joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6e5078
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x6e5175
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x7726fc]
mov byte [eax], 1
mov eax, 8
call fcn.00406498
mov ebx, eax
mov dword [ebx], esi
mov eax, dword [ebp - 4]
mov dword [ebx + 4], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push ebx
push 0x6e4ff0
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_CreateThread_1
mov esi, eax
test esi, esi
jne 0x6e5112
mov eax, ebx
call fcn.004064b4
call sub.kernel32.dll_GetLastError_2
push eax
push 0
push 0
push 0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x6ccbac]
call fcn.006d1c4c
mov edx, eax
test edx, edx
je 0x6e5109
sub edx, 0xffffff90
mov eax, edi
call fcn.0040da80
jmp 0x6e5157
lea ecx, [ebp - 0x10]
mov dl, 1
mov eax, esi
call fcn.006d3f24
mov edx, dword [ebp - 0x10]
mov al, 5
call fcn.006d1484
mov ebx, eax
mov byte [ebx + 0x4c], 1
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x50], eax
lea eax, [ebp - 0x14]
call fcn.006eb7c0
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x6c]
call fcn.0040da80
mov eax, edi
mov edx, ebx
test edx, edx
je 0x6e5152
sub edx, 0xffffff90
call fcn.0040da80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6e517c
lea eax, [ebp - 0x14]
call fcn.0040da68
lea eax, [ebp - 0x10]
call fcn.0040da68
ret

Function at 0x6ef6a0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x6ef760
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea edx, [ebp - 0xc]
mov eax, dword [0x771580]
call fcn.005bc8d8
push dword [ebp - 0xc]
push 0x6ef77c
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov edx, dword [edx]
movzx ecx, byte [ebp - 5]
mov eax, dword [0x771584]
call fcn.006ef588
push dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040a7a4
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
call fcn.0040a8ec
push eax
call fcn.006ef574
mov esi, eax
test esi, esi
je 0x6ef73d
push 0
push 0
push 0
push 4
push esi
call sub.kernel32.dll_MapViewOfFile
test eax, eax
je 0x6ef737
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov ecx, dword [eax]
mov dword [edx], ecx
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov bl, 1
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6ef767
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00409ecc
lea eax, [ebp - 4]
call fcn.00409e60
ret

Function at 0x6ef9b8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
mov ebx, eax
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
je 0x6ef9d8
push 0x40
push 0x1000
push ebx
push 0
call sub.kernel32.dll_VirtualAlloc_1
pop ebx
ret
push 0
push ebx
call fcn.006c7df8
pop ebx
ret
Function at 0x6efcd8
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
pushfd
xor ebx, ebx
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x20], 0
push 0x1c
lea eax, [ebp - 0x1c]
push eax
push ebx
call dword [0x771654]
cmp eax, 0x1c
jne 0x6efd53
cmp dword [ebp - 0xc], 0x1000
jne 0x6efd4e
cmp dword [ebp - 0x18], 0
je 0x6efd4e
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x20], eax
je 0x6efd4e
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
cmp eax, 0
jne 0x6efd2d
mov eax, dword [ebp - 0x18]
cmp eax, 0x80000000
jae 0x6efd53
push 2
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
push eax
call dword [0x771628]
cmp eax, 0
je 0x6efd4e
push edi
push esi
mov eax, dword [ebp - 0x18]
push eax
call dword [0x77169c]
add ebx, dword [ebp - 0x10]
jmp 0x6efcef
popfd
popal
add esp, 0x20
pop ebp
ret 0xc
Function at 0x6f3e3c
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x6f402d
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor edx, edx
mov eax, dword [0x7714dc]
call fcn.006c6954
mov dword [0x77acb8], eax
xor edx, edx
mov eax, dword [0x7714e0]
call fcn.006c6954
mov dword [0x77acbc], eax
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, 5
call fcn.0040a9b0
lea eax, [ebp - 4]
call fcn.0040a404
mov byte [eax], 0x72
lea eax, [ebp - 4]
call fcn.0040a404
mov byte [eax + 1], 0x64
lea eax, [ebp - 4]
call fcn.0040a404
mov byte [eax + 2], 0x65
lea eax, [ebp - 4]
call fcn.0040a404
mov byte [eax + 3], 0x63
lea eax, [ebp - 4]
call fcn.0040a404
mov byte [eax + 4], 0x20
lea edx, [ebp - 0xc]
mov eax, dword [0x771568]
call fcn.005bc8d8
push dword [ebp - 0xc]
push 0x6f404c
push dword [ebp - 4]
lea eax, [ebp - 0x10]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.005bc090
push dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040a7a4
mov eax, dword [ebp - 4]
call fcn.0040a8ec
push eax
push 0
push 0
call fcn.004134c8
mov edx, dword [ebp + 8]
mov dword [edx - 4], eax
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 0
je 0x6f400a
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov dword [0x77acac], esi
mov dword [0x77acb0], edi
cmp dword [0x77acb8], 0
je 0x6f3f5a
cmp dword [0x77acbc], 0
jne 0x6f3fdc
mov dl, 1
mov eax, dword [0x771474]
call fcn.006c6a60
mov esi, eax
cmp dword [esi], 0x4244c8b
jne 0x6f3fee
lea eax, [esi + 4]
mov eax, dword [eax]
and eax, 0xffffff
cmp eax, 0x241c8b
jne 0x6f3fee
lea eax, [esi + 7]
cmp byte [eax], 0x51
jne 0x6f3fee
lea eax, [esi + 8]
cmp byte [eax], 0x53
jne 0x6f3fee
lea eax, [esi + 9]
cmp byte [eax], 0xe8
jne 0x6f3fee
lea eax, [ebp - 8]
push eax
push 0x40
push 4
lea eax, [esi + 0xa]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x6f3fee
lea edx, [esi + 0xe]
lea eax, [esi + 0xa]
add edx, dword [eax]
mov dword [0x77acb4], edx
mov edx, 0x6f3dec
sub edx, esi
sub edx, 0xe
mov dword [eax], edx
lea edx, [ebp - 8]
push edx
mov edx, dword [ebp - 8]
push edx
push 4
push eax
call sub.kernel32.dll_VirtualProtect
mov bl, 1
jmp 0x6f3fee
push 0x6f3d98
push 0xffffffffffffffff
call dword [0x77acb8]
test eax, eax
setne bl
test bl, bl
jne 0x6f400a
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_ReleaseMutex
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6f4034
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00409ecc
lea eax, [ebp - 4]
call fcn.00409e60
ret
Function at 0x6f4050
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
cmp dword [0x77acb8], 0
je 0x6f4068
cmp dword [0x77acbc], 0
jne 0x6f40a9
mov dl, 1
mov eax, dword [0x771474]
call fcn.006c6a60
mov ebx, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 4
lea esi, [ebx + 0xa]
push esi
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x6f40b4
mov eax, dword [0x77acb4]
sub eax, ebx
sub eax, 0xe
mov dword [esi], eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
push eax
push 4
push esi
call sub.kernel32.dll_VirtualProtect
jmp 0x6f40b4
push 0x6f3d98
call dword [0x77acbc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_ReleaseMutex
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.kernel32.dll_CloseHandle_1
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x6f6298
Capabilities:
Check os version
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd70
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x28c], edx
mov dword [ebp - 0x290], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x6f6426
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
je 0x6f63f0
mov edi, 1
mov bl, 1
lea edx, [ebp - 0x28c]
mov eax, dword [0x7715b4]
call fcn.005bc8d8
mov eax, dword [ebp - 0x28c]
push eax
lea eax, [ebp - 0x290]
mov edx, edi
add dl, 0x30
mov ecx, 0
call fcn.0040a5b4
mov ecx, dword [ebp - 0x290]
lea eax, [ebp - 4]
pop edx
call fcn.0040a720
mov eax, dword [ebp - 4]
call fcn.0040a8ec
push eax
push 0
push 4
call sub.kernel32.dll_OpenFileMappingA
mov esi, eax
test esi, esi
je 0x6f63e1
push 0
push 0
push 0
push 4
push esi
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x6f63db
mov eax, dword [ebp - 0x14]
mov edx, dword [eax + 4]
mov eax, dword [eax]
push edx
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [eax]
cmp edx, dword [esp + 4]
jne 0x6f636e
cmp eax, dword [esp]
pop edx
pop eax
jne 0x6f63d2
xor ebx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x6f63d2
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], 0
imul eax, dword [ebp - 0xc], 0x4e
mov edx, dword [ebp - 0x14]
push esi
push edi
lea esi, [edx + eax*8 + 0xc]
lea edi, [ebp - 0x288]
mov ecx, 0x9c
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
cmp byte [ebp - 0x288], 0
jne 0x6f63b3
mov bl, 1
jmp 0x6f63d2
lea eax, [ebp - 0x288]
push eax
call sub.kernel32.dll_GetModuleHandleA
cmp eax, dword [ebp - 8]
jne 0x6f63ca
mov byte [ebp - 0xd], 1
jmp 0x6f63d2
inc dword [ebp - 0xc]
dec dword [ebp - 0x18]
jne 0x6f638a
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_UnmapViewOfFile
push esi
call sub.kernel32.dll_CloseHandle_1
or bl, byte [ebp - 0xd]
jne 0x6f63f0
inc edi
cmp edi, 0xa
jne 0x6f62df
cmp byte [ebp - 0xd], 0
jne 0x6f6400
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.006f6148
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6f642d
lea eax, [ebp - 0x290]
mov edx, 2
call fcn.00409ecc
lea eax, [ebp - 4]
call fcn.00409e60
ret
Function at 0x6f9bb0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x6f9c5f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x209
call fcn.0040ae48
mov eax, dword [ebp - 4]
call fcn.0040acb4
push eax
push 0x208
call sub.kernel32.dll_GetTempPathW_1
mov edx, eax
lea eax, [ebp - 4]
call fcn.0040ae48
push ebx
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0042db44
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
mov eax, 0x6f9c78
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0x11
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x6f9c90
call fcn.00427c4c
mov eax, dword [ebx]
mov dl, 1
call fcn.00426a20
test al, al
jne 0x6f9c41
mov eax, dword [ebx]
call fcn.00426af4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6f9c66
lea eax, [ebp - 0x18]
call fcn.00409e3c
lea eax, [ebp - 4]
call fcn.00409e3c
ret

Function at 0x700f4c
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov byte [ebp - 1], dl
mov edi, eax
xor ebx, ebx
xor esi, esi
push esi
lea eax, [ebp - 8]
push eax
call sub.wininet.dll_InternetGetConnectedState
test eax, eax
je 0x701051
call fcn.006f7510
mov edx, dword [0x772888]
cmp al, 0x1f
ja 0x700f85
and eax, 0x7f
bt dword [edx], eax
setb al
xor al, 1
and al, byte [ebp - 1]
je 0x70104f
mov byte [0x77ad14], 0
xor eax, eax
push ebp
push 0x701035
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov dl, 1
mov eax, dword [0x6fec04]
call fcn.00639d40
mov dword [0x77ad18], eax
xor eax, eax
push ebp
push 0x701024
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x701068
mov eax, dword [0x77ad18]
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [0x77ad18]
mov dword [eax + 0x9c], edi
mov eax, dword [0x77ad18]
mov edx, dword [0x77ad10]
mov dword [eax + 0xdc], edx
mov dword [eax + 0xd8], 0x700b18
xor ecx, ecx
xor edx, edx
mov eax, dword [0x77ad18]
call fcn.00700aac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x70102b
mov eax, dword [0x77ad18]
call fcn.00408084
ret
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4091f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], edi
mov ebx, eax
mov eax, dword [ebx + 0x38]
mov edi, dword [ebx + 0x40]
mov edx, dword [ebx + 0x134]
sub edi, eax
test edx, edx
mov ecx, edx
jne 0x409217
mov ecx, 0x20000
cmp edi, ecx
ja 0x409243
lea edx, [ebp - 8]
push 0
push edx
push edi
push eax
push dword [ebx + 0xdc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xffffffff
test eax, eax
je 0x4092b8
mov ecx, 1
jmp 0x4092b8
mov dword [ebp - 0x18], edi
mov ecx, edi
mov dword [ebp - 0x14], esi
test edx, edx
jne 0x409254
mov edx, 0x20000
mov edi, eax
mov esi, ecx
mov dword [ebp - 4], edx
push 0
lea edx, [ebp - 8]
push edx
push dword [ebp - 4]
push edi
push dword [ebx + 0xdc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x409282
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
mov ecx, 0xffffffff
jmp 0x4092b8
mov eax, dword [ebp - 8]
mov edx, dword [ebx + 0x134]
add edi, eax
sub esi, eax
test edx, edx
jne 0x409298
mov edx, 0x20000
cmp esi, edx
jae 0x4092a5
mov dword [ebp - 4], esi
test esi, esi
jne 0x4092a9
jmp 0x4092ad
test esi, esi
je 0x4092ad
test eax, eax
ja 0x40925b
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
mov ecx, 1
mov edx, dword [ebx + 0x38]
mov eax, dword [ebx + 0xf0]
and byte [ebx + 0x165], 0xfb
mov dword [ebx + 0x40], edx
add edx, eax
mov dword [ebx + 0x44], edx
xor eax, eax
mov dword [ebx + 0xa8], eax
mov dword [ebx + 0xac], eax
mov eax, edi
cdq
mov eax, dword [ebx + 0xc0]
add edi, eax
adc edx, dword [ebx + 0xc4]
mov dword [ebx + 0xc0], edi
mov dword [ebx + 0xb8], edi
mov dword [ebx + 0xc4], edx
mov dword [ebx + 0xbc], edx
cmp ecx, 0xffffffff
je 0x409318
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
xor eax, eax
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [ebp - 0x10]
mov dword [ebx + 0xe0], eax
mov ebx, dword [ebp - 0xc]
mov eax, 0x26
mov esp, ebp
pop ebp
ret
Function at 0x40e880
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], edi
mov ebx, eax
mov eax, dword [ebx + 0x38]
mov edi, dword [ebx + 0x40]
mov edx, dword [ebx + 0x134]
sub edi, eax
test edx, edx
mov ecx, edx
jne 0x40e8a7
mov ecx, 0x20000
cmp edi, ecx
ja 0x40e8d3
lea edx, [ebp - 8]
push 0
push edx
push edi
push eax
push dword [ebx + 0xdc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xffffffff
test eax, eax
je 0x40e948
mov ecx, 1
jmp 0x40e948
mov dword [ebp - 0x18], edi
mov ecx, edi
mov dword [ebp - 0x14], esi
test edx, edx
jne 0x40e8e4
mov edx, 0x20000
mov edi, eax
mov esi, ecx
mov dword [ebp - 4], edx
push 0
lea edx, [ebp - 8]
push edx
push dword [ebp - 4]
push edi
push dword [ebx + 0xdc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40e912
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
mov ecx, 0xffffffff
jmp 0x40e948
mov eax, dword [ebp - 8]
mov edx, dword [ebx + 0x134]
add edi, eax
sub esi, eax
test edx, edx
jne 0x40e928
mov edx, 0x20000
cmp esi, edx
jae 0x40e935
mov dword [ebp - 4], esi
test esi, esi
jne 0x40e939
jmp 0x40e93d
test esi, esi
je 0x40e93d
test eax, eax
ja 0x40e8eb
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
mov ecx, 1
mov edx, dword [ebx + 0x38]
mov eax, dword [ebx + 0xf0]
and byte [ebx + 0x165], 0xfb
mov dword [ebx + 0x40], edx
add edx, eax
mov dword [ebx + 0x44], edx
xor eax, eax
mov dword [ebx + 0xa8], eax
mov dword [ebx + 0xac], eax
mov eax, edi
cdq
mov eax, dword [ebx + 0xc0]
add edi, eax
adc edx, dword [ebx + 0xc4]
mov dword [ebx + 0xc0], edi
mov dword [ebx + 0xb8], edi
mov dword [ebx + 0xc4], edx
mov dword [ebx + 0xbc], edx
cmp ecx, 0xffffffff
je 0x40e9a8
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
xor eax, eax
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [ebp - 0x10]
mov dword [ebx + 0xe0], eax
mov ebx, dword [ebp - 0xc]
mov eax, 0x26
mov esp, ebp
pop ebp
ret
Function at 0x410a20
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], ebx
mov dword [ebp - 8], esi
mov ebx, 1
mov dword [ebp - 0xc], 0
push 1
push 0x4f0d70
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x410aac
mov eax, 0x51eb851f
imul ebx
mov ecx, ebx
sar ecx, 0x1f
sar edx, 5
sub edx, ecx
imul esi, edx, 0x64
mov eax, ebx
sub eax, esi
jne 0x410aac
cmp ebx, 0x15f90
jge 0x410a75
xor eax, eax
jmp 0x410aa5
cmp ebx, 0x1d4c0
jge 0x410a84
mov eax, 0x32
jmp 0x410aa5
cmp ebx, 0x2bf20
jge 0x410a93
mov eax, 0x64
jmp 0x410aa5
mov eax, 0x1482
cmp ebx, 0x57d78
jl 0x410aa5
mov eax, 0xfa
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x410ac0
inc ebx
cmp ebx, 0x57e40
jl 0x410a38
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x410ad8
mov dword [ebp - 0x10], 0x98
lea eax, [ebp - 0x10]
push eax
call fcn.00429410
pop ecx
mov eax, dword [0x4f0d74]
test eax, eax
jne 0x410b0e
cmp dword [0x4ee720], 1
je 0x410b92
xor ebx, ebx
xor esi, esi
cmp dword [0x4f0d6c], 0
je 0x410b52
cmp dword [0x4ee720], 1
mov dword [0x4f0d74], 1
je 0x410b3d
push dword [0x4f0d68]
mov dword [0x4f0d70], 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x410bb0
mov edx, dword [ebp + 8]
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov dword [edx], eax
xor eax, eax
mov esp, ebp
pop ebp
ret
push esi
push 2
call fcn.0045e300
push ebx
push 0x16
call fcn.0045e300
add esp, 0x10
jmp 0x410b0e
mov dword [0x4f0d6c], 1
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x4f0d68], eax
cmp eax, 0xffffffff
jne 0x410b76
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x410afb
push 0x4109b0
call fcn.0045ed20
push 0x410980
call fcn.0045ed20
add esp, 8
jmp 0x410afb
push 1
push 2
call fcn.0045e300
mov esi, eax
push 1
push 0x16
call fcn.0045e300
add esp, 0x10
mov ebx, eax
jmp 0x410af2
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x70
call fcn.00419300
add esp, 0xc
test eax, eax
je 0x410bda
mov edx, dword [ebp + 8]
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov dword [edx], 0
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov edx, 0x70
mov ecx, dword [edx + 0x4ee67c]
mov dword [eax + edx - 4], ecx
mov ebx, dword [edx + 0x4ee678]
mov dword [eax + edx - 8], ebx
mov esi, dword [edx + 0x4ee674]
mov dword [eax + edx - 0xc], esi
mov ecx, dword [edx + 0x4ee670]
mov dword [eax + edx - 0x10], ecx
sub edx, 0x10
jne 0x410be2
push dword [ebp - 0xc]
push dword [0x4f0d68]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp - 0xc]
jmp 0x410b2c
Function at 0x410c30
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], ebx
mov dword [ebp - 8], esi
mov ebx, 1
mov dword [ebp - 0xc], 0
push 1
push 0x4f0d70
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x410cbc
mov eax, 0x51eb851f
imul ebx
mov ecx, ebx
sar ecx, 0x1f
sar edx, 5
sub edx, ecx
imul esi, edx, 0x64
mov eax, ebx
sub eax, esi
jne 0x410cbc
cmp ebx, 0x15f90
jge 0x410c85
xor eax, eax
jmp 0x410cb5
cmp ebx, 0x1d4c0
jge 0x410c94
mov eax, 0x32
jmp 0x410cb5
cmp ebx, 0x2bf20
jge 0x410ca3
mov eax, 0x64
jmp 0x410cb5
mov eax, 0x1482
cmp ebx, 0x57d78
jl 0x410cb5
mov eax, 0xfa
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x410cd0
inc ebx
cmp ebx, 0x57e40
jl 0x410c48
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x410ce8
mov dword [ebp - 0x10], 0x98
lea eax, [ebp - 0x10]
push eax
call fcn.00429410
pop ecx
mov eax, dword [0x4f0d74]
test eax, eax
jne 0x410d1e
cmp dword [0x4ee720], 1
je 0x410db7
xor ebx, ebx
xor esi, esi
cmp dword [0x4f0d6c], 0
je 0x410d74
cmp dword [0x4ee720], 1
mov dword [0x4f0d74], 1
je 0x410d5f
push dword [0x4f0d68]
mov dword [0x4f0d70], 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0xc], ebx
test ebx, ebx
je 0x410df5
mov eax, dword [ebp + 8]
mov dword [eax], ebx
cmp dword [0x4ee720], 1
je 0x410dd5
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 8]
xor eax, eax
mov esp, ebp
pop ebp
ret
push esi
push 2
call fcn.0045e300
push ebx
push 0x16
call fcn.0045e300
add esp, 0x10
jmp 0x410d1e
mov dword [0x4f0d6c], 1
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x4f0d68], eax
cmp eax, 0xffffffff
jne 0x410d9b
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x410d0b
push 0x4109b0
call fcn.0045ed20
push 0x410980
call fcn.0045ed20
add esp, 8
jmp 0x410d0b
push 1
push 2
call fcn.0045e300
mov esi, eax
push 1
push 0x16
call fcn.0045e300
add esp, 0x10
mov ebx, eax
jmp 0x410d02
push 1
push 2
call fcn.0045e300
push 1
push 0x16
mov dword [ebx + 0x64], eax
call fcn.0045e300
add esp, 0x10
mov dword [ebx + 0x68], eax
jmp 0x410d53
lea eax, [ebp - 0xc]
push eax
push 0
push 0x70
call fcn.00419300
add esp, 0xc
test eax, eax
je 0x410e1c
mov edx, dword [ebp + 8]
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov dword [edx], 0
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov edx, 0x70
mov ecx, dword [edx + 0x4ee67c]
mov dword [eax + edx - 4], ecx
mov ebx, dword [edx + 0x4ee678]
mov dword [eax + edx - 8], ebx
mov esi, dword [edx + 0x4ee674]
mov dword [eax + edx - 0xc], esi
mov ecx, dword [edx + 0x4ee670]
mov dword [eax + edx - 0x10], ecx
sub edx, 0x10
jne 0x410e24
push dword [ebp - 0xc]
push dword [0x4f0d68]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ebx, dword [ebp - 0xc]
jmp 0x410d41
Function at 0x417340
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], edi
mov ebx, eax
mov eax, dword [ebx + 0x38]
mov edi, dword [ebx + 0x40]
mov edx, dword [ebx + 0x134]
sub edi, eax
test edx, edx
mov ecx, edx
jne 0x417367
mov ecx, 0x20000
cmp edi, ecx
ja 0x417393
lea edx, [ebp - 8]
push 0
push edx
push edi
push eax
push dword [ebx + 0xdc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xffffffff
test eax, eax
je 0x417408
mov ecx, 1
jmp 0x417408
mov dword [ebp - 0x18], edi
mov ecx, edi
mov dword [ebp - 0x14], esi
test edx, edx
jne 0x4173a4
mov edx, 0x20000
mov edi, eax
mov esi, ecx
mov dword [ebp - 4], edx
push 0
lea edx, [ebp - 8]
push edx
push dword [ebp - 4]
push edi
push dword [ebx + 0xdc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4173d2
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
mov ecx, 0xffffffff
jmp 0x417408
mov eax, dword [ebp - 8]
mov edx, dword [ebx + 0x134]
add edi, eax
sub esi, eax
test edx, edx
jne 0x4173e8
mov edx, 0x20000
cmp esi, edx
jae 0x4173f5
mov dword [ebp - 4], esi
test esi, esi
jne 0x4173f9
jmp 0x4173fd
test esi, esi
je 0x4173fd
test eax, eax
ja 0x4173ab
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
mov ecx, 1
mov edx, dword [ebx + 0x38]
mov eax, dword [ebx + 0xf0]
and byte [ebx + 0x165], 0xfb
mov dword [ebx + 0x40], edx
add edx, eax
mov dword [ebx + 0x44], edx
xor eax, eax
mov dword [ebx + 0xa8], eax
mov dword [ebx + 0xac], eax
mov eax, edi
cdq
mov eax, dword [ebx + 0xc0]
add edi, eax
adc edx, dword [ebx + 0xc4]
mov dword [ebx + 0xc0], edi
mov dword [ebx + 0xb8], edi
mov dword [ebx + 0xc4], edx
mov dword [ebx + 0xbc], edx
cmp ecx, 0xffffffff
je 0x417468
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
xor eax, eax
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [ebp - 0x10]
mov dword [ebx + 0xe0], eax
mov ebx, dword [ebp - 0xc]
mov eax, 0x26
mov esp, ebp
pop ebp
ret
Function at 0x41ac50
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x41cb20
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]