joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403890
Capabilities:
Get system information on windows

Disassembly:
push ebx
sub esp, 0x48
lea eax, [esp + 0x1c]
mov ebx, dword [esp + 0x50]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
sub esp, 4
cmp ebx, 2
je 0x403920
jg 0x4038d8
test ebx, ebx
je 0x403900
cmp ebx, 1
jne 0x4038f1
mov eax, dword [esp + 0x20]
mov dword [esp], 0x40c7c1
mov dword [esp + 4], eax
call fcn.00401e60
add esp, 0x48
pop ebx
ret
cmp ebx, 3
jne 0x4038f1
mov eax, dword [esp + 0x28]
mov dword [esp], 0x40c7c1
mov dword [esp + 4], eax
call fcn.00401e60
add esp, 0x48
pop ebx
ret
mov eax, dword [esp + 0x30]
mov dword [esp], 0x40c7c1
mov dword [esp + 4], eax
call fcn.00401e60
add esp, 0x48
pop ebx
ret
mov eax, dword [esp + 0x24]
mov dword [esp], 0x40c7c1
mov dword [esp + 4], eax
call fcn.00401e60
add esp, 0x48
pop ebx
ret

Function at 0x403940
Capabilities:
Get memory capacity

Disassembly:
push ebx
sub esp, 0x68
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0x40
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
sub esp, 4
cmp dword [esp + 0x70], 1
mov ecx, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
je 0x4039a0
shrd eax, edx, 0x14
shr edx, 0x14
mov dword [esp], 0x40c7c4
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
fild qword [esp + 0x18]
fstp qword [esp + 4]
call fcn.00401e60
add esp, 0x68
pop ebx
ret
shrd ecx, ebx, 0x14
shr ebx, 0x14
mov dword [esp], 0x40c7c4
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ecx
fild qword [esp + 0x18]
fstp qword [esp + 4]
call fcn.00401e60
add esp, 0x68
pop ebx
ret
Function at 0x403ea0
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [esp + 0x54]
mov esi, dword [esp + 0x58]
mov dword [esp + 0x2c], 0
test ebx, ebx
sete al
test esi, esi
sete dl
or al, dl
jne 0x403f88
mov eax, dword [esp + 0x50]
test eax, eax
je 0x403f88
mov dword [esp], ebx
call fcn.00403a30
mov ebp, eax
test eax, eax
je 0x403f88
mov eax, dword [esp + 0x50]
mov dword [esp + 0x10], 0x40
mov dword [esp + 0xc], 0x3000
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
sub esp, 0x14
mov edi, eax
test eax, eax
je 0x403f88
mov dword [esp + 4], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
sub esp, 0x14
test eax, eax
je 0x403f88
lea eax, [esp + 0x2c]
lea edx, [edi + ebp]
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 8], 0x100000
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
sub esp, 0x1c
jmp 0x403f8a
xor eax, eax
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret 0x10

Function at 0x4042c0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.0040a4e0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.0040a4e0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]
Function at 0x404320
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x412050]
test esi, esi
jle 0x404440
mov eax, dword [0x412054]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x404354
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x4043d7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x404340
mov dword [esp], ebx
call fcn.00404d20
mov edi, eax
test eax, eax
je 0x404467
mov eax, dword [0x412054]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00404e60
mov edx, dword [0x412054]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x404447
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x4043d0
lea edx, [eax - 0x40]
and edx, 0xffffffbf
jne 0x4043e0
add dword [0x412050], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x412054]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4043d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.004042c0
lea esi, cs:[esi]
nop
xor esi, esi
jmp 0x40435e
mov eax, dword [0x412054]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.004042c0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.004042c0
lea esi, cs:[esi]
nop

Function at 0x404990
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x41206c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x412064]
sub esp, 4
test ebx, ebx
je 0x4049e5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
mov esi, eax
sub esp, 4
call edi
test esi, esi
je 0x4049de
test eax, eax
jne 0x4049de
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4049c0
mov dword [esp], 0x41206c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x404d20
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x404d45
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x404d50
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x404d45
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x404d98
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x404d8e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x404d9a
add ecx, 1
add eax, 0x28
cmp esi, ecx
jne 0x404d80
xor eax, eax
pop ebx
pop esi
ret
Function at 0x40acf0
Capabilities:
Copy file
Create directory
Hide graphical window

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x418]
push ebx
lea ebx, [ebp - 0x818]
push ecx
mov edi, ebx
sub esp, 0x828
call fcn.00404100
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor edx, edx
mov ecx, 0x100
sub esp, 8
mov eax, edx
rep stosd dword es:[edi], eax
mov edi, esi
call fcn.00401d10
mov dword [esp], ebx
mov dword [esp + 0x14], str.OzarkVPN.exe
mov dword [esp + 0x10], 0x40c051
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._s_s_s
mov dword [esp + 4], 0x400
call fcn.004014f0
xor eax, eax
mov ecx, 0x100
rep stosd dword es:[edi], eax
call fcn.00401d10
mov dword [esp], esi
mov dword [esp + 0x10], 0x40c051
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._s_s_
mov dword [esp + 4], 0x400
call fcn.004014f0
mov dword [esp], esi
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
sub esp, 8
call fcn.00403700
mov dword [esp + 4], ebx
mov dword [esp + 8], 1
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
sub esp, 0xc
mov dword [esp], ebx
call fcn.00401d60
call fcn.00402050
lea esp, [ebp - 0x10]
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
Function at 0x40d700
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov eax, 0x10
mov ebp, esp
push ebx
sub esp, 0x64
and esp, 0xfffffff0
call fcn.0041aa70
call fcn.0040d8b0
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x58]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x40d738
jmp 0x40d7d4
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
or eax, edx
test al, 1
jne 0x40d737
cmp cl, 0x22
je 0x40d790
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
je 0x40d7b0
lea esi, [esi]
lea edi, [edi]
test cl, cl
je 0x40d7b0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
jne 0x40d770
jmp 0x40d7b0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x22
setne al
xor edx, edx
test cl, cl
setne dl
test eax, edx
jne 0x40d790
cmp cl, 0x22
je 0x40d810
lea esi, [esi]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
jmp 0x40d7ce
inc ebx
movzx eax, byte [ebx]
cmp al, 0x20
sete dl
cmp al, 9
sete al
or eax, edx
test al, 1
jne 0x40d7c0
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
test byte [ebp - 0x2c], 1
mov edx, 0xa
je 0x40d7f2
movzx edx, word [ebp - 0x28]
mov dword [esp + 0xc], edx
xor edx, edx
mov dword [esp + 8], ebx
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0040da10
sub esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
inc ebx
movzx ecx, byte [ebx]
jmp 0x40d7b0
Function at 0x419190
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea esi, [esi]
lea edi, [edi]
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.004190d0
mov dword [esp], eax
mov dword [esp + 8], esi
mov dword [esp + 4], edi
call sub.msvcrt.dll__read
cmp eax, 0xffffffff
mov ebx, eax
jne 0x4191dc
call sub.msvcrt.dll__errno
cmp dword [eax], 4
je 0x4191b0
add esp, 0x1c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x419f10
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [0x459590]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x419f50
mov dword [ebx + 0x30], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
call sub.mingwm10.dll___mingwthr_key_dtor
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x2c], eax
add esp, 0x14
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x2c], eax
add esp, 0x14
pop ebx
pop ebp
ret
Function at 0x41a300
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [0x459590]
mov edi, dword [ebp + 8]
test eax, eax
je 0x41a3dc
mov ecx, dword [eax + 0x2c]
test ecx, ecx
js 0x41a3f1
mov edx, dword [eax + 0x2c]
test edx, edx
jne 0x41a3b0
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
jmp 0x41a348
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
xor ecx, ecx
test eax, eax
mov edx, 5
je 0x41a358
mov ecx, dword [eax + 0x18]
xor edx, edx
cmp edx, 5
je 0x41a3a3
test edx, edx
jne 0x41a396
test ecx, ecx
je 0x41a340
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov eax, dword [edi]
mov edx, dword [edi + 4]
mov dword [esp], 1
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
call ecx
cmp eax, 6
je 0x41a400
cmp eax, 8
je 0x41a340
mov eax, 3
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
mov eax, 5
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [eax + 0x30]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x41a332
call fcn.00419ca0
mov eax, dword [0x459590]
mov ecx, dword [eax + 0x2c]
test ecx, ecx
jns 0x41a324
call fcn.00419f70
mov eax, dword [0x459590]
jmp 0x41a324
mov dword [edi + 0xc], 0
mov eax, dword [ebp - 0x14]
mov edx, ebx
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, edi
call fcn.0041a270
cmp eax, 7
jne 0x41a39b
mov eax, dword [0x459590]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x41a453
mov edi, dword [eax + 0x2c]
test edi, edi
js 0x41a47e
mov esi, dword [eax + 0x2c]
test esi, esi
jne 0x41a45f
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
call fcn.00419ca0
mov eax, dword [0x459590]
jmp 0x41a431
mov eax, dword [eax + 0x30]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x41a442
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x41a442
call fcn.00419f70
mov eax, dword [0x459590]
jmp 0x41a438
Function at 0x41a6e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x459590]
mov edi, dword [ebp + 8]
test eax, eax
je 0x41a774
mov esi, dword [eax + 0x2c]
test esi, esi
js 0x41a790
mov ebx, dword [eax + 0x2c]
test ebx, ebx
jne 0x41a7b0
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
mov ecx, dword [edi + 0xc]
mov dword [ebp - 0x14], eax
test ecx, ecx
jne 0x41a768
lea edx, [ebp - 0x14]
mov eax, edi
call fcn.0041a270
cmp eax, 7
jne 0x41a82f
mov eax, dword [0x459590]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x41a806
mov edx, dword [eax + 0x2c]
test edx, edx
js 0x41a820
mov edi, dword [eax + 0x2c]
test edi, edi
jne 0x41a7e0
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
lea edx, [ebp - 0x14]
mov eax, edi
call fcn.0041a490
jmp 0x41a725
call fcn.00419ca0
mov eax, dword [0x459590]
mov esi, dword [eax + 0x2c]
test esi, esi
jns 0x41a700
lea esi, [esi]
call fcn.00419f70
mov eax, dword [0x459590]
mov ebx, dword [eax + 0x2c]
test ebx, ebx
je 0x41a70b
lea esi, [esi]
lea edi, [edi]
mov ebx, dword [eax + 0x30]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x41a70e
mov eax, dword [eax + 0x30]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x41a757
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x41a757
call fcn.00419ca0
mov eax, dword [0x459590]
mov edx, dword [eax + 0x2c]
test edx, edx
jns 0x41a749
nop
lea esi, [esi]
call fcn.00419f70
mov eax, dword [0x459590]
jmp 0x41a749
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]
Function at 0x41a840
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov esi, dword [edi + 0xc]
test esi, esi
je 0x41a8d2
mov eax, dword [0x459590]
test eax, eax
je 0x41a8c6
mov ebx, dword [eax + 0x2c]
test ebx, ebx
js 0x41a941
mov ecx, dword [eax + 0x2c]
test ecx, ecx
jne 0x41a8e7
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, edi
call fcn.0041a490
cmp eax, 7
jne 0x41a95f
mov eax, dword [0x459590]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x41a932
mov edx, dword [eax + 0x2c]
test edx, edx
js 0x41a950
mov edi, dword [eax + 0x2c]
test edi, edi
jne 0x41a913
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
call fcn.00419ca0
mov eax, dword [0x459590]
jmp 0x41a862
mov dword [esp], edi
call fcn.0041a300
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov ebx, dword [eax + 0x30]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x41a877
mov eax, dword [eax + 0x30]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x41a8b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x41a8b5
call fcn.00419ca0
mov eax, dword [0x459590]
jmp 0x41a8a0
call fcn.00419f70
mov eax, dword [0x459590]
jmp 0x41a86d
call fcn.00419f70
mov eax, dword [0x459590]
jmp 0x41a8ab
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]

Function at 0x41ab40
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov edx, eax
je 0x41ab70
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov eax, dword [ebp + 0xc]
mov dword [esp], edx
mov dword [esp + 4], eax
call sub.mingwm10.dll___mingwthr_key_dtor
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
leave
ret
Function at 0x4ce5e0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x14e8768]
xor edx, edx
cmp eax, edx
jne 0x4ce606
xor eax, eax
mov byte [eax + 0x14e8668], al
inc eax
cmp eax, 0x100
jl 0x4ce5ee
mov dword [0x14e8768], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x14e8668
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x4ce697
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x4ce66a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x4ce638
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4ce710
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4ce763
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4ce74a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d2b10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x68
mov eax, dword [esp + 0x78]
push ebx
push esi
cmp eax, 1
push edi
mov dword [esp + 0x14], ecx
jl 0x4d2d31
cmp eax, 8
jg 0x4d2d31
cmp dword [esp + 0x8c], 2
jl 0x4d2d31
mov eax, dword [esp + 0x7c]
mov esi, dword [eax]
mov edi, dword [eax + 4]
mov ecx, dword [eax + 8]
mov dword [esp + 0x6c], ecx
sub ecx, esi
mov ebx, dword [eax + 0xc]
mov dword [esp + 0x7c], ecx
test ecx, ecx
mov dword [esp + 0x70], ebx
jle 0x4d2d31
sub ebx, edi
test ebx, ebx
mov dword [esp + 0x20], ebx
jle 0x4d2d31
mov eax, dword [esp + 0x80]
test eax, eax
je 0x4d2b97
mov edx, dword [eax]
mov dword [esp + 0x44], edx
mov edx, dword [eax + 4]
mov dword [esp + 0x48], edx
mov edx, dword [eax + 8]
mov dword [esp + 0x4c], edx
mov eax, dword [eax + 0xc]
mov dword [esp + 0x50], eax
xor edx, edx
push ebp
test ebx, ebx
mov dword [esp + 0x1c], 1
mov dword [esp + 0x14], edx
jle 0x4d2d1a
mov ebp, dword [0x5485bc]
mov eax, ebx
mov dword [esp + 0x10], 0x32
sub eax, edx
cmp eax, 0x32
jg 0x4d2bc9
mov dword [esp + 0x10], eax
xor eax, eax
test ecx, ecx
jle 0x4d2d01
mov ebx, dword [esp + 0x10]
add ebx, edx
mov dword [esp + 0x20], ebx
sub ecx, eax
cmp ecx, 0x32
jle 0x4d2be9
mov ecx, 0x32
lea ebx, [ecx + eax]
mov ecx, dword [esp + 0x20]
push ecx
push ebx
push edx
lea edx, [esp + 0x34]
push eax
push edx
call dword [0x54866c]
push edi
lea eax, [esp + 0x2c]
push esi
push eax
call ebp
mov eax, dword [esp + 0x84]
test eax, eax
je 0x4d2c28
lea ecx, [esp + 0x48]
lea edx, [esp + 0x28]
push ecx
lea eax, [esp + 0x2c]
push edx
push eax
call dword [0x5485b0]
lea ecx, [esp + 0x28]
push ecx
call dword [0x5485f0]
test eax, eax
jne 0x4d2ce8
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], edx
mov edx, dword [esp + 0x34]
mov dword [esp + 0x40], ecx
mov eax, edi
mov ecx, esi
mov dword [esp + 0x44], edx
neg eax
neg ecx
push eax
lea edx, [esp + 0x3c]
push ecx
push edx
call ebp
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x60], edx
lea edx, [esp + 0x58]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x94]
mov dword [esp + 0x60], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x74]
push edx
mov edx, dword [esp + 0x94]
sub ecx, edi
sub eax, esi
push edx
push ecx
mov ecx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x9c]
push eax
call fcn.004d2120
cmp eax, 1
jne 0x4d2d12
mov ecx, dword [esp + 0x94]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x80]
push edx
push eax
push ecx
mov ecx, dword [esp + 0x28]
call fcn.004d29d0
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x14]
mov eax, ebx
cmp eax, ecx
jl 0x4d2bdd
mov ebx, dword [esp + 0x24]
add edx, dword [esp + 0x10]
cmp edx, ebx
mov dword [esp + 0x14], edx
jge 0x4d2d1a
jmp 0x4d2bb4
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x18]
call fcn.004d1cf0
mov eax, dword [esp + 0x1c]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x68
ret 0x1c
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x68
ret 0x1c