor eax, eax
mov word [ebp - 0x220], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push edx
sub edx, 0x1389b
pop edx
push ecx
push edi
add esp, 4
add ecx, 0xa4b6
or ecx, 0x14d55
or ecx, 0x4780
add ecx, 0xfecb
pop ecx
push ecx
push edx
add esp, 4
sub ecx, 0xce5c
pop ecx
mov edx, dword [ebp - 0xccc]
mov ax, word [edx]
mov word [ebp - 0x1046], ax
mov ecx, dword [ebp - 0xccc]
add ecx, 2
mov dword [ebp - 0xccc], ecx
mov dx, word [ebp - 0x1046]
mov word [ebp - 0x220], dx
mov eax, dword [ebp - 0xcd0]
mov cx, word [eax]
mov word [ebp - 0x1048], cx
mov edx, dword [ebp - 0xcd0]
add edx, 2
mov dword [ebp - 0xcd0], edx
mov ax, word [ebp - 0x1048]
mov word [ebp - 0x3c], ax
push edx
sub edx, 0xa6ab
sub edx, 0x782b
and edx, 0x45b1
pop edx
push eax
push ebx
add esp, 4
or eax, 0x6890
sub eax, 0x1681f
or eax, 0x6a8f
or eax, 0x132e9
pop eax
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x66f94cc5
movzx edx, word [ebp - 0x220]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1670], edx
jmp 0x66f94d1f
movzx ecx, word [ebp - 0x220]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x66f94bed
movzx eax, word [ebp - 0x220]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x66f94bed
movzx edx, word [ebp - 0x220]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x66f94d09
mov dword [ebp - 0x162c], 0xffffffff
jmp 0x66f94d13
mov dword [ebp - 0x162c], 1
mov ecx, dword [ebp - 0x162c]
mov dword [ebp - 0x1670], ecx
cmp dword [ebp - 0x1670], 0
jne 0x66f94d68
push ecx
add ecx, 0x137c0
add ecx, 0x15035
xor ecx, 0x1b00
xor ecx, 0x25f
pop ecx
push edx
push ebx
add esp, 4
xor edx, 0xc9d8
or edx, 0xd57c
xor edx, 0x1751d
pop edx
mov edx, dword [ebp - 0x51c]
mov dword [ebp - 0x778], edx
jmp 0x66f94dd0
push eax
and eax, 0x15c8a
call 0x66f94d7c
add byte [ebx], dh
cmp bh, byte [0x384a3d50]
add esp, 4
xor eax, 0xb546
jmp 0x66f94d8b
pop eax
push ebx
sub ebx, 0x1dc6
add ebx, 0x16ddf
pop ebx
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax]
mov dword [ebp - 0x51c], ecx
mov edx, dword [ebp - 0x51c]
cmp edx, dword [ebp - 0xcd4]
je 0x66f94dc6
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x30], 0
jne 0x66f94b91
mov dword [ebp - 0x778], 0
Function at 0x66f94bb9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push ebx
add esp, 4
call fcn.66f94ba6
add byte [edx], bh
cmp edi, dword [esi]
dec ebx
aaa
xor eax, dword [ebp + 0x3e]
xor al, 0x44
add esp, 4
call 0x66f94bb9
add byte [eax + 0x48], cl
xor bh, byte [esi]
xor al, 0x4b
dec ebp
xor cl, byte [ebp + 0x4f]
add esp, 4
sub edi, 0x610a
pop edi
lea eax, [ebp - 0x17a0]
mov dword [ebp - 0xcd0], eax
mov ecx, dword [ebp - 0x51c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xccc], edx
xor eax, eax
mov word [ebp - 0x220], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push edx
sub edx, 0x1389b
pop edx
push ecx
push edi
add esp, 4
add ecx, 0xa4b6
or ecx, 0x14d55
or ecx, 0x4780
add ecx, 0xfecb
pop ecx
push ecx
push edx
add esp, 4
sub ecx, 0xce5c
pop ecx
mov edx, dword [ebp - 0xccc]
mov ax, word [edx]
mov word [ebp - 0x1046], ax
mov ecx, dword [ebp - 0xccc]
add ecx, 2
mov dword [ebp - 0xccc], ecx
mov dx, word [ebp - 0x1046]
mov word [ebp - 0x220], dx
mov eax, dword [ebp - 0xcd0]
mov cx, word [eax]
mov word [ebp - 0x1048], cx
mov edx, dword [ebp - 0xcd0]
add edx, 2
mov dword [ebp - 0xcd0], edx
mov ax, word [ebp - 0x1048]
mov word [ebp - 0x3c], ax
push edx
sub edx, 0xa6ab
sub edx, 0x782b
and edx, 0x45b1
pop edx
push eax
push ebx
add esp, 4
or eax, 0x6890
sub eax, 0x1681f
or eax, 0x6a8f
or eax, 0x132e9
pop eax
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x66f94cc5
movzx edx, word [ebp - 0x220]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1670], edx
jmp 0x66f94d1f
movzx ecx, word [ebp - 0x220]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x66f94bed
movzx eax, word [ebp - 0x220]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x66f94bed
movzx edx, word [ebp - 0x220]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x66f94d09
mov dword [ebp - 0x162c], 0xffffffff
jmp 0x66f94d13
mov dword [ebp - 0x162c], 1
mov ecx, dword [ebp - 0x162c]
mov dword [ebp - 0x1670], ecx
cmp dword [ebp - 0x1670], 0
jne 0x66f94d68
push ecx
add ecx, 0x137c0
add ecx, 0x15035
xor ecx, 0x1b00
xor ecx, 0x25f
pop ecx
push edx
push ebx
add esp, 4
xor edx, 0xc9d8
or edx, 0xd57c
xor edx, 0x1751d
pop edx
mov edx, dword [ebp - 0x51c]
mov dword [ebp - 0x778], edx
jmp 0x66f94dd0
push eax
and eax, 0x15c8a
call 0x66f94d7c
add byte [ebx], dh
cmp bh, byte [0x384a3d50]
add esp, 4
xor eax, 0xb546
jmp 0x66f94d8b
pop eax
push ebx
sub ebx, 0x1dc6
add ebx, 0x16ddf
pop ebx
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax]
mov dword [ebp - 0x51c], ecx
mov edx, dword [ebp - 0x51c]
cmp edx, dword [ebp - 0xcd4]
je 0x66f94dc6
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x30], 0
jne 0x66f94b91
mov dword [ebp - 0x778], 0
Function at 0x66f94d7c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push ebx
add esp, 4
call fcn.66f94ba6
add byte [edx], bh
cmp edi, dword [esi]
dec ebx
aaa
xor eax, dword [ebp + 0x3e]
xor al, 0x44
add esp, 4
call 0x66f94bb9
add byte [eax + 0x48], cl
xor bh, byte [esi]
xor al, 0x4b
dec ebp
xor cl, byte [ebp + 0x4f]
add esp, 4
sub edi, 0x610a
pop edi
lea eax, [ebp - 0x17a0]
mov dword [ebp - 0xcd0], eax
mov ecx, dword [ebp - 0x51c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xccc], edx
xor eax, eax
mov word [ebp - 0x220], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push edx
sub edx, 0x1389b
pop edx
push ecx
push edi
add esp, 4
add ecx, 0xa4b6
or ecx, 0x14d55
or ecx, 0x4780
add ecx, 0xfecb
pop ecx
push ecx
push edx
add esp, 4
sub ecx, 0xce5c
pop ecx
mov edx, dword [ebp - 0xccc]
mov ax, word [edx]
mov word [ebp - 0x1046], ax
mov ecx, dword [ebp - 0xccc]
add ecx, 2
mov dword [ebp - 0xccc], ecx
mov dx, word [ebp - 0x1046]
mov word [ebp - 0x220], dx
mov eax, dword [ebp - 0xcd0]
mov cx, word [eax]
mov word [ebp - 0x1048], cx
mov edx, dword [ebp - 0xcd0]
add edx, 2
mov dword [ebp - 0xcd0], edx
mov ax, word [ebp - 0x1048]
mov word [ebp - 0x3c], ax
push edx
sub edx, 0xa6ab
sub edx, 0x782b
and edx, 0x45b1
pop edx
push eax
push ebx
add esp, 4
or eax, 0x6890
sub eax, 0x1681f
or eax, 0x6a8f
or eax, 0x132e9
pop eax
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x66f94cc5
movzx edx, word [ebp - 0x220]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1670], edx
jmp 0x66f94d1f
movzx ecx, word [ebp - 0x220]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x66f94bed
movzx eax, word [ebp - 0x220]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x66f94bed
movzx edx, word [ebp - 0x220]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x66f94d09
mov dword [ebp - 0x162c], 0xffffffff
jmp 0x66f94d13
mov dword [ebp - 0x162c], 1
mov ecx, dword [ebp - 0x162c]
mov dword [ebp - 0x1670], ecx
cmp dword [ebp - 0x1670], 0
jne 0x66f94d68
push ecx
add ecx, 0x137c0
add ecx, 0x15035
xor ecx, 0x1b00
xor ecx, 0x25f
pop ecx
push edx
push ebx
add esp, 4
xor edx, 0xc9d8
or edx, 0xd57c
xor edx, 0x1751d
pop edx
mov edx, dword [ebp - 0x51c]
mov dword [ebp - 0x778], edx
jmp 0x66f94dd0
push eax
and eax, 0x15c8a
call 0x66f94d7c
add byte [ebx], dh
cmp bh, byte [0x384a3d50]
add esp, 4
xor eax, 0xb546
jmp 0x66f94d8b
pop eax
push ebx
sub ebx, 0x1dc6
add ebx, 0x16ddf
pop ebx
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax]
mov dword [ebp - 0x51c], ecx
mov edx, dword [ebp - 0x51c]
cmp edx, dword [ebp - 0xcd4]
je 0x66f94dc6
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x30], 0
jne 0x66f94b91
mov dword [ebp - 0x778], 0
Function at 0x66fcd120
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
mov edx, 0xffffffff
mov eax, dword [esp + 0x10]
mov dword [eax + 0x954], edx
mov ecx, dword [eax + 0x54]
mov eax, dword [ecx + 0x14]
lea edx, [eax + 8]
mov dword [ecx + 0x14], edx
mov edx, dword [esp + 0x14]
mov dword [eax + 4], 0xfffffff2
mov dword [eax], edx
mov edx, 2
call fcn.66f86bb0
lea esi, [esi]
lea esi, [esi]

Function at 0x66fed3a0
Capabilities:
Execute shellcode via indirect call
Get thread local storage value

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.66ff6b60
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call fcn.66ff7148
mov dword [esp], 2
call fcn.66ff6b60
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.66ff7278
call fcn.66ff70a0
lea esi, [esi]

Function at 0x66fed400
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x670150dc]
test esi, esi
jle 0x66fed520
mov eax, dword [0x670150e0]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x66fed434
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x66fed4b7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x66fed420
mov dword [esp], ebx
call fcn.66fedbf0
mov edi, eax
test eax, eax
je 0x66fed547
mov eax, dword [0x670150e0]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.66fedd30
mov edx, dword [0x670150e0]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x66fed527
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x66fed4b0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x66fed4c0
add dword [0x670150dc], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x670150e0]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x66fed4b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.66fed3a0
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x66fed43e
mov eax, dword [0x670150e0]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.66fed3a0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.66fed3a0
lea esi, [esi]
nop
Function at 0x66fed860
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x670150ec
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x670150e4]
sub esp, 4
test ebx, ebx
je 0x66fed8b5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x66fed8ae
test esi, esi
je 0x66fed8ae
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x66fed890
mov dword [esp], 0x670150ec
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x66fedbf0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x66f80000], 0x5a4d
jne 0x66fedc15
mov ecx, dword [0x66f8003c]
cmp dword [ecx + 0x66f80000], 0x4550
lea edx, [ecx + 0x66f80000]
je 0x66fedc20
ret
cmp word [ecx + 0x66f80018], 0x10b
jne 0x66fedc15
push esi
movzx eax, word [ecx + 0x66f80014]
push ebx
movzx esi, word [ecx + 0x66f80006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x66f80000
test si, si
je 0x66fedc68
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x66fedc5e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x66fedc6a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x66fedc50
xor eax, eax
pop ebx
pop esi
ret
Function at 0x4119c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [0x67a114]
xor eax, esp
mov dword [esp + 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
test ebx, ebx
jne 0x4119f6
push str.filename_null_
push ebx
push 4
push esi
call fcn.00411b20
add esp, 0x10
jmp 0x411b01
call fcn.00411870
push 0x66dbd8
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push ebx
push eax
call fcn.005b2227
add esp, 0xc
test eax, eax
jne 0x411aee
mov edi, dword [esp + 0x10]
test edi, edi
je 0x411aee
mov ecx, esi
call fcn.00411870
push 0
push 0
push edi
call fcn.005bb48e
push edi
call fcn.005baa1c
add esp, 0x10
cmp eax, 0xffffffff
jne 0x411a56
push edi
call fcn.005bdd94
add esp, 4
test eax, eax
jne 0x411ad4
push 2
push 0
push edi
call fcn.005bb48e
push edi
call fcn.005bbb2a
push 0
cdq
push 0
push edi
mov ebx, eax
mov dword [esp + 0x28], edx
call fcn.005bb48e
mov edx, dword [esp + 0x28]
mov ecx, ebx
and ecx, edx
add esp, 0x1c
cmp ecx, 0xffffffff
je 0x411ad4
test edx, edx
ja 0x411ad4
jb 0x411a92
cmp ebx, 0xffffffff
jae 0x411ad4
mov eax, ebx
or eax, edx
jne 0x411a9e
push eax
push eax
push 0xd
jmp 0x411ada
lea eax, [ebx + 1]
push eax
call fcn.00486475
push edi
push ebx
push 1
push eax
mov dword [esi + 0x50], eax
call fcn.005bb0d6
add esp, 0x14
cmp eax, ebx
jne 0x411ad4
mov eax, dword [esi + 0x50]
mov ecx, esi
mov byte [ebx + eax], 0
call fcn.00411c10
push edi
call fcn.005b201b
add esp, 4
jmp 0x411b01
push 0
push 0
push 5
push esi
call fcn.00411b20
add esp, 0x10
push edi
call fcn.005b201b
add esp, 4
jmp 0x411b01
push ebx
push str.filename_s
push 0
push 3
push esi
call fcn.00411b20
add esp, 0x14
mov eax, dword [esi + 0x38]
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004862cc
mov esp, ebp
pop ebp
ret 4

Function at 0x413590
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x67a114]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], 1
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x2190], eax
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x10], eax
mov eax, 2
mov word [ebp - 0x14], ax
push 0x6999
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
push 0x10
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x2190]
push eax
call dword [sym.imp.WS2_32.dll_bind]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffff
jne 0x413610
mov dword [ebp - 0x1c], 0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
mov dword [ecx + 0x2198], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004862cc
mov esp, ebp
pop ebp
ret 4