joyce8/EMBER2024-capa huggingface dataset:
Function at 0x547d3c
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe7c
push ebx
xor edx, edx
mov dword [ebp - 0x184], edx
mov dword [ebp - 0x178], edx
mov dword [ebp - 0x17c], edx
mov dword [ebp - 0x180], edx
mov dword [ebp - 0x174], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405904
xor eax, eax
push ebp
push 0x547fc7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x170]
xor ecx, ecx
mov edx, 0x160
call fcn.00403c1c
push 0x4000
push 0x160
lea eax, [ebp - 0x170]
push eax
push 0
lea edx, [ebp - 0x174]
mov eax, dword [ebp - 4]
call fcn.0040e0e4
mov eax, dword [ebp - 0x174]
call fcn.00405914
push eax
call sub.shell32.dll_SHGetFileInfoA
cmp dword [ebp - 0x16c], 0
jne 0x547dd9
mov ebx, 0x25
jmp 0x547f9c
mov eax, dword [ebp - 0x170]
test eax, eax
je 0x547de9
push eax
call sub.user32.dll_DestroyIcon
mov eax, dword [0x588558]
call fcn.00406a00
dec eax
test eax, eax
jl 0x547e2b
inc eax
mov dword [ebp - 0xc], 0
mov edx, dword [0x588558]
mov ecx, dword [ebp - 0xc]
mov edx, dword [edx + ecx*8]
cmp edx, dword [ebp - 0x16c]
jne 0x547e25
mov eax, dword [0x588558]
mov edx, dword [ebp - 0xc]
mov ebx, dword [eax + edx*8 + 4]
jmp 0x547f9c
inc dword [ebp - 0xc]
dec eax
jne 0x547e00
mov dl, 1
mov eax, dword [0x434fb4]
call fcn.0043e9c0
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x547edc
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x16c]
mov eax, dword [0x58847c]
call fcn.0047d21c
mov eax, dword [0x588360]
mov eax, dword [eax + 0x368]
mov edx, dword [ebp - 0x10]
call fcn.0047d124
mov dword [ebp - 0xc], eax
lea edx, [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.00547a84
lea edx, [ebp - 0x178]
mov eax, dword [ebp - 8]
call fcn.004930c0
mov eax, dword [ebp - 0x178]
push eax
lea edx, [ebp - 0x180]
mov eax, dword [ebp - 0xc]
call fcn.0040d470
mov ecx, dword [ebp - 0x180]
lea eax, [ebp - 0x17c]
mov edx, 0x547fe0
call fcn.00405760
mov edx, dword [ebp - 0x17c]
mov eax, dword [0x588454]
pop ecx
call fcn.004250a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x547ee3
mov eax, dword [ebp - 0x10]
call fcn.00404510
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x547fce
lea eax, [ebp - 0x184]
mov edx, 5
call fcn.00405474
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405474
ret
Function at 0x552568
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x552719
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
cmp dword [eax - 8], 0
je 0x5526f6
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
cmp dword [eax + 0x124], 0
je 0x5526f6
mov eax, dword [ebp + 8]
push eax
call fcn.00552524
pop ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x10]
mov eax, dword [eax + 0x5fc]
cmp byte [eax + 0x38], 0
je 0x5525ee
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0xd4]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405914
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
jmp 0x5525fb
cmp dword [0x5884a4], 0
je 0x5526f6
mov ecx, 1
mov edx, dword [0x5884a4]
mov eax, 0x55272c
call fcn.004ab918
test eax, eax
jne 0x552668
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0xd4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov edx, dword [eax + 0xd4]
lea eax, [ebp - 0x24]
mov ecx, dword [0x5884a4]
call fcn.00405760
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
call fcn.00405914
push eax
mov eax, dword [ebp - 0xc]
call fcn.00405914
push eax
call sub.kernel32.dll_MoveFileA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x11], al
jmp 0x5526f6
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0xd4]
mov dword [ebp - 0x18], eax
lea edx, [ebp - 0x28]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0xd4]
call fcn.0040de80
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x55272c
mov dword [ebp - 0x34], eax
lea edx, [ebp - 0x38]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0xd4]
call fcn.0040e040
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x30], eax
lea edx, [ebp - 0x34]
mov ecx, 1
mov eax, dword [0x5884a4]
call fcn.00518d10
mov edx, dword [ebp - 0x2c]
pop eax
call fcn.0040571c
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
call fcn.00405914
push eax
mov eax, dword [ebp - 0x18]
call fcn.00405914
push eax
call sub.kernel32.dll_MoveFileA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x1d], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x552720
lea eax, [ebp - 0x38]
call fcn.00405450
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.00405474
ret
Function at 0x55f918
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
xor edx, edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x55faf9
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
cmp dword [0x588364], 0
je 0x55fad6
cmp byte [0x58854d], 0
je 0x55f972
cmp dword [0x5885b8], 0
jbe 0x55f972
lea eax, [ebp - 8]
mov edx, dword [0x5885b8]
call fcn.004054e8
jmp 0x55f97f
lea ecx, [ebp - 8]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00559470
movzx eax, byte [0x588400]
sub al, 1
jb 0x55fa33
je 0x55f9cf
dec al
jne 0x55fa76
lea eax, [ebp - 0x24]
mov ecx, 0x55fb10
mov edx, dword [0x588538]
call fcn.00405760
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.00514088
test al, al
jne 0x55f9c8
push ebp
call fcn.0055f89c
pop ecx
jmp 0x55fad6
mov bl, 1
jmp 0x55fa76
lea eax, [ebp - 0x28]
mov ecx, 0x55fb10
mov edx, dword [0x588538]
call fcn.00405760
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.00405914
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
xor edx, edx
mov eax, 0x55fb20
call fcn.00514730
push 0x80000002
mov eax, 0x55fb20
mov ecx, dword [ebp - 8]
xor edx, edx
call fcn.00514580
test al, al
jne 0x55fa2f
push ebp
call fcn.0055f89c
pop ecx
jmp 0x55fad6
mov bl, 1
jmp 0x55fa76
lea eax, [ebp - 0x2c]
mov ecx, 0x55fb10
mov edx, dword [0x588538]
call fcn.00405760
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
call fcn.00405914
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x15], al
push 0
mov eax, 0x55fb20
mov ecx, dword [ebp - 8]
xor edx, edx
call fcn.00514580
mov ebx, eax
mov eax, dword [0x588374]
mov edx, dword [eax]
call dword [edx + 0x14]
cmp eax, 0x32
jl 0x55faa3
lea edx, [ebp - 0x30]
mov eax, dword [0x588374]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edx, dword [ebp - 0x30]
xor ecx, ecx
mov eax, 0x55fb40
call fcn.00514088
jmp 0x55fab3
mov eax, 0x55fb40
call fcn.00405914
push eax
call sub.kernel32.dll_DeleteFileA
test bl, bl
je 0x55fad6
mov eax, dword [0x5884cc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
call fcn.00405914
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x1d], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55fb00
lea eax, [ebp - 0x30]
mov edx, 4
call fcn.00405474
lea eax, [ebp - 8]
call fcn.00405450
ret
Function at 0x565620
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x5656b9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5884cc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405914
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
lea eax, [ebp - 0x14]
mov ecx, 0x5656cc
mov edx, dword [0x588538]
call fcn.00405760
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.00405914
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
xor edx, edx
mov eax, 0x5656dc
call fcn.00514730
mov eax, 0x5656dc
mov edx, 0x80000002
call fcn.00514730
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5656c0
lea eax, [ebp - 0x14]
call fcn.00405450
ret

Function at 0x56a9cc
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x56aafe
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov edx, dword [eax - 8]
lea eax, [ebp - 0x1c]
mov ecx, 0x56ab14
call fcn.00405760
mov eax, dword [ebp - 0x1c]
call fcn.0040db48
test al, al
je 0x56aa69
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.0040db48
test al, al
jne 0x56aa21
mov al, 1
jmp 0x56aa6b
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, dword [eax - 8]
lea eax, [ebp - 0x20]
mov ecx, 0x56ab24
call fcn.00405760
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
call fcn.00405914
push eax
mov eax, dword [ebp - 4]
call fcn.00405914
push eax
call sub.kernel32.dll_MoveFileA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
movzx eax, byte [ebp - 9]
jmp 0x56aa6b
xor eax, eax
test al, al
je 0x56aab7
mov eax, dword [ebp + 8]
mov edx, dword [eax - 8]
lea eax, [ebp - 0x24]
mov ecx, 0x56ab14
call fcn.00405760
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
call fcn.00405914
push eax
mov eax, dword [ebp - 0x10]
call fcn.00405914
push eax
call sub.kernel32.dll_MoveFileA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x15], al
movzx eax, byte [ebp - 0x15]
jmp 0x56aab9
xor eax, eax
mov ebx, eax
test bl, bl
je 0x56aae3
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
lea edx, [ebp - 0x28]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.00513dfc
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp + 8]
add eax, 0xfffffff4
call fcn.004054e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56ab05
lea eax, [ebp - 0x28]
mov edx, 4
call fcn.00405474
ret
Function at 0x573e24
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x581d10]
mov eax, dword [eax]
call fcn.0048eaa0
call fcn.005481b0
mov eax, dword [0x588404]
call fcn.0050dccc
push 0
mov eax, dword [0x581d10]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
mov byte [0x588464], 1
pop ebp
ret

Function at 0x57761c
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405904
xor eax, eax
push ebp
push 0x577695
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebx + 4]
call fcn.00405450
lea eax, [ebx + 0x30]
mov edx, dword [0x574f04]
call fcn.00406cdc
lea eax, [ebx + 0x18]
mov edx, dword [0x407aec]
call fcn.00406cdc
lea eax, [ebx + 0x10]
mov edx, 0x5776a8
call fcn.004054a4
lea eax, [ebx + 0x1c]
call fcn.004144b4
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0057799c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57769c
lea eax, [ebp - 4]
call fcn.00405450
ret

Function at 0x57a81c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, 0x577f28
call fcn.00407a7c
mov ebx, dword [0x581d10]
xor eax, eax
push ebp
push 0x57a990
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x581a0c]
mov eax, dword [eax]
mov dword [eax + 0x14], 0x577d84
push 0x11
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
test ah, 0x80
jne 0x57a8cf
mov eax, dword [0x581a0c]
mov eax, dword [eax]
mov edx, 0x57a9a8
call fcn.00491390
test al, al
jne 0x57a8a8
mov eax, dword [0x581a0c]
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
lea eax, [ebp - 0x14]
mov edx, 0x57a9c0
call fcn.00405760
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov edx, 0x10
call fcn.005138c4
mov eax, 1
call fcn.00405364
mov eax, dword [0x581a0c]
mov eax, dword [eax]
cmp byte [eax + 8], 0
jne 0x57a8cf
call fcn.00577e1c
test al, al
je 0x57a8cf
mov eax, dword [0x581a0c]
mov eax, dword [eax]
call fcn.00491468
jmp 0x57a97a
mov eax, dword [ebx]
call fcn.0048f500
mov eax, dword [0x581d9c]
mov eax, dword [eax]
mov dl, 1
call fcn.004b2390
mov eax, dword [0x581d9c]
mov eax, dword [eax]
mov edx, 0x57a9d8
call fcn.004b124c
mov ecx, dword [0x581bb4]
mov eax, dword [ebx]
mov edx, dword [0x542010]
call fcn.0048f520
mov ecx, dword [0x5819bc]
mov eax, dword [ebx]
mov edx, dword [0x511508]
call fcn.0048f520
mov ecx, dword [0x581db0]
mov eax, dword [ebx]
mov edx, dword [0x52e824]
call fcn.0048f520
mov ecx, dword [0x581930]
mov eax, dword [ebx]
mov edx, dword [0x5323e0]
call fcn.0048f520
mov ecx, dword [0x581d20]
mov eax, dword [ebx]
mov edx, dword [0x532578]
call fcn.0048f520
mov ecx, dword [0x581d08]
mov eax, dword [ebx]
mov edx, dword [0x541778]
call fcn.0048f520
mov eax, dword [0x581bb4]
mov eax, dword [eax]
call fcn.00572188
mov eax, dword [ebx]
call fcn.0048f5b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57a997
lea eax, [ebp - 0x14]
call fcn.00405450
ret
Function at 0xc31280
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x9a0015
lea edi, [esi - 0x59f015]
mov dword [edi + 0x82632c], 0xe1bde4ce
push edi
jmp 0xc312aa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xc312b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xc312a0
mov eax, 1
add ebx, ebx
jne 0xc312c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xc312d4
jne 0xc312f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xc312f3
dec eax
add ebx, ebx
jne 0xc312e0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xc312b8
add ebx, ebx
jne 0xc312ef
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xc31345
xor ecx, ecx
sub eax, 3
jb 0xc3130b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xc3137a
sar eax, 1
mov ebp, eax
jmp 0xc31316
add ebx, ebx
jne 0xc31316
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xc312e4
inc ecx
add ebx, ebx
jne 0xc31324
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xc312e4
add ebx, ebx
jne 0xc31331
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xc31326
jne 0xc31342
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xc31326
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xc31364
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xc31356
jmp 0xc312a6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xc31364
add edi, ecx
jmp 0xc312a6
pop esi
mov edi, esi
mov ecx, 0x18d69
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xc31382
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xc31387
lea edi, [esi + 0x82f000]
mov eax, dword [edi]
or eax, eax
je 0xc313ef
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8354cc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x835530]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xc313ad
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x835538]
or eax, eax
je 0xc313e9
mov dword [ebx], eax
add ebx, 4
jmp 0xc313ca
call dword [esi + 0x835534]
mov ebp, dword [esi + 0x83553c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
lea ebx, [esi - 0x1000]
lea edi, [ebx + 0x83144a]
push edi
xor eax, eax
stosb byte es:[edi], al
pop ecx
dec ecx
push eax
push 1
push ebx
call ecx
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xc3143b
sub esp, 0xffffff80
jmp 0x4012f0
Function at 0x435035
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push dword [0x455214]
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call esi
test eax, eax
je 0x43506e
mov eax, dword [0x455210]
cmp eax, 0xffffffff
je 0x43506e
push eax
push dword [0x455214]
call esi
call eax
push 0x1e81b4
jmp fcn.004caf18
mov esi, str.KERNEL32.DLL
push esi
call dword [0x446048]
push 0x1e8108
jmp fcn.004caf18

Function at 0x4350b0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push dword [0x455214]
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call esi
test eax, eax
je 0x4350e9
mov eax, dword [0x455210]
cmp eax, 0xffffffff
je 0x4350e9
push eax
push dword [0x455214]
call esi
call eax
push 0x1e8090
jmp fcn.004caf18
mov esi, str.KERNEL32.DLL
push esi
call dword [0x446048]
push 0x1e7fe4
jmp fcn.004caf18

Function at 0x476d4c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi]
mov ecx, dword [esi + 4]
test eax, eax
jle 0x476da6
push edi
mov edi, dword [ebp + 0x10]
sub dword [ebp + 0xc], edi
mov dword [ebp + 8], eax
mov edi, edi
inc bl
lea edi, [edi + 1]
movzx ebx, bl
mov dl, byte [esi + ebx + 8]
add cl, dl
movzx ecx, cl
mov al, byte [esi + ecx + 8]
mov byte [esi + ebx + 8], al
add al, dl
movzx eax, al
mov byte [esi + ecx + 8], dl
movzx edx, byte [eax + esi + 8]
mov eax, dword [ebp + 0xc]
xor dl, byte [eax + edi - 1]
dec dword [ebp + 8]
mov byte [edi - 1], dl
jne 0x476d6c
mov eax, dword [ebp + 0x14]
pop edi
mov dword [esi], ebx
mov dword [esi + 4], ecx
pop esi
pop ebx
pop ebp
ret
Function at 0x485e6c
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
pushfd
add ebp, 0xd
popfd
lea ebp, [ebp - 0xd]
xchg ecx, ebp
lea esp, [esp - 4]
mov dword [esp], ecx
mov ecx, ebp
mov ebp, dword [esp]
xchg ebp, edx
mov edx, esp
push ebp
xchg ebp, edx
pop edx
leave
push edi
mov edi, dword [esp + 4]
lea edi, [edi + 0x56]
xchg dword [esp + 4], edi
mov dword [esp + 4], edi
mov edi, dword [esp]
lea esp, [esp + 4]
add dword [esp], 0xfffffced
xchg dword [esp], edx
push eax
mov eax, dword [esp + 4]
lea eax, [eax + 0x4f]
xchg dword [esp + 4], eax
mov dword [esp + 4], eax
mov eax, dword [esp]
lea esp, [esp + 4]
pushfd
push edi
mov edi, dword [esp + 4]
lea edi, [edi + 0x2d]
xchg dword [esp + 4], edi
mov dword [esp + 4], edi
mov edi, dword [esp]
lea esp, [esp + 4]
add ebp, 0x79
pushfd
add ebp, 0x3c
popfd
lea ebp, [ebp - 0x3c]
popfd
lea edi, [edi]
lea ebp, [ebp - 0x79]
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x44]
xchg dword [esp + 4], ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp]
lea esp, [esp + 4]
xchg dword [esp + 4], edx
mov ecx, ecx
lea eax, [eax]
push edx
mov edx, dword [esp + 4]
lea edx, [edx + 0x44]
xchg dword [esp + 4], edx
mov dword [esp + 4], edx
mov edx, dword [esp]
lea esp, [esp + 4]
xchg dword [esp], edx
mov ecx, ecx
xchg esi, eax
lea esp, [esp - 4]
mov dword [esp], esi
mov esi, eax
mov eax, dword [esp]
xchg esi, eax
mov esi, dword [esp + 4]
push eax
xchg esi, eax
pop esi
lea eax, [eax + 0x73]
push esi
mov esi, dword [esp + 4]
lea esi, [esi + 0x76]
xchg dword [esp + 4], esi
mov dword [esp + 4], esi
mov esi, dword [esp]
lea esp, [esp + 4]
xchg dword [esp + 4], eax
push edi
mov edi, dword [esp + 4]
lea edi, [edi + 0x62]
xchg dword [esp + 4], edi
mov dword [esp + 4], edi
mov edi, dword [esp]
lea esp, [esp + 4]
mov dword [esp + 4], eax
push ebp
mov ebp, esp
leave
xchg esi, eax
mov esi, dword [esp]
push eax
xchg esi, eax
pop esi
lea esp, [esp + 4]
push esi
mov esi, dword [esp + 4]
lea esi, [esi + 1]
xchg dword [esp + 4], esi
mov dword [esp + 4], esi
mov esi, dword [esp]
lea esp, [esp + 4]
popfd
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x69]
xchg dword [esp + 4], ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp]
lea esp, [esp + 4]
xchg ebx, eax
lea esp, [esp - 4]
mov dword [esp], eax
mov eax, ebx
mov ebx, dword [esp]
xchg ebx, eax
mov eax, dword [esp + 1]
push ebx
xchg ebx, eax
pop eax
xchg ecx, ebx
xchg dword [esp], ecx
xchg ecx, ebx
lea esp, [esp + 4]
jmp fcn.00476d4c
Function at 0x412722
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x4186e0], 0
push ebx
push esi
mov esi, 0x4186e8
jne 0x41274e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x418700], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4186e0], 1
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x4127eb
push 0x14
push 8
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x412815
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4186e4]
test eax, eax
je 0x412790
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x4186e4], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x41281a
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x412815
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x686422
Capabilities:
Check for trap flag exception

Disassembly:
clc
mov byte [esp], ah
rol dl, 3
push dword [esp]
bt sp, bp
stc
xor dl, 0xdb
stc
clc
push word [esp + 8]
popf
call fcn.007bd925
push edi
pushfd
bts esi, 8
mov dword [esp], ebx
xor edi, 0x9f5aa022
btr di, sp
mov esi, dword [esp + 0x14]
pushal
mov edi, dword [esp + 0x38]
rcr dl, cl
xadd dl, al
call fcn.006b7a08
mov byte es:[0xbc069e06], al
mov ch, 0x4f
jno 0x68649c
nop
ret
pop es
rol byte [0x921cca74], 0x4d
sti
in al, 0x43
mov ebp, 0x7311d730
dec edi
sub al, 0xc
outsb dx, byte [esi]
cmp dword [esp + eax - 0x41], esi
wait
and bh, byte [eax + 0x6fb4c1f7]
mov edi, 0xfa5cb806
salc
push ss
pop ebx
mov bh, 0x4c
mov cl, 0xbe
xor dword [ebp + edi - 0x1cb6ca1b], esi
mov ah, 0xa9
sub dword [ebp + 0x5a5f453e], esp
sbb al, byte [ecx]
jle 0x68654b
push edi
in eax, 0xe1
ret 0xde93
aad 0xb4
invalid

Function at 0x6ade20
Capabilities:
Encode data using xor

Disassembly:
stc
push dword [edi]
pop dword [esp + 0x28]
stc
cmc
test cx, dx
cmp edi, ebx
push dword [esp + 0xc]
jmp 0x7bd62c
push dword [esp + 4]
pushfd
lea esp, [esp + 0x34]
ja 0x6b2bd4
push edx
push ebx
neg al
sub ebx, edi
lea edi, [edx*4 - 0x37f097b2]
add esp, 8
add ebx, esp
mov di, 0x8983
add di, ax
adc di, 0x6473
mov edi, ebx
shr al, 3
mov al, 0x2e
bt bx, 0xb
cmc
call fcn.006b72ec
pop es
xor esi, dword [ebx + ebx*2 + 0x4a]
insd dword es:[edi], dx
movsd dword es:[edi], dword [esi]
adc al, 0x44
invalid