joyce8/EMBER2024-capa huggingface dataset:
Function at 0x485364
Capabilities:
Get session information

Disassembly:
push ebp
mov ebp, esp
add ah, 0xf4
cmp dword [0x52345c], 0
invalid
je 0x48537e
call dword [0x5234dc]
mov dword [ebp - 4], eax
jmp 0x485383
xor eax, eax
mov eax, dword [ebp - 4]
cmp dword [ebp - 4], 0
je 0x4853f1
sbb dword [ebp - 4], 0xffffffff
je 0x4853f1
lea eax, [ebp - 0xc]
push eax
popfd
inc ebp
clc
push eax
push 8
mov eax, dword [ebp - 4]
push eax
mov eax, dword [0x523450]
push eax
call sub.wtsapi32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x4853ec
xor eax, esi
push ebp
push 0x4853e5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
cmp byte [eax], 0
jne 0x4853c9
call fcn.00404c48
jmp 0x485405
xor eax, eax
mov dword [ebp - 2], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4853f1
wait
inc ebp
clc
push eax
call sub.wtsapi32.dll_WTSFreeMemory
ret
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4853fd
cmp dword [ebp - 4], 0xffffffff
jne 0x485405
invalid
call fcn.004851a4
mov dword [ebp - 4], eax

Function at 0x4877dc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [ebp + 8], 0
je 0x487808
push 0
push 0
mov eax, edi
call fcn.00406028
push eax
mov eax, ebx
call 0xfc406028
push eax
push 0
push esi
call sub.shell32.dll_ShellExecuteW
jmp 0x487828
cld
invalid
pop edi
pop esi
pop ebx
pop ebp
rol byte [eax + eax - 0x13f4aa70], 0x83
xabort 0x73
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
xor al, al
mov dword [ecx - 8], eax
xor ebx, dword [ebx + 3]
cmp eax, 0x5234a0
push dword [ebp + 0x1a]
push 0x4878bc
pushal
fdivr qword [eax - 0x38]
add al, ch
mov edx, dword [edx]
clc
call dword [eax - 0x58]
xchg ebp, eax
adc bh, al
jmp dword [ebx + 0x5234a4]

Function at 0x492d8c
Capabilities:
Access peb ldr_data

Disassembly:
sbb al, 0xf7
insd dword es:[edi], dx
xor byte [ebx], al
inc ebp
and byte [ecx], al
inc ebp
hlt
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
test eax, 0xda8bf84d
mov dword [ebp - 0x44], eax
mov esi, dword [ecx + 0xc]
aaa
rcl byte [ebp + 0x68], 0xeb
das
inc ecx
add byte [esi + edi*8 + 0x30], ah
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x30], eax
jmp 0x492fc0
cmp dword [ebx + 0x10], 0x20
jg 0x48edca
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1492ff2
lea eax, [ebp - 0x24]
mov edx, 3
call 0xf8405f94
shr ecx, 0x84
sbb dh, bh
invalid
Function at 0x49f4b8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov esi, edx
mov ebx, eax
cmp byte [esi], 0
je 0x49f564
test ebx, ebx
je 0x49f964
xor cl, cl
mov esi, 6
or eax, ebx
call 0x49f0a0
test al, al
je 0x49f50f
mov eax, dword [0x528c88]
cmp byte [eax], 0
je 0x49f503
mov ecx, 0x3c6c
mov edx, 0x49b578
cmp ah, ah
cmc
dec ecx
add al, ch
jne 0x49f55e
idiv bh
push 0x49f628
call fcn.00408c94
jmp 0x49f564
mov eax, ebx
call fcn.0049ed14
mov ebx, edx
test ebx, ebx
je 0x49f564
lea eax, [esp + 4]
push eax
push 0x40
push 5
push ebx
call sub.kernel32.dll_VirtualProtect
aam 0x6a
add eax, 0x4be85756
xchg ebp, eax
idiv bl
push eax
call fcn.00408d64
cwde
idiv bh
mov edi, eax
lea eax, [eax + 4]
push eax
mov eax, dword [esp + 8]
push eax
sub al, byte [0x97dde853]
idiv bh
test edi, edi
je 0x49f562
push 5
push ebx
call sub.kernel32.dll_GetCurrentProcess
push eax
call 0xffc08a18
xchg esp, eax
jbe 0x49f560
inc esi
mov byte [esi], 0
push es
add byte [ecx + 0x5a], bl
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
add al, 0x8b
push ds
jmp 0x49f972
rcr byte [edx + 0x59], 0x59
mov dword fs:[eax], edx
push 0x49f993
lea eax, [ebp - 8]
mov edx, 2
call fcn.00415f94
ret

Function at 0x4a169c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov eax, 0x4a1728
loopne 0x4a1725
push edx
jbe 0x4a16b2
dec dword [ebx + 0x75db85d8]
cmp cl, byte [ebx + 0x408b0845]
cld
mov ebx, eax
test ebx, ebx
jne 0x4a16f3
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
test eax, eax
je 0x4a171f
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
adc dword fs:[ebx + 0x508b0845], ecx
cld
mov eax, dword [ebp + 8]
add eax, 0xfffffffc
call fcn.0040551c
test eax, eax
je 0x4a16e8
sub eax, 4
mov eax, dword [eax]
lea ebx, [eax + 1]
cmp ebx, 1
jl 0x4a1704
add dword [esp + edx + 0x56], edi
push esi
mov ecx, ebx
pop ecx
mov eax, dword [ebp + 0xc]
mov eax, dword [ecx - 4]
mov edx, 1
loopne 0x4a16ed
dec esi
idiv bh
mov eax, dword [ebp + 8]
add eax, 0xfffffffc
mov ecx, ebx
mov edx, 1
call fcn.004066c0
pop esi
pop ebx
pop ebp
ret
add bh, bh
invalid
add byte [eax], al
add byte [eax + eax], ch
adc byte [eax], al

Function at 0x4bf664
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
mov cl, 0xd4
xor ch, bh
mov ebp, 0xd57653bf
test eax, 0x5599f45d
clc
mov dword [ebp - 4], eax
mov ebx, dword [0x20450f18]
call 0xfc406185
xor eax, eax
ja 0x4bf6f0
cmp al, 0x5b
add byte [edi + edi*8 + 0x30], ah
mov dword fs:[eax - 0x74], esp
push ebp
clc
mov eax, dword [ebp + 0x40]
call 0xf8403708
retf
push eax
call sub.shell32.dll_SHGetFileInfoW
jmp 0x4bf71b
xor al, 0x7d
invalid
Function at 0x4e5690
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov esi, eax
mov byte [esp], 0
xor eax, eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov edi, 1
jmp 0x4e56b1
inc edi
mov eax, esi
call fcn.004056bc
cmp edi, eax
jg 0x4e56c3
cmp byte [esi + edi - 1], 0x20
je 0x4e56b0
mov eax, esi
test eax, eax
je 0x4e56ce
sub eax, 4
mov eax, dword [eax]
cmp eax, edi
jl 0x4e5790
cmp byte [esi + edi - 1], 0x2e
je 0x4e57b4
jmp 0x4e5790
Function at 0x5166f4
Capabilities:
Encode data using base64
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
add eax, eax
add eax, eax
mov ecx, 3
cdq
idiv ecx
mov edx, eax
add edx, 4
mov ecx, esi
xor eax, eax
call fcn.00405b58
cmp byte [ebp - 1], 0
jne 0x516754
mov eax, esi
call fcn.00405a54
movzx edx, byte [ebp - 0xc]
dec edx
and dl, 0x3f
add dl, 0x21
mov byte [eax], dl
mov eax, dword [ebp - 0xc]
add eax, 2
mov ecx, 3
cdq
idiv ecx
lea eax, [eax + eax*2]
mov dword [ebp - 0xc], eax
mov edi, 2
xor eax, eax
mov dword [ebp - 0x10], eax
xor ebx, ebx
movzx eax, byte [ebp - 1]
sub al, 1
jb 0x51676e
sub al, 2
jb 0x516775
jmp 0x51677a
mov ebx, 2
jmp 0x51677a
mov ebx, 1
mov eax, esi
call fcn.00405a54
mov byte [eax + ebx - 1], 0
mov eax, dword [ebp - 0x10]

Function at 0x51a9f4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x51aa6a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, 0x51aa84
call fcn.00405ff0
lea eax, [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, 0x51aac8
call fcn.00406370
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.005171e8
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00406028
push eax
mov eax, dword [ebx]
push eax
push 0x51ab78
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51aa71
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405f94
ret

Function at 0x51b7b4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x51b8a9
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x51b86b
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.0051b2e8
test al, al
je 0x51b810
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0x51b8bc
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_ShellExecuteW
jmp 0x51b82d
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
jg 0x51b861
cmp eax, 0x1d
je 0x51b861
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
call fcn.0051b5c8
mov eax, dword [ebp - 0x10]
call fcn.00406028
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51b893
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51b8b0
lea eax, [ebp - 0x10]
call fcn.00405f8c
ret
Function at 0x10011360
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x1001136f
pop dword [ebp - 0x28]
mov eax, 0x96974346
add eax, 0x7969d029
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x96af0f04
add dword [ebp - 0x38], 0xb7a33647
mov dword [ebp - 0x34], 0x8d818096
sub dword [ebp - 0x34], 0x5b4e3451
mov dword [ebp - 0x30], 0xded48a61
add dword [ebp - 0x30], 0x6d77b9cd
mov dword [ebp - 0x2c], 0x3718cc1e
sub dword [ebp - 0x2c], 0x3718cc1e
lea eax, [ebp - 0x38]
push eax
mov eax, 0xa49c97ca
add eax, 0x6b67b902
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x1841426
add dword [ebp - 0x38], 0x72ee5530
mov dword [ebp - 0x34], 0x61dc2f15
sub dword [ebp - 0x34], 0x206fcda0
mov dword [ebp - 0x30], 0xc2a8472e
sub dword [ebp - 0x30], 0x5f38dac2
mov dword [ebp - 0x2c], 0xf2d2e3ca
add dword [ebp - 0x2c], 0xd2d1c36
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x452fd
push 0
call eax
mov ecx, 0xac94f7d1
add ecx, 0x536b55e9
mov edi, eax
mov edx, 0x3b96747c
sub edx, 0x2b8ed87c
add edx, dword [ebp - 0x28]
mov esi, 0xa0a41459
add esi, 0x246c2e91
add dword [ebp - 0x24], 0xf2685440
mov ebx, dword [edx]
xor ebx, esi
sub dword [ebp - 0x14], edx
mov dword [edi], ebx
add dword [ebp - 4], 0xe47aaccf
add edi, 4
add edx, 0x6c6d4dca
add edx, 0x9392b23a
loop 0x1001148c
add eax, 0x65cae416
sub eax, 0x65c9ba5b
mov ebx, eax
add eax, 5
mov ecx, 0x5bd917d8
add ecx, 0xb426e828
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x10014630
Capabilities:
Enumerate process modules
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.10018b90
call fcn.1000d420
call fcn.100190f0
call fcn.100092f0
call fcn.10011360
mov ecx, eax
call fcn.10037430
call fcn.10011360
mov ecx, eax
call fcn.10011360
mov esi, dword [esi]
test esi, esi
je 0x10014675
mov ecx, esi
call fcn.10011360
push esi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
call fcn.10013770
call fcn.1002d0f0
pop esi
jmp fcn.1001f4d0
Function at 0x10016a60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003ef28
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x1006b894]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x40], eax
cmp dword [esi + 0x30], ebx
jne 0x10016ad9
movzx ecx, word [esi + 0x28]
mov eax, dword [esi + 4]
push ecx
lea edx, [esi + 0xc]
push edx
push eax
call fcn.1000d760
mov ecx, eax
call fcn.10011360
mov dword [esi + 0x30], eax
cmp eax, ebx
jne 0x10016ad9
push str.Hyphenation_service_not_supported
push 0xffffff36
lea ecx, [ebp - 0x3c]
call fcn.10011360
push 0x1005d268
lea ecx, [ebp - 0x3c]
push ecx
call sub.MSVCR100.dll__CxxThrowException
call fcn.10011360
mov ecx, eax
call fcn.10037410
test al, al
je 0x10016b61
cmp byte [esi + 0x3d], bl
jne 0x10016b61
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x4c], esp
push 6
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], ebx
push 0x10046540
mov byte [ecx], bl
call fcn.10011360
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x44], esp
push 0xffffffffffffffff
push ebx
lea edx, [esi + 0xc]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], ebx
push edx
mov dword [ebp - 4], ebx
mov byte [ecx], bl
call fcn.10011360
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
push ecx
mov edx, esp
mov dword [ebp - 0x48], esp
mov bl, 1
push edx
mov byte [ebp - 4], bl
call eax
mov byte [ebp - 4], 2
call fcn.10011360
mov ecx, eax
mov dword [ebp - 4], 0xffffffff
call fcn.10011360
mov byte [esi + 0x3d], bl
mov ecx, dword [esi + 0x30]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x40]
mov edx, dword [edx + 0xc]
push eax
call edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003c1ea
mov esp, ebp
pop ebp
ret 4
Function at 0x10022c80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004081c
mov eax, dword fs:[0]
push eax
sub esp, 0x478
mov eax, dword [0x1006b894]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [sym.imp.kernel32.dll_ReadFile]
xor ebx, ebx
mov esi, ecx
mov dword [ebp - 0x484], ebx
cmp byte [esi + 0x28], bl
je 0x10022de1
mov edx, dword [esi + 4]
push ebx
lea eax, [ebp - 0x480]
push eax
push 0x400
lea ecx, [ebp - 0x414]
push ecx
push edx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x480], ebx
call edi
cmp eax, ebx
jne 0x10022d19
call dword [sym.imp.kernel32.dll_GetLastError]
push str.MailSlotRead
push eax
lea ecx, [ebp - 0x47c]
call fcn.10011360
push 0x1005d268
lea eax, [ebp - 0x47c]
push eax
call sub.MSVCR100.dll__CxxThrowException
cmp dword [ebp - 0x480], ebx
jne 0x10022d2a
mov dword [ebp - 4], 0xffffffff
jmp 0x10022cc1
mov dword [ebp - 0x420], 0xf
mov dword [ebp - 0x424], ebx
mov byte [ebp - 0x434], bl
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 1
call fcn.10011360
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 2
call fcn.10036db0
mov edx, dword [esi]
mov edx, dword [edx + 8]
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x434]
push ecx
lea eax, [ebp - 0x414]
push eax
mov ecx, esi
mov byte [ebp - 4], 3
call edx
cmp al, bl
je 0x10022d99
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x434]
push ecx
mov ecx, esi
call fcn.10011360
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 2
call fcn.10035170
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 4
call sym.AdobeLinguistic.dll_public:_void___thiscall_devtech::RCPtr_struct_devtech::LM_UniString::StringValue_::destructor_void_
cmp dword [ebp - 0x420], 0x10
jb 0x10022dcf
mov edx, dword [ebp - 0x434]
push edx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [ebp - 4], 0xffffffff
jmp 0x10022cc1
mov eax, dword [ebp - 0x484]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1003c1ea
mov esp, ebp
pop ebp
ret

Function at 0x1003ba10
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x1006bd68]
test eax, eax
je 0x1003ba3b
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1003ba3b
mov eax, dword [eax + 0x14]
test eax, eax
je 0x1003ba3b
mov ecx, dword [esp + 4]
nop
cmp dword [eax], ecx
je 0x1003ba3e
mov eax, dword [eax + 0x10]
test eax, eax
jne 0x1003ba30
xor eax, eax
ret
mov eax, dword [eax + 0xc]
ret

Function at 0x1003bc40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x1006bd68]
push edi
mov edi, dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1003bc57
push eax
call edi
test eax, eax
jne 0x1003bc8d
push esi
call fcn.10011360
push 0x1003b950
push 0x1006bd64
mov esi, eax
call fcn.10011360
mov eax, dword [0x1006bd68]
add esp, 8
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov eax, dword [0x1006bd68]
pop esi
test eax, eax
jne 0x1003bc8a
pop edi
ret
push eax
call edi
pop edi
ret
Function at 0x1003bd80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x10043248
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1006b894]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [0x1006bd68]
test eax, eax
jne 0x1003bdb2
xor esi, esi
jmp 0x1003bdbb
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
mov dword [esp + 0x14], esi
mov ebp, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 0x20], 0
test esi, esi
je 0x1003bdfd
cmp dword [esi + 0x14], 0
jne 0x1003be3f
cmp dword [esi + 0x10], 0
jne 0x1003be45
push 0x1003b950
push 0x1006bd64
call fcn.10011360
mov eax, dword [0x1006bd68]
add esp, 8
push 0
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [esp + 0x20], 0xffffffff
test esi, esi
je 0x1003be2b
lea ecx, [esi + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x1003be2b
mov eax, dword [esi]
mov edx, dword [eax]
push 0
mov ecx, esi
call edx
push esi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
cmp dword [esi + 0x10], 0
je 0x1003be85
mov ebx, dword [esi + 0x10]
mov eax, dword [ebx + 4]
mov dword [esi + 0x10], eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x1003be73
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebx]
mov edx, dword [edi]
mov eax, dword [edx]
push 0
mov ecx, edi
call eax
push edi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
push ebx
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x10], 0
jne 0x1003be45
cmp dword [esi + 0x14], 0
je 0x1003bdd7
mov edi, dword [esi + 0x14]
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x14], ecx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x1003beaa
mov edx, dword [ecx]
mov eax, dword [edi + 0xc]
mov edx, dword [edx + 4]
push eax
call edx
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x1003bedb
lea eax, [ebx + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x1003bedb
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
lea ecx, [ebx + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x1003bedb
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
push edi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x14], 0
jne 0x1003be8f
jmp 0x1003bdd1
jmp 0x1003bd80
Function at 0x1003bf00
Capabilities:
Get thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x10043278
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x1006b894]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov eax, dword [0x1006bd68]
mov dword [esp + 0x10], 0
test eax, eax
je 0x1003bf53
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1003bf53
mov esi, dword [eax + 0x14]
test esi, esi
je 0x1003bf53
mov eax, dword [esp + 0x18]
cmp dword [esi], eax
je 0x1003bfc0
mov esi, dword [esi + 0x10]
test esi, esi
jne 0x1003bf48
call fcn.1003bc40
lea esi, [eax + 0x14]
push esi
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x24]
push edx
call fcn.10011360
add esp, 0x10
mov dword [esi], eax
mov esi, dword [esp + 0x20]
mov dword [esp + 0x10], 0xffffffff
test esi, esi
je 0x1003bfaf
lea eax, [esi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x1003bfaf
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
lea ecx, [esi + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x1003bfaf
mov eax, dword [esi]
mov edx, dword [eax + 8]
mov ecx, esi
call edx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret
cmp byte [esp + 0x28], 0
je 0x1003bfd9
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x1003bfd9
mov eax, dword [ecx]
mov edx, dword [esi + 0xc]
mov eax, dword [eax + 4]
push edx
call eax
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esi + 4]
call fcn.1003bb20
mov edx, dword [esp + 0x24]
mov dword [esi + 0xc], edx
jmp 0x1003bf75
Function at 0x1003bff0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x10043248
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1006b894]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [0x1006bd68]
test eax, eax
jne 0x1003bdb2
xor esi, esi
jmp 0x1003bdbb
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
mov dword [esp + 0x14], esi
mov ebp, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 0x20], 0
test esi, esi
je 0x1003bdfd
cmp dword [esi + 0x14], 0
jne 0x1003be3f
cmp dword [esi + 0x10], 0
jne 0x1003be45
push 0x1003b950
push 0x1006bd64
call fcn.10011360
mov eax, dword [0x1006bd68]
add esp, 8
push 0
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [esp + 0x20], 0xffffffff
test esi, esi
je 0x1003be2b
lea ecx, [esi + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x1003be2b
mov eax, dword [esi]
mov edx, dword [eax]
push 0
mov ecx, esi
call edx
push esi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
cmp dword [esi + 0x10], 0
je 0x1003be85
mov ebx, dword [esi + 0x10]
mov eax, dword [ebx + 4]
mov dword [esi + 0x10], eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x1003be73
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebx]
mov edx, dword [edi]
mov eax, dword [edx]
push 0
mov ecx, edi
call eax
push edi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
push ebx
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x10], 0
jne 0x1003be45
cmp dword [esi + 0x14], 0
je 0x1003bdd7
mov edi, dword [esi + 0x14]
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x14], ecx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x1003beaa
mov edx, dword [ecx]
mov eax, dword [edi + 0xc]
mov edx, dword [edx + 4]
push eax
call edx
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x1003bedb
lea eax, [ebx + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x1003bedb
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
lea ecx, [ebx + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x1003bedb
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
push edi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x14], 0
jne 0x1003be8f
jmp 0x1003bdd1
jmp 0x1003bd80

Function at 0x1003c1ea
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1006b894]
jne 0x1003c1f4
repz ret
jmp fcn.1003c9ee
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x7b0a7733
nop
nop
nop
nop
test eax, eax
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..rsrc
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x4b757af
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
jmp 0x401219