joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3d85116
Capabilities:
Create process on windows

Disassembly:
push edi
push esi
sub esp, 0x48
mov eax, edx
mov esi, ecx
mov edx, dword [esp + 0x54]
lea edi, [esp + 0x18]
mov ecx, edi
push eax
push esi
push dword [esp + 0x60]
call fcn.03daeaa0
add esp, 0xc
mov edx, dword [edi + 4]
lea esi, [esp + 0xc]
mov ecx, esi
push dword [edi + 8]
call fcn.03db8d50
add esp, 4
mov edi, dword [esi + 4]
mov eax, dword [esi + 8]
add eax, edi
lea edx, [esp + 0x30]
mov dword [edx], 1
mov dword [edx + 4], edi
mov dword [edx + 8], eax
mov word [edx + 0xc], 0
mov ecx, esp
call fcn.03d8136f
test dword [esi], 0x7fffffff
je 0x3d85187
push edi
push 0
push dword [0x3de3a38]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [esp + 4]
xor eax, eax
push 1
push eax
push eax
push edi
push eax
push eax
call dword [sym.imp.shell32.dll_ShellExecuteW]
cmp eax, 0x21
jge 0x3d851ea
call sub.KERNEL32.dll_GetLastError
mov byte [esp + 0xc], 0
mov dword [esp + 0x10], eax
lea eax, [esp + 0x28]
mov dword [eax], esi
mov dword [eax + 4], fcn.03da9060
lea ecx, [esp + 0x30]
mov dword [ecx], 0x3dcef00
mov dword [ecx + 4], 2
mov dword [ecx + 0x10], 0
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], 1
call fcn.03dae3c0
push esi
call fcn.03d827c6
add esp, 4
cmp dword [esp], 0
je 0x3d851ff
push edi
push 0
push dword [0x3de3a38]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [esp + 0x18], 0
je 0x3d85218
push dword [esp + 0x1c]
push 0
push dword [0x3de3a38]
call dword [sym.imp.KERNEL32.dll_HeapFree]
add esp, 0x48
pop esi
pop edi
ret
Function at 0x3d95cf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, edx
mov edx, dword [esp + 0x14]
mov ebp, dword [esp + 0x20]
xor esi, esi
lea edx, [eax + edx*2]
movzx ebx, byte [eax + 1]
cmp byte [eax], ch
lea eax, [eax + 2]
lea edi, [esi + ebx]
jne 0x3d95d40
cmp esi, edi
ja 0x3d95da8
cmp edi, dword [esp + 0x1c]
ja 0x3d95db6
add esi, dword [esp + 0x18]
nop word [eax + eax]
test ebx, ebx
je 0x3d95d42
dec ebx
cmp byte [esi], cl
lea esi, [esi + 1]
jne 0x3d95d30
jmp 0x3d95d9f
ja 0x3d95d48
cmp eax, edx
mov esi, edi
jne 0x3d95d03
mov edi, dword [esp + 0x24]
movzx ecx, cx
mov al, 1
add edi, ebp
nop word cs:[eax + eax]
nop dword [eax]
movzx edx, byte [ebp]
lea esi, [ebp + 1]
test dl, dl
js 0x3d95d80
mov ebp, esi
sub ecx, edx
jns 0x3d95d97
jmp 0x3d95da1
cmp esi, edi
je 0x3d95dc6
movzx esi, byte [ebp + 1]
and edx, 0x7f
add ebp, 2
shl edx, 8
or edx, esi
sub ecx, edx
js 0x3d95da1
xor al, 1
cmp ebp, edi
jne 0x3d95d60
jmp 0x3d95da1
xor eax, eax
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
mov edx, edi
push 0x3dd0178
call fcn.03dcc4f0
mov edx, dword [esp + 0x1c]
mov ecx, edi
push 0x3dd0178
call fcn.03dcc310
mov ecx, 0x3dd0168
call fcn.03dcc620
Function at 0x3da1b90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x3dbcf10
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
movzx eax, byte [0x3de3a48]
test al, al
je 0x3da1d61
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x3da1bdc
cmp eax, 3
jne 0x3da1d5a
mov ebx, dword [0x3de3a4c]
test ebx, ebx
je 0x3da1d5a
mov dword [ebp - 0x20], 0
jmp 0x3da1c07
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x3da1c38
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x3da1dab
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x3da1c00
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x3da1c00
test byte [ebp - 0x20], 1
je 0x3da1d5a
mov ebx, dword [0x3de3a4c]
test ebx, ebx
je 0x3da1d5a
mov dword [ebp - 0x20], 0
jmp 0x3da1c67
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x3da1c98
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x3da1dab
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x3da1c60
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x3da1c60
test byte [ebp - 0x20], 1
je 0x3da1d5a
mov ebx, dword [0x3de3a4c]
test ebx, ebx
je 0x3da1d5a
mov dword [ebp - 0x20], 0
jmp 0x3da1cc7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x3da1cf8
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x3da1dab
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x3da1cc0
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x3da1cc0
test byte [ebp - 0x20], 1
je 0x3da1d5a
mov ebx, dword [0x3de3a4c]
test ebx, ebx
je 0x3da1d5a
mov dword [ebp - 0x20], 0
jmp 0x3da1d27
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x3da1d54
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x3da1dab
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x3da1d20
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x3da1d20
test byte [ebp - 0x20], 1
jne 0x3da1d74
movzx eax, byte [0x3ddfcc0]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov ebx, dword [0x3de3a4c]
jmp 0x3da1d7f
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x3da1d5a
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x3da1dab
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x3da1d7c
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
jmp 0x3da1d7c
mov ecx, 0x3dda8e0
mov dword [ebp - 0x10], 0
call fcn.03dcc620
ud2
Function at 0x3da29d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x3de3050]
test eax, eax
je 0x3da2a85
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x3da29fc
cmp dword [eax + 4], 0
mov edi, eax
je 0x3da29fc
add edi, 8
jmp 0x3da2a80
mov eax, dword [0x3de3050]
test eax, eax
je 0x3da2a94
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x3da2a7e
mov esi, eax
test eax, eax
jne 0x3da2a54
movzx eax, byte [0x3de3a90]
xor ecx, ecx
mov edx, 0xc
call fcn.03db9190
test eax, eax
je 0x3da2aaf
mov dword [eax], 0x3de3050
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x3de3050]
test eax, eax
je 0x3da2aa3
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x3da2a80
test ecx, ecx
je 0x3da2a80
lock dec dword [ecx]
jne 0x3da2a80
call fcn.03da26d0
jmp 0x3da2a80
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x3de3050
call fcn.03dccfb0
jmp 0x3da29e0
mov ecx, 0x3de3050
call fcn.03dccfb0
jmp 0x3da2a0a
mov ecx, 0x3de3050
call fcn.03dccfb0
jmp 0x3da2a4c
mov ecx, 4
mov edx, 0xc
call fcn.03dcc180
int3

Function at 0x3da2f70
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x3de3060]
test eax, eax
je 0x3da2ff1
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x3da2f8f
cmp byte [eax + 4], 0
mov esi, eax
jne 0x3da2fe6
mov eax, dword [0x3de3060]
test eax, eax
je 0x3da3000
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x3da2feb
mov esi, eax
test eax, eax
jne 0x3da2fe0
movzx eax, byte [0x3de3a90]
xor ecx, ecx
mov edx, 8
call fcn.03db9190
test eax, eax
je 0x3da3018
mov dword [eax], 0x3de3060
mov byte [eax + 4], 0
mov esi, eax
mov eax, dword [0x3de3060]
test eax, eax
je 0x3da300c
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov word [esi + 4], 1
add esi, 5
jmp 0x3da2fed
xor esi, esi
mov eax, esi
pop esi
ret
mov ecx, 0x3de3060
call fcn.03dccfb0
jmp 0x3da2f7b
mov ecx, 0x3de3060
call fcn.03dccfb0
jmp 0x3da2f99
mov ecx, 0x3de3060
call fcn.03dccfb0
jmp 0x3da2fd8
mov ecx, 4
mov edx, 8
call fcn.03dcc180
int3
Function at 0x3da3740
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x40]
mov esi, ecx
mov ecx, dword [esp + 0x44]
mov edi, edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x103
lea edx, [esp + 4]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x3da3794
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
cmp eax, 0x103
je 0x3da37b7
test eax, eax
js 0x3da37a3
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov al, 4
jmp 0x3da37af
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [esi + 4], eax
xor eax, eax
mov byte [esi], al
add esp, 0x34
pop esi
pop edi
ret
mov eax, esp
mov dword [esp + 0x1c], 0x3dda1a0
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
push ecx
push edx
call fcn.03da21a0
add esp, 0xc
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.03da2300
mov ecx, 7
int 0x29
ud2
Function at 0x3da3de0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x3de3040]
test eax, eax
je 0x3da3e75
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x3da3e06
cmp dword [eax + 4], 0
je 0x3da3e06
add eax, 8
pop esi
ret
mov eax, dword [0x3de3040]
test eax, eax
je 0x3da3e84
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x3da3e71
mov esi, eax
test eax, eax
jne 0x3da3e5a
movzx eax, byte [0x3de3a90]
xor ecx, ecx
mov edx, 0x10
call fcn.03db9190
test eax, eax
je 0x3da3e9c
mov dword [eax], 0x3de3040
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x3de3040]
test eax, eax
je 0x3da3e90
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
lea eax, [esi + 8]
mov byte [esi + 0xc], 0
pop esi
ret
xor eax, eax
pop esi
ret
mov ecx, 0x3de3040
call fcn.03dccfb0
jmp 0x3da3def
mov ecx, 0x3de3040
call fcn.03dccfb0
jmp 0x3da3e10
mov ecx, 0x3de3040
call fcn.03dccfb0
jmp 0x3da3e52
mov ecx, 4
mov edx, 0x10
call fcn.03dcc180
int3
Function at 0x3daa4b0
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x40]
mov esi, ecx
mov ecx, dword [esp + 0x44]
mov edi, edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x103
lea edx, [esp + 4]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x3daa4fd
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
cmp eax, 0xc0000011
jne 0x3daa50d
mov dword [esi + 4], 0
jmp 0x3daa51f
cmp eax, 0x103
je 0x3daa537
test eax, eax
js 0x3daa528
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov byte [esi], 4
add esp, 0x34
pop esi
pop edi
ret
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov byte [esi], 0
mov dword [esi + 4], eax
jmp 0x3daa522
mov eax, esp
mov dword [esp + 0x1c], 0x3dda1a0
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
push ecx
push edx
call fcn.03da21a0
add esp, 0xc
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.03da2300
mov ecx, 7
int 0x29
ud2

Function at 0x3dabbe0
Capabilities:
Create directory

Disassembly:
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
lea ecx, [esp + 0xc]
push dword [esp + 0x34]
call fcn.03da4600
add esp, 4
mov ecx, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
cmp ecx, 0x80000000
je 0x3dabc3b
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], eax
mov ecx, esp
lea edx, [esp + 0x18]
push 1
call fcn.03daa710
add esp, 4
mov ebx, dword [esp]
mov edi, dword [esp + 4]
cmp ebx, 0x80000000
jne 0x3dabc47
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov dword [esi], edi
add esp, 0x24
pop esi
pop edi
pop ebx
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x3dabc5d
mov byte [esi], 4
test ebx, ebx
jne 0x3dabc6c
jmp 0x3dabc40
call sub.KERNEL32.dll_GetLastError
mov byte [esi], 0
mov dword [esi + 4], eax
test ebx, ebx
je 0x3dabc40
push edi
push 0
push dword [0x3de3a38]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x3dabc40
Function at 0x3dadc50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x3de3070]
test eax, eax
je 0x3dadd05
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x3dadc7c
cmp dword [eax + 4], 0
mov edi, eax
je 0x3dadc7c
add edi, 8
jmp 0x3dadd00
mov eax, dword [0x3de3070]
test eax, eax
je 0x3dadd14
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x3dadcfe
mov esi, eax
test eax, eax
jne 0x3dadcd4
movzx eax, byte [0x3de3a90]
xor ecx, ecx
mov edx, 0xc
call fcn.03db9190
test eax, eax
je 0x3dadd2f
mov dword [eax], 0x3de3070
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x3de3070]
test eax, eax
je 0x3dadd23
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x3dadd00
test ecx, ecx
je 0x3dadd00
lock dec dword [ecx]
jne 0x3dadd00
call fcn.03dadd40
jmp 0x3dadd00
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x3de3070
call fcn.03dccfb0
jmp 0x3dadc60
mov ecx, 0x3de3070
call fcn.03dccfb0
jmp 0x3dadc8a
mov ecx, 0x3de3070
call fcn.03dccfb0
jmp 0x3dadccc
mov ecx, 4
mov edx, 0xc
call fcn.03dcc180
int3
Function at 0x3db4f90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
lea ecx, [esp + 0xc]
push dword [esp + 0x38]
call fcn.03da4600
add esp, 4
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
cmp edx, 0x80000000
jne 0x3db4fce
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp], 0x80000000
jmp 0x3db4ff0
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], ecx
mov ecx, esp
lea edx, [esp + 0x18]
mov dword [esp + 0x1c], eax
call fcn.03db4ec0
mov ebx, dword [esp]
cmp ebx, 0x80000000
jne 0x3db5005
mov ecx, esp
call fcn.03da47c0
mov dword [esi], 0x80000000
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, dword [esp + 4]
mov ebp, dword [esp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x3db5023
mov dword [esi], ebx
mov dword [esi + 4], edi
mov dword [esi + 8], ebp
jmp 0x3db4ffd
test ebx, ebx
mov dword [esi], 0x80000000
je 0x3db4ffd
push edi
push 0
push dword [0x3de3a38]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x3db4ffd
Function at 0x3db7310
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1038
call fcn.03dbd500
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x3dbd330
mov edi, ecx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x24], edx
lea esi, [ebp - 0x1044]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
push 0x1000
push 0
push esi
call fcn.03dbfca0
add esp, 0xc
xorps xmm0, xmm0
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x44]
push 0x3daebb0
push eax
push 0x1000
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
je 0x3db7464
mov ebx, dword [sym.imp.KERNEL32.dll_SleepEx]
mov dword [ebp - 0x20], edi
push 1
push 0xffffffffffffffff
call ebx
cmp dword [ebp - 0x30], 0
je 0x3db739a
cmp dword [ebp - 0x2c], 0
jne 0x3db7473
mov esi, dword [ebp - 0x28]
test esi, esi
je 0x3db7473
cmp esi, 0x1000
ja 0x3db74af
xor edi, edi
nop dword [eax]
mov eax, esi
sub eax, edi
jb 0x3db7495
xorps xmm0, xmm0
lea edx, [ebp - 0x30]
lea ecx, [ebp + edi - 0x1044]
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], edx
push 0x3daebb0
lea edx, [ebp - 0x44]
push edx
push eax
push ecx
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
test eax, eax
je 0x3db746b
nop dword [eax]
push 1
push 0xffffffffffffffff
call ebx
cmp dword [ebp - 0x30], 0
je 0x3db7410
cmp dword [ebp - 0x2c], 0
jne 0x3db7470
add edi, dword [ebp - 0x28]
cmp edi, esi
jne 0x3db73d0
xorps xmm0, xmm0
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], eax
push 0x3daebb0
lea eax, [ebp - 0x44]
push eax
push 0x1000
lea eax, [ebp - 0x1044]
push eax
mov edi, dword [ebp - 0x20]
push edi
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
jne 0x3db739a
call sub.KERNEL32.dll_GetLastError
jmp 0x3db7473
call sub.KERNEL32.dll_GetLastError
mov edi, dword [ebp - 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call esi
push dword [ebp - 0x24]
call esi
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x1038
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
mov ecx, edi
mov edx, esi
push 0x3dda45c
call fcn.03dcc4f0
add esp, 4
jmp 0x3db74ca
mov dword [ebp - 0x10], 0
mov ecx, esi
mov edx, 0x1000
push 0x3dda45c
call fcn.03dcc310
add esp, 4
ud2
Function at 0x3db75c0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov esi, esp
mov dword [esi + 0x38], ebp
mov dword [esi + 0x3c], esp
mov dword [esi + 0x48], 0xffffffff
mov dword [esi + 0x44], 0x3dbd350
lea eax, [esi + 0x40]
xorps xmm0, xmm0
mov ecx, dword fs:[0]
mov dword [esi + 0x40], ecx
mov dword fs:[0], eax
movaps xmmword [esi + 0x10], xmm0
lea eax, [esi + 0x10]
push 0x10
push eax
call dword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
je 0x3db7624
mov ecx, dword [esi + 0x40]
mov eax, dword [esi + 0x10]
mov edx, dword [esi + 0x14]
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call sub.KERNEL32.dll_GetLastError
mov edx, esi
lea ecx, [esi + 8]
mov dword [esi + 0x20], 0x3dda584
mov dword [esi + 0x24], 1
mov dword [esi + 0x30], 0
mov byte [esi], 0
mov dword [esi + 4], eax
mov dword [esi + 0x48], 0
mov dword [esi + 8], edx
mov dword [esi + 0x28], ecx
lea ecx, [esi + 0x20]
mov edx, 0x3dda5b4
mov dword [esi + 0xc], fcn.03da9060
mov dword [esi + 0x2c], 1
call fcn.03dcc220
ud2
Function at 0x3dbdc2e
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x3dbdc6d
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x3dbdc6d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x3dbdc6d
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x3dbdc6d
cmp dword [ecx + 0x74], 0xe
jbe 0x3dbdc6d
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x3dc4e43
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x3dc4ee0
push ebx
push esi
call fcn.03dc4e0c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.03dc4da0
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x3dc4e8d
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x3dc4edf
push edi
push eax
call fcn.03dc5a60
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x3dc4ead
call fcn.03dc3901
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x3dc4ede
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.03dc4da0
add esp, 0x20
test eax, eax
jne 0x3dc4ecc
push edi
call fcn.03dc3901
jmp 0x3dc4ed4
push ebx
call fcn.03dc3901
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x3dc61dd
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x3ddced8
push 0x3ddced0
push str.FlsAlloc
push 0x1f
call fcn.03dc609c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x3dc6211
push dword [ebp + 8]
mov ecx, esi
call dword [0x3dce250]
call esi
jmp 0x3dc6217
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x3dc625b
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x3ddcee8
push 0x3ddcee0
push str.FlsGetValue
push 0x21
call fcn.03dc609c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x3dc6292
push dword [ebp + 8]
mov ecx, esi
call dword [0x3dce250]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x3dc629a
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x3ddcef0
push 0x3ddcee8
push str.FlsSetValue
push 0x22
call fcn.03dc609c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x3dc62d4
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x3dce250]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x3dcb740
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x3dcb76d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x3dcb76d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x3dccfb0
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
cmp dword [ecx + 4], 0
mov esi, ecx
je 0x3dcd021
lea ebx, [esi + 0xc]
mov dword [esp + 4], 0
lea eax, [esp + 4]
push 0
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_InitOnceBeginInitialize]
cmp eax, 1
mov dword [esp], eax
jne 0x3dcd058
cmp dword [esp + 4], 0
je 0x3dcd03f
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x3dcd06b
mov edi, eax
inc eax
mov dword [esi], eax
mov eax, dword [0x3de3a4c]
nop dword [eax]
mov dword [esi + 8], eax
lock cmpxchg dword [0x3de3a4c], esi
jne 0x3dcd000
mov byte [0x3de3a48], 1
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_InitOnceComplete]
jmp 0x3dcd04f
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esp], eax
je 0x3dcd0ac
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [esi], ecx
jne 0x3dcd043
mov edi, dword [esp]
jmp 0x3dcd04f
mov edi, dword [esi]
jmp 0x3dcd04e
mov edi, eax
push dword [esp]
call dword [sym.imp.KERNEL32.dll_TlsFree]
dec edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
ret
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0
call fcn.03dcd0e0
push 0
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_InitOnceComplete]
lea ecx, [esp + 8]
mov edx, 0x3dda8ac
mov dword [esp + 8], 0x3dda870
mov dword [esp + 0xc], 1
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], 0x3ddb048
mov dword [esp + 0x14], 0
call fcn.03dcc220
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0x3dda870
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 0x3ddb048
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.03dcd110
int3