joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4061d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov esi, eax
lea eax, [esp + 0x18]
push eax
push 0x20119
xor edi, edi
push edi
push 0x4206b0
push reloc.OLEAUT32.dll_SysReAllocString
mov ebx, ecx
mov dword [esp + 0x30], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x406361
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
lea ecx, [esp + 0x10]
push ecx
mov dword [esi + 0x10], eax
push ebx
mov dword [esi + 0x14], eax
lea edx, [esp + 0x1c]
push edx
mov dword [esi + 0x18], eax
push eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x28]
push str.Operator
mov edi, 0x400
push eax
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x406263
cmp dword [esp + 0x14], 1
jne 0x406348
mov eax, dword [esp + 0x10]
sub edi, eax
mov dword [esi], ebx
lea ebx, [eax + ebx]
je 0x406348
mov eax, dword [esp + 0x18]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.IssueDate
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x4062a8
cmp dword [esp + 0x14], 1
jne 0x406348
mov eax, dword [esp + 0x10]
mov dword [esi + 4], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x406348
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.ExpirationDate
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x4062df
cmp dword [esp + 0x14], 1
jne 0x406348
mov eax, dword [esp + 0x10]
mov dword [esi + 8], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x406348
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.SignData
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x406348
cmp dword [esp + 0x14], 3
jne 0x406348
mov eax, dword [esp + 0x10]
sub edi, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ebx
je 0x406348
lea eax, [esi + 0xc]
call fcn.004060b0
test eax, eax
je 0x406348
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov ecx, 0x400
sub ecx, edi
push eax
mov dword [edx], ecx
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x406760
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x6c
mov eax, dword [0x4231d0]
xor eax, esp
mov dword [esp + 0x68], eax
push esi
lea eax, [esp + 8]
mov esi, edx
push eax
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], 0x67452301
mov dword [esp + 0x1c], 0xefcdab89
mov dword [esp + 0x20], 0x98badcfe
mov dword [esp + 0x24], 0x10325476
call fcn.00408960
add esp, 8
test eax, eax
jne 0x4067cb
pop esi
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.0040caaf
add esp, 0x6c
ret
mov eax, dword [esp + 0x74]
test eax, eax
jbe 0x4067e0
push esi
lea ecx, [esp + 0x14]
call fcn.00409e00
add esp, 4
lea esi, [esp + 0x10]
mov ecx, ebx
call fcn.00409ea0
test edi, edi
je 0x4067fe
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, dword [esp + 8]
sete al
mov dword [edi], eax
mov ecx, dword [esp + 0x6c]
pop esi
xor ecx, esp
mov eax, 1
call fcn.0040caaf
add esp, 0x6c
ret

Function at 0x406890
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x64
mov eax, dword [0x4231d0]
xor eax, esp
mov dword [esp + 0x5c], eax
xor eax, eax
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
push edi
lea eax, [esp + 8]
mov edi, ecx
push eax
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00408b60
add esp, 4
test eax, eax
jne 0x4068ee
pop edi
pop esi
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.0040caaf
add esp, 0x64
ret
lea esi, [esp + 8]
mov ecx, ebx
call fcn.00409ea0
mov ecx, dword [esp + 0x64]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.0040caaf
add esp, 0x64
ret

Function at 0x406910
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 0x74
mov eax, dword [0x4231d0]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x78]
xor ecx, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
push edi
lea ecx, [esp + 8]
push ecx
push eax
mov dword [esp + 0x10], 0x6a09e667
mov dword [esp + 0x14], 0xbb67ae85
mov dword [esp + 0x18], 0x3c6ef372
mov dword [esp + 0x1c], 0xa54ff53a
mov dword [esp + 0x20], 0x510e527f
mov dword [esp + 0x24], 0x9b05688c
mov dword [esp + 0x28], 0x1f83d9ab
mov dword [esp + 0x2c], 0x5be0cd19
call fcn.00408c50
add esp, 8
test eax, eax
jne 0x40698f
pop edi
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.0040caaf
add esp, 0x74
ret
mov eax, esi
lea edi, [esp + 8]
call fcn.004099e0
mov ecx, dword [esp + 0x74]
pop edi
xor ecx, esp
mov eax, 1
call fcn.0040caaf
add esp, 0x74
ret

Function at 0x407270
Capabilities:
Read file on windows

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4072a2
push str.ReadFile__
push 0xfc
push str..QHImageHlp.c
xor edx, edx
call fcn.0040ad30
add esp, 0xc
xor eax, eax
pop ecx
ret
cmp esi, dword [esp]
je 0x4072c7
push 0x420844
push 0xfe
push str..QHImageHlp.c
mov edx, 1
call fcn.0040ae60
add esp, 0xc
xor eax, eax
pop ecx
ret
mov eax, 1
pop ecx
ret
Function at 0x408460
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jo 0x4084aa
push dword [eax + 8]
call dword [ebx + 0x50]
mov edi, eax
mov ecx, esi
call fcn.00409457
test eax, eax
je 0x408484
xor ecx, ecx
movzx edx, word [esi + ecx*2]
mov word [edi + ecx*2], dx
inc ecx
cmp eax, ecx
jne 0x408477
push edi
call dword [ebx + 0x60]
mov esi, eax
mov edi, ebx
mov ebx, dword [esp + 4]
mov edx, dword [ebx + 0x108]
mov ecx, eax
push ebx
call fcn.00409337
add esp, 4
mov dword [esp + 0x88], eax
mov edx, dword [ebx + 0x88]
mov byte [eax], al
add byte [eax], al
mov ecx, esi
push ebx
call fcn.00409337
add esp, 4
mov dword [esp + 0x84], eax
mov edx, dword [ebx + 0xb8]
mov ecx, esi
push ebx
call fcn.00409337
add esp, 4
mov dword [esp + 0x74], eax
mov edx, dword [ebx + 0xf8]
mov ecx, esi
push ebx
call fcn.00409337
add esp, 4
mov dword [esp + 0x70], eax
mov edx, dword [ebx + 0x58]
mov ecx, esi
push ebx
call fcn.00409337
add esp, 4
mov dword [esp + 0x78], eax
mov edx, dword [ebx + 0x120]
mov ecx, esi
push ebx
call fcn.00409337
add esp, 4
mov dword [esp + 0x80], eax
mov edx, dword [ebx + 0x28]
mov ecx, esi
push ebx
call fcn.00409337
add esp, 4
mov dword [esp + 0x6c], eax
mov edx, dword [ebx + 0x90]
mov ecx, esi
push ebx
call fcn.00409337
add esp, 4
mov dword [esp + 0x7c], eax
mov eax, dword [edi + 0xc]
push dword [eax + 0x48]
push dword [eax + 8]
call dword [edi + 0x50]
mov esi, eax
mov eax, dword [edi + 0xc]
push 0x18
push dword [eax + 8]
call dword [edi + 0x50]
mov edi, eax
lea edx, [ebx + 0xe0]
mov ecx, eax
push 4
call fcn.00409487
add esp, 4
mov ecx, edi
call fcn.004094d7
movzx ecx, byte [ebx + 0xc0]
mov byte [edi + eax], cl
movzx ecx, byte [ebx + 0xc1]
mov byte [edi + eax + 1], cl
mov ecx, edi
call fcn.004094d7
movzx ecx, byte [ebx + 0xf0]
mov byte [edi + eax], cl
movzx ecx, byte [ebx + 0xf1]
mov byte [edi + eax + 1], cl
movzx ecx, byte [ebx + 0xf2]
mov byte [edi + eax + 2], cl
movzx ecx, byte [ebx + 0xf3]
mov byte [edi + eax + 3], cl
mov ecx, edi
call fcn.004094d7
test eax, eax
je 0x4085d2
nop
nop
nop
nop
nop
nop
movsx ecx, byte [edi + eax]
mov word [esi + eax*2], cx
dec eax
jne 0x4085c7
movsx eax, byte [edi]
mov word [esi], ax
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx + 0xc]
push dword [eax + 0x48]
push dword [eax + 8]
mov ebx, ecx
call dword [ecx + 0x50]
mov edi, eax
mov ecx, esi
call fcn.00409457
test eax, eax
je 0x408614
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, word [esi + ecx*2]
mov word [edi + ecx*2], dx
inc ecx
cmp eax, ecx
jne 0x408607
push edi
call dword [ebx + 0x60]
mov edi, eax
mov esi, dword [esp + 4]
mov edx, dword [esi + 0xac]
mov ecx, eax
push esi
call fcn.00409337
add esp, 4
mov dword [ebx + 0x2c], eax
mov edx, dword [esi + 0xc8]
mov ecx, edi
push esi
call fcn.00409337
Function at 0x409337
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x218
mov dword [esp + 0xc], edx
mov esi, ecx
mov eax, dword [ecx + 0x3c]
mov eax, dword [ecx + eax + 0x78]
mov ecx, dword [ecx + eax + 0x20]
mov ebp, dword [esi + ecx]
cmp byte [esi + ebp], 0
je 0x409429
add ecx, esi
mov edx, dword [esi + eax + 0x1c]
add edx, esi
mov dword [esp + 4], edx
mov eax, dword [esi + eax + 0x24]
add eax, esi
mov dword [esp], eax
add ebp, esi
xor edi, edi
lea ebx, [esp + 0x10]
mov dword [esp + 8], ecx
nop
nop
nop
nop
nop
nop
nop
mov ecx, ebx
mov edx, 0x208
call fcn.00409507
mov ecx, ebp
call fcn.004094d7
test eax, eax
je 0x4093b4
nop
nop
nop
nop
nop
nop
nop
nop
nop
movsx ecx, byte [ebp + eax]
mov word [esp + eax*2 + 0x10], cx
dec eax
jne 0x4093a7
movsx eax, byte [ebp]
mov word [esp + 0x10], ax
mov ecx, ebx
call fcn.00409457
test eax, eax
je 0x409407
mov ecx, dword [esp + 0x22c]
mov edx, dword [ecx + 0xd4]
xor ecx, ecx
mov ebp, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
imul ecx, edx
movzx ebx, word [ebp]
add ecx, ebx
add ebp, 2
dec eax
jne 0x4093e7
cmp ecx, dword [esp + 0xc]
jne 0x40940f
jmp 0x40942d
xor ecx, ecx
cmp ecx, dword [esp + 0xc]
je 0x40942d
mov ecx, dword [esp + 8]
mov eax, dword [ecx + edi*4 + 4]
inc edi
lea ebp, [esi + eax]
cmp byte [esi + eax], 0
lea ebx, [esp + 0x10]
jne 0x409387
xor esi, esi
jmp 0x40943b
mov eax, dword [esp]
movzx eax, word [eax + edi*2]
mov ecx, dword [esp + 4]
add esi, dword [ecx + eax*4]
mov eax, esi
add esp, 0x218
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4099e0
Capabilities:
Encode data using xor

Disassembly:
movzx ecx, byte [esp + 0x18]
movzx edx, byte [esp + 0x19]
mov ch, byte [esp + 0x1a]
mov dh, byte [esp + 0x1b]
mov byte [esp + 8], dh
mov dh, byte [esp + 0x1c]
mov byte [esp + 4], dh
mov dh, byte [esp + 0x1d]
mov byte [esp + 0x14], dh
mov dh, byte [esp + 0x1e]
mov byte [esp + 3], dh
mov dh, byte [esp + 0x1f]
mov byte [esp + 2], dh
add eax, 0xfffffff8
xor ebp, ebp
jmp 0x409890
inc ebp
cmp eax, ebp
je 0x4099d1
cmp byte [esi + ebp + 1], cl
je 0x40989b
cmp cl, 0x3f
jne 0x409887
cmp byte [esi + ebp + 2], dl
je 0x4098a6
cmp dl, 0x3f
jne 0x409887
cmp byte [esi + ebp + 3], ch
je 0x4098b1
cmp ch, 0x3f
jne 0x409887
mov dh, byte [esp + 8]
cmp byte [esi + ebp + 4], dh
je 0x4098c2
cmp byte [esp + 8], 0x3f
jne 0x409887
mov dh, byte [esp + 4]
cmp byte [esi + ebp + 5], dh
je 0x4098d3
cmp byte [esp + 4], 0x3f
jne 0x409887
mov dh, byte [esp + 0x14]
cmp byte [esi + ebp + 6], dh
je 0x4098e4
cmp byte [esp + 0x14], 0x3f
jne 0x409887
mov dh, byte [esp + 3]
cmp byte [esi + ebp + 7], dh
je 0x4098f5
cmp byte [esp + 3], 0x3f
jne 0x409887
mov dh, byte [esp + 2]
cmp byte [esi + ebp + 8], dh
je 0x409906
cmp byte [esp + 2], 0x3f
jne 0x409887
lea edx, [esi + ebp + 9]
mov ecx, dword [esi + ebp + 1]
mov eax, dword [esi + ebp + 9]
bswap ecx
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x44]
cmp eax, dword [ecx + 0xf4]
add byte [eax], al
add byte [eax], al
jne 0x40996c
test ebx, ebx
jne 0x40996c
mov dword [esp + 4], edx
mov ecx, dword [esi + ebp + 0x11]
add ecx, 0x10
mov edx, dword [esp + 0x40]
mov eax, dword [edx + 0xc]
mov dword [esp + 0x20], ecx
jne 0x409943
mov ecx, dword [eax + 0x48]
push ecx
push dword [eax + 8]
call dword [edx + 0x50]
mov ebx, eax
mov ecx, eax
mov edx, dword [esp + 4]
push dword [esp + 8]
call fcn.00409487
mov edx, dword [esp + 8]
add esp, 4
mov eax, dword [esp + 8]
add dword [esp + 0x10], eax
jmp 0x4099b0
test ebx, ebx
je 0x4099aa
mov dword [esp + 4], edx
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 8]
lea edx, [eax + ecx]
mov dword [esp + 0x14], edx
cmp edx, dword [esp + 0x20]
ja 0x409a1e
add ecx, ebx
mov edx, dword [esp + 4]
push eax
call fcn.00409487
add esp, 4
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
jmp 0x4099b0
xor ebx, ebx
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x24]
sub eax, esi
sub eax, ebp
mov ecx, edi
sub ecx, esi
add ecx, 0xffffffef
cmp ecx, ebp
lea esi, [esi + ebp + 1]
mov dword [esp + 0xc], edx
jne 0x409848
jmp 0x4099d5
mov edx, dword [esp + 0xc]
test ebx, ebx
mov ecx, edx
je 0x409a12
mov eax, dword [ecx + 8]
and eax, 0xfffffffc
cld
je 0x409a02
mov ecx, dword [ecx + 4]
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx + edx + 0x10], ecx
add edx, 4
cmp edx, eax
jb 0x4099f7
mov eax, dword [esp + 0x3c]
mov dword [eax], ebx
cmp dword [esp + 0x10], 0
setne bl
jmp 0x409a14
xor ebx, ebx
mov eax, ebx
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esp + 0x20]
sub eax, ecx
add ecx, ebx
lea edx, [esi + ebp + 9]
push eax
call fcn.00409487
add esp, 4
mov ecx, dword [esp + 0xc]
jmp 0x4099db
Function at 0x409a47
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp + 4], edx
mov esi, dword [esp + 0x34]
mov eax, dword [ecx + 0xc]
push dword [eax + 0x48]
push dword [eax + 8]
mov dword [esp + 8], ecx
call dword [ecx + 0x50]
mov edi, eax
lea edx, [esi + 0x124]
mov ecx, eax
push 4
call fcn.00409487
add esp, 4
mov ecx, edi
call fcn.004094d7
movzx ecx, byte [esi + 0x34]
mov byte [edi + eax], cl
movzx ecx, byte [esi + 0x35]
mov byte [edi + eax + 1], cl
movzx ecx, byte [esi + 0x36]
mov byte [edi + eax + 2], cl
movzx ecx, byte [esi + 0x37]
mov byte [edi + eax + 3], cl
mov byte [edi + 8], 0x25
mov ecx, edi
call fcn.004094d7
lea ebx, [edi + eax + 1]
mov ecx, edi
call fcn.004094d7
test eax, eax
je 0x409ad2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movsx ecx, byte [edi + eax]
mov word [ebx + eax*2], cx
dec eax
jne 0x409ac7
movsx eax, byte [edi]
mov word [ebx], ax
push 0x104
mov eax, dword [esp + 0x2c]
push eax
push ebx
mov esi, dword [esp + 0xc]
call dword [esi + 0x58]
mov eax, dword [esi + 0xc]
push dword [eax + 0x48]
push dword [eax + 8]
call dword [esi + 0x50]
mov ebp, eax
mov eax, dword [esi + 0xc]
push dword [eax + 0x48]
push dword [eax + 8]
call dword [esi + 0x50]
mov ebx, eax
mov dword [esp + 0x10], 0
lea eax, [esp + 0x10]
mov ecx, dword [esp + 4]
mov edx, ebx
mov esi, dword [esp + 0x34]
push esi
push dword [esi + 0x10c]
push eax
call fcn.00409ca7
add esp, 0xc
mov eax, dword [esp + 0x28]
lea edx, [eax - 2]
mov eax, 0xffffffff
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp word [edx + 2], 0
lea edx, [edx + 2]
jne 0x409b47
xor ecx, ecx
cmp word [edx - 2], 0x5c
je 0x409b65
mov word [edx], 0x5c
mov ecx, 1
test ebx, ebx
je 0x409b98
movzx esi, word [ebx]
test si, si
mov dword [esp + 0xc], ecx
je 0x409b9d
lea ecx, [edx + ecx*2]
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx + edx*2], si
movzx esi, word [ebx + edx*2 + 2]
inc edx
test si, si
jne 0x409b87
jmp 0x409b9f
inc eax
mov edx, eax
jmp 0x409ba5
xor edx, edx
add edx, dword [esp + 0xc]
add edx, eax
mov esi, dword [esp + 0x28]
mov word [esi + edx*2], 0
push 0
push esi
mov eax, dword [esp + 8]
call dword [eax + 0x10]
mov dword [esp + 8], 0
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x2c]
xor eax, dword [esi + 0x10c]
mov ecx, dword [esp + 4]
mov edx, ebp
push esi
push eax
lea eax, [esp + 0x10]
push eax
call fcn.00409ca7
add esp, 0xc
mov eax, 0xffffffff
mov edx, dword [esp + 0x28]
nop
nop
nop
nop
nop
nop
Function at 0x409ca7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x40
mov esi, edx
mov edi, ecx
lea ebx, [esp + 0x20]
mov ecx, ebx
mov edx, 0x20
call fcn.00409507
mov dword [esp], 0x10
mov eax, esp
push eax
push ebx
call dword [edi + 0x10]
mov dword [esp], 0x105
mov ecx, ebx
call fcn.00409457
test eax, eax
je 0x409d07
mov ecx, dword [esp + 0x5c]
mov ecx, dword [ecx + 0xd4]
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
imul ebp, ecx
movzx edx, word [ebx]
add ebp, edx
add ebx, 2
dec eax
jne 0x409cf7
jmp 0x409d09
xor ebp, ebp
xor ebp, dword [esp + 0x58]
push ebp
call dword [edi + 4]
add esp, 4
mov eax, dword [esp + 0x54]
mov dword [eax], ebp
lea ecx, [esp + 0x20]
call fcn.00409457
mov ebx, eax
call dword [edi + 8]
mov ecx, eax
sar ecx, 0x1f
shr ecx, 0x1d
add ecx, eax
and ecx, 0xfffffff8
sub eax, ecx
add eax, ebx
add eax, 3
mov dword [esp], eax
mov dword [esp + 6], 0x44434241
mov dword [esp + 0xa], 0x48474645
mov dword [esp + 0xe], 0x4c4b4a49
mov dword [esp + 0x12], 0x504f4e4d
mov dword [esp + 0x16], 0x54535251
mov dword [esp + 0x1a], 0x58575655
mov word [esp + 0x1e], 0x5a59
je 0x409daa
xor ebx, ebx
mov ebp, 0x4ec4ec4f
nop
nop
nop
nop
nop
nop
nop
nop
call dword [edi + 8]
mov ecx, eax
mul ebp
shr edx, 3
lea eax, [edx + edx*4]
lea eax, [eax + eax*4]
add eax, edx
sub ecx, eax
movsx eax, byte [esp + ecx + 6]
mov word [esi + ebx*2], ax
inc ebx
cmp ebx, dword [esp]
jb 0x409d87
add esp, 0x40
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40c2d0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
lea ebp, [esp - 0xc8]
sub esp, 0xc8
push 0xffffffffffffffff
push 0x41be0b
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x4231d0]
xor eax, ebp
mov dword [ebp + 0xc4], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor esi, esi
mov dword [0x4261a0], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.1830B7BD_F7A3_4c4d_989B_C004DE465EDE
push str._s__u
lea eax, [ebp]
push 0x40
push eax
call fcn.0040d5c1
add esp, 0x14
lea edx, [ebp]
push edx
push 1
xor ecx, ecx
push esi
mov word [ebp + 0x80], cx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, eax
mov dword [ebp - 0x18], ebx
cmp ebx, esi
je 0x40c4bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40c36e
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x3e
lea ecx, [ebp + 0x86]
xor eax, eax
push esi
mov dword [ebp - 4], esi
push ecx
mov word [ebp + 0x84], ax
call fcn.0040d9e0
add esp, 0xc
push 0x1f
lea edx, [ebp + 0x84]
push edx
call fcn.0040bfc0
mov dword [ebp - 0x14], esi
cmp eax, esi
je 0x40c3d5
lea edx, [ebp - 0x14]
xor ecx, ecx
push edx
mov word [ebp + eax*2 + 0x84], cx
lea eax, [ebp + 0x84]
push 0x420d58
push eax
call fcn.0040dd37
add esp, 0xc
cmp eax, 1
jne 0x40c3d5
mov eax, dword [ebp - 0x14]
mov dword [0x4261a0], eax
jmp 0x40c4a5
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
test eax, eax
je 0x40c3ef
push 0x5c0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x24], esi
mov byte [ebp - 4], 1
test esi, esi
je 0x40c403
push ebx
push esi
call fcn.0040c720
jmp 0x40c405
xor eax, eax
mov byte [ebp - 4], 0
mov dword [0x4261a0], eax
test eax, eax
jne 0x40c427
push 0x421830
lea ecx, [ebp - 0x20]
push ecx
mov dword [ebp - 0x20], 1
call fcn.00411670
push eax
lea edx, [ebp + 0x84]
push 0x420d58
push edx
mov edi, 1
call fcn.0040e1bb
add esp, 0xc
lea esi, [ebp + 0x84]
call fcn.0040c100
test eax, eax
jne 0x40c49e
push 0x421830
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 3
call fcn.00411670
call fcn.0040c1a0
mov edi, dword [ebp - 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov esi, dword [0x4261a0]
test esi, esi
je 0x40c48f
call fcn.0040c800
mov dword [0x4261a0], 0
jmp 0x40c496
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x40c49c
ret
mov eax, dword [0x4261a0]
xor esi, esi
inc dword [eax + 0x5bc]
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp edi, esi
jne 0x40c4bd
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x4261a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xc4]
xor ecx, ebp
call fcn.0040caaf
add ebp, 0xc8
mov esp, ebp
pop ebp
ret
Function at 0x40c4f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41bd60
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4231d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, dword [0x4261a0]
xor edi, edi
cmp ecx, edi
jne 0x40c53b
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
jne 0x40c548
mov dword [ebp - 0x14], edi
jmp 0x40c560
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x14], eax
cmp eax, edi
jne 0x40c5f6
mov ecx, dword [0x4261a0]
mov eax, dword [ecx]
cmp eax, edi
je 0x40c527
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40c527
mov ebx, 0x4261a0
mov dword [ebp - 4], edi
call fcn.0040c610
mov esi, eax
mov dword [ebp - 0x14], esi
cmp esi, edi
jne 0x40c59e
push 0x421830
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], 1
call fcn.00411670
mov ecx, dword [0x4261a0]
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
je 0x40c5b8
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp eax, edi
jne 0x40c5e2
push 0x421830
lea edx, [ebp - 0x1c]
push edx
mov dword [ebp - 0x1c], 4
call fcn.00411670
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x40c5d9
call fcn.0040c920
mov eax, 0x40c5df
ret
mov eax, dword [0x4261a0]
mov eax, dword [eax]
test eax, eax
je 0x40c5f4
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret