joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a210
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
xor eax, eax
test ebx, ebx
je 0x41a23d
add ebx, dword [esp + 8]
mov edx, dword [esp + 8]
add edx, 1
mov ecx, eax
movzx eax, ah
xor cl, byte [edx - 1]
movzx ecx, cl
xor ax, word [ecx + ecx + 0x47b0e0]
cmp edx, ebx
jne 0x41a223
pop ebx
ret

Function at 0x423f20
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [0x46c420], 0
mov dword [esp], 0x4ad880
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub esp, 4
test eax, eax
je 0x423fdb
mov eax, dword [0x4ad880]
mov edx, dword [0x4ad884]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x1e848
mov dword [esp + 0xc], 0
lea edi, [esp + 0x28]
mov ebx, 0x32
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.0044ed50
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov dword [esp + 0x18], eax
sar eax, 0x1f
mov dword [esp + 0x1c], eax
nop
mov dword [esp], ebp
call esi
sub esp, 4
mov dword [esp], edi
call esi
sub esp, 4
mov eax, dword [esp + 0x28]
sub eax, dword [esp + 0x20]
mov edx, dword [esp + 0x2c]
sbb edx, dword [esp + 0x24]
cmp dword [esp + 0x1c], edx
jl 0x423fd6
jle 0x423fd0
mov dword [0x46c420], 1
add esp, 0x3c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
cmp dword [esp + 0x18], eax
ja 0x423fb8
sub ebx, 1
jne 0x423f90
mov eax, dword [0x46c420]
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x423ff0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
cmp dword [0x46c420], 0xffffffff
mov dword [ecx], vtable.4vCmd.0
je 0x424001
repz ret
jmp fcn.00423f20

Function at 0x424070
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov eax, dword [0x46c420]
mov esi, dword [esp + 0x30]
test eax, eax
je 0x424100
lea eax, [esp + 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov dword [esp], eax
call ebx
mov eax, esi
mov ecx, dword [0x4ad880]
sub esp, 4
cdq
mov eax, dword [0x4ad884]
mov dword [esp + 8], 0xf4240
mov dword [esp + 0xc], 0
imul ecx, edx
imul eax, esi
add ecx, eax
mov eax, esi
lea esi, [esp + 0x18]
mul dword [0x4ad880]
add edx, ecx
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.0044ed50
mov edi, eax
mov esi, esi
lea edi, [edi]
mov dword [esp], esi
call ebx
sub esp, 4
mov eax, dword [esp + 0x18]
sub eax, dword [esp + 0x10]
cmp edi, eax
jg 0x4240e0
add esp, 0x20
pop ebx
pop esi
pop edi
ret 4
mov ecx, dword [0x4ad888]
test ecx, ecx
je 0x424140
imul ecx, esi
mov edx, 0x10624dd3
mov eax, ecx
sar ecx, 0x1f
imul edx
sar edx, 6
sub edx, ecx
mov dword [esp + 0x18], edx
mov eax, dword [esp + 0x18]
lea edx, [eax - 1]
test eax, eax
mov dword [esp + 0x18], edx
jne 0x424122
add esp, 0x20
pop ebx
pop esi
pop edi
ret 4
call fcn.0042ff60
lea ecx, [eax + 0x74]
call fcn.0041bf00
mov ecx, eax
mov dword [0x4ad888], eax
jmp 0x42410a
Function at 0x424160
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov eax, dword [esp + 4]
cmp eax, 0x1e
jg 0x424180
imul eax, eax, 0x3e8
mov dword [esp + 4], eax
jmp fcn.00424070
jmp dword [sym.imp.KERNEL32.dll_Sleep]
Function at 0x42f1e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, dword [ecx + 0x28]
mov esi, dword [sym.imp.USER32.dll_IsWindow]
mov ebx, dword [esp + 0x30]
test edi, edi
je 0x42f26e
mov ebp, ecx
jmp 0x42f207
mov edi, dword [edi + 4]
test edi, edi
je 0x42f259
mov eax, dword [edi]
cmp dword [eax + 4], ebx
je 0x42f200
mov dword [eax + 0x50], 0
mov eax, dword [eax + 0x1c]
mov dword [esp], eax
call esi
sub esp, 4
test eax, eax
je 0x42f200
mov eax, dword [edi]
mov eax, dword [eax + 0x1c]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
sub esp, 4
test eax, eax
je 0x42f200
mov dword [esp + 4], 0
mov eax, dword [edi]
mov eax, dword [eax + 0x1c]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov edi, dword [edi + 4]
sub esp, 8
test edi, edi
jne 0x42f207
mov esi, dword [ebp + 0x28]
test esi, esi
je 0x42f26e
mov eax, dword [esi]
cmp ebx, dword [eax + 4]
je 0x42f280
mov esi, dword [esi + 4]
test esi, esi
jne 0x42f260
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret 4
mov dword [eax + 0x50], 1
mov eax, dword [eax + 0x1c]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_IsWindow]
sub esp, 4
test eax, eax
je 0x42f267
mov eax, dword [esi]
mov eax, dword [eax + 0x1c]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
sub esp, 4
test eax, eax
jne 0x42f267
mov dword [esp + 4], 5
mov eax, dword [esi]
mov eax, dword [eax + 0x1c]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
sub esp, 8
jmp 0x42f267
Function at 0x440d80
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
push edi
push esi
push ebx
mov esi, str.______.pqrstuvwxyz
sub esp, 0x10c
lea ebp, [esp + 0x28]
mov dword [esp + 0x1c], ecx
mov ecx, 0x1b
mov ebx, dword [esp + 0x120]
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x94]
mov esi, 0x478840
mov ecx, 0x1b
rep movsd dword es:[edi], dword [esi]
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [esp], 0x10
call edi
movsx esi, ax
sub esp, 4
shr esi, 0x1f
mov dword [esp], 0x11
call edi
mov ecx, esi
sub esp, 4
or ecx, 4
test ax, ax
mov eax, dword [esp + 0x124]
cmovs esi, ecx
mov edx, dword [esp + 0x1c]
test eax, eax
je 0x440e37
mov eax, dword [esp + 0x28]
test eax, eax
je 0x440e1f
cmp ebx, eax
mov eax, 0
jne 0x440e14
jmp 0x440e30
cmp ebx, ecx
je 0x440e30
add eax, 1
mov ecx, dword [ebp + eax*4]
test ecx, ecx
jne 0x440e10
add esp, 0x10c
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
mov ebx, dword [esp + eax*4 + 0x94]
cmp ebx, 9
je 0x440eb0
mov eax, esi
and eax, 1
cmp ebx, 0x1f
cmovbe esi, eax
mov ecx, dword [edx + 0x24]
test ecx, ecx
je 0x440e90
lea eax, [esp + 0x24]
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
mov dword [esp + 8], eax
call fcn.00438460
sub esp, 0xc
test eax, eax
mov edx, dword [esp + 0x1c]
je 0x440e90
mov ecx, dword [esp + 0x24]
mov eax, dword [edx]
mov dword [esp], ecx
mov ecx, edx
call dword [eax + 0x14]
sub esp, 4
add esp, 0x10c
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
mov eax, dword [edx]
mov ecx, edx
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [eax + 0x10]
sub esp, 8
add esp, 0x10c
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
test esi, 1
je 0x440ec0
mov ebx, 0xff09
jmp 0x440e47
xor esi, esi
jmp 0x440e47

Function at 0x444c70
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.00444cd0
Function at 0x444cd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x4ade00]
test esi, esi
jle 0x444dbd
mov edi, dword [0x4ade04]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x444d04
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x444db6
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x444cf0
mov dword [esp], eax
mov esi, eax
call fcn.00445620
test eax, eax
mov edi, eax
je 0x444dfa
mov esi, dword [0x4ade04]
lea ebx, [ebx + ebx*2]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call fcn.00445730
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x4ade04]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x444dda
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x444daf
sub eax, 0x40
and eax, 0xffffffbf
je 0x444daf
mov eax, dword [esp + 0x20]
add ebx, dword [0x4ade04]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x444dc4
add dword [0x4ade00], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor ebx, ebx
jmp 0x444d0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00444c70
mov eax, dword [0x4ade04]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00444c70
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00444c70
lea esi, [esi]

Function at 0x445290
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4ade18
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4ade10]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x4452e5
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4452de
test esi, esi
je 0x4452de
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4452c0
mov dword [esp], 0x4ade18
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x453750
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
mov edi, edx
push esi
push ebx
lea ebx, [ecx - 1]
mov ecx, 0x66666667
sub esp, 0x2c
mov dword [esp + 0x1c], eax
mov eax, ebx
mov dword [esp + 0x10], ebx
sar eax, 0x1f
mov esi, dword [esp + 0x40]
mov dword [esp + 0x14], eax
mov eax, ebx
sar ebx, 0x1f
imul ecx
mov ecx, edx
sar ecx, 2
sub ecx, ebx
mov ebx, 1
je 0x4537a3
mov ebp, 0x66666667
mov eax, ecx
sar ecx, 0x1f
add ebx, 1
imul ebp
sar edx, 2
sub edx, ecx
mov ecx, edx
jne 0x453790
mov edx, dword [esi + 0x28]
cmp edx, 0xffffffff
je 0x453820
mov ecx, dword [esi + 8]
cmp ebx, edx
cmovl ebx, edx
lea edx, [ebx + 2]
mov eax, ecx
sub eax, edx
cmp ecx, edx
mov edx, 0xffffffff
cmovle eax, edx
mov ecx, 1
mov edx, edi
mov dword [esi + 8], eax
mov eax, dword [esp + 0x1c]
add ebx, 1
mov dword [esp], esi
call fcn.00453010
mov eax, dword [esi + 0x28]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 4]
mov edx, eax
and eax, 0x20
or edx, 0x1c0
or eax, 0x45
mov dword [esi + 4], edx
mov edx, esi
call fcn.00452bc0
add dword [esi + 8], ebx
mov eax, dword [esp + 0x10]
mov ecx, esi
mov edx, dword [esp + 0x14]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00453450
mov eax, dword [0x478c5c]
cmp eax, 0xffffffff
je 0x45384b
test eax, eax
je 0x45383b
mov edx, 2
mov dword [esi + 0x28], edx
jmp 0x4537ab
call fcn.00457be0
test al, 1
mov edx, 3
jne 0x45382e
jmp 0x453833
mov dword [esp], str.PRINTF_EXPONENT_DIGITS
call sub.msvcrt.dll_getenv
test eax, eax
je 0x453871
movsx eax, byte [eax]
sub eax, 0x30
cmp eax, 2
setbe al
movzx eax, al
mov dword [0x478c5c], eax
jmp 0x45382a
xor eax, eax
jmp 0x453867
Function at 0x4585f0
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0xc
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x478ca4], eax
je 0x458607
add esp, 0xc
ret
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x458a10
Capabilities:
Print debug messages

Disassembly:
test eax, eax
je 0x458a35
push edi
push esi
push ebx
mov ebx, eax
add esp, 0xffffff80
mov dword [esp], eax
call fcn.0045b7a0
cmp eax, 1
je 0x458a37
mov dword [ebx], 0xffffffff
sub esp, 0xffffff80
pop ebx
pop esi
pop edi
repz ret
lea ebx, [esp + 0x15]
mov esi, str.Error_cleaning_up_spin_keys_for_thread
mov ecx, 0xa
xor eax, eax
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x3d]
mov ecx, 0x43
rep stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea edx, [esp + 0x3c]
mov dword [esp + 8], 0xa
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.msvcrt.dll__ultoa]
cmp byte [esp + 0x3c], 0
mov eax, 0x27
jne 0x458a88
jmp 0x458a96
cmp eax, 0x6a
je 0x458aa0
add eax, 1
cmp byte [ebx + eax], 0
jne 0x458a83
cmp eax, 0x6a
je 0x458aa0
mov byte [esp + eax + 0x15], 0xa
mov byte [esp + eax + 0x16], 0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push eax
call sub.msvcrt.dll_abort
nop

Function at 0x458b30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
cmp dword [0x4ae86c], 1
je 0x458b45
call fcn.00458ab0
mov eax, dword [0x478ca4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
mov ebx, eax
je 0x458b70
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.00458960
mov esi, eax
mov eax, dword [entry3]
test eax, eax
je 0x458b5c
test esi, esi
je 0x458b5c
mov dword [esi + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x18], eax
lea eax, [esi + 0x38]
sub esp, 0x10
mov dword [esi + 0x1c], 0xffffffff
call fcn.00458a10
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esi + 0x64], 0
mov dword [esi + 0x14], 0
call ebx
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, eax
call ebx
lea edx, [esi + 0x14]
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], ebp
mov dword [esp + 0xc], edx
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
sub esp, 0x1c
test eax, eax
je 0x458c6d
mov eax, dword [esi + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esi + 0x6c], eax
movzx eax, byte [esi + 0x20]
sub esp, 4
mov dword [esi + 0x68], 0
and eax, 0xffffffcf
or eax, 0x10
mov byte [esi + 0x20], al
mov eax, dword [0x478ca4]
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x458c6d
mov ebx, esi
jmp 0x458b5c
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]
Function at 0x458dc0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x458df0
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x458eb0
add esp, 0x14
mov eax, 1
pop ebx
pop esi
ret 0xc
cmp eax, 1
je 0x458f70
cmp eax, 3
jne 0x458dd9
mov eax, dword [0x478ca4]
cmp eax, 0xffffffff
je 0x458dd9
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
mov ebx, eax
je 0x458dd9
test byte [eax + 0x20], 0x30
je 0x458ee0
mov eax, dword [eax + 0xb4]
test eax, eax
jne 0x458f92
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x458e64
mov dword [esp], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x458e56
mov dword [esp], eax
call esi
sub esp, 4
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x14], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call fcn.00458270
lea eax, [ebx + 0x38]
call fcn.00458a10
mov edx, dword [ebx + 0xb0]
test edx, edx
je 0x458fb0
mov eax, dword [0x478ca4]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
mov eax, 1
add esp, 0x14
pop ebx
pop esi
ret 0xc
mov eax, dword [0x4ae848]
test eax, eax
je 0x458dd9
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
mov dword [0x4ae848], 0
sub esp, 4
jmp 0x458dd9
mov eax, dword [eax + 0x68]
test eax, eax
mov eax, dword [ebx + 0x18]
jne 0x458f40
test eax, eax
je 0x458efa
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebx + 0xb4]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x68], 1
test eax, eax
jne 0x458fa0
test byte [ebx + 0x24], 4
je 0x458f57
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x458e5d
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
jmp 0x458e5d
test eax, eax
je 0x458f50
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebx + 0x18], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call fcn.00458270
lea eax, [ebx + 0x38]
call fcn.00458a10
jmp 0x458dd9
mov dword [esp + 4], 0x458440
mov dword [esp], 1
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
sub esp, 8
mov dword [0x4ae848], eax
jmp 0x458dd9
call fcn.00458cc0
jmp 0x458e32
call fcn.00458cc0
jmp 0x458f16
mov eax, ebx
call fcn.004587f0
jmp 0x458e85
Function at 0x4598f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call fcn.00458b30
mov ebx, eax
mov dword [eax + 4], esi
mov eax, dword [eax + 0xb4]
test eax, eax
jne 0x459972
test byte [ebx + 0x20], 0x30
jne 0x459926
add ebx, 0x70
mov dword [esp + 4], 1
mov dword [esp], ebx
call sub.msvcrt.dll_longjmp
mov eax, dword [0x478ca4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
push edx
mov ebx, eax
je 0x459969
cmp dword [eax + 0x14], 0
je 0x4599b6
mov esi, dword [eax + 4]
mov dword [eax + 0x68], 1
mov eax, dword [eax + 0x18]
test eax, eax
je 0x45995c
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
test byte [ebx + 0x24], 4
mov dword [ebx + 0x18], 0
jne 0x459979
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
call fcn.00458cc0
jmp 0x45990d
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
cmp dword [ebx + 0xb0], 0
mov dword [ebx + 0x14], 0
je 0x4599e0
mov eax, dword [0x478ca4]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push eax
push eax
jmp 0x459969
mov dword [eax], 0xdeadbeef
mov eax, dword [eax + 0x18]
test eax, eax
je 0x4599cd
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
cmp dword [ebx + 0xb0], 0
mov dword [ebx + 0x18], 0
mov esi, dword [ebx + 4]
jne 0x45999c
mov eax, ebx
call fcn.004587f0
jmp 0x45999c

Function at 0x409ebd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x409ebd
lcall 0x5de5, 0x8b10c483
jmp fcn.0076d6b4
Function at 0x405e30
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x43edab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x4040f4
call fcn.00406a91
push 4
mov dword [esp + 0x18], 0
call fcn.0040774b
mov edi, eax
add esp, 4
test edi, edi
je 0x405ea4
push ebx
call fcn.00406969
mov dword [edi], eax
call fcn.00406728
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00406a52
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x405e98
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.00406a7a
pop ebx
jmp 0x405ea6
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x4081c1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x442648]
jne 0x4081cb
repz ret
jmp fcn.0040ca4c
Function at 0x411e8c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x442648]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040b5bd
and dword [ebp - 0x14], 0
cmp dword [0x444f8c], 0
mov dword [ebp - 0x18], eax
jne 0x411f3f
push 0x403f00
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x411fe7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403ef4
push ebx
call edi
test eax, eax
je 0x411fe7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403ee4
push ebx
mov dword [0x444f8c], eax
call edi
push eax
call esi
push 0x403ed0
push ebx
mov dword [0x444f90], eax
call edi
push eax
call esi
push 0x403eb4
push ebx
mov dword [0x444f94], eax
call edi
push eax
call esi
mov dword [0x444f9c], eax
test eax, eax
je 0x411f3f
push 0x403e9c
push ebx
call edi
push eax
call esi
mov dword [0x444f98], eax
mov eax, dword [0x444f98]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x411f98
cmp dword [0x444f9c], ecx
je 0x411f98
push eax
call esi
push dword [0x444f9c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x411f98
test ebx, ebx
je 0x411f98
call edi
test eax, eax
je 0x411f8f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x411f8f
test byte [ebp - 8], 1
jne 0x411f98
or dword [ebp + 0x10], 0x200000
jmp 0x411fcb
mov eax, dword [0x444f90]
cmp eax, dword [ebp - 0x18]
je 0x411fcb
push eax
call esi
test eax, eax
je 0x411fcb
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x411fcb
mov eax, dword [0x444f94]
cmp eax, dword [ebp - 0x18]
je 0x411fcb
push eax
call esi
test eax, eax
je 0x411fcb
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x444f8c]
call esi
test eax, eax
je 0x411fe7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x411fe9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004081c1
leave
ret

Function at 0x43d740
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
mov eax, 0x6b
mov edx, 0x72
mov word [0x7c8ce8], ax
mov word [0x7c8cec], dx
mov ecx, 0x6e
mov edx, 0x65
xor eax, eax
push 0x7c8ce8
mov dword [0x7c8cf4], 0x320033
mov dword [0x7c8cfc], 0x6c006c
mov word [0x7c8cee], cx
mov dword [0x7c8cf0], 0x6c0065
mov dword [0x7c8cf8], 0x64002e
mov word [0x7c8cea], dx
mov word [0x7c8d00], ax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edx, dword [0x7c8ce4]
lea ecx, [esp]
push ecx
push 0x40
mov dword [0x7c8ce0], eax
mov eax, dword [0x449d34]
push edx
push eax
mov byte [0x444fab], 0x65
mov dword [0x444fa1], 0x75747269
mov word [0x444fa5], 0x6c61
mov byte [0x444fa0], 0x56
mov word [0x444fac], 0x7463
mov byte [0x444fae], 0
mov dword [0x444fa7], 0x746f7250
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret