joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b0d0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
call fcn.0041ade0
mov edx, dword [entry3]
test edx, edx
je 0x41b200
mov ebx, eax
test eax, eax
je 0x41b200
mov dword [eax + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebx + 0x1c], 0xffffffff
mov dword [ebx + 0x18], eax
sub esp, 0x10
lea eax, [ebx + 0x38]
mov dword [esp], eax
call fcn.0041a8c0
cmp eax, 1
je 0x41b20c
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebx + 0x38], 0xffffffff
mov dword [ebx + 0x64], 0
mov dword [ebx + 0x14], 0
call ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov esi, eax
call ebp
lea edx, [ebx + 0x14]
mov dword [esp + 8], edi
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
sub esp, 0x1c
test eax, eax
je fcn.004ab5be
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x6c], eax
movzx eax, byte [ebx + 0x20]
sub esp, 4
and eax, 0xffffffcf
or eax, 0x10
mov byte [ebx + 0x20], al
mov eax, dword [0x4b20ac]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x41b211
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x2c
xor ebx, ebx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0041ac00
jmp fcn.004ab5be

Function at 0x41b220
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub esp, 0x1c
cmp dword [0x4ffbf4], 1
je 0x41b231
call fcn.0041b030
mov eax, dword [0x4b20ac]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x41b250
add esp, 0x1c
ret
add esp, 0x1c
jmp fcn.0041b0d0
Function at 0x41b540
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x41b570
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x41b640
add esp, 0x10
mov eax, 1
pop ebx
pop esi
pop edi
ret 0xc
cmp eax, 1
je 0x41b670
cmp eax, 3
jne 0x41b55a
mov eax, dword [0x4b20ac]
cmp eax, 0xffffffff
je 0x41b55a
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x41b55a
test byte [eax + 0x20], 0x30
je 0x41b6a0
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x41b5b3
call fcn.0041b260
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x41b5e5
mov dword [esp], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x41b5d7
mov dword [esp], eax
call esi
sub esp, 4
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x14], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call fcn.0041a700
lea eax, [ebx + 0x38]
mov dword [esp], eax
call fcn.0041a8c0
cmp eax, 1
je 0x41b720
mov ecx, dword [ebx + 0xb0]
mov dword [ebx + 0x38], 0xffffffff
test ecx, ecx
je 0x41b790
mov eax, dword [0x4b20ac]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
jmp 0x41b55a
mov eax, dword [0x4ffbd0]
test eax, eax
je 0x41b55a
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
mov dword [0x4ffbd0], 0
sub esp, 4
jmp 0x41b55a
mov dword [esp + 4], 0x41a930
mov dword [esp], 1
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
sub esp, 8
mov dword [0x4ffbd0], eax
mov eax, 1
add esp, 0x10
pop ebx
pop esi
pop edi
ret 0xc
mov edx, dword [ebx + 0x68]
mov eax, dword [eax + 0x18]
test edx, edx
jne 0x41b728
test eax, eax
je 0x41b6ba
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebx + 0xb4]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x68], 1
test eax, eax
je 0x41b6d7
call fcn.0041b260
lea edi, [ebx + 0x1c]
lea esi, [ebx + 0x38]
test byte [ebx + 0x24], 4
je 0x41b770
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x41b700
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebx + 0x14], 0
mov dword [esp], edi
call fcn.0041a700
mov dword [esp], esi
call fcn.0041a8c0
cmp eax, 1
jne 0x41b604
call fcn.0041ac00
lea esi, [esi]
test eax, eax
je 0x41b738
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
lea eax, [ebx + 0x1c]
mov dword [ebx + 0x18], 0
mov dword [esp], eax
call fcn.0041a700
lea eax, [ebx + 0x38]
mov dword [esp], eax
call fcn.0041a8c0
cmp eax, 1
je 0x41b720
mov dword [ebx + 0x38], 0xffffffff
jmp 0x41b55a
mov dword [esp], edi
call fcn.0041a700
mov dword [esp], esi
call fcn.0041a8c0
cmp eax, 1
jne 0x41b75a
jmp 0x41b720
mov eax, ebx
call fcn.0041aea0
jmp 0x41b619
Function at 0x41ba30
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
mov eax, dword [ebx]
test edx, edx
je 0x41bb68
cmp eax, 1
je 0x41ba84
mov eax, ebx
call fcn.0041a9c0
lea edi, [eax + 4]
mov esi, eax
mov dword [esp], edi
call fcn.0041a220
mov ebp, dword [ebx]
test ebp, ebp
je 0x41ba90
cmp ebp, 1
jne 0x41bb38
mov dword [esp], edi
call fcn.0041a570
test esi, esi
je 0x41ba84
mov eax, esi
call fcn.0041acf0
add esp, 0x2c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
cmp dword [0x4ffbf4], 1
mov dword [esp + 0x14], 0x41adb0
mov dword [esp + 0x18], esi
je 0x41baaa
call fcn.0041b030
mov eax, dword [0x4b20ac]
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x41bba8
mov eax, dword [eax + 0xc]
mov dword [esp + 0x1c], eax
lock or dword [esp], 0
cmp dword [0x4ffbf4], 1
je 0x41badf
call fcn.0041b030
mov eax, dword [0x4b20ac]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x41bb90
lea edx, [esp + 0x14]
mov dword [eax + 0xc], edx
lock or dword [esp], 0
call dword [esp + 0x44]
cmp dword [0x4ffbf4], 1
je 0x41bb12
call fcn.0041b030
mov eax, dword [0x4b20ac]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x41bb78
mov edx, dword [esp + 0x1c]
mov dword [eax + 0xc], edx
mov dword [ebx], 1
jmp 0x41ba71
mov dword [esp], 2
call dword [0x4b2084]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], ebx
mov dword [esp + 4], str._once__p_is__d_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x41ba71
add esp, 0x2c
mov eax, 0x16
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0041b0d0
test eax, eax
jne 0x41bb23
jmp 0x4ab5d1
call fcn.0041b0d0
test eax, eax
jne 0x41baf4
jmp 0x4ab5e3
call fcn.0041b0d0
test eax, eax
jne 0x41bac5
jmp 0x4ab5dc
mov eax, dword [esp + 0x1c]
mov dword [0], eax
ud2
mov eax, dword [pe_dos_header]
ud2
lea eax, [esp + 0x14]
mov dword [0], eax
ud2

Function at 0x41be10
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x4ffbf4], 1
mov esi, eax
je 0x41be2d
call fcn.0041b030
mov eax, dword [0x4b20ac]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x41be90
lea ebp, [ebx + 0x38]
xor edi, edi
mov dword [esp], ebp
call fcn.0041a8d0
mov eax, dword [esp + 0x30]
cmp dword [ebx + 0x28], eax
jbe 0x41be6d
mov eax, dword [ebx + 0x30]
mov edx, dword [esp + 0x30]
cmp byte [eax + edx], 0
je 0x41be6d
mov eax, dword [ebx + 0x2c]
mov edi, dword [eax + edx*4]
mov dword [esp], ebp
call fcn.0041a920
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0041b0d0
mov ebx, eax
jmp 0x41be44
Function at 0x41bea0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [esp + 0x40]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x4ffbf4], 1
mov dword [esp + 0x14], eax
je 0x41bec3
call fcn.0041b030
mov eax, dword [0x4b20ac]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x41bfc8
lea edi, [ebx + 0x38]
mov dword [esp], edi
call fcn.0041a8d0
cmp dword [ebx + 0x28], esi
jbe 0x41bf28
mov edx, dword [ebx + 0x2c]
mov eax, dword [esp + 0x44]
mov dword [edx + esi*4], eax
mov eax, dword [ebx + 0x30]
mov byte [eax + esi], 1
mov dword [esp], edi
call fcn.0041a920
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
sub esp, 4
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
lea ebp, [esi + 1]
lea eax, [ebp*4]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sub.msvcrt.dll_realloc
test eax, eax
je 0x41bfd4
mov dword [esp + 0x1c], eax
mov dword [esp + 4], ebp
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
call sub.msvcrt.dll_realloc
mov edx, dword [esp + 0x1c]
test eax, eax
mov dword [esp + 0x18], eax
je 0x41bfd4
mov ecx, dword [ebx + 0x28]
mov eax, ebp
mov dword [esp + 4], 0
mov dword [esp + 0x1c], edx
sub eax, ecx
lea ecx, [edx + ecx*4]
shl eax, 2
mov dword [esp], ecx
mov dword [esp + 8], eax
call sub.msvcrt.dll_memset
mov eax, dword [esp + 0x18]
mov ecx, ebp
add eax, dword [ebx + 0x28]
sub ecx, dword [ebx + 0x28]
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov dword [ebx + 0x28], ebp
mov dword [ebx + 0x2c], edx
mov dword [ebx + 0x30], eax
jmp 0x41bef1
call fcn.0041b0d0
mov ebx, eax
jmp 0x41bede
mov dword [esp], edi
call fcn.0041a920
mov eax, 0xc
jmp 0x41bf19

Function at 0x41c060
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
cmp dword [0x4ffbf4], 1
je 0x41c071
call fcn.0041b030
mov eax, dword [0x4b20ac]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x41c090
mov eax, dword [eax + 0x18]
add esp, 0x1c
ret
call fcn.0041b0d0
test eax, eax
jne 0x41c086
add esp, 0x1c
ret

Function at 0x41c0f0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
cmp dword [0x4ffbf4], 1
je 0x41c101
call fcn.0041b030
mov eax, dword [0x4b20ac]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x41c120
add eax, 0xc
add esp, 0x1c
ret
call fcn.0041b0d0
test eax, eax
jne 0x41c116
jmp 0x41c119
Function at 0x41c150
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call fcn.0041b220
mov dword [eax + 4], esi
mov ebx, eax
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x41c172
call fcn.0041b260
test byte [ebx + 0x20], 0x30
jne 0x41c18c
add ebx, 0x70
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_longjmp]
mov eax, dword [0x4b20ac]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
push edx
test eax, eax
je 0x41c1cf
cmp dword [ebx + 0x14], 0
mov eax, dword [eax + 0x18]
je 0x41c213
mov dword [ebx + 0x68], 1
mov esi, dword [ebx + 4]
test eax, eax
je 0x41c1c2
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
mov dword [ebx + 0x18], 0
test byte [ebx + 0x24], 4
jne 0x41c1d8
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
mov dword [ebx + 0x14], 0
mov eax, ebx
call fcn.0041b010
mov eax, dword [0x4b20ac]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push eax
push eax
jmp 0x41c1cf
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x41c227
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
mov dword [ebx + 0x18], 0
mov esi, dword [ebx + 4]
jmp 0x41c1f2

Function at 0x41c240
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x4ffbfc]
test eax, eax
jne 0x41c250
xor eax, eax
ret
sub esp, 0x1c
cmp dword [0x4ffbf4], 1
je 0x41c261
call fcn.0041b030
mov eax, dword [0x4b20ac]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x41c2a0
mov edx, dword [eax + 0x10]
test edx, edx
jle 0x41c288
xor eax, eax
add esp, 0x1c
ret
test byte [eax + 0x20], 3
je 0x41c27d
mov eax, dword [eax + 0x24]
and eax, 1
jmp 0x41c27f
call fcn.0041b0d0
test eax, eax
je 0x41c27d
jmp 0x41c276

Function at 0x41c2b0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
cmp dword [0x4ffbf4], 1
je 0x41c2c1
call fcn.0041b030
mov eax, dword [0x4b20ac]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x41c300
mov edx, dword [esp + 0x20]
add eax, 0x10
test edx, edx
jle 0x41c2f0
lock add dword [eax], 1
add esp, 0x1c
ret
lock sub dword [eax], 1
add esp, 0x1c
ret
call fcn.0041b0d0
test eax, eax
jne 0x41c2d6
add esp, 0x1c
ret
Function at 0x41c400
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
cmp dword [0x4ffbf4], 1
je 0x41c413
call fcn.0041b030
mov eax, dword [0x4b20ac]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x41c470
test byte [ebx + 0x20], 0xc
jne 0x41c439
mov eax, dword [0x4ffbfc]
test eax, eax
jne 0x41c440
add esp, 0x14
pop ebx
pop esi
ret
lea esi, [ebx + 0x1c]
mov dword [esp], esi
call fcn.0041a220
movzx eax, byte [ebx + 0x20]
test al, 3
je 0x41c462
mov edx, dword [ebx + 0x24]
test dl, 1
je 0x41c462
mov ecx, dword [ebx + 0x10]
test ecx, ecx
jle 0x41c481
mov dword [esp], esi
call fcn.0041a570
add esp, 0x14
pop ebx
pop esi
ret
call fcn.0041b0d0
mov ebx, eax
test eax, eax
jne 0x41c42a
add esp, 0x14
pop ebx
pop esi
ret
and eax, 0xfffffff3
and edx, 0xfffffffe
or eax, 4
mov dword [ebx + 0x24], edx
mov byte [ebx + 0x20], al
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x41c4a1
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push eax
mov dword [esp], esi
call fcn.0041a570
call fcn.0041c310
nop
push esi
xor esi, esi
push ebx
sub esp, 0x14
mov eax, dword [esp + 0x20]
test eax, eax
je 0x41c4d8
mov dword [esp], eax
call fcn.00419f60
mov ecx, 0xfffffffe
cmp ecx, eax
sbb esi, edx
mov esi, 0xffffffff
cmovae esi, eax
cmp dword [0x4ffbf4], 1
je 0x41c4e6
call fcn.0041b030
mov eax, dword [0x4b20ac]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x41c558
test esi, esi
je 0x41c530
call fcn.0041c400
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x41c568
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.0041a070
call fcn.0041c400
add esp, 0x14
xor eax, eax
pop ebx
pop esi
ret
call fcn.0041c400
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
call fcn.0041c400
add esp, 0x14
xor eax, eax
pop ebx
pop esi
ret
call fcn.0041b0d0
mov ebx, eax
jmp 0x41c4fd
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
jmp 0x41c519
Function at 0x4214c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ecx, 0x1a
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x80]
mov esi, 0x4b5101
push ebx
sub esp, 0x9c
mov eax, dword [str.not_enough_space_for_format_expansion__Please_submit_full_bug_report_at_https:__gcc.gnu.org_bugs__:_n]
mov dword [ebp - 0x81], eax
mov eax, dword [0x4b5165]
mov dword [ebp - 0x1c], eax
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp + 8]
lea eax, [edx + 0x84]
and eax, 0xfffffff0
call fcn.0040b260
mov ecx, 0x1a
sub esp, eax
lea esi, [ebp - 0x81]
mov dword [ebp - 0x8c], edx
lea ebx, [esp + 0x1b]
and ebx, 0xfffffff0
mov edi, ebx
lea eax, [ebx + 0x68]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 8]
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], ecx
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x8c]
mov byte [ebx + edx + 0x68], 0
mov dword [esp], ebx
call fcn.004a9f50
nop
nop
nop
nop
nop
nop
nop
push edi
push esi
push ebx
sub esp, 0x20
cmp byte [0x4b3bd4], 0
jne 0x4215e6
mov byte [0x4b3bd4], 1
call fcn.004a8430
test eax, eax
je 0x4215b4
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
sete al
mov dword [esp + 4], 0
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call fcn.0040a1e0
mov dword [esp], 2
mov esi, dword [fcn.00418a60]
mov edi, eax
call esi
mov dword [esp + 8], 0x30
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
call sub.msvcrt.dll_fwrite
mov edx, dword [esp + 0x1c]
mov dword [esp], 2
test edx, edx
je 0x4215a4
call esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x4b58d5
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x4aa848
jmp 0x4aa840
call esi
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
jmp 0x42156a
mov dword [esp], 2
call dword [0x4b2084]
mov dword [esp + 8], 0x2d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
call sub.msvcrt.dll_fwrite
jmp 0x4aa83b
mov dword [esp], 2
call dword [0x4b2084]
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_recursively_n
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
push ebx
mov ebx, ecx
sub esp, 0x18
mov dword [ecx], 0x4bc590
call fcn.004a20f0
mov dword [esp], ebx
mov dword [esp + 4], 4
call fcn.004a81d0
add esp, 0x18
pop ebx
ret
call sub.msvcrt.dll_abort
mov dword [esp], edi
call sub.msvcrt.dll_free
call fcn.004a8860
call fcn.004a8310
call fcn.004a8480
jmp 0x4aa83b
Function at 0x472510
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x1c
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
jmp 0x472533
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 4
jne 0x472551
mov ecx, ebx
call fcn.004722b0
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.msvcrt.dll__read
mov ebp, eax
cmp eax, 0xffffffff
je 0x472528
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x10002eb0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10018004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push esi
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10002ef1
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003d26
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
sub eax, esi
mov byte [esi], 0xe9
sub eax, 5
mov dword [esi + 1], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.10003d26
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10003b30
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10018004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp byte [esi], 0
je 0x10003bbe
mov eax, dword [esi + 8]
sub eax, dword [esi + 4]
je 0x10003bbe
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
push 0x40
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10003bbe
mov edx, dword [esi + 8]
xor ecx, ecx
push edi
mov edi, dword [esi + 4]
mov eax, edx
sub eax, edi
je 0x10003b98
nop dword [eax]
mov eax, dword [esi + 4]
mov al, byte [ecx + eax]
mov byte [ebx + ecx], al
inc ecx
mov edx, dword [esi + 8]
mov eax, edx
mov edi, dword [esi + 4]
sub eax, edi
cmp ecx, eax
jb 0x10003b80
lea eax, [ebp - 8]
sub edx, edi
push eax
push dword [ebp - 8]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003d26
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor al, al
pop esi
xor ecx, ebp
pop ebx
call fcn.10003d26
mov esp, ebp
pop ebp
ret 4
Function at 0x4099a4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409a77
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409a90
push ebx
push 0x409a9c
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409a24
mov al, 0x62
call fcn.00409648
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.00409978
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a2d
call fcn.00409978
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409a7e
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409b30
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409be4
jmp 0x409bd9
cmp dword [esi + 0x10], 0x1000
jne 0x409bc5
test byte [esi + 0x15], 1
jne 0x409bc5
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409b84
cmp eax, 2
je 0x409b84
cmp eax, 0x10
je 0x409b84
cmp eax, 0x20
jne 0x409b99
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409b99
mov bl, 1
xor ebp, ebp
jmp 0x409baa
mov eax, dword [esi]
add eax, ebp
call fcn.00409b28
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409b9d
test bl, bl
je 0x409bc5
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409be4
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409b5c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219