joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6f2524b0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Get process heap force flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov eax, dword [ecx + 8]
mov esi, dword [ecx]
mov edi, dword [ecx + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x20], eax
test esi, esi
je 0x6f252599
mov ecx, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [ebp - 0x28], ecx
call ecx
sub esp, 0x20
mov edx, eax
mov dword [esp + 8], edx
mov eax, dword fs:[0x18]
mov dword [ebp - 0x24], edx
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x6f2526dd
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov edx, dword [ebp - 0x24]
mov dword [esp + 8], esi
mov esi, ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x14], edx
mov dword [esp + 4], 0
mov dword [esp], 0
mov ecx, dword [ebp - 0x28]
call ecx
sub esp, 0x20
test edi, edi
je 0x6f2526d0
mov ecx, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [ebp - 0x28], ecx
call ecx
sub esp, 0x20
mov edx, eax
mov dword [esp + 8], edx
mov eax, dword fs:[0x18]
mov dword [ebp - 0x24], edx
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x6f2526d4
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov edx, dword [ebp - 0x24]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], edi
mov dword [esp + 0x14], edx
mov dword [esp + 4], 0
mov dword [esp], 0
mov ecx, dword [ebp - 0x28]
call ecx
sub esp, 0x20
mov eax, dword [ebp - 0x20]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], ebx
mov dword [esp], esi
mov dword [esp + 8], eax
call sym.winmm.dll_mmioRenameA
sub esp, 0x10
mov dword [ebp - 0x1c], eax
mov dword [esp + 8], esi
mov esi, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 4], 0
mov edi, dword fs:[0x18]
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov eax, dword [ebp - 0x1c]
sub esp, 0xc
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
xor ebx, ebx
jmp 0x6f25265b
mov dword [ebp - 0x1c], 7
jmp 0x6f25267b
xor esi, esi
mov dword [ebp - 0x1c], 7
jmp 0x6f25267b
Function at 0x6f2526f0
Capabilities:
Get process heap flags

Disassembly:
push esi
push ebx
mov ebx, eax
sub esp, 0x14
mov dword [esp], 0x6f266460
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov eax, dword [0x6f27af40]
mov dword [0x6f27a52c], 0
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_SetEvent]
sub esp, 4
mov dword [esp], 0x6f266460
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 4
test byte [ebx], 2
jne 0x6f252768
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
add esp, 0x14
pop ebx
pop esi
ret
mov edx, dword [ebx + 4]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
jmp 0x6f25273d
Function at 0x6f255b20
Capabilities:
Get process heap flags

Disassembly:
push ebx
mov ebx, eax
sub esp, 0x18
mov dword [eax + 0x14], 0
mov eax, dword [eax + 0xa0]
test eax, eax
jne 0x6f255b4f
mov eax, dword [ebx + 0x1c]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 0x2c]
mov dword [ebx + 0xa0], 1
sub esp, 4
mov eax, dword [ebx + 0x34]
test eax, eax
je 0x6f255b70
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msacm32.dll_acmStreamClose
mov dword [ebx + 0x34], 0
sub esp, 8
mov eax, dword [ebx + 0x18]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
mov eax, dword [ebx + 0x1c]
mov dword [ebx + 0x18], 0
sub esp, 4
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
mov eax, dword [ebx + 0x28]
mov dword [ebx + 0x1c], 0
sub esp, 4
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
mov edx, dword [ebx + 0x30]
mov dword [ebx + 0x28], 0
sub esp, 4
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
add esp, 0x18
pop ebx
ret
Function at 0x6f2563e0
Capabilities:
Create thread

Disassembly:
push esi
push ebx
sub esp, 0x34
mov dword [esp], 0x6f266420
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov eax, dword [0x6f27a6f0]
sub esp, 4
test eax, eax
je 0x6f256588
mov eax, dword [0x6f27a6f4]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
sub esp, 8
cmp eax, 0x102
je 0x6f256560
test eax, eax
jne 0x6f256543
test byte [0x6f266438], 8
jne 0x6f256638
mov eax, dword [0x6f27a6f4]
mov dword [0x6f27a6f0], 0
mov ebx, dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [esp], eax
call ebx
mov dword [0x6f27a6f4], 0
sub esp, 4
test byte [0x6f266438], 8
jne 0x6f2565d3
mov dword [esp + 8], 0x6f27a6ec
mov dword [esp + 4], fcn.6f2563e0
mov dword [esp], 4
call dword [sym.imp.kernel32.dll_GetModuleHandleExW]
sub esp, 0xc
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateEventW]
sub esp, 0x10
mov dword [esp + 0x28], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x6f258a00
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateThread]
sub esp, 0x18
mov dword [0x6f27a6f4], eax
test eax, eax
je 0x6f256600
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x28]
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 2
call dword [sym.imp.kernel32.dll_WaitForMultipleObjects]
sub esp, 0x10
mov esi, eax
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call ebx
sub esp, 4
test esi, esi
je 0x6f256560
cmp esi, 1
je 0x6f256668
mov dword [esp], 0x6f266420
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
xor eax, eax
sub esp, 4
add esp, 0x34
pop ebx
pop esi
ret
lock add dword [0x6f27a6f8], 1
mov dword [esp], 0x6f266420
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, 1
sub esp, 4
add esp, 0x34
pop ebx
pop esi
ret
mov eax, dword [0x6f27a6f4]
mov ebx, dword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
je 0x6f256462
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [0x6f27a6f4]
sub esp, 8
mov dword [esp], eax
call ebx
mov dword [0x6f27a6f4], 0
sub esp, 4
test byte [0x6f266438], 8
je 0x6f25646f
mov dword [esp + 0xc], str.Starting_up_devices_thread_n
mov dword [esp + 8], str.WINMM_StartDevicesThread
mov dword [esp + 4], 0x6f266438
mov dword [esp], 3
call fcn.6f255f70
jmp 0x6f25646f
mov dword [esp], 0x6f266420
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
sub esp, 4
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call ebx
mov eax, dword [0x6f27a6ec]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_FreeLibrary]
xor eax, eax
sub esp, 4
jmp 0x6f256555
mov dword [esp + 0xc], str.Devices_thread_left_dangling_message_window__n
mov dword [esp + 8], str.WINMM_StartDevicesThread
mov dword [esp + 4], 0x6f266438
mov dword [esp], 3
call fcn.6f255f70
jmp 0x6f25643b
mov eax, dword [0x6f27a6f4]
mov dword [esp], eax
call ebx
mov dword [0x6f27a6f4], 0
mov dword [0x6f27a6f0], 0
sub esp, 4
jmp 0x6f256543
Function at 0x6f257ff0
Capabilities:
Get process heap flags

Disassembly:
push ebp
push edi
push esi
mov esi, eax
push ebx
xor ebx, ebx
sub esp, 0x3c
mov dword [esp + 0x2c], edx
mov dword [esp + 0x28], ecx
jmp 0x6f258040
lea edi, [ebp + 0xcc]
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov eax, dword [ebp + 0x14]
sub esp, 4
test eax, eax
je 0x6f2580ae
mov dword [esp], edi
add ebx, 1
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
sub esp, 4
cmp ebx, 0x100
je 0x6f2580ea
mov ebp, dword [esi + ebx*4]
test ebp, ebp
jne 0x6f258008
mov dword [esp + 8], 0xe8
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ebp, eax
mov dword [esi + ebx*4], eax
test eax, eax
je 0x6f2580f3
lea edi, [eax + 0xcc]
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov eax, dword [ebp + 0xcc]
sub esp, 4
mov dword [eax + 0x18], str._Users_gcenx_Documents_GitHub_wineskincx_dlls_winmm_waveform.c:_WINMM_Device.lock
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov eax, dword [ebp + 0x14]
sub esp, 4
test eax, eax
jne 0x6f258025
cmp dword [esp + 0x50], 1
mov dword [ebp + 0x14], 1
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
sbb ecx, ecx
and ecx, 0xffffc000
shl edx, 8
add ecx, 0xc000
or edx, ebx
mov dword [ebp + 0xe4], eax
or edx, ecx
mov dword [ebp + 0x10], edx
add esp, 0x3c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [0x6f266438], 8
jne 0x6f258100
xor ebp, ebp
jmp 0x6f2580e0
mov eax, dword [esp + 0x28]
mov dword [esp + 0xc], str.All_devices_in_use:_mmdevice:__u_n
xor ebp, ebp
mov dword [esp + 8], str.WINMM_FindUnusedDevice
mov dword [esp + 4], 0x6f266438
mov dword [esp], 3
mov dword [esp + 0x10], eax
call fcn.6f255f70
jmp 0x6f2580e0
Function at 0x6f259e60
Capabilities:
Get process heap flags

Disassembly:
push edi
mov edi, eax
push esi
mov esi, edx
push ebx
sub esp, 0x20
call fcn.6f255340
mov ebx, eax
test byte [0x6f266438], 8
jne 0x6f259f10
test ebx, ebx
je 0x6f259f44
lea edi, [ebx + 0xcc]
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov edx, dword [ebx + 0x14]
sub esp, 4
test edx, edx
je 0x6f259f50
mov eax, dword [ebx + 0x20]
test eax, eax
je 0x6f259eef
mov eax, dword [ebx + 0x34]
test eax, eax
je 0x6f259eef
mov ebx, dword [esi + 0x1c]
mov dword [esp + 8], 0
mov dword [esp], eax
mov dword [esp + 4], ebx
call sub.msacm32.dll_acmStreamUnprepareHeader
sub esp, 0xc
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
xor eax, eax
and dword [esi + 0x10], 0xfffffffd
sub esp, 4
add esp, 0x20
pop ebx
pop esi
pop edi
ret
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0x6f26c690
mov dword [esp + 8], str.WINMM_UnprepareHeader
mov dword [esp + 4], 0x6f266438
mov dword [esp], 3
call fcn.6f255f70
test ebx, ebx
jne 0x6f259e86
mov eax, 5
add esp, 0x20
pop ebx
pop esi
pop edi
ret
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, 5
sub esp, 4
jmp 0x6f259f49
Function at 0x6f25a980
Capabilities:
Get process heap flags

Disassembly:
push ebp
push edi
mov edi, eax
push esi
mov esi, edx
push ebx
sub esp, 0x4c
call fcn.6f255340
mov ebx, eax
test byte [0x6f266438], 8
jne 0x6f25aac8
test ebx, ebx
je 0x6f25aafc
lea ebp, [ebx + 0xcc]
mov dword [esp], ebp
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov ecx, dword [ebx + 0x14]
sub esp, 4
test ecx, ecx
je 0x6f25ab10
mov edx, dword [ebx + 0x20]
test edx, edx
je 0x6f25aa9f
mov eax, dword [ebx + 0x34]
test eax, eax
je 0x6f25aa9f
lea edx, [esp + 0x3c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov edx, dword [esi + 4]
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msacm32.dll_acmStreamSize
sub esp, 0x10
mov edi, eax
test eax, eax
jne 0x6f25ab28
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], 0
mov edi, dword fs:[0x18]
add eax, 0x54
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov edx, eax
test eax, eax
je 0x6f25ab71
movq xmm0, qword [0x6f26ee50]
mov dword [eax + 8], esi
mov dword [esp + 0x2c], edx
movq qword [eax], xmm0
mov eax, dword [esi]
mov dword [edx + 0x28], 0
mov dword [edx + 0xc], eax
mov eax, dword [esi + 4]
mov dword [edx + 0x10], eax
mov eax, dword [esi + 0xc]
mov dword [edx + 0x18], eax
lea eax, [edx + 0x54]
mov dword [edx + 0x1c], eax
mov eax, dword [esp + 0x3c]
mov dword [edx + 0x20], eax
mov dword [esp + 4], edx
mov dword [esp + 8], 0
mov eax, dword [ebx + 0x34]
mov dword [esp], eax
call sub.msacm32.dll_acmStreamPrepareHeader
sub esp, 0xc
test eax, eax
mov ebx, eax
mov edx, dword [esp + 0x2c]
jne 0x6f25ab40
mov dword [esi + 0x1c], edx
mov dword [esp], ebp
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, dword [esi + 0x10]
sub esp, 4
and eax, 0xffffffee
or eax, 2
mov dword [esi + 0x10], eax
xor eax, eax
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0x6f26c690
mov dword [esp + 8], str.WINMM_PrepareHeader
mov dword [esp + 4], 0x6f266438
mov dword [esp], 3
call fcn.6f255f70
test ebx, ebx
jne 0x6f25a9a7
mov eax, 5
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebp
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, 5
sub esp, 4
jmp 0x6f25ab01
mov dword [esp], ebp
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, edi
sub esp, 4
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
mov dword [esp], ebp
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, ebx
sub esp, 4
jmp 0x6f25aab9
mov dword [esp], ebp
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
push eax
mov eax, 7
jmp 0x6f25aab9
Function at 0x6f25b490
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov esi, dword [ecx + 4]
mov edx, dword [ecx]
mov ebx, dword [ecx + 8]
test esi, esi
je 0x6f25b5b8
test ebx, ebx
jne 0x6f25b4d0
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
lea ecx, [ebx + ebx]
mov dword [ebp - 0x1c], edx
mov eax, dword fs:[0x18]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov edi, eax
test eax, eax
je 0x6f25b5cd
mov edx, dword [ebp - 0x1c]
lea eax, [edx - 0x20]
cmp eax, 3
jbe 0x6f25b550
cmp edx, 0x15
jbe 0x6f25b550
mov ebx, 9
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, ebx
sub esp, 0xc
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov dword [esp + 0xc], ebx
mov dword [esp + 8], edi
mov dword [esp + 4], edx
mov eax, dword [0x6f27af44]
mov dword [esp], eax
call dword [sym.imp.user32.dll_LoadStringW]
sub esp, 0x10
test eax, eax
jle 0x6f25b514
mov dword [esp + 0x14], ebx
xor ebx, ebx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
sub esp, 0x20
jmp 0x6f25b519
lea esp, [ebp - 0x10]
mov ebx, 0xb
pop ecx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov ebx, 7
jmp 0x6f25b4b8
Function at 0x6f260830
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov esi, dword [ecx + 4]
mov edx, dword [ecx]
mov ebx, dword [ecx + 8]
test esi, esi
je 0x6f260958
test ebx, ebx
jne 0x6f260870
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
lea ecx, [ebx + ebx]
mov dword [ebp - 0x1c], edx
mov eax, dword fs:[0x18]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov edi, eax
test eax, eax
je 0x6f26096d
mov edx, dword [ebp - 0x1c]
lea eax, [edx - 0x40]
cmp eax, 7
jbe 0x6f2608f0
cmp edx, 0x15
jbe 0x6f2608f0
mov ebx, 9
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, ebx
sub esp, 0xc
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov dword [esp + 0xc], ebx
mov dword [esp + 8], edi
mov dword [esp + 4], edx
mov eax, dword [0x6f27af44]
mov dword [esp], eax
call dword [sym.imp.user32.dll_LoadStringW]
sub esp, 0x10
test eax, eax
jle 0x6f2608b4
mov dword [esp + 0x14], ebx
xor ebx, ebx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
sub esp, 0x20
jmp 0x6f2608b9
lea esp, [ebp - 0x10]
mov ebx, 0xb
pop ecx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov ebx, 7
jmp 0x6f260858
Function at 0x6f2640c0
Capabilities:
Create thread
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 8]
mov edi, dword [ecx]
mov esi, dword fs:[0x18]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
mov dword [esp + 8], 0xc
mov dword [esp + 4], 0
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
je 0x6f264261
mov edx, dword [ebp - 0x20]
mov ebx, eax
mov dword [eax], edi
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x6f2641d0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateEventW]
sub esp, 0x10
mov dword [ebp - 0x20], eax
mov dword [ebx + 8], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x6f25f880
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateThread]
sub esp, 0x18
mov edi, eax
test eax, eax
je 0x6f264230
mov dword [esp + 4], 0xf
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_SetThreadPriority]
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
sub esp, 8
mov dword [eax], esi
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_CloseHandle]
xor eax, eax
sub esp, 4
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov dword [ebx + 8], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x6f25f880
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateThread]
sub esp, 0x18
mov edi, eax
test eax, eax
je 0x6f264270
mov dword [esp + 4], 0xf
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_SetThreadPriority]
sub esp, 8
jmp 0x6f2641b0
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebp - 0x20]
sub esp, 0xc
test eax, eax
je 0x6f264261
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
mov eax, 2
jmp 0x6f2641be
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x6f264261
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
mov ecx, 0x3aa25ea5
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
mov eax, section..text_1
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x1de84a6f
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x401010
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
add eax, 2
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 3
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 4
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 5
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 6
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 7
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 8
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 9
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0xa
mov dword [ebp - 4], edx
push 0x4e20
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x40a340
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x32b6a980]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x208], ecx
push 0x100
lea ecx, [ebp - 0x204]
push ecx
push eax
call 0x37b308
lea eax, [ebp - 0x204]
push eax
call 0x37adfe
mov edi, eax
xor ebx, ebx
test edi, edi
jle 0x40a3a0
lea esi, [ebp + ebx*2 - 0x204]
movzx eax, word [esi]
push eax
call 0x390e66
inc ebx
cmp ebx, edi
mov word [esi], ax
jl 0x40a388
mov esi, dword [ebp - 0x204]
lea ebx, [ebp - 0x204]
mov eax, ebx
add edi, edi
push eax
shr edi, 2
call 0x37adfe
cmp eax, 2
jl 0x97eefe
cmp edi, 1
jle 0x40a3d2
lea eax, [edi - 1]
add ebx, 4
xor esi, dword [ebx]
dec eax
jne 0x40a3ca
mov eax, dword [ebp - 0x208]
mov ecx, dword [ebp - 4]
pop edi
mov dword [eax], esi
pop esi
xor ecx, ebp
pop ebx
call 0x378a9c
leave
ret 8