joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419880
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call fcn.004189f0
mov dword [eax + 4], esi
mov ebx, eax
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x4198a2
call fcn.00418a20
test byte [ebx + 0x20], 0x30
jne 0x4198bc
add ebx, 0x70
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_longjmp]
mov eax, dword [0x446168]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
push edx
test eax, eax
je 0x4198fd
cmp dword [ebx + 0x14], 0
mov eax, dword [eax + 0x18]
je 0x41993d
mov dword [ebx + 0x68], 1
mov esi, dword [ebx + 4]
test eax, eax
je 0x4198f2
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
xor eax, eax
mov dword [ebx + 0x18], eax
test byte [ebx + 0x24], 4
jne 0x419906
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
push ecx
mov dword [ebx + 0x14], eax
mov eax, ebx
call fcn.004187c0
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [0x446168]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edx
push edx
jmp 0x4198fd
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x419951
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
xor eax, eax
mov esi, dword [ebx + 4]
mov dword [ebx + 0x18], eax
jmp 0x41991e

Function at 0x419960
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x46badc]
test eax, eax
jne 0x419970
xor eax, eax
ret
sub esp, 0x1c
call fcn.004187e0
mov eax, dword [0x446168]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x4199b0
mov edx, dword [eax + 0x10]
test edx, edx
jle 0x4199a0
xor eax, eax
add esp, 0x1c
ret
test byte [eax + 0x20], 3
je 0x419994
mov eax, dword [eax + 0x24]
and eax, 1
jmp 0x419996
call fcn.004188a0
test eax, eax
jne 0x41998d
jmp 0x419994

Function at 0x4199c0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.004187e0
mov eax, dword [0x446168]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x419a00
mov edx, dword [esp + 0x20]
test edx, edx
jle 0x4199f0
lock add dword [eax + 0x10], 1
add esp, 0x1c
ret
lock sub dword [eax + 0x10], 1
add esp, 0x1c
ret
call fcn.004188a0
test eax, eax
jne 0x4199dd
add esp, 0x1c
ret
Function at 0x419b00
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call fcn.004187e0
mov eax, dword [0x446168]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x419b70
test byte [ebx + 0x20], 0xc
jne 0x419b30
mov eax, dword [0x46badc]
test eax, eax
jne 0x419b40
add esp, 0x14
pop ebx
pop esi
ret
lea esi, [ebx + 0x1c]
mov dword [esp], esi
call fcn.004179e0
movzx eax, byte [ebx + 0x20]
test al, 3
je 0x419b62
mov edx, dword [ebx + 0x24]
test dl, 1
je 0x419b62
mov ecx, dword [ebx + 0x10]
test ecx, ecx
jle 0x419b81
mov dword [esp], esi
call fcn.00417d20
add esp, 0x14
pop ebx
pop esi
ret
call fcn.004188a0
mov ebx, eax
test eax, eax
jne 0x419b21
add esp, 0x14
pop ebx
pop esi
ret
and eax, 0xfffffff3
and edx, 0xfffffffe
or eax, 4
mov dword [ebx + 0x24], edx
mov byte [ebx + 0x20], al
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x419ba1
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push eax
mov dword [esp], esi
call fcn.00417d20
call fcn.00419a10
nop
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x20]
test eax, eax
je 0x419c30
mov dword [esp], eax
call fcn.00417720
mov edi, eax
mov eax, 0xfffffffe
cmp eax, edi
mov eax, 0
sbb eax, edx
jb 0x419c70
call fcn.004187e0
mov eax, dword [0x446168]
mov esi, edi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x419cd0
test edi, edi
je 0x419c4a
call fcn.00419b00
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x419ca8
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.00417830
call fcn.00419b00
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop edi
ret
call fcn.004187e0
mov eax, dword [0x446168]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x419cc0
call fcn.00419b00
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
call fcn.00419b00
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop edi
ret
call fcn.004187e0
mov eax, dword [0x446168]
mov esi, 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
jne 0x419c02
call fcn.004188a0
mov ebx, eax
jmp 0x419c02
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
jmp 0x419c1e
call fcn.004188a0
jmp 0x419c4a
call fcn.004188a0
mov ebx, eax
jmp 0x419bfe
Function at 0x4235f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x6c
nop
mov esi, 0x446060
lea edi, [ebp - 0x4a]
lea ebx, [ebp - 0x4a]
mov ecx, 0x2d
rep movsb byte es:[edi], byte [esi]
mov al, byte [0x446938]
test al, al
jne 0x42364b
mov dword [esp], 0x446938
call fcn.004420b0
test eax, eax
je 0x42364b
mov dword [esp], ebx
mov ecx, 0x44a7a0
call fcn.0042f1b8
push esi
mov dword [esp], 0x4429ac
call fcn.00401400
mov dword [esp], 0x446938
call fcn.00442180
mov ecx, 0x44a7a0
call fcn.0042f178
mov dword [esp + 0xc], 0x26
mov dword [esp + 8], 0x186d
mov dword [esp + 4], 0xa8
mov dword [esp], 0x44a7a0
call fcn.0042c220
nop
mov word [ebp - 0x4a], 0x31af
mov al, byte [0x446928]
test al, al
jne 0x4236c0
mov dword [esp], 0x446928
call fcn.004420b0
test eax, eax
je 0x4236c0
mov dword [esp], ebx
mov ecx, 0x44a740
call fcn.0042f160
push ecx
mov dword [esp], 0x4429b0
call fcn.00401400
mov dword [esp], 0x446928
call fcn.00442180
mov ecx, 0x44a740
call fcn.0042f120
mov dword [esp], 0x44a740
call sub.msvcrt.dll_atoi
cmp eax, dword [0x44fb38]
jne 0x4236e7
push eax
xor eax, eax
mov dword [0xc], eax
pop eax
mov esi, 0x446020
mov ecx, 0x32
mov edi, ebx
rep movsb byte es:[edi], byte [esi]
mov al, byte [0x446930]
test al, al
jne 0x423734
mov dword [esp], 0x446930
call fcn.004420b0
test eax, eax
je 0x423734
mov dword [esp], ebx
mov ecx, 0x44a760
call fcn.0042f224
push edx
mov dword [esp], 0x4429b4
call fcn.00401400
mov dword [esp], 0x446930
call fcn.00442180
mov ecx, 0x44a760
call fcn.0042f1e4
mov dword [esp + 0xc], 0x94
mov dword [esp + 8], 0x316e
mov dword [esp + 4], 0xaa
mov dword [esp], 0x44a760
call fcn.0042c220
mov dword [esp + 0x10], 0x40
mov dword [esp + 0xc], 0x3000
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x50]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
sub esp, 0x14
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x424470
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x7c
nop
mov esi, 0x446060
lea edi, [ebp - 0x4a]
lea ebx, [ebp - 0x4a]
mov ecx, 0x2d
rep movsb byte es:[edi], byte [esi]
mov al, byte [0x446a10]
test al, al
jne 0x4244cb
mov dword [esp], 0x446a10
call fcn.004420b0
test eax, eax
je 0x4244cb
mov dword [esp], ebx
mov ecx, 0x44ad40
call fcn.0042f1b8
push edi
mov dword [esp], 0x44336c
call fcn.00401400
mov dword [esp], 0x446a10
call fcn.00442180
mov ecx, 0x44ad40
call fcn.0042f178
mov dword [esp + 0xc], 0x14
mov dword [esp + 8], 0xb0f
mov dword [esp + 4], 0x94
mov dword [esp], 0x44ad40
call fcn.0042c220
nop
mov word [ebp - 0x4a], 0x31af
mov al, byte [0x446a00]
test al, al
jne 0x424540
mov dword [esp], 0x446a00
call fcn.004420b0
test eax, eax
je 0x424540
mov dword [esp], ebx
mov ecx, 0x44ace0
call fcn.0042f160
push esi
mov dword [esp], 0x443370
call fcn.00401400
mov dword [esp], 0x446a00
call fcn.00442180
mov ecx, 0x44ace0
call fcn.0042f120
mov dword [esp], 0x44ace0
call sub.msvcrt.dll_atoi
cmp eax, dword [0x44fb38]
jne 0x424567
push eax
xor eax, eax
mov dword [0xc], eax
pop eax
mov esi, 0x446020
mov ecx, 0x32
mov edi, ebx
rep movsb byte es:[edi], byte [esi]
mov al, byte [0x446a08]
test al, al
jne 0x4245b4
mov dword [esp], 0x446a08
call fcn.004420b0
test eax, eax
je 0x4245b4
mov dword [esp], ebx
mov ecx, 0x44ad00
call fcn.0042f224
push ecx
mov dword [esp], 0x443374
call fcn.00401400
mov dword [esp], 0x446a08
call fcn.00442180
mov ecx, 0x44ad00
call fcn.0042f1e4
mov dword [esp + 0xc], 0x4c
mov dword [esp + 8], 0x166a
mov dword [esp + 4], 0x96
mov dword [esp], 0x44ad00
call fcn.0042c220
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x14], 4
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], edx
mov dword [esp + 8], edx
mov dword [esp + 4], edx
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
sub esp, 0x28
test eax, eax
setne al
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x430d10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ecx, 0x1a
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x80]
mov esi, 0x450301
push ebx
sub esp, 0x9c
mov eax, dword [str.not_enough_space_for_format_expansion__Please_submit_full_bug_report_at_https:__gcc.gnu.org_bugs__:_n]
mov dword [ebp - 0x81], eax
mov eax, dword [0x450365]
mov dword [ebp - 0x1c], eax
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp + 8]
lea eax, [edx + 0x84]
and eax, 0xfffffff0
call fcn.0040bc10
mov ecx, 0x1a
sub esp, eax
lea esi, [ebp - 0x81]
mov dword [ebp - 0x8c], edx
lea ebx, [esp + 0x1b]
and ebx, 0xfffffff0
mov edi, ebx
lea eax, [ebx + 0x68]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 8]
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], ecx
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x8c]
mov byte [ebx + edx + 0x68], 0
mov dword [esp], ebx
call fcn.00444238
nop
nop
nop
nop
nop
nop
nop
push edi
push esi
push ebx
sub esp, 0x20
cmp byte [0x44761c], 0
jne 0x430e36
mov byte [0x44761c], 1
call fcn.00441ea0
test eax, eax
je 0x430e04
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
sete al
mov dword [esp + 4], 0
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call fcn.0040ab00
mov dword [esp], 2
mov esi, dword [fcn.00415ca0]
mov edi, eax
call esi
mov dword [esp + 8], 0x30
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
call sub.msvcrt.dll_fwrite
mov edx, dword [esp + 0x1c]
mov dword [esp], 2
test edx, edx
je 0x430df4
call esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x4502c1
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x444128
jmp 0x444120
call esi
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
jmp 0x430dba
mov dword [esp], 2
call dword [0x446150]
mov dword [esp + 8], 0x2d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
call sub.msvcrt.dll_fwrite
jmp 0x44411b
mov dword [esp], 2
call dword [0x446150]
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_recursively_n
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
push ebx
mov ebx, ecx
sub esp, 0x18
mov dword [ecx], 0x4534c8
call fcn.00440940
mov dword [esp], ebx
mov dword [esp + 4], 4
call fcn.00441c80
add esp, 0x18
pop ebx
ret
Function at 0x401a84
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42a14c]
jne 0x401a8e
repz ret
jmp fcn.004025b5

Function at 0x40b18e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42a14c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004043e4
and dword [ebp - 0x14], 0
cmp dword [0x42c7d8], 0
mov dword [ebp - 0x18], eax
jne 0x40b241
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40b2e9
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40b2e9
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42c7d8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42c7dc], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42c7e0], eax
call edi
push eax
call esi
mov dword [0x42c7e8], eax
test eax, eax
je 0x40b241
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42c7e4], eax
mov eax, dword [0x42c7e4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40b29a
cmp dword [0x42c7e8], ecx
je 0x40b29a
push eax
call esi
push dword [0x42c7e8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40b29a
test ebx, ebx
je 0x40b29a
call edi
test eax, eax
je 0x40b291
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40b291
test byte [ebp - 8], 1
jne 0x40b29a
or dword [ebp + 0x10], 0x200000
jmp 0x40b2cd
mov eax, dword [0x42c7dc]
cmp eax, dword [ebp - 0x18]
je 0x40b2cd
push eax
call esi
test eax, eax
je 0x40b2cd
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40b2cd
mov eax, dword [0x42c7e0]
cmp eax, dword [ebp - 0x18]
je 0x40b2cd
push eax
call esi
test eax, eax
je 0x40b2cd
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42c7d8]
call esi
test eax, eax
je 0x40b2e9
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40b2eb
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401a84
leave
ret
Function at 0x422de0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x41c
mov eax, dword [0x42a14c]
xor eax, esp
mov dword [esp + 0x418], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
push edi
mov dword [esp + 0xc], eax
cmp dword [ebp + 0xc], esi
jle 0x422ebb
mov edi, dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
cmp dword [ebp + 0xc], 0x2d
jne 0x422e48
push 0
push str.wilebamigehuteyebayo_mumajuzokirigulonusu_zuhokinuligoloy_visusanedefubiluyikipukewafeju_seroz
call edi
push str.rowozemunuloc_jin
push str.cimuzenaherepixekojicodofunibug
push str.netigeyonakozodosunobe_tonocekacawuruzowajuxipunud_votocorumuxehis
push str.vevonaluvodupamajicepeloponebe_wixereyobetiliverofeyayutoru_jetob_tufuhavojofefegodatuwud_sadusarilatedabuyoyumulipib
call ebx
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
call fcn.00422d30
mov ecx, dword [esp + 0xc]
xor byte [ecx + esi], al
cmp dword [ebp + 0xc], 0xf
jne 0x422eb1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
xor eax, eax
push eax
lea edx, [esp + 0x24]
push edx
push 0x427f98
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x26], eax
mov word [esp + 0x2a], ax
xor ecx, ecx
lea eax, [esp + 0x1c]
push eax
push ecx
push ecx
mov word [esp + 0x28], cx
call dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
push 0x427f9c
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
inc esi
cmp esi, dword [ebp + 0xc]
jl 0x422e1b
cmp dword [ebp + 0xc], 0x2d
jne 0x422ed5
mov dword [0x42d8d0], 0xa62e7790
mov dword [0x42d8d4], 0xffffffff
mov ecx, dword [esp + 0x424]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401a84
mov esp, ebp
pop ebp
ret
Function at 0x4232c0
Capabilities:
Access the windows event log
Manipulate console buffer
Set file attributes

Disassembly:
sub esp, 0x14
mov eax, dword [0x42d8c4]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
push esi
mov dword [esp + 0x10], 0x1540b5
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x14]
cmp eax, 0xcc1
jne 0x4232fc
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
mov eax, dword [0x42d8c4]
mov dword [0x42d52c], 0x8e468c60
cmp eax, 0x3dc
jne 0x42335b
push 0
push str.dafesatalosolovatuboboyuhiseheyu
call ebx
xor eax, eax
lea edx, [esp + 0x18]
push edx
push eax
push eax
push eax
push eax
mov dword [esp + 0x24], eax
call ebp
push 0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x28]
push edx
push esi
push 0
push 0
push edi
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AccessCheckByType]
push str.fudagugoholixihufeloko
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerA]
mov eax, dword [0x42d8c4]
dec dword [esp + 0x14]
jne 0x4232e8
mov edi, dword [sym.imp.ADVAPI32.dll_OpenEventLogW]
xor esi, esi
mov ebp, 0xec58acac
or ebx, 0xffffffff
cmp eax, 0x997
jne 0x423383
push 0
push 0
call edi
mov eax, dword [0x42d8c4]
cmp esi, 0x846373
jne 0x42339a
mov eax, dword [0x42bad0]
add eax, 0xa231
mov dword [0x42d8c4], eax
cmp eax, 0x141
jne 0x4233ad
mov dword [0x42cd18], ebp
mov dword [0x42cd1c], ebx
inc esi
cmp esi, 0x123c962
jl 0x423371
call fcn.00422f30
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret 0x10
Function at 0x42a3f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x4290ae
lea edi, [esi - 0x280ae]
push edi
or ebp, 0xffffffff
jmp 0x42a412
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x42a419
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
mov al, byte [edi]
jb 0x42a408
mov eax, 1
add ebx, ebx
jne 0x42a42d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x42a422
jne 0x42a43e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42a422
xor ecx, ecx
sub eax, 3
jb 0x42a452
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42a4c6
mov ebp, eax
add ebx, ebx
jne 0x42a45d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x42a46a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42a48e
inc ecx
add ebx, ebx
jne 0x42a47a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42a46f
jne 0x42a48b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42a46f
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
mov al, byte [edi + ecx]
jbe 0x42a4b0
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42a4a2
jmp 0x42a40e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42a4b0
add edi, ecx
jmp 0x42a40e
pop esi
mov edi, esi
mov ecx, 0x7d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42a4ce
cmp byte [edi], 0
jne 0x42a4ce
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x42a4d3
lea edi, [esi + 0x28000]
mov eax, dword [edi]
or eax, eax
je 0x42a542
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2a3ec]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2a450]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42a500
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2a454]
or eax, eax
je 0x42a53c
mov dword [ebx], eax
add ebx, 4
jmp 0x42a51d
call dword [esi + 0x2a458]
popal
jmp 0x4011f0
Function at 0x40aef0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00415ca0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00415ca0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x40af50
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x49d068]
test esi, esi
jle 0x40b070
mov eax, dword [0x49d06c]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x40af84
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x40b007
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x40af70
mov dword [esp], ebx
call fcn.0040b940
mov edi, eax
test eax, eax
je 0x40b097
mov eax, dword [0x49d06c]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.0040ba80
mov edx, dword [0x49d06c]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x40b077
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x40b000
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x40b010
add dword [0x49d068], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x49d06c]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x40b000
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.0040aef0
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x40af8e
mov eax, dword [0x49d06c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.0040aef0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.0040aef0
lea esi, [esi]
nop
Function at 0x40b5b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x49d084
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x49d07c]
sub esp, 4
test ebx, ebx
je 0x40b605
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40b5fe
test esi, esi
je 0x40b5fe
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x40b5e0
mov dword [esp], 0x49d084
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40b940
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x40b965
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x40b970
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x40b965
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x40b9b8
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x40b9ae
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40b9ba
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x40b9a0
xor eax, eax
pop ebx
pop esi
ret