joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100768c0
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x1010
call fcn.1008a920
mov eax, dword [esp + 0x1014]
push ebx
push ebp
mov ebp, dword [esp + 0x1020]
push esi
push edi
xor edi, edi
push 1
push edi
push edi
push eax
mov dword [ebp], edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
je 0x100769c2
jmp 0x100768ff
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x1024]
xor esi, esi
lea ecx, [esp + 0x18]
push esi
push ecx
lea edx, [esp + 0x28]
push 0x1000
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100769df
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], esi
cmp eax, esi
jle 0x1007694b
mov cl, byte [esp + esi + 0x20]
test cl, cl
je 0x10076942
inc esi
cmp esi, eax
jl 0x10076933
jmp 0x1007694b
inc esi
mov dword [esp + 0x14], 1
mov eax, dword [ebp]
mov ebx, edi
add edi, esi
test eax, eax
mov dword [esp + 0x1c], edi
je 0x10076967
inc edi
push edi
push eax
call fcn.10072c30
add esp, 8
jmp 0x10076971
inc edi
push edi
call fcn.10072b90
add esp, 4
mov edi, eax
lea ecx, [esp + 0x20]
add edi, ebx
push esi
push ecx
push edi
mov dword [ebp], eax
call fcn.10089c00
mov eax, dword [esp + 0x20]
add esp, 0xc
test eax, eax
mov byte [edi + esi], 0
jne 0x100769f8
cmp dword [esp + 0x18], 0x1000
jb 0x10076a2b
mov edx, dword [esp + 0x1024]
push 1
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x100768fb
mov eax, dword [esp + 0x102c]
pop edi
pop esi
pop ebp
mov dword [eax], 0
mov eax, 1
pop ebx
add esp, 0x1010
ret
mov ecx, dword [esp + 0x102c]
pop edi
mov eax, 1
mov dword [ecx], esi
pop esi
pop ebp
pop ebx
add esp, 0x1010
ret
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x1024]
push 0
add esi, edx
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esp + 0x102c]
pop edi
pop esi
pop ebp
mov dword [ecx], 1
xor eax, eax
pop ebx
add esp, 0x1010
ret
mov edx, dword [esp + 0x102c]
pop edi
pop esi
pop ebp
mov dword [edx], 1
mov eax, 1
pop ebx
add esp, 0x1010
ret

Function at 0x10076a50
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esp + 0x18]
push 4
push ecx
push edi
mov dword [esi], 0
call ebx
test eax, eax
je 0x10076adc
cmp dword [esp + 0x14], 4
jb 0x10076adc
mov edx, dword [esp + 0x10]
add edx, 8
push edx
call fcn.10072b90
mov edx, dword [esp + 0x14]
add esp, 4
lea ecx, [esp + 0x14]
mov dword [esi], eax
push 0
push ecx
add eax, 8
push edx
push eax
push edi
call ebx
test eax, eax
je 0x10076acb
mov esi, dword [esi]
mov dword [esi], 1
mov eax, dword [esp + 0x14]
mov dword [esi + 4], eax
mov ecx, dword [esp + 0x14]
cmp ecx, dword [esp + 0x10]
jne 0x10076adc
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov edx, dword [esi]
push edx
call fcn.10072ca0
add esp, 4
mov dword [esi], 0
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x10076ec0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
mov esi, dword [esp + 0x1c]
push edi
push 1
mov dword [esi], 0
mov edi, dword [ebx + 4]
push 0
push 0
push edi
call ebp
mov dword [esp + 0x10], eax
lea eax, [esp + 0x20]
push 0
push eax
lea ecx, [esp + 0x24]
push 4
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10076fd0
mov edx, dword [ebx + 0x130]
lea eax, [ebx + 0xc]
lea ecx, [ebx + 0x2c]
push eax
push edx
mov dword [esp + 0x1c], ecx
push ecx
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x28]
push 4
push eax
push ecx
call fcn.1007a380
mov eax, dword [esp + 0x38]
add esp, 0x18
cmp eax, 4
jb 0x10076fd0
mov edx, dword [esp + 0x1c]
add edx, 8
push edx
call fcn.10072b90
add esp, 4
mov dword [esi], eax
push 1
push 0
push 0
push edi
call ebp
mov edx, dword [esi]
mov ecx, dword [esp + 0x1c]
mov ebp, eax
lea eax, [esp + 0x20]
push 0
push eax
add edx, 8
push ecx
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10076fbf
mov eax, dword [esi]
mov dword [eax], 1
mov ecx, dword [esp + 0x20]
mov dword [eax + 4], ecx
mov edx, dword [ebx + 0x130]
mov ecx, dword [esp + 0x20]
lea eax, [ebx + 0xc]
push eax
mov eax, dword [esp + 0x18]
push edx
mov edx, dword [esi]
push eax
add edx, 8
push ecx
push edx
push ebp
call fcn.1007a380
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
add esp, 0x18
cmp eax, ecx
jne 0x10076fd0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
mov ecx, dword [esi]
push ecx
call fcn.10072ca0
add esp, 4
mov dword [esi], 0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
Function at 0x10079c10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, edx
push esi
push edi
mov esi, ebp
xor edi, edi
and esi, 3
mov eax, ecx
jle 0x10079c31
mov dl, byte [eax]
inc eax
cmp dl, bl
je 0x10079c8b
inc edi
cmp edi, esi
jl 0x10079c25
mov edi, ebx
and edi, 0xff
mov esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
lea edi, [ecx + ebp]
cmp eax, edi
jae 0x10079cc0
mov edx, dword [eax]
xor edx, esi
lea ebp, [edx - 0x1010101]
not edx
and ebp, edx
test ebp, 0x80808080
je 0x10079c7a
cmp byte [eax], bl
je 0x10079c95
cmp byte [eax + 1], bl
je 0x10079c9e
cmp byte [eax + 2], bl
je 0x10079ca8
cmp byte [eax + 3], bl
je 0x10079cb4
add eax, 4
cmp eax, edi
jb 0x10079c51
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
dec eax
pop ebx
ret 4
pop edi
pop esi
pop ebp
sub eax, ecx
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
inc eax
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 2
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 3
pop ebx
ret 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4

Function at 0x1007a190
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esp + 0x11c]
lea eax, [esp + 0x18]
mov ebx, edi
xor esi, esi
xor ecx, ecx
sub ebx, eax
mov eax, ecx
lea ebp, [esp + ecx + 0x18]
cdq
idiv dword [esp + 0x124]
mov eax, dword [esp + 0x120]
mov byte [ebx + ebp], cl
inc ecx
cmp ecx, 0x100
mov dl, byte [edx + eax]
mov byte [ebp], dl
jl 0x1007a1c2
lea ebp, [esp + 0x18]
mov eax, edi
sub ebp, edi
mov dword [esp + 0x10], 0x100
mov cl, byte [eax]
xor edx, edx
mov dl, byte [eax + ebp]
mov byte [esp + 0x14], cl
mov ebx, dword [esp + 0x14]
add esi, edx
and ebx, 0xff
add esi, ebx
and esi, 0x800000ff
jns 0x1007a222
dec esi
or esi, 0xffffff00
inc esi
mov dl, byte [esi + edi]
mov byte [eax], dl
mov byte [esi + edi], cl
mov ecx, dword [esp + 0x10]
inc eax
dec ecx
mov dword [esp + 0x10], ecx
jne 0x1007a1f9
xor al, al
mov byte [edi + 0x100], al
mov byte [edi + 0x101], al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
Function at 0x1007a2d0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0x14]
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
xor esi, esi
mov byte [esp + 0x18], cl
test edi, edi
mov byte [esp + 8], dl
jle 0x1007a36c
mov edx, dword [esp + 0x10]
push ebx
push ebp
mov cl, byte [esp + 0x20]
mov bl, byte [esp + 0x10]
inc cl
mov byte [esp + 0x20], cl
mov ecx, dword [esp + 0x20]
and ecx, 0xff
lea edi, [ecx + eax]
mov cl, byte [ecx + eax]
add bl, cl
mov byte [esp + 0x10], bl
mov ebx, dword [esp + 0x10]
and ebx, 0xff
lea ebp, [ebx + eax]
mov bl, byte [ebx + eax]
mov byte [edi], bl
mov byte [ebp], cl
mov bl, byte [edi]
add bl, cl
and ebx, 0xff
mov cl, byte [ebx + eax]
mov bl, byte [esi + edx]
xor bl, cl
mov ecx, dword [esp + 0x1c]
mov byte [esi + edx], bl
inc esi
cmp esi, ecx
jl 0x1007a2fb
mov dl, byte [esp + 0x20]
mov cl, byte [esp + 0x10]
pop ebp
pop ebx
pop edi
mov byte [eax + 0x100], dl
mov byte [eax + 0x101], cl
pop esi
pop ecx
ret
pop edi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop esi
pop ecx
ret
Function at 0x416cfd
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0040d90c
xor ebx, ebx
cmp dword [0x4222ec], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x416dd3
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x416eb3
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x416eb3
push eax
call fcn.0040d89e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4222ec], eax
call esi
push eax
call fcn.0040d89e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4222f0], eax
call esi
push eax
call fcn.0040d89e
mov dword [0x4222f4], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0040b068
test eax, eax
pop ecx
pop ecx
je 0x416da1
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00407516
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x416dd3
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0040d89e
cmp eax, ebx
pop ecx
mov dword [0x4222fc], eax
je 0x416dd3
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040d89e
pop ecx
mov dword [0x4222f8], eax
mov eax, dword [0x4222f8]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x416e58
cmp dword [0x4222fc], ecx
je 0x416e58
push eax
call fcn.0040d915
push dword [0x4222fc]
mov esi, eax
call fcn.0040d915
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x416e58
cmp edi, ebx
je 0x416e58
call esi
cmp eax, ebx
je 0x416e25
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x416e25
test byte [ebp - 0x18], 1
jne 0x416e58
lea eax, [ebp - 0x10]
push eax
call fcn.0040b09f
test eax, eax
pop ecx
je 0x416e40
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00407516
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x416e4f
or dword [ebp + 0x10], 0x200000
jmp 0x416e93
or dword [ebp + 0x10], 0x40000
jmp 0x416e93
mov eax, dword [0x4222f0]
cmp eax, dword [ebp - 8]
je 0x416e93
push eax
call fcn.0040d915
cmp eax, ebx
pop ecx
je 0x416e93
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x416e93
mov eax, dword [0x4222f4]
cmp eax, dword [ebp - 8]
je 0x416e93
push eax
call fcn.0040d915
cmp eax, ebx
pop ecx
je 0x416e93
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4222ec]
call fcn.0040d915
cmp eax, ebx
pop ecx
je 0x416eb3
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x416eb5
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x418f89
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x418f89
lcall 0x5de5, 0x8b10c483
jmp loc.007b04e0
Function at 0x403900
Capabilities:
Check os version

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
mov ecx, 0x27
xor eax, eax
mov edi, 0x40a418
rep stosd dword es:[edi], eax
push 0x40a418
mov dword [0x40a4b4], 0
mov dword [0x40a418], 0x94
call esi
test eax, eax
je 0x403971
mov eax, dword [0x40a428]
mov dword [0x40a410], 1
cmp eax, 2
jne 0x403971
cmp dword [0x40a41c], 5
jb 0x403971
mov ecx, 0x27
xor eax, eax
mov edi, 0x40a418
push 0x40a418
rep stosd dword es:[edi], eax
mov dword [0x40a418], 0x9c
call esi
pop edi
pop esi
ret

Function at 0x404010
Capabilities:
Create udp socket
Get local ipv4 addresses
Get socket information
Initialize winsock library

Disassembly:
sub esp, 0x1a4
push ebx
push esi
mov esi, ecx
cmp byte [esi], 0
je 0x40402c
pop esi
mov al, 1
pop ebx
add esp, 0x1a4
ret 8
lea eax, [esp + 0x1c]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x404050
mov byte [esi], 0
pop esi
xor al, al
pop ebx
add esp, 0x1a4
ret 8
mov eax, dword [esi + 1]
mov ebx, dword [sym.imp.WS2_32.dll_closesocket]
cmp eax, 0xffffffff
mov byte [esi], 1
je 0x404064
push eax
call ebx
push 0
push 2
push 2
mov dword [esi + 1], 0xffffffff
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 1], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esi + 1], 0xffffffff
je 0x404043
mov ecx, dword [esp + 0x1b0]
mov word [esp + 0xc], 2
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0xe], ax
mov eax, dword [esp + 0x1b4]
test eax, eax
jne 0x4040b1
mov dword [esp + 0x10], eax
jmp 0x4040bc
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 1]
lea edx, [esp + 0xc]
push 0x10
push edx
push eax
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x4040e5
mov ecx, dword [esi + 1]
push ecx
call ebx
pop esi
xor al, al
pop ebx
add esp, 0x1a4
ret 8
mov ecx, dword [esi + 1]
lea edx, [esp + 8]
lea eax, [esp + 0xc]
push edx
push eax
push ecx
mov dword [esp + 0x14], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x404043
mov dx, word [esp + 0xe]
mov al, 1
mov word [esi + 0x11], dx
pop esi
pop ebx
add esp, 0x1a4
ret 8

Function at 0x404290
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push esi
mov esi, ecx
push eax
mov word [esp + 8], 2
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [esp + 0x18]
mov word [esp + 6], ax
push ecx
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, dword [esp + 0x20]
lea edx, [esp + 4]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
push 0x10
push edx
mov edx, dword [esi + 1]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
pop esi
setne al
add esp, 0x10
ret 0x10
Function at 0x4042f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x14
mov ecx, dword [ecx + 1]
lea eax, [esp]
lea edx, [esp + 4]
push eax
mov eax, dword [esp + 0x24]
push edx
push 0
push 0x578
push eax
push ecx
mov dword [esp + 0x18], 0x578
call dword [sym.imp.WS2_32.dll_recvfrom]
mov edx, dword [esp + 0x24]
cmp eax, 0xffffffff
mov word [edx], ax
jne 0x40432f
xor al, al
add esp, 0x14
ret 0x10
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 6]
mov ecx, dword [esp + 8]
push edx
mov dword [eax], ecx
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [esp + 0x1c]
mov word [ecx], ax
mov al, 1
add esp, 0x14
ret 0x10
Function at 0x404f30
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x128
push ebx
push ebp
push esi
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebp, eax
lea eax, [esp + 0x10]
push eax
push ebp
mov dword [esp + 0x18], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x40501e
mov edi, dword [esp + 0x13c]
lea eax, [esp + 0x34]
mov esi, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x404f95
test cl, cl
je 0x404f91
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x404f95
add eax, 2
add esi, 2
test cl, cl
jne 0x404f6d
xor eax, eax
jmp 0x404f9a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x404fe4
lea eax, [esp + 0x10]
push eax
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40501e
mov esi, edi
lea eax, [esp + 0x34]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x404fdb
test cl, cl
je 0x404fd7
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x404fdb
add eax, 2
add esi, 2
test cl, cl
jne 0x404fb3
xor eax, eax
jmp 0x404fe0
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x404f9e
mov al, byte [esp + 0x140]
test al, al
je 0x40500a
mov eax, dword [esp + 0x18]
push 0
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x128
ret
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x128
ret
Function at 0x40d5e0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.0040d640

Function at 0x40d640
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x492054]
test esi, esi
jle 0x40d72d
mov edi, dword [0x492058]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x40d674
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x40d726
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x40d660
mov dword [esp], eax
mov ebx, eax
call fcn.0040df80
test eax, eax
mov edi, eax
je 0x40d76a
lea ebx, [esi + esi*2]
mov esi, dword [0x492058]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call fcn.0040e080
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x492058]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x40d74a
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x40d71f
sub eax, 0x40
and eax, 0xffffffbf
je 0x40d71f
mov eax, dword [esp + 0x20]
add ebx, dword [0x492058]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x40d734
add dword [0x492054], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor esi, esi
jmp 0x40d67e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.0040d5e0
mov eax, dword [0x492058]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.0040d5e0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.0040d5e0
lea esi, [esi]
Function at 0x40dc30
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x492408
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x492400]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x40dc85
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40dc7e
test esi, esi
je 0x40dc7e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x40dc60
mov dword [esp], 0x492408
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40dea0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x40ded8
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x40dece
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40deda
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x40dec0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x40f310
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov esi, eax
lea eax, [eax + 0x41]
and eax, 0xfffffff0
call fcn.0040e1b0
mov edx, 0x326d
sub esp, eax
lea eax, [esp + 0x1b]
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
lea edi, [esp + 0xc]
mov word [esp + 0x18], dx
mov dword [esp + 0xc], 0x2d636367
mov dword [esp], eax
mov dword [esp + 0x10], 0x656d6873
mov dword [esp + 0x14], 0x64742d6d
mov byte [esp + 0x1a], 0x2d
call sub.msvcrt.dll_memcpy
lea eax, [esi + 0x10]
lea edx, [edi + eax]
mov dword [ebp - 0x20], eax
mov dword [edx], 0x61616161
mov dword [edx + 4], 0x61616161
mov dword [edx + 8], 0x61616161
mov dword [edx + 0xc], 0x61616161
mov dword [edx + 0x10], 0x61616161
mov dword [edx + 0x14], 0x61616161
mov dword [edx + 0x18], 0x61616161
mov dword [edx + 0x1c], 0x61616161
mov dword [ebp - 0x24], edx
mov byte [esp + esi + 0x3c], 0
mov byte [esp + esi + 0x1b], 0
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
sub esp, 0xc
mov byte [edi + esi + 0xf], 0x2d
mov dword [ebp - 0x1c], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
mov edx, dword [ebp - 0x24]
je 0x40f3ff
int3
mov dword [ebp - 0x24], edx
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_FindAtomA]
sub esp, 4
test ax, ax
mov edx, dword [ebp - 0x24]
jne 0x40f4a3
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], edx
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov edx, dword [ebp - 0x24]
mov ebx, eax
mov eax, 0x20
bt ebx, eax
jae 0x40f43a
mov byte [edx], 0x41
add edx, 1
sub eax, 1
jne 0x40f432
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_AddAtomA]
sub esp, 4
test ax, ax
je 0x40f4a0
lea ecx, [esi + 0x31]
mov esi, dword [ebp - 0x20]
movzx eax, ax
mov edx, edi
mov dword [esp], esi
call fcn.0040f290
cmp eax, ebx
mov esi, eax
je 0x40f4ba
mov dword [esp], ebx
call fcn.00419e78
mov edi, dword [ebp - 0x1c]
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
int3
lea ecx, [esi + 0x31]
mov esi, dword [ebp - 0x20]
movzx eax, ax
mov edx, edi
mov dword [esp], esi
call fcn.0040f290
mov esi, eax
jmp 0x40f474
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [esp + 8], eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x40f474
mov dword [esp], ebx
call dword [ebp + 0x10]
jmp 0x40f474
Function at 0x41ad60
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [0x492e40]
test ebx, ebx
je 0x41ad90
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [ebx], eax
mov eax, dword [0x492e40]
test eax, eax
je 0x41adb5
cmp dword [eax], 0xffffffff
je 0x41add8
add esp, 0x18
pop ebx
ret
mov dword [esp + 8], 0x41a1f0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.00420330
mov ebx, eax
mov dword [0x492e40], eax
jmp 0x41ad6e
mov dword [esp + 8], 0x41a1f0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.00420330
mov dword [0x492e40], eax
jmp 0x41ad7f
call sub.msvcrt.dll_abort
lea esi, [esi]