joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422ba4
Capabilities:
Get file attributes

Disassembly:
cmp dword [0x483d74], edi
jne 0x422c9a
xor ebx, ebx
cmp word [ebp - 0x24], 0xffff
sete bl
cmp ebx, edi
je 0x422bc9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x2c], eax
jmp 0x422bcc
mov dword [ebp - 0x2c], edi
mov edi, dword [ebp - 0x20]
mov eax, dword [0x48af20]
test eax, eax
jne 0x422c87
xor esi, esi
mov eax, dword [0x48af14]
test eax, eax
jne 0x422c19
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x422c0f
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x48af18], eax
mov dword [0x48af14], 1
mov eax, dword [0x48af18]
test eax, eax
je 0x422c34
push str.DeactivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x422c7c
mov eax, dword [0x48af1c]
test eax, eax
jne 0x422c6e
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x422c59
mov edx, dword [str.Kernel32.dll]
push edx
call dword [0x4429b8]
jmp 0x422c65
mov eax, dword [0x4429c4]
push eax
call dword [0x4429bc]
test eax, eax
je 0x422c7c
mov dword [0x48af1c], eax
push str.DeactivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov eax, esi
mov dword [0x48af20], eax
test esi, esi
je 0x422c8c
push edi
push 0
call eax
test ebx, ebx
je 0x422c9a
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
ret
Function at 0x422f07
Capabilities:
Get file attributes

Disassembly:
mov eax, dword [0x483d74]
test eax, eax
jne 0x423000
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x423000
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x422f30
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x422f32
xor ebx, ebx
mov edi, dword [ebp - 0x24]
mov eax, dword [0x48af20]
test eax, eax
jne 0x422fed
xor esi, esi
mov eax, dword [0x48af14]
test eax, eax
jne 0x422f7f
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x422f75
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x48af18], eax
mov dword [0x48af14], 1
mov eax, dword [0x48af18]
test eax, eax
je 0x422f9a
push str.DeactivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x422fe2
mov eax, dword [0x48af1c]
test eax, eax
jne 0x422fd4
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x422fbf
mov edx, dword [str.Kernel32.dll]
push edx
call dword [0x4429b8]
jmp 0x422fcb
mov eax, dword [0x4429c4]
push eax
call dword [0x4429bc]
test eax, eax
je 0x422fe2
mov dword [0x48af1c], eax
push str.DeactivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov eax, esi
mov dword [0x48af20], eax
test esi, esi
je 0x422ff2
push edi
push 0
call eax
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x423000
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
ret

Function at 0x42758b
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x449118
push 0x423b60
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
mov eax, dword [fcn.0042752a]
test eax, eax
je 0x4275d3
mov dword [ebp - 4], 1
call eax
jmp 0x4275cf
and dword [ebp - 4], 0
or dword [ebp - 4], 0xffffffff
call 0x4275dc
jmp fcn.0042752a
Function at 0x42f7c0
Capabilities:
Get file attributes
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x449a50
push 0x423b60
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], edi
cmp dword [0x483d74], edi
jne 0x42f92b
xor ebx, ebx
cmp dword [0x483d6c], edi
je 0x42f80c
push str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [0x483d74], edi
jne 0x42f8ff
cmp dword [0x483d6c], edi
jne 0x42f82d
call fcn.00407570
test eax, eax
je 0x42f904
mov eax, dword [0x451140]
mov dword [ebp - 0x48], eax
mov eax, dword [0x48af10]
cmp eax, edi
jne 0x42f8f1
xor esi, esi
cmp dword [0x48af14], edi
jne 0x42f87e
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x42f874
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x48af18], eax
mov dword [0x48af14], 1
mov eax, dword [0x48af18]
cmp eax, edi
je 0x42f899
push str.ActivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, edi
jne 0x42f8e2
mov eax, dword [0x48af1c]
cmp eax, edi
jne 0x42f8d4
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x42f8be
mov ecx, dword [str.Kernel32.dll]
push ecx
call dword [0x4429b8]
jmp 0x42f8cb
mov edx, dword [0x4429c4]
push edx
call dword [0x4429bc]
cmp eax, edi
je 0x42f8e2
mov dword [0x48af1c], eax
push str.ActivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov eax, esi
mov dword [0x48af10], eax
cmp esi, edi
jne 0x42f8f1
xor eax, eax
jmp 0x42f8fb
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x48]
push edx
call eax
cmp eax, edi
je 0x42f904
mov ebx, 1
cmp ebx, edi
jne 0x42f92b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7f
je 0x42f918
cmp eax, 0x78
jne 0x42f923
mov ebx, 1
mov dword [0x483d74], ebx
cmp ebx, edi
jne 0x42f92b
xor eax, eax
jmp 0x42f930
mov eax, 1
cmp eax, edi
jne 0x42f949
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [ebp - 4], edi
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_UnregisterClassA]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
call fcn.0042f981
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x42f981
Capabilities:
Get file attributes

Disassembly:
cmp dword [0x483d74], edi
jne 0x42fa75
xor ebx, ebx
cmp dword [ebp - 0x1c], edi
sete bl
cmp ebx, edi
je 0x42f9a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x2c], eax
jmp 0x42f9a7
mov dword [ebp - 0x2c], edi
mov edi, dword [ebp - 0x24]
mov eax, dword [0x48af20]
test eax, eax
jne 0x42fa62
xor esi, esi
mov eax, dword [0x48af14]
test eax, eax
jne 0x42f9f4
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x42f9ea
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x48af18], eax
mov dword [0x48af14], 1
mov eax, dword [0x48af18]
test eax, eax
je 0x42fa0f
push str.DeactivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x42fa57
mov eax, dword [0x48af1c]
test eax, eax
jne 0x42fa49
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x42fa34
mov edx, dword [str.Kernel32.dll]
push edx
call dword [0x4429b8]
jmp 0x42fa40
mov eax, dword [0x4429c4]
push eax
call dword [0x4429bc]
test eax, eax
je 0x42fa57
mov dword [0x48af1c], eax
push str.DeactivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov eax, esi
mov dword [0x48af20], eax
test esi, esi
je 0x42fa67
push edi
push 0
call eax
test ebx, ebx
je 0x42fa75
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
ret
Function at 0x432410
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x440b70
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
mov eax, dword [esi + 0x48]
mov edi, dword [esi + 0x44]
mov dword [ebp - 0x14], eax
call fcn.0043b780
mov ebx, dword [eax + 0xc]
mov eax, dword [esi + 0x40]
test eax, eax
je 0x43246d
call fcn.0043b780
mov ecx, dword [esi + 0x40]
mov ebx, dword [eax + 0xc]
push 5
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x43247b
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x432496
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.00432380
mov edi, eax
mov dword [ebp - 0x20], edi
call fcn.004335b0
test edi, edi
mov dword [ebp - 0x18], 0
je 0x4324cd
push edi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x4324cd
push 0
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x18], 1
push esi
mov dword [ebp - 4], 0
call fcn.00433560
push edi
call fcn.00432f80
mov edx, dword [ebp - 0x14]
push ebx
push eax
push edx
mov ecx, esi
call fcn.004320b0
test eax, eax
je 0x432570
test byte [esi + 0x24], 0x10
je 0x432533
mov ecx, esi
mov ebx, 4
call fcn.00435e80
test ah, 1
je 0x43250d
mov ebx, 5
push ebx
mov ecx, esi
call fcn.00435820
test edi, edi
je 0x432533
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x432533
xor edi, edi
mov dword [esi + 0x2c], 2
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x20], edi
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x432570
push 0x97
push 0
push 0
push 0
push 0
push 0
mov ecx, esi
call fcn.00435f50
jmp 0x432570
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x432587
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
test edi, edi
je 0x43259d
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x1c]
jne 0x43259d
push edi
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x58]
mov ecx, esi
call fcn.004323c0
mov eax, dword [esi + 0x2c]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x435660
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ecx
test edi, edi
je 0x4356aa
call fcn.0043b780
mov esi, dword [eax + 0xc]
push 0xf0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4356aa
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4356a1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push ebx
call fcn.004356c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4378a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
cmp dword [eax + 4], 0x100
jne 0x4378ec
cmp dword [eax + 8], 0x70
jne 0x4378ec
mov eax, dword [eax + 0xc]
shr eax, 0x10
test ah, 0x40
jne 0x4378ec
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call esi
test ax, ax
jl 0x4378ec
push 0x11
call esi
test ax, ax
jl 0x4378ec
push 0x12
call esi
test ax, ax
jl 0x4378ec
mov eax, 1
pop esi
pop ebp
ret 4
xor eax, eax
pop esi
pop ebp
ret 4

Function at 0x4383b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
test edi, edi
je 0x4383f9
mov ecx, dword [ebp + 8]
mov edx, dword [esi + 4]
lea eax, [ebp + 0xc]
push 0
push eax
push edi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4383e7
mov eax, dword [esi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00437d10
cmp dword [ebp + 0xc], edi
je 0x4383f9
mov eax, dword [esi + 0xc]
push eax
push 0xffffffffffffffff
push 0xd
call fcn.00437df0
pop edi
pop esi
pop ebp
ret 8
Function at 0x438600
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x441218
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x148
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push edi
mov edi, dword [ebp + 0xc]
push eax
push esi
push 0x100
push edi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
jne 0x43865c
push 0x100
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [0x4804ec]
mov dword [ebp + 8], ecx
lea edx, [ebp + 8]
mov dword [ebp - 4], 0
push edx
push esi
call fcn.00438720
mov edx, dword [ebp + 8]
push 0
lea eax, [ebp + 0xc]
push 0
lea ecx, [ebp - 0x14]
push eax
push ecx
push 0
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x4386b9
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0xffffffff
call fcn.004368f0
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
test byte [ebp + 0xc], 2
jne 0x4386c6
push esi
call dword [sym.imp.USER32.dll_CharUpperA]
test byte [ebp + 0xc], 4
jne 0x4386f7
lea eax, [ebp - 0x154]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x4386f7
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 0x128]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0xffffffff
call fcn.004368f0
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x43a730
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, dword [ebp + 8]
mov esi, eax
cmp esi, 0x100
ja 0x43a77c
lea eax, [ebp - 0x100]
push 0x100
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp eax, esi
jne 0x43a77c
lea ecx, [ebp - 0x100]
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x43a784
push edi
push ebx
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43ade0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
mov eax, dword [esi + 0x7c]
test eax, eax
je 0x43ae34
mov eax, dword [ebp + 8]
push eax
call fcn.0043d1f0
mov esi, eax
test esi, esi
jne 0x43ae06
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp + 0xc]
push edi
lea ecx, [ebp + 0x10]
push 4
push ecx
push 4
push 0
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
pop edi
pop esi
sete al
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x10]
push eax
push 0x44887c
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov edx, dword [esi + 0x90]
mov ecx, dword [ebp + 0xc]
add esp, 0xc
lea eax, [ebp - 0x10]
push edx
mov edx, dword [ebp + 8]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x43c7e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
push edi
mov eax, dword [ebx]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x43c819
mov eax, dword [ebp + 8]
mov ecx, dword [esi + 8]
lea edi, [esi + 8]
cmp eax, ecx
mov dword [ebp - 4], edi
jl 0x43c8dd
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x43c8ef
jmp 0x43c863
push 0x10
call fcn.0043c530
test eax, eax
je 0x43c82e
mov dword [eax], vtable.CThreadData.0
mov esi, eax
jmp 0x43c830
xor esi, esi
lea eax, [esi + 8]
mov dword [esi + 0xc], 0
mov dword [ebp - 4], eax
mov dword [eax], 0
lea eax, [ebx + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
lea ecx, [ebx + 0x14]
call fcn.0043c4b0
lea eax, [ebx + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, dword [ebp - 4]
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x43c87a
mov ecx, dword [ebx + 0xc]
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x43c88a
mov edx, dword [ebx + 0xc]
push 2
shl edx, 2
push edx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
test eax, eax
mov dword [esi + 0xc], eax
jne 0x43c896
call fcn.00430880
mov edx, dword [edi]
mov ecx, dword [ebx + 0xc]
mov edi, dword [esi + 0xc]
sub ecx, edx
shl ecx, 2
lea edi, [edi + edx*4]
mov edx, ecx
xor eax, eax
push esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
mov dword [ecx], eax
mov edx, dword [ebx]
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [esi + 0xc]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
pop edi
pop esi
mov dword [eax + edx*4], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esi + 0xc]
mov edx, dword [ebp + 0xc]
pop edi
pop esi
mov dword [ecx + eax*4], edx
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [esi + 0xc]
pop edi
pop esi
pop ebx
mov dword [edx + eax*4], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x43c930
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 1
mov ebx, ecx
mov eax, dword [esi + 8]
mov dword [ebp - 4], edi
cmp eax, edi
jle 0x43c996
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x43c96d
mov ecx, dword [ebx + 0x10]
cmp dword [ecx + edi*8 + 4], eax
je 0x43c96d
mov edx, dword [esi + 0xc]
cmp dword [edx + edi*4], 0
je 0x43c987
mov dword [ebp - 4], 0
jmp 0x43c987
mov eax, dword [esi + 0xc]
mov ecx, dword [eax + edi*4]
test ecx, ecx
je 0x43c97d
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, dword [esi + 0xc]
mov dword [eax + edi*4], 0
mov eax, dword [esi + 8]
inc edi
cmp edi, eax
jl 0x43c94b
mov eax, dword [ebp - 4]
test eax, eax
je 0x43c9d1
lea edi, [ebx + 0x1c]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
lea ecx, [ebx + 0x14]
call fcn.0043c4d0
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esi + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
test esi, esi
je 0x43c9c6
mov edx, dword [esi]
push 1
mov ecx, esi
call dword [edx]
mov eax, dword [ebx]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x43ca60
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
cmp dword [edi], 0
jne 0x43ca97
mov eax, dword [0x48a834]
test eax, eax
jne 0x43ca8e
mov eax, 0x48a838
test eax, eax
je 0x43ca87
mov ecx, eax
call fcn.0043c580
jmp 0x43ca89
xor eax, eax
mov dword [0x48a834], eax
mov ecx, eax
call fcn.0043c630
mov dword [edi], eax
mov eax, dword [0x48a834]
mov esi, dword [edi]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x43caba
cmp esi, dword [eax + 8]
jge 0x43caba
mov edx, dword [eax + 0xc]
mov eax, dword [edx + esi*4]
test eax, eax
jne 0x43cad0
call dword [ebp + 8]
mov ecx, dword [0x48a834]
mov esi, eax
mov eax, dword [edi]
push esi
push eax
call fcn.0043c7e0
mov eax, esi
pop edi
pop esi
pop ebp
ret 4
Function at 0x40a020
Capabilities:
Get common file path
Move file

Disassembly:
sub esp, 0x200
lea eax, [esp]
push 0xff
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x40a0cb
push ebx
push esi
lea ecx, [esp + 8]
push edi
push ecx
lea edx, [esp + 0x110]
push 0x40e394
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov edi, 0x40e38c
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xc]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x210]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
test eax, eax
pop ebx
je 0x40a0b5
lea eax, [esp + 0x100]
lea ecx, [esp]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_rename]
add esp, 8
add esp, 0x200
ret
lea edx, [esp]
lea eax, [esp + 0x100]
push edx
push eax
call dword [sym.imp.MSVCRT.dll_rename]
add esp, 8
add esp, 0x200
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x48c053ef
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x6410314e
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x401000
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x200
mov dword [ebp - 0xc], 0x200
mov dword [ebp - 8], 0
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push 0xff
push 0
push 3
push str..pipemiller
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
cmp eax, 0xffffffff
jne 0x401049
mov dword [ebp - 4], 1
jmp 0x401050
mov dword [ebp - 4], 0
mov edx, dword [ebp - 4]
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
je 0x401060
xor eax, eax
jmp 0x40106f
push str.works_n
call fcn.00402b9a
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret