joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c480
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x42b4ac
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x42b4a4]
sub esp, 4
test ebx, ebx
je 0x40c4d5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40c4ce
test esi, esi
je 0x40c4ce
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x40c4b0
mov dword [esp], 0x42b4ac
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40c800
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x40c825
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x40c830
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x40c825
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test esi, esi
je 0x40c878
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x40c86e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40c87a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x40c860
xor eax, eax
pop ebx
pop esi
ret
Function at 0x410dd0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x12c
mov ebx, dword [esp + 0x140]
call sub.msvcrt.dll__errno
mov dword [eax], 0
test ebx, ebx
je 0x410f40
cmp byte [ebx], 0
je 0x410f20
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
sub esp, 4
cmp eax, 0xffffffff
je 0x410f50
test al, 0x10
je 0x410f20
lea esi, [esp + 0x1c]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0x104
mov dword [esp], esi
call sub.msvcrt.dll__fullpath
mov dword [esp], esi
call sub.msvcrt.dll_strlen
mov ebp, eax
lea eax, [eax + 0x233]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov ebx, eax
test eax, eax
je 0x410f62
lea edx, [ebp + 1]
lea eax, [eax + 0x22c]
cmp edx, 4
jb 0x410ed0
mov ecx, dword [esi + edx - 4]
mov edi, eax
mov dword [eax + edx - 4], ecx
mov ecx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
cmp byte [ebx + 0x22c], 0
jne 0x410ef0
add ebp, eax
mov eax, 0x2a
lea edx, [ebx + 0x120]
mov ecx, 0x41
mov word [ebp], ax
mov edi, edx
xor eax, eax
mov dword [ebx + 0x224], 0xffffffff
mov dword [ebx + 0x228], 0
mov dword [ebx + 0x118], 0
mov dword [ebx + 0x11c], 0
rep stosd dword es:[edi], eax
add esp, 0x12c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
test edx, edx
je 0x410e73
movzx ecx, byte [esi]
mov byte [eax], cl
test dl, 2
je 0x410e73
movzx ecx, word [esi + edx - 2]
mov word [eax + edx - 2], cx
jmp 0x410e73
movzx ecx, byte [ebx + ebp + 0x22b]
add ebp, eax
cmp cl, 0x5c
je 0x410e7e
cmp cl, 0x2f
je 0x410e7e
mov ecx, 0x5c
mov word [ebp], cx
lea ebp, [eax + edx]
jmp 0x410e7e
call sub.msvcrt.dll__errno
xor ebx, ebx
mov dword [eax], 0x14
add esp, 0x12c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
mov dword [eax], 0xe
jmp 0x410ec0
call sub.msvcrt.dll__errno
xor ebx, ebx
mov dword [eax], 2
jmp 0x410ec0
call sub.msvcrt.dll__errno
mov dword [eax], 0xc
jmp 0x410ec0
Function at 0x417ab0
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
push edi
xor eax, eax
mov ecx, 0x10
sub esp, 0x88
lea edi, [esp + 0x40]
mov dword [esp + 0x15], 0x6f727245
mov dword [esp + 0x19], 0x6c632072
mov dword [esp + 0x1d], 0x696e6165
mov dword [esp + 0x21], 0x7520676e
mov dword [esp + 0x25], 0x70732070
mov dword [esp + 0x29], 0x6b5f6e69
mov dword [esp + 0x2d], 0x20737965
mov dword [esp + 0x31], 0x20726f66
mov dword [esp + 0x35], 0x65726874
mov dword [esp + 0x39], 0x206461
mov dword [esp + 0x3d], 0
mov dword [esp + 0x7c], 0
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea edx, [esp + 0x3c]
mov dword [esp + 8], 0xa
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__ultoa]
cmp byte [esp + 0x3c], 0
je 0x417b8b
mov eax, 0x27
lea edx, [esp + 0x15]
jmp 0x417b5d
cmp eax, 0x6a
je 0x417b7a
mov ecx, eax
add eax, 1
cmp byte [edx + eax], 0
jne 0x417b58
cmp eax, 0x6a
je 0x417b7a
add ecx, 2
mov byte [esp + eax + 0x15], 0xa
mov byte [esp + ecx + 0x15], 0
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
sub esp, 4
call sub.msvcrt.dll_abort
mov ecx, 0x28
mov eax, 0x27
lea edx, [esp + 0x15]
jmp 0x417b70

Function at 0x417ee0
Capabilities:
Allocate thread local storage

Disassembly:
push edi
mov eax, 0x42bf08
push esi
push ebx
sub esp, 0x10
call fcn.00417870
lea esi, [eax + 4]
mov ebx, eax
mov dword [esp], esi
call fcn.00417150
mov edi, dword [0x42bf08]
test edi, edi
jne 0x417f48
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x41f06c], eax
cmp eax, 0xffffffff
je 0x41ede1
mov dword [0x42bf08], 1
mov dword [esp], esi
call fcn.004174a0
test ebx, ebx
je 0x417f38
mov eax, ebx
call fcn.00417ba0
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop edi
ret
cmp edi, 1
je 0x417f25
mov dword [esp], 2
call dword [0x41f044]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x42bf08
mov dword [esp + 4], str._once__p_is__d_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x417f25
Function at 0x417f80
Capabilities:
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
call fcn.00417c90
mov edx, dword [entry3]
test edx, edx
je 0x4180b0
mov ebx, eax
test eax, eax
je 0x4180b0
mov dword [eax + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebx + 0x1c], 0xffffffff
mov dword [ebx + 0x18], eax
sub esp, 0x10
lea eax, [ebx + 0x38]
mov dword [esp], eax
call fcn.0041b4a0
cmp eax, 1
je 0x4180bc
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebx + 0x38], 0xffffffff
mov dword [ebx + 0x64], 0
mov dword [ebx + 0x14], 0
call ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov esi, eax
call ebp
lea edx, [ebx + 0x14]
mov dword [esp + 8], edi
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
sub esp, 0x1c
test eax, eax
je fcn.0041ede6
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x6c], eax
movzx eax, byte [ebx + 0x20]
sub esp, 4
and eax, 0xffffffcf
or eax, 0x10
mov byte [ebx + 0x20], al
mov eax, dword [0x41f06c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x4180c1
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x2c
xor ebx, ebx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.00417ab0
jmp fcn.0041ede6

Function at 0x4180d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub esp, 0x1c
cmp dword [0x42bf08], 1
je 0x4180e1
call fcn.00417ee0
mov eax, dword [0x41f06c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x418100
add esp, 0x1c
ret
add esp, 0x1c
jmp fcn.00417f80
Function at 0x4183f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x418420
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x4184f0
add esp, 0x10
mov eax, 1
pop ebx
pop esi
pop edi
ret 0xc
cmp eax, 1
je 0x418520
cmp eax, 3
jne 0x41840a
mov eax, dword [0x41f06c]
cmp eax, 0xffffffff
je 0x41840a
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x41840a
test byte [eax + 0x20], 0x30
je 0x418550
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x418463
call fcn.00418110
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x418495
mov dword [esp], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x418487
mov dword [esp], eax
call esi
sub esp, 4
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x14], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call fcn.00417630
lea eax, [ebx + 0x38]
mov dword [esp], eax
call fcn.0041b4a0
cmp eax, 1
je 0x4185d0
mov ecx, dword [ebx + 0xb0]
mov dword [ebx + 0x38], 0xffffffff
test ecx, ecx
je 0x418640
mov eax, dword [0x41f06c]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
jmp 0x41840a
mov eax, dword [0x42bee4]
test eax, eax
je 0x41840a
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
mov dword [0x42bee4], 0
sub esp, 4
jmp 0x41840a
mov dword [esp + 4], 0x4177e0
mov dword [esp], 1
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
sub esp, 8
mov dword [0x42bee4], eax
mov eax, 1
add esp, 0x10
pop ebx
pop esi
pop edi
ret 0xc
mov edx, dword [ebx + 0x68]
mov eax, dword [eax + 0x18]
test edx, edx
jne 0x4185d8
test eax, eax
je 0x41856a
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebx + 0xb4]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x68], 1
test eax, eax
je 0x418587
call fcn.00418110
lea edi, [ebx + 0x1c]
lea esi, [ebx + 0x38]
test byte [ebx + 0x24], 4
je 0x418620
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x4185b0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebx + 0x14], 0
mov dword [esp], edi
call fcn.00417630
mov dword [esp], esi
call fcn.0041b4a0
cmp eax, 1
jne 0x4184b4
call fcn.00417ab0
lea esi, [esi]
test eax, eax
je 0x4185e8
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
lea eax, [ebx + 0x1c]
mov dword [ebx + 0x18], 0
mov dword [esp], eax
call fcn.00417630
lea eax, [ebx + 0x38]
mov dword [esp], eax
call fcn.0041b4a0
cmp eax, 1
je 0x4185d0
mov dword [ebx + 0x38], 0xffffffff
jmp 0x41840a
mov dword [esp], edi
call fcn.00417630
mov dword [esp], esi
call fcn.0041b4a0
cmp eax, 1
jne 0x41860a
jmp 0x4185d0
mov eax, ebx
call fcn.00417d50
jmp 0x4184c9
Function at 0x4188e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
mov eax, dword [ebx]
test edx, edx
je 0x418a18
cmp eax, 1
je 0x418934
mov eax, ebx
call fcn.00417870
lea edi, [eax + 4]
mov esi, eax
mov dword [esp], edi
call fcn.00417150
mov ebp, dword [ebx]
test ebp, ebp
je 0x418940
cmp ebp, 1
jne 0x4189e8
mov dword [esp], edi
call fcn.004174a0
test esi, esi
je 0x418934
mov eax, esi
call fcn.00417ba0
add esp, 0x2c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
cmp dword [0x42bf08], 1
mov dword [esp + 0x14], 0x417c60
mov dword [esp + 0x18], esi
je 0x41895a
call fcn.00417ee0
mov eax, dword [0x41f06c]
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x418a58
mov eax, dword [eax + 0xc]
mov dword [esp + 0x1c], eax
lock or dword [esp], 0
cmp dword [0x42bf08], 1
je 0x41898f
call fcn.00417ee0
mov eax, dword [0x41f06c]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x418a40
lea edx, [esp + 0x14]
mov dword [eax + 0xc], edx
lock or dword [esp], 0
call dword [esp + 0x44]
cmp dword [0x42bf08], 1
je 0x4189c2
call fcn.00417ee0
mov eax, dword [0x41f06c]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x418a28
mov edx, dword [esp + 0x1c]
mov dword [eax + 0xc], edx
mov dword [ebx], 1
jmp 0x418921
mov dword [esp], 2
call dword [0x41f044]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], ebx
mov dword [esp + 4], str._once__p_is__d_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x418921
add esp, 0x2c
mov eax, 0x16
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.00417f80
test eax, eax
jne 0x4189d3
jmp 0x41edf9
call fcn.00417f80
test eax, eax
jne 0x4189a4
jmp 0x41ee0b
call fcn.00417f80
test eax, eax
jne 0x418975
jmp 0x41ee04
mov eax, dword [esp + 0x1c]
mov dword [0], eax
ud2
mov eax, dword [pe_dos_header]
ud2
lea eax, [esp + 0x14]
mov dword [0], eax
ud2

Function at 0x418cc0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x42bf08], 1
mov esi, eax
je 0x418cdd
call fcn.00417ee0
mov eax, dword [0x41f06c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x418d40
lea ebp, [ebx + 0x38]
xor edi, edi
mov dword [esp], ebp
call fcn.0041b4b0
mov eax, dword [esp + 0x30]
cmp dword [ebx + 0x28], eax
jbe 0x418d1d
mov eax, dword [ebx + 0x30]
mov edx, dword [esp + 0x30]
cmp byte [eax + edx], 0
je 0x418d1d
mov eax, dword [ebx + 0x2c]
mov edi, dword [eax + edx*4]
mov dword [esp], ebp
call fcn.0041b500
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.00417f80
mov ebx, eax
jmp 0x418cf4
Function at 0x418d50
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [esp + 0x40]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x42bf08], 1
mov dword [esp + 0x14], eax
je 0x418d73
call fcn.00417ee0
mov eax, dword [0x41f06c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x418e78
lea edi, [ebx + 0x38]
mov dword [esp], edi
call fcn.0041b4b0
cmp dword [ebx + 0x28], esi
jbe 0x418dd8
mov edx, dword [ebx + 0x2c]
mov eax, dword [esp + 0x44]
mov dword [edx + esi*4], eax
mov eax, dword [ebx + 0x30]
mov byte [eax + esi], 1
mov dword [esp], edi
call fcn.0041b500
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
sub esp, 4
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
lea ebp, [esi + 1]
lea eax, [ebp*4]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sub.msvcrt.dll_realloc
test eax, eax
je 0x418e84
mov dword [esp + 0x1c], eax
mov dword [esp + 4], ebp
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
call sub.msvcrt.dll_realloc
mov edx, dword [esp + 0x1c]
test eax, eax
mov dword [esp + 0x18], eax
je 0x418e84
mov ecx, dword [ebx + 0x28]
mov eax, ebp
mov dword [esp + 4], 0
mov dword [esp + 0x1c], edx
sub eax, ecx
lea ecx, [edx + ecx*4]
shl eax, 2
mov dword [esp], ecx
mov dword [esp + 8], eax
call sub.msvcrt.dll_memset
mov eax, dword [esp + 0x18]
mov ecx, ebp
add eax, dword [ebx + 0x28]
sub ecx, dword [ebx + 0x28]
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov dword [ebx + 0x28], ebp
mov dword [ebx + 0x2c], edx
mov dword [ebx + 0x30], eax
jmp 0x418da1
call fcn.00417f80
mov ebx, eax
jmp 0x418d8e
mov dword [esp], edi
call fcn.0041b500
mov eax, 0xc
jmp 0x418dc9

Function at 0x418f10
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
cmp dword [0x42bf08], 1
je 0x418f21
call fcn.00417ee0
mov eax, dword [0x41f06c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x418f40
mov eax, dword [eax + 0x18]
add esp, 0x1c
ret
call fcn.00417f80
test eax, eax
jne 0x418f36
add esp, 0x1c
ret

Function at 0x418fa0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
cmp dword [0x42bf08], 1
je 0x418fb1
call fcn.00417ee0
mov eax, dword [0x41f06c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x418fd0
add eax, 0xc
add esp, 0x1c
ret
call fcn.00417f80
test eax, eax
jne 0x418fc6
jmp 0x418fc9
Function at 0x419000
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call fcn.004180d0
mov dword [eax + 4], esi
mov ebx, eax
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x419022
call fcn.00418110
test byte [ebx + 0x20], 0x30
jne 0x41903c
add ebx, 0x70
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_longjmp]
mov eax, dword [0x41f06c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
push edx
test eax, eax
je 0x41907f
cmp dword [ebx + 0x14], 0
mov eax, dword [eax + 0x18]
je 0x4190c3
mov dword [ebx + 0x68], 1
mov esi, dword [ebx + 4]
test eax, eax
je 0x419072
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
mov dword [ebx + 0x18], 0
test byte [ebx + 0x24], 4
jne 0x419088
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
mov dword [ebx + 0x14], 0
mov eax, ebx
call fcn.00417ec0
mov eax, dword [0x41f06c]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push eax
push eax
jmp 0x41907f
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x4190d7
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
mov dword [ebx + 0x18], 0
mov esi, dword [ebx + 4]
jmp 0x4190a2

Function at 0x4190f0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x42bf10]
test eax, eax
jne 0x419100
xor eax, eax
ret
sub esp, 0x1c
cmp dword [0x42bf08], 1
je 0x419111
call fcn.00417ee0
mov eax, dword [0x41f06c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x419150
mov edx, dword [eax + 0x10]
test edx, edx
jle 0x419138
xor eax, eax
add esp, 0x1c
ret
test byte [eax + 0x20], 3
je 0x41912d
mov eax, dword [eax + 0x24]
and eax, 1
jmp 0x41912f
call fcn.00417f80
test eax, eax
je 0x41912d
jmp 0x419126

Function at 0x419160
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
cmp dword [0x42bf08], 1
je 0x419171
call fcn.00417ee0
mov eax, dword [0x41f06c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x4191b0
mov edx, dword [esp + 0x20]
add eax, 0x10
test edx, edx
jle 0x4191a0
lock add dword [eax], 1
add esp, 0x1c
ret
lock sub dword [eax], 1
add esp, 0x1c
ret
call fcn.00417f80
test eax, eax
jne 0x419186
add esp, 0x1c
ret
Function at 0x4192b0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
cmp dword [0x42bf08], 1
je 0x4192c3
call fcn.00417ee0
mov eax, dword [0x41f06c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x419320
test byte [ebx + 0x20], 0xc
jne 0x4192e9
mov eax, dword [0x42bf10]
test eax, eax
jne 0x4192f0
add esp, 0x14
pop ebx
pop esi
ret
lea esi, [ebx + 0x1c]
mov dword [esp], esi
call fcn.00417150
movzx eax, byte [ebx + 0x20]
test al, 3
je 0x419312
mov edx, dword [ebx + 0x24]
test dl, 1
je 0x419312
mov ecx, dword [ebx + 0x10]
test ecx, ecx
jle 0x419331
mov dword [esp], esi
call fcn.004174a0
add esp, 0x14
pop ebx
pop esi
ret
call fcn.00417f80
mov ebx, eax
test eax, eax
jne 0x4192da
add esp, 0x14
pop ebx
pop esi
ret
and eax, 0xfffffff3
and edx, 0xfffffffe
or eax, 4
mov dword [ebx + 0x24], edx
mov byte [ebx + 0x20], al
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x419351
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push eax
mov dword [esp], esi
call fcn.004174a0
call fcn.004191c0
nop
push esi
xor esi, esi
push ebx
sub esp, 0x14
mov eax, dword [esp + 0x20]
test eax, eax
je 0x419388
mov dword [esp], eax
call fcn.0041a570
mov ecx, 0xfffffffe
cmp ecx, eax
sbb esi, edx
mov esi, 0xffffffff
cmovae esi, eax
cmp dword [0x42bf08], 1
je 0x419396
call fcn.00417ee0
mov eax, dword [0x41f06c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x419408
test esi, esi
je 0x4193e0
call fcn.004192b0
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x419418
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.0041a680
call fcn.004192b0
add esp, 0x14
xor eax, eax
pop ebx
pop esi
ret
call fcn.004192b0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
call fcn.004192b0
add esp, 0x14
xor eax, eax
pop ebx
pop esi
ret
call fcn.00417f80
mov ebx, eax
jmp 0x4193ad
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
jmp 0x4193c9
Function at 0x100012d2
Capabilities:
Initialize winsock library

Disassembly:
mov eax, 0x1001d115
call fcn.10009bf4
sub esp, 0x198
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
call fcn.10001000
xor ebx, ebx
lea ecx, [esi + 0x14]
mov dword [ebp - 4], ebx
call fcn.10001000
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
call fcn.10001000
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 2
call fcn.10001000
lea eax, [ebp - 0x1a4]
mov dword [esi], 0x1001e4c8
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
or dword [esi + 0x48], 0xffffffff
mov dword [esi + 0x4c], eax
lea eax, [ebp - 0x10]
push 3
push eax
lea eax, [esi + 0x50]
push eax
mov byte [esi + 0x53], bl
mov byte [ebp - 0x10], 0x68
mov byte [ebp - 0xf], 0x78
mov byte [ebp - 0xe], 0x20
call fcn.100093a0
mov ecx, dword [ebp - 0xc]
add esp, 0xc
mov eax, esi
mov dword fs:[0], ecx
pop esi
pop ebx
leave
ret

Function at 0x1000141c
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
xor ebx, ebx
cmp dword [0x10048a50], ebx
push esi
push edi
mov esi, ecx
jne 0x10001496
call fcn.100017f5
push dword [esi + 0x4c]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 6
push 1
push 2
mov byte [esi + 0x53], bl
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 0x48], eax
je 0x10001496
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov edi, eax
cmp edi, ebx
je 0x10001496
push dword [ebp + 0xc]
mov word [ebp - 0x24], 2
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x22], ax
mov eax, dword [edi + 0xc]
push 0x10
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push eax
push dword [esi + 0x48]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x1000149a
xor al, al
jmp 0x10001503
push 1
lea eax, [ebp - 4]
pop edi
push 4
push eax
push 8
push 0xffff
push dword [esi + 0x48]
mov dword [ebp - 4], edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x100014e7
push ebx
lea eax, [ebp - 8]
push ebx
push eax
push ebx
push ebx
lea eax, [ebp - 0x14]
push 0xc
push eax
push 0x98000004
push dword [esi + 0x48]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], 0x2bf20
mov dword [ebp - 0xc], 0x1388
call dword [sym.imp.WS2_32.dll_WSAIoctl]
push ebx
push ebx
push ebx
push esi
push 0x1000150a
push ebx
push ebx
mov byte [esi + 0x53], 1
call fcn.10008acb
mov dword [esi + 0x44], eax
add esp, 0x1c
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x1000196a
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
cmp dword [esp + 8], ecx
jle 0x10001989
mov dl, byte [ecx + eax]
xor dl, 0xfc
add dl, 0x31
mov byte [ecx + eax], dl
inc ecx
cmp ecx, dword [esp + 8]
jl 0x10001976
ret