joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b170
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [0x44b0f8]
mov dword [esp + 0x2c], esi
mov esi, dword [esp + 0x54]
mov ebx, dword [esp + 0x50]
mov eax, dword [ebx]
test esi, esi
je 0x41b2b0
cmp eax, 1
je 0x41b1ce
mov eax, ebx
call fcn.0041a1a0
lea edi, [eax + 4]
mov dword [esp + 0x1c], eax
mov dword [esp], edi
call fcn.00419a90
mov ebp, dword [ebx]
test ebp, ebp
je 0x41b1f0
cmp ebp, 1
jne 0x41b280
mov dword [esp], edi
call fcn.00419dc0
mov eax, dword [esp + 0x1c]
call fcn.0041a430
xor eax, eax
mov edx, dword [esp + 0x2c]
sub edx, dword [0x44b0f8]
jne 0x41b2fa
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x20], 0x41a4f0
mov dword [esp + 0x24], eax
call fcn.0041a7a0
mov eax, dword [0x432124]
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x41b2e8
mov eax, dword [eax + 0xc]
mov dword [esp + 0x28], eax
lock or dword [esp], 0
call fcn.0041a7a0
mov eax, dword [0x432124]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x41b2d0
lea ecx, [esp + 0x20]
mov dword [eax + 0xc], ecx
lock or dword [esp], 0
call esi
call fcn.0041a7a0
mov eax, dword [0x432124]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x41b2c0
mov edx, dword [esp + 0x28]
mov dword [eax + 0xc], edx
mov dword [ebx], 1
jmp 0x41b1bd
mov dword [esp], 2
call dword [0x43210c]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], ebx
mov dword [esp + 4], str._once__p_is__ld_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x41b1bd
mov eax, 0x16
jmp 0x41b1d0
call fcn.0041a850
test eax, eax
jne 0x41b26a
jmp 0x4313ff
call fcn.0041a850
test eax, eax
jne 0x41b246
jmp 0x4313f4
call fcn.0041a850
test eax, eax
jne 0x41b220
jmp 0x4313ed
call fcn.004135f0
nop
mov eax, dword [pe_dos_header]
ud2
lea eax, [esp + 0x20]
mov dword [0], eax
ud2
mov eax, dword [esp + 0x28]
mov dword [0], eax
ud2

Function at 0x41b540
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.0041a7a0
mov eax, dword [0x432124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x41b5b8
lea ebp, [ebx + 0x38]
xor edi, edi
mov dword [esp], ebp
call fcn.0041dfd0
mov eax, dword [ebx + 0x28]
cmp dword [esp + 0x30], eax
jae 0x41b594
mov eax, dword [ebx + 0x30]
mov edx, dword [esp + 0x30]
cmp byte [eax + edx], 0
je 0x41b594
mov eax, dword [ebx + 0x2c]
mov edi, dword [eax + edx*4]
mov dword [esp], ebp
call fcn.0041e020
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0041a850
mov ebx, eax
jmp 0x41b56b
Function at 0x41b5d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [esp + 0x40]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
call fcn.0041a7a0
mov eax, dword [0x432124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x41b6e8
lea edi, [ebx + 0x38]
mov dword [esp], edi
call fcn.0041dfd0
mov edx, dword [ebx + 0x2c]
cmp esi, dword [ebx + 0x28]
jb 0x41b6b4
lea ebp, [esi + 1]
mov dword [esp], edx
lea eax, [ebp*4]
mov dword [esp + 4], eax
call sub.msvcrt.dll_realloc
test eax, eax
je 0x41b6f4
mov dword [esp + 0x1c], eax
mov dword [esp + 4], ebp
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
call sub.msvcrt.dll_realloc
mov edx, dword [esp + 0x1c]
test eax, eax
mov dword [esp + 0x18], eax
je 0x41b6f4
mov ecx, dword [ebx + 0x28]
mov eax, ebp
mov dword [esp + 4], 0
mov dword [esp + 0x1c], edx
sub eax, ecx
lea ecx, [edx + ecx*4]
shl eax, 2
mov dword [esp], ecx
mov dword [esp + 8], eax
call sub.msvcrt.dll_memset
mov eax, dword [ebx + 0x28]
mov edx, dword [esp + 0x18]
mov ecx, ebp
mov dword [esp + 4], 0
sub ecx, eax
add eax, edx
mov dword [esp + 8], ecx
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov dword [ebx + 0x28], ebp
mov dword [ebx + 0x2c], edx
mov dword [ebx + 0x30], eax
mov eax, dword [esp + 0x44]
mov dword [edx + esi*4], eax
mov eax, dword [ebx + 0x30]
mov byte [eax + esi], 1
mov dword [esp], edi
call fcn.0041e020
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
sub esp, 4
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0041a850
mov ebx, eax
jmp 0x41b605
mov dword [esp], edi
call fcn.0041e020
mov eax, 0xc
jmp 0x41b6dc

Function at 0x41b790
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.0041a7a0
mov eax, dword [0x432124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x41b7b8
mov eax, dword [eax + 0x18]
add esp, 0x1c
ret
call fcn.0041a850
test eax, eax
jne 0x41b7ad
add esp, 0x1c
ret

Function at 0x41b820
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.0041a7a0
mov eax, dword [0x432124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x41b848
add eax, 0xc
add esp, 0x1c
ret
call fcn.0041a850
test eax, eax
jne 0x41b83d
jmp 0x41b840
Function at 0x41b880
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call fcn.0041a980
mov dword [eax + 4], esi
mov ebx, eax
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x41b8a2
call fcn.0041a9b0
test byte [ebx + 0x20], 0x30
jne 0x41b8bc
add ebx, 0x70
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_longjmp]
mov eax, dword [0x432124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
push edx
test eax, eax
je 0x41b8fd
cmp dword [ebx + 0x14], 0
mov eax, dword [eax + 0x18]
je 0x41b93d
mov dword [ebx + 0x68], 1
mov esi, dword [ebx + 4]
test eax, eax
je 0x41b8f2
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
xor eax, eax
mov dword [ebx + 0x18], eax
test byte [ebx + 0x24], 4
jne 0x41b906
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
push ecx
mov dword [ebx + 0x14], eax
mov eax, ebx
call fcn.0041a780
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [0x432124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edx
push edx
jmp 0x41b8fd
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x41b951
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
xor eax, eax
mov esi, dword [ebx + 4]
mov dword [ebx + 0x18], eax
jmp 0x41b91e

Function at 0x41b960
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x44bafc]
test eax, eax
jne 0x41b970
xor eax, eax
ret
sub esp, 0x1c
call fcn.0041a7a0
mov eax, dword [0x432124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x41b9b0
mov edx, dword [eax + 0x10]
test edx, edx
jle 0x41b9a0
xor eax, eax
add esp, 0x1c
ret
test byte [eax + 0x20], 3
je 0x41b994
mov eax, dword [eax + 0x24]
and eax, 1
jmp 0x41b996
call fcn.0041a850
test eax, eax
je 0x41b994
jmp 0x41b98d

Function at 0x41b9c0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.0041a7a0
mov eax, dword [0x432124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x41ba00
mov edx, dword [esp + 0x20]
test edx, edx
jle 0x41b9f0
lock add dword [eax + 0x10], 1
add esp, 0x1c
ret
lock sub dword [eax + 0x10], 1
add esp, 0x1c
ret
call fcn.0041a850
test eax, eax
jne 0x41b9dd
add esp, 0x1c
ret
Function at 0x41bb00
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call fcn.0041a7a0
mov eax, dword [0x432124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x41bb70
test byte [ebx + 0x20], 0xc
jne 0x41bb30
mov eax, dword [0x44bafc]
test eax, eax
jne 0x41bb40
add esp, 0x14
pop ebx
pop esi
ret
lea esi, [ebx + 0x1c]
mov dword [esp], esi
call fcn.00419a90
movzx eax, byte [ebx + 0x20]
test al, 3
je 0x41bb62
mov edx, dword [ebx + 0x24]
test dl, 1
je 0x41bb62
mov ecx, dword [ebx + 0x10]
test ecx, ecx
jle 0x41bb81
mov dword [esp], esi
call fcn.00419dc0
add esp, 0x14
pop ebx
pop esi
ret
call fcn.0041a850
mov ebx, eax
test eax, eax
jne 0x41bb21
add esp, 0x14
pop ebx
pop esi
ret
and eax, 0xfffffff3
and edx, 0xfffffffe
or eax, 4
mov dword [ebx + 0x24], edx
mov byte [ebx + 0x20], al
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x41bba1
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push eax
mov dword [esp], esi
call fcn.00419dc0
call fcn.0041ba10
nop
push esi
push ebx
sub esp, 0x14
mov eax, dword [esp + 0x20]
test eax, eax
je 0x41bc20
mov dword [esp], eax
call fcn.0041cf30
xor ecx, ecx
mov ebx, edx
mov edx, 0xffffffff
cmp edx, eax
sbb ecx, ebx
cmovae edx, eax
mov ebx, edx
call fcn.0041a7a0
mov eax, dword [0x432124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
test eax, eax
je 0x41bc70
test ebx, ebx
je 0x41bc3a
call fcn.0041bb00
mov eax, dword [esi + 0x18]
test eax, eax
je 0x41bc60
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.0041d040
call fcn.0041bb00
add esp, 0x14
xor eax, eax
pop ebx
pop esi
ret
call fcn.0041a7a0
mov eax, dword [0x432124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x41bc80
call fcn.0041bb00
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
call fcn.0041bb00
add esp, 0x14
xor eax, eax
pop ebx
pop esi
ret
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
jmp 0x41bc0f
call fcn.0041a850
mov esi, eax
jmp 0x41bbf3
call fcn.0041a850
jmp 0x41bc3a
Function at 0x42ff30
Capabilities:
Query environment variable

Disassembly:
push edi
sub esp, 0x18
mov eax, dword [esp + 0x20]
lea edi, [eax + 0x60]
mov dword [esp], edi
call sub.msvcrt.dll_malloc
test eax, eax
je 0x42f3d2
mov edx, eax
lea edi, [edx + 4]
mov ecx, edx
xor eax, eax
mov dword [edx], 0
and edi, 0xfffffffc
mov dword [edx + 0x5c], 0
sub ecx, edi
add ecx, 0x60
shr ecx, 2
rep stosd dword es:[edi], eax
add esp, 0x18
lea eax, [edx + 0x60]
pop edi
ret
mov eax, edi
call fcn.004213d0
mov edx, eax
test eax, eax
je 0x42ff18
jmp 0x42f3a9
call fcn.00430294
nop
nop
nop
call fcn.00430294
nop
nop
nop
nop
nop
nop
nop
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [0x44b0f8]
mov dword [esp + 0x2c], eax
xor eax, eax
mov dword [esp + 4], 0
mov dword [esp], 0x432188
call fcn.00419f10
mov dword [esp], str.GLIBCXX_TUNABLES
mov dword [0x43218c], 0
mov dword [0x432190], 0
mov dword [0x432194], 0
call sub.msvcrt.dll_getenv
mov dword [esp + 0x14], 8
mov dword [esp + 0x18], str.obj_size
mov ebx, eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 9
mov dword [esp + 0x24], str.obj_count
mov dword [esp + 0x28], 0x40
test eax, eax
jne 0x42ffd6
jmp 0x4300a7
mov dword [esp], ebx
mov dword [esp + 4], 0x3a
call sub.msvcrt.dll_strchr
mov ebx, eax
test eax, eax
je 0x430050
xor eax, eax
cmp byte [ebx], 0x3a
sete al
add ebx, eax
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
xor eax, 0x62696c67
xor edx, 0x2e787863
or eax, edx
jne 0x42ffc0
mov eax, dword [ebx + 7]
mov edx, dword [ebx + 0xb]
xor eax, 0x5f68652e
xor edx, 0x6c6f6f70
or eax, edx
jne 0x42ffc0
cmp byte [ebx + 0xf], 0x2e
jne 0x42ffc0
add ebx, 0x10
lea esi, [esp + 0x14]
lea ebp, [esp + 0x2c]
mov edi, dword [esi]
test edi, edi
je 0x430037
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
mov eax, dword [esi + 4]
mov dword [esp], eax
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x430041
cmp byte [ebx + edi], 0x3d
je 0x4300d5
add esi, 0xc
cmp ebp, esi
jne 0x43001a
jmp 0x42ffc0
mov eax, dword [esp + 0x28]
mov edx, 0x100
mov ecx, 6
cmp eax, edx
cmovle edx, eax
mov eax, dword [esp + 0x1c]
test eax, eax
cmove eax, ecx
add eax, 0x2c
imul eax, edx
lea ebx, [eax*4]
mov dword [0x432194], ebx
test ebx, ebx
jne 0x4300b6
mov dword [esp], 0x42fea0
call fcn.00401400
mov eax, dword [esp + 0x2c]
sub eax, dword [0x44b0f8]
jne 0x430120
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [0x432194], 0x3200
mov ebx, 0x3200
mov dword [esp], ebx
call sub.msvcrt.dll_malloc
mov dword [0x432190], eax
test eax, eax
je 0x430113
xor edx, edx
mov dword [0x43218c], eax
mov dword [eax], ebx
mov dword [eax + 4], edx
jmp 0x430083
lea eax, [esp + 0x10]
xor ebp, ebp
mov dword [esp + 4], eax
lea eax, [ebx + edi + 1]
mov dword [esp + 8], ebp
mov dword [esp], eax
call sub.msvcrt.dll_strtoul
mov ebx, dword [esp + 0x10]
movzx edx, byte [ebx]
cmp dl, 0x3a
je 0x430103
test dl, dl
jne 0x42ffc0
test eax, eax
js 0x42ffc0
mov dword [esi + 8], eax
jmp 0x42ffc0
xor ecx, ecx
mov dword [0x432194], ecx
jmp 0x430083
call fcn.004135f0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
call fcn.00430294
nop
nop
nop
call fcn.00430294
nop
nop
nop
Function at 0x347e8ffd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x347e900c
pop dword [ebp - 0x30]
mov eax, 0x347e900c
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xd5bb510b
sub dword [ebp - 0x40], 0x87690bc0
mov dword [ebp - 0x3c], 0x23d4d077
add dword [ebp - 0x3c], 0xe5e7bce
mov dword [ebp - 0x38], 0x64c586c6
add dword [ebp - 0x38], 0xe786bd68
mov dword [ebp - 0x34], 0xdb37c705
sub dword [ebp - 0x34], 0xdb37c705
lea eax, [ebp - 0x40]
push eax
mov eax, 0xf94f11fc
sub eax, 0xc4d8010c
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x32c6253e
add dword [ebp - 0x40], 0x41ac4418
mov dword [ebp - 0x3c], 0x2dcf733c
sub dword [ebp - 0x3c], 0xec6311c7
mov dword [ebp - 0x38], 0x1eb1ed7f
add dword [ebp - 0x38], 0x44bd7eed
mov dword [ebp - 0x34], 0xd1d2d1e6
sub dword [ebp - 0x34], 0xd1d2d1e6
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x870479bf
add eax, 0xad7297c1
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x38e42
push 0
call eax
mov ecx, 0x5018
mov edx, eax
mov esi, 0x8aa40184
sub esi, 0x56249184
add esi, dword [ebp - 0x30]
mov ebx, 0x6cf19f1c
add ebx, 0xfd11126b
add dword [ebp - 0x10], edx
mov edi, dword [esi]
xor dword [ebp - 0x14], ecx
add edi, ebx
add dword [ebp - 4], ebx
mov dword [edx], edi
xor dword [ebp - 0x20], ebx
add edx, 0xccee02a7
sub edx, 0xccee02a3
add esi, 4
loop 0x347e9123
add eax, 0xfac52a64
add eax, 0x53c08cf
mov ebx, eax
add eax, 0xf64812cf
sub eax, 0xf64812ca
mov ecx, 0xe8ccd80c
add ecx, 0x4baa27f4
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x347ea89f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x347765c8]
jne 0x347eb289
ret
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x347ee7f0], eax
mov dword [0x347ee7ec], ecx
mov dword [0x347ee7e8], edx
mov dword [0x347ee7e4], ebx
mov dword [0x347ee7e0], esi
mov dword [0x347ee7dc], edi
mov word [0x347ee808], ss
mov word [0x347ee7fc], cs
mov word [0x347ee7d8], ds
mov word [0x347ee7d4], es
mov word [0x347ee7d0], fs
mov word [0x347ee7cc], gs
pushfd
pop dword [0x347ee800]
mov eax, dword [ebp]
mov dword [0x347ee7f4], eax
mov eax, dword [ebp + 4]
mov dword [0x347ee7f8], eax
lea eax, [ebp + 8]
mov dword [0x347ee804], eax
mov eax, dword [ebp - 0x320]
mov dword [0x347ee740], 0x10001
mov eax, dword [0x347ee7f8]
mov dword [0x347ee6f4], eax
mov dword [0x347ee6e8], 0xc0000409
mov dword [0x347ee6ec], 1
mov eax, dword [0x347765c8]
mov dword [ebp - 0x328], eax
mov eax, dword [0x347ed254]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x347ee738], eax
push 1
call sub.msvcr80.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x3477694c
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x347ee738], 0
jne 0x347eb379
push 1
call sub.msvcr80.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x411f02
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x418680], 0
push ebx
push esi
mov esi, 0x418688
jne 0x411f2e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x4186a0], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x418680], 1
push dword [0x4186a0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x411fcb
push 0x14
push 8
push dword [0x418010]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x411ff5
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x418684]
test eax, eax
je 0x411f70
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x418684], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x411ffa
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x4186a0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x418010]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x411ff5
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..reloc
mov ebx, 0x40de38
nop
nop
mov ecx, 0x51692bfd
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..rdata
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0xb716e56
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x402fc9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x402fd8
pop dword [ebp - 0x40]
mov eax, 0x402fd8
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xc66db2ad
sub dword [ebp - 0x50], 0x781b6d62
mov dword [ebp - 0x4c], 0x2b60ad91
sub dword [ebp - 0x4c], 0xf92d614c
mov dword [ebp - 0x48], 0xa05e3461
sub dword [ebp - 0x48], 0x5411f033
mov dword [ebp - 0x44], 0x6a7b4daf
add dword [ebp - 0x44], 0x9584b251
lea eax, [ebp - 0x50]
push eax
mov eax, 0xd0840ff8
sub eax, 0xd0433fa4
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x249a1c24
sub dword [ebp - 0x50], 0xb027b2ce
mov dword [ebp - 0x4c], 0x4a347d9d
sub dword [ebp - 0x4c], 0x8c81c28
mov dword [ebp - 0x48], 0xf80c86ae
sub dword [ebp - 0x48], 0x949d1a42
mov dword [ebp - 0x44], 0x730bea05
add dword [ebp - 0x44], 0x8cf415fb
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0xfe735c48
add eax, 0x1cd7404
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3f37b
push 0
call eax
mov ecx, 0xb51da8fe
sub ecx, 0xb51d4a34
xor edi, edi
add edi, eax
mov ebx, 0x681d8017
sub ebx, 0x67dbd017
add ebx, dword [ebp - 0x40]
mov esi, 0xe4d14e8b
add esi, 0xda7b6874
sub dword [ebp - 0xc], ecx
mov edx, dword [ebx]
xor dword [ebp - 0x30], ecx
sub edx, esi
xor dword [ebp - 0x30], 0xc45f4242
mov dword [edi], edx
mov dword [ebp - 0x3c], 0x51cc15a3
add edi, 0xc31976e2
sub edi, 0xc31976de
add ebx, 4
loop 0x4030f7
add eax, 0x175ad9ea
sub eax, 0x17596bef
xor ebx, ebx
add ebx, eax
add eax, 0x95bad8de
add eax, 0x6a452727
mov ecx, 0xa760ac66
add ecx, 0x58df539a
add ecx, dword [ebp - 0x40]
call ebx
leave
Function at 0x29a09125
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x29a09134
pop dword [ebp - 0x2c]
mov eax, 0x29a09134
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x4edffb9b
add dword [ebp - 0x3c], 0xff7249b0
mov dword [ebp - 0x38], 0xd001f824
sub dword [ebp - 0x38], 0x9dceabdf
mov dword [ebp - 0x34], 0x12b1231e
sub dword [ebp - 0x34], 0xc664def0
mov dword [ebp - 0x30], 0xbce7a3ee
add dword [ebp - 0x30], 0x43185c12
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x8e67b9c3
sub eax, 0x64c67937
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x5c21c013
add dword [ebp - 0x3c], 0x1850a943
mov dword [ebp - 0x38], 0xd3ae3b2e
sub dword [ebp - 0x38], 0x9241d9b9
mov dword [ebp - 0x34], 0xdd2bcd98
sub dword [ebp - 0x34], 0x79bc612c
mov dword [ebp - 0x30], 0xc2c96330
sub dword [ebp - 0x30], 0xc2c96330
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x4c9fd52b
add eax, 0xdd016b19
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3dc0f
push 0
call eax
mov ecx, 0x34055b47
sub ecx, 0x34050550
mov edx, eax
mov ebx, 0x72e7e71d
add ebx, 0xb6ba38e3
add ebx, dword [ebp - 0x2c]
mov esi, 0x8ecee6e8
sub esi, 0x401dc868
mov edi, dword [ebx]
mov dword [ebp - 0x28], 0x1c65d7bf
xor edi, esi
sub dword [ebp - 0x28], edx
mov dword [edx], edi
mov dword [ebp - 4], 0xfcdfe3f1
add edx, 0x7fd73679
add edx, 0x8028c98b
add ebx, 0xb446be94
sub ebx, 0xb446be90
loop 0x29a09251
add eax, 0xc432da13
sub eax, 0xc4318f64
mov ebx, eax
add eax, 0xfbcc8acf
sub eax, 0xfbcc8aca
mov ecx, 0xc72bca0d
sub ecx, 0x9d8bca0d
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret