joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40610d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x40611c
pop dword [ebp - 0x2c]
mov eax, 0xe7011c4e
add eax, 0x193f44ce
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x2b219e1
sub dword [ebp - 0x3c], 0xb45fd496
mov dword [ebp - 0x38], 0x8195907d
sub dword [ebp - 0x38], 0x4f624438
mov dword [ebp - 0x34], 0x4f3b25c1
add dword [ebp - 0x34], 0xfd111e6d
mov dword [ebp - 0x30], 0xed1e8c7e
add dword [ebp - 0x30], 0x12e17382
lea eax, [ebp - 0x3c]
push eax
mov eax, 0xee45f3af
add eax, 0x11fa7cb1
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xfd9d48a2
add dword [ebp - 0x3c], 0x76d520b4
mov dword [ebp - 0x38], 0xefdf9ae3
add dword [ebp - 0x38], 0x518cc692
mov dword [ebp - 0x34], 0x8a5b939a
sub dword [ebp - 0x34], 0x26ec272e
mov dword [ebp - 0x30], 0xe55c7702
add dword [ebp - 0x30], 0x1aa388fe
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x251d39cf
add eax, 0xdb233731
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3b5ab
push 0
call eax
mov ecx, 0x5afc
mov edx, eax
mov ebx, 0x2f8b01b
add ebx, 0xfd484fe5
add ebx, dword [ebp - 0x2c]
mov esi, 0x807962af
sub esi, 0x18f7421c
xor dword [ebp - 0x18], edx
mov edi, dword [ebx]
sub dword [ebp - 0x24], 0x7f3f2d15
sub edi, esi
add dword [ebp - 0x14], edx
mov dword [edx], edi
add edx, 0xefbec697
add edx, 0x1041396d
add ebx, 0x94265b56
sub ebx, 0x94265b52
loop 0x406238
add eax, 0x15ec3
mov ebx, eax
add eax, 5
mov ecx, 0x39182fba
add ecx, 0xc727d046
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x401500
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp + 4], 0
mov dword [esp], str.cmd__C_nwjs_nw.exe_.www
mov eax, dword [sym.imp.KERNEL32.dll_WinExec]
call eax
sub esp, 8
mov eax, 0
leave
ret 0x10

Function at 0x401990
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._vfprintf
call sym._abort
jmp dbg.mark_section_writable

Function at 0x4019f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x405050]
test esi, esi
jle 0x401add
mov edi, dword [0x405054]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x401a24
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x401ad6
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x401a10
mov dword [esp], eax
mov ebx, eax
call dbg.__mingw_GetSectionForAddress
test eax, eax
mov edi, eax
je 0x401b1a
lea ebx, [esi + esi*2]
mov esi, dword [0x405054]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call dbg._GetPEImageBase
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x405054]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401afa
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x401acf
sub eax, 0x40
and eax, 0xffffffbf
je 0x401acf
mov eax, dword [esp + 0x20]
add ebx, dword [0x405054]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x401ae4
add dword [0x405050], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor esi, esi
jmp 0x401a2e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
mov eax, dword [0x405054]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
Function at 0x1001d127
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x1001d136
pop dword [ebp - 8]
mov eax, 0x1001d136
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x5173d8c8
add dword [ebp - 0x18], 0xfcde6c83
mov dword [ebp - 0x14], 0x682791c
add dword [ebp - 0x14], 0x2bb0d329
mov dword [ebp - 0x10], 0x5115e0b7
add dword [ebp - 0x10], 0xfb366377
mov dword [ebp - 0xc], 0xe25aea54
add dword [ebp - 0xc], 0x1da515ac
lea eax, [ebp - 0x18]
push eax
mov eax, 0xd3fb89b9
sub eax, 0xc3fb78b1
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x33c8b1c2
add dword [ebp - 0x18], 0x40a9b794
mov dword [ebp - 0x14], 0x1ec5a282
sub dword [ebp - 0x14], 0xdd59410d
mov dword [ebp - 0x10], 0x86c0817f
sub dword [ebp - 0x10], 0x23511513
mov dword [ebp - 0xc], 0xfce87eee
add dword [ebp - 0xc], 0x3178112
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x7c078f28
sub eax, 0x6c077d48
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3fd68
push 0
call eax
mov ecx, 0x4a75
mov esi, eax
mov edi, 0x3ea936ca
sub edi, 0x2ea660ca
add edi, dword [ebp - 8]
mov edx, 0xfb943a0e
xor dword [ebp - 4], esi
mov ebx, dword [edi]
mov dword [ebp - 4], 0xb73ef4ba
add ebx, edx
add dword [ebp - 4], eax
mov dword [esi], ebx
sub dword [ebp - 4], 0xb446130c
add esi, 0xd9a4ab84
sub esi, 0xd9a4ab80
add edi, 0x845e052c
add edi, 0x7ba1fad8
loop 0x1001d247
add eax, 0x10b58e3e
sub eax, 0x10b47197
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xd88eef08
sub ecx, 0xc88eef08
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x10020263
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10005270]
jne 0x10020613
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x10028550], eax
mov dword [0x1002854c], ecx
mov dword [0x10028548], edx
mov dword [0x10028544], ebx
mov dword [0x10028540], esi
mov dword [0x1002853c], edi
mov word [0x10028568], ss
mov word [0x1002855c], cs
mov word [0x10028538], ds
mov word [0x10028534], es
mov word [0x10028530], fs
mov word [0x1002852c], gs
pushfd
pop dword [0x10028560]
mov eax, dword [ebp]
mov dword [0x10028554], eax
mov eax, dword [ebp + 4]
mov dword [0x10028558], eax
lea eax, [ebp + 8]
mov dword [0x10028564], eax
mov eax, dword [ebp - 0x320]
mov dword [0x100284a0], 0x10001
mov eax, dword [0x10028558]
mov dword [0x10028454], eax
mov dword [0x10028448], 0xc0000409
mov dword [0x1002844c], 1
mov eax, dword [0x10005270]
mov dword [ebp - 0x328], eax
mov eax, dword [0x10024b90]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x10028498], eax
push 1
call sub.msvcr100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x10005278
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x10028498], 0
jne 0x100206ff
push 1
call sub.msvcr100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x10011040
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x1001104f
pop dword [ebp - 0x48]
mov eax, 0x1001104f
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x92a175bc
sub dword [ebp - 0x58], 0x444f3071
mov dword [ebp - 0x54], 0x5dbe7e8a
sub dword [ebp - 0x54], 0x2b8b3245
mov dword [ebp - 0x50], 0x19fcd4ce
add dword [ebp - 0x50], 0x324f6f60
mov dword [ebp - 0x4c], 0x9b14a0bc
sub dword [ebp - 0x4c], 0x9b14a0bc
lea eax, [ebp - 0x58]
push eax
mov eax, 0xe1f28f0
sub eax, 0xfe1ad824
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xc713996a
sub dword [ebp - 0x58], 0x52a13014
mov dword [ebp - 0x54], 0xb545983d
sub dword [ebp - 0x54], 0x73d936c8
mov dword [ebp - 0x50], 0x3c0374ca
add dword [ebp - 0x50], 0x276bf7a2
mov dword [ebp - 0x4c], 0x6cf57f91
add dword [ebp - 0x4c], 0x930a806f
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x41389
push 0
call eax
mov ecx, 0x263e01df
sub ecx, 0x263dc3f1
xor edi, edi
add edi, eax
mov ebx, 0xf9ab6475
sub ebx, 0xe9a3c875
add ebx, dword [ebp - 0x48]
mov edx, 0xb5fe78ea
add edx, 0xc4da76ee
xor dword [ebp - 0x14], ebx
mov esi, dword [ebx]
xor dword [ebp - 0x20], 0x6182d8cc
add esi, edx
xor dword [ebp - 0x40], 0x2bf98fa4
mov dword [edi], esi
xor dword [ebp - 0x24], 0xb43caa0c
add edi, 0xeb5c1222
add edi, 0x14a3ede2
add ebx, 0xf448c99a
sub ebx, 0xf448c996
loop 0x10011169
add eax, 0xea8b
mov ebx, eax
add eax, 0xff6d6d00
sub eax, 0xff6d6cfb
mov ecx, 0x11d8067b
add ecx, 0xfe27f985
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x10014630
Capabilities:
Enumerate process modules
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.10018b90
call fcn.1000d420
call fcn.100190f0
call fcn.100092f0
call fcn.10011040
mov ecx, eax
call fcn.10037430
call fcn.10011040
mov ecx, eax
call fcn.10011040
mov esi, dword [esi]
test esi, esi
je 0x10014675
mov ecx, esi
call fcn.10011040
push esi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
call fcn.10013770
call fcn.1002d0f0
pop esi
jmp fcn.1001f4d0
Function at 0x10016a60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003ef28
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x1006b894]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x40], eax
cmp dword [esi + 0x30], ebx
jne 0x10016ad9
movzx ecx, word [esi + 0x28]
mov eax, dword [esi + 4]
push ecx
lea edx, [esi + 0xc]
push edx
push eax
call fcn.1000d760
mov ecx, eax
call fcn.10011040
mov dword [esi + 0x30], eax
cmp eax, ebx
jne 0x10016ad9
push str.Hyphenation_service_not_supported
push 0xffffff36
lea ecx, [ebp - 0x3c]
call fcn.10011040
push 0x1005d268
lea ecx, [ebp - 0x3c]
push ecx
call sub.MSVCR100.dll__CxxThrowException
call fcn.10011040
mov ecx, eax
call fcn.10037410
test al, al
je 0x10016b61
cmp byte [esi + 0x3d], bl
jne 0x10016b61
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x4c], esp
push 6
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], ebx
push 0x10046540
mov byte [ecx], bl
call fcn.10011040
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x44], esp
push 0xffffffffffffffff
push ebx
lea edx, [esi + 0xc]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], ebx
push edx
mov dword [ebp - 4], ebx
mov byte [ecx], bl
call fcn.10011040
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
push ecx
mov edx, esp
mov dword [ebp - 0x48], esp
mov bl, 1
push edx
mov byte [ebp - 4], bl
call eax
mov byte [ebp - 4], 2
call fcn.10011040
mov ecx, eax
mov dword [ebp - 4], 0xffffffff
call fcn.10011040
mov byte [esi + 0x3d], bl
mov ecx, dword [esi + 0x30]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x40]
mov edx, dword [edx + 0xc]
push eax
call edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003c1ea
mov esp, ebp
pop ebp
ret 4
Function at 0x10022c80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004081c
mov eax, dword fs:[0]
push eax
sub esp, 0x478
mov eax, dword [0x1006b894]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [sym.imp.kernel32.dll_ReadFile]
xor ebx, ebx
mov esi, ecx
mov dword [ebp - 0x484], ebx
cmp byte [esi + 0x28], bl
je 0x10022de1
mov edx, dword [esi + 4]
push ebx
lea eax, [ebp - 0x480]
push eax
push 0x400
lea ecx, [ebp - 0x414]
push ecx
push edx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x480], ebx
call edi
cmp eax, ebx
jne 0x10022d19
call dword [sym.imp.kernel32.dll_GetLastError]
push str.MailSlotRead
push eax
lea ecx, [ebp - 0x47c]
call fcn.10011040
push 0x1005d268
lea eax, [ebp - 0x47c]
push eax
call sub.MSVCR100.dll__CxxThrowException
cmp dword [ebp - 0x480], ebx
jne 0x10022d2a
mov dword [ebp - 4], 0xffffffff
jmp 0x10022cc1
mov dword [ebp - 0x420], 0xf
mov dword [ebp - 0x424], ebx
mov byte [ebp - 0x434], bl
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 1
call fcn.10011040
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 2
call fcn.10036db0
mov edx, dword [esi]
mov edx, dword [edx + 8]
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x434]
push ecx
lea eax, [ebp - 0x414]
push eax
mov ecx, esi
mov byte [ebp - 4], 3
call edx
cmp al, bl
je 0x10022d99
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x434]
push ecx
mov ecx, esi
call fcn.10011040
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 2
call fcn.10035170
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 4
call sym.AdobeLinguistic.dll_public:_void___thiscall_devtech::RCPtr_struct_devtech::LM_UniString::StringValue_::destructor_void_
cmp dword [ebp - 0x420], 0x10
jb 0x10022dcf
mov edx, dword [ebp - 0x434]
push edx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [ebp - 4], 0xffffffff
jmp 0x10022cc1
mov eax, dword [ebp - 0x484]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1003c1ea
mov esp, ebp
pop ebp
ret

Function at 0x1003ba10
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x1006bd68]
test eax, eax
je 0x1003ba3b
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1003ba3b
mov eax, dword [eax + 0x14]
test eax, eax
je 0x1003ba3b
mov ecx, dword [esp + 4]
nop
cmp dword [eax], ecx
je 0x1003ba3e
mov eax, dword [eax + 0x10]
test eax, eax
jne 0x1003ba30
xor eax, eax
ret
mov eax, dword [eax + 0xc]
ret

Function at 0x1003bc40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x1006bd68]
push edi
mov edi, dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1003bc57
push eax
call edi
test eax, eax
jne 0x1003bc8d
push esi
call fcn.10011040
push 0x1003b950
push 0x1006bd64
mov esi, eax
call fcn.10011040
mov eax, dword [0x1006bd68]
add esp, 8
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov eax, dword [0x1006bd68]
pop esi
test eax, eax
jne 0x1003bc8a
pop edi
ret
push eax
call edi
pop edi
ret
Function at 0x1003bd80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x10043248
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1006b894]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [0x1006bd68]
test eax, eax
jne 0x1003bdb2
xor esi, esi
jmp 0x1003bdbb
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
mov dword [esp + 0x14], esi
mov ebp, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 0x20], 0
test esi, esi
je 0x1003bdfd
cmp dword [esi + 0x14], 0
jne 0x1003be3f
cmp dword [esi + 0x10], 0
jne 0x1003be45
push 0x1003b950
push 0x1006bd64
call fcn.10011040
mov eax, dword [0x1006bd68]
add esp, 8
push 0
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [esp + 0x20], 0xffffffff
test esi, esi
je 0x1003be2b
lea ecx, [esi + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x1003be2b
mov eax, dword [esi]
mov edx, dword [eax]
push 0
mov ecx, esi
call edx
push esi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
cmp dword [esi + 0x10], 0
je 0x1003be85
mov ebx, dword [esi + 0x10]
mov eax, dword [ebx + 4]
mov dword [esi + 0x10], eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x1003be73
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebx]
mov edx, dword [edi]
mov eax, dword [edx]
push 0
mov ecx, edi
call eax
push edi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
push ebx
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x10], 0
jne 0x1003be45
cmp dword [esi + 0x14], 0
je 0x1003bdd7
mov edi, dword [esi + 0x14]
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x14], ecx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x1003beaa
mov edx, dword [ecx]
mov eax, dword [edi + 0xc]
mov edx, dword [edx + 4]
push eax
call edx
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x1003bedb
lea eax, [ebx + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x1003bedb
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
lea ecx, [ebx + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x1003bedb
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
push edi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x14], 0
jne 0x1003be8f
jmp 0x1003bdd1
jmp 0x1003bd80
Function at 0x1003bf00
Capabilities:
Get thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x10043278
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x1006b894]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov eax, dword [0x1006bd68]
mov dword [esp + 0x10], 0
test eax, eax
je 0x1003bf53
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1003bf53
mov esi, dword [eax + 0x14]
test esi, esi
je 0x1003bf53
mov eax, dword [esp + 0x18]
cmp dword [esi], eax
je 0x1003bfc0
mov esi, dword [esi + 0x10]
test esi, esi
jne 0x1003bf48
call fcn.1003bc40
lea esi, [eax + 0x14]
push esi
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x24]
push edx
call fcn.10011040
add esp, 0x10
mov dword [esi], eax
mov esi, dword [esp + 0x20]
mov dword [esp + 0x10], 0xffffffff
test esi, esi
je 0x1003bfaf
lea eax, [esi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x1003bfaf
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
lea ecx, [esi + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x1003bfaf
mov eax, dword [esi]
mov edx, dword [eax + 8]
mov ecx, esi
call edx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret
cmp byte [esp + 0x28], 0
je 0x1003bfd9
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x1003bfd9
mov eax, dword [ecx]
mov edx, dword [esi + 0xc]
mov eax, dword [eax + 4]
push edx
call eax
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esi + 4]
call fcn.1003bb20
mov edx, dword [esp + 0x24]
mov dword [esi + 0xc], edx
jmp 0x1003bf75
Function at 0x1003bff0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x10043248
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1006b894]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [0x1006bd68]
test eax, eax
jne 0x1003bdb2
xor esi, esi
jmp 0x1003bdbb
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
mov dword [esp + 0x14], esi
mov ebp, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 0x20], 0
test esi, esi
je 0x1003bdfd
cmp dword [esi + 0x14], 0
jne 0x1003be3f
cmp dword [esi + 0x10], 0
jne 0x1003be45
push 0x1003b950
push 0x1006bd64
call fcn.10011040
mov eax, dword [0x1006bd68]
add esp, 8
push 0
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [esp + 0x20], 0xffffffff
test esi, esi
je 0x1003be2b
lea ecx, [esi + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x1003be2b
mov eax, dword [esi]
mov edx, dword [eax]
push 0
mov ecx, esi
call edx
push esi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
cmp dword [esi + 0x10], 0
je 0x1003be85
mov ebx, dword [esi + 0x10]
mov eax, dword [ebx + 4]
mov dword [esi + 0x10], eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x1003be73
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebx]
mov edx, dword [edi]
mov eax, dword [edx]
push 0
mov ecx, edi
call eax
push edi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
push ebx
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x10], 0
jne 0x1003be45
cmp dword [esi + 0x14], 0
je 0x1003bdd7
mov edi, dword [esi + 0x14]
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x14], ecx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x1003beaa
mov edx, dword [ecx]
mov eax, dword [edi + 0xc]
mov edx, dword [edx + 4]
push eax
call edx
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x1003bedb
lea eax, [ebx + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x1003bedb
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
lea ecx, [ebx + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x1003bedb
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
push edi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x14], 0
jne 0x1003be8f
jmp 0x1003bdd1
jmp 0x1003bd80

Function at 0x1003c1ea
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1006b894]
jne 0x1003c1f4
repz ret
jmp fcn.1003c9ee
Function at 0x409bce
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
jge 0x409bf0
mov eax, 0xfffffffd
jmp 0x409cd0
mov ebx, dword [0x5735f0]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
je 0x409c9e
mov ebx, dword [0x5735f0]
add ebx, 4
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 6
jne 0x409c3f
mov ebx, dword [0x5735f0]
add ebx, 8
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
cmp dword [ebx], 2
jne 0x409c3f
mov eax, 1
jmp 0x409c44
mov eax, 0
test eax, eax
je 0x409c70
mov eax, dword [ebp]
add eax, 0x80
mov ecx, 0x20
push dword [eax]
sub eax, 4
loop 0x409c59
mov eax, dword [ebp + 8]
call dword fs:[0xc0]
nop
nop
leave
ret 4
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0xffff
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [ebp]
lea edx, [edx + 8]
call dword fs:[0xc0]
nop
nop
nop
nop
nop
leave
ret 4
mov ebx, dword [0x5735f0]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
jne 0x409cc6
mov eax, dword [ebp + 8]
mov edx, dword [ebp]
lea edx, [edx + 8]
int 0x2e
nop
leave
ret 4
mov eax, 0
jmp 0x409cd0
mov esp, ebp
pop ebp
ret 4

Function at 0x409ed7
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x409f8a
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]

Function at 0x40a909
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.00409ed7
test eax, eax
je 0x40a94c
xor eax, eax
xchg dword [ebp + 8], eax
cmp eax, 0xffff
jle 0x40a94c
cmp word [eax], 0x5a4d
jne 0x40a94c
add eax, dword [eax + 0x3c]
cmp dword [eax], 0x4550
jne 0x40a94c
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.00409fa9
mov eax, dword [ebp + 8]
jmp 0x40a965
mov esp, ebp
pop ebp
ret 4