joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416d63
Capabilities:
Persist via ginadll registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [0x46703d]
xor eax, 1
test al, al
je 0x416d83
mov dword [esp], str.Configuring_GINA...
call fcn.0041b00c
mov dword [esp], str.Configurig_gina
call fcn.00411655
lea eax, [ebp - 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x416e34
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edx, dword [ebp - 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.GinaDll
mov dword [esp], edx
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x416e22
mov byte [0x46703c], 1
mov dword [esp], str.Cannot_configure_ginadll
call fcn.00411655
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
jmp 0x416e47
mov byte [0x46703c], 1
mov dword [esp], str.Cannot_open_HKLM_softwareMicrosoftWindows_NTCurrentVersionWinlogon
call fcn.00411655
nop
leave
ret
Function at 0x417d47
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
mov byte [ebp - 9], 1
mov dword [esp], str.Configuring_Shirokabuto
call fcn.00411655
movzx eax, byte [0x46703d]
xor eax, 1
test al, al
je 0x417d7a
mov dword [esp], str.Configuring_Shiro_Kabuto....
call fcn.0041b00c
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
call eax
sub esp, 0xc
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str.__s_
lea eax, [ebp - 0x118]
mov dword [esp], eax
call fcn.00431940
cmp dword [ebp - 0x10], 0
je 0x417e7f
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
lea eax, [ebp - 0x118]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 1
mov dword [esp + 0x14], 2
mov dword [esp + 0x10], 0x10
mov dword [esp + 0xc], 2
mov dword [esp + 8], str.Soffid_Single_Sing_On_User_Manager
mov dword [esp + 4], str.ShiroKabuto
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CreateServiceA]
call eax
sub esp, 0x34
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x417e6d
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
cmp eax, 0x431
setne al
test al, al
je 0x417e92
call fcn.00411b5a
mov byte [0x46703c], 1
mov dword [esp], str.Cannot_register_shirokabuto
call fcn.00411655
jmp 0x417e92
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call eax
sub esp, 4
jmp 0x417e92
mov dword [esp], str.Cannot_register_shiro_kabuto_service
call fcn.00411655
mov byte [0x46703c], 1
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call eax
sub esp, 4
movzx eax, byte [ebp - 9]
leave
ret
Function at 0x4180b5
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [0x46703d]
xor eax, 1
test al, al
je 0x4180dc
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], str.Uninstalling__s_....
call fcn.0041b00c
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], str.Removing__s
call fcn.00411655
mov dword [esp + 4], 0x44996f
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x41819b
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov dword [esp + 8], 8
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_MoveFileExA]
call eax
sub esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x418151
mov dword [esp], str.__Removed
call fcn.00411655
jmp 0x41819b
mov dword [esp + 8], 4
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_MoveFileExA]
call eax
sub esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x418188
mov dword [esp], str.__Remove_scheduled
call fcn.00411655
jmp 0x41819b
mov dword [esp], str.__Remove_failed
call fcn.00411655
mov byte [0x46703c], 1
mov dword [esp], 1
mov eax, dword [fcn.004311f0]
call eax
mov dword [esp], eax
call sub.msvcrt.dll_fflush
nop
leave
ret
Function at 0x418c3a
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1028
call fcn.00424e30
sub esp, eax
call fcn.00411583
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
jne 0x418c6e
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x100c]
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
jmp 0x418c92
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_s
lea eax, [ebp - 0x100c]
mov dword [esp], eax
call fcn.00431940
lea eax, [ebp - 0x100c]
mov dword [esp], eax
call sub.msvcrt.dll__mkdir
nop
leave
ret
Function at 0x418ca3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov byte [ebp - 9], 0
mov dword [esp], str.
call fcn.00411655
mov dword [esp], str._Scheduled_file_operations
call fcn.00411655
mov dword [esp], 0x20019
call fcn.00411563
lea edx, [ebp - 0x30]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], str.SYSTEMCurrentControlSetControlSession_Manager
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x418e77
mov dword [ebp - 0x38], 0
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x38]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], 0x4670e2
lea edx, [ebp - 0x34]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], str.PendingFileRenameOperations
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
cmp eax, 2
setne al
test al, al
je 0x418e67
mov eax, dword [ebp - 0x38]
add eax, 1
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x38]
mov dword [esp + 0x14], edx
mov edx, dword [ebp - 0x14]
mov dword [esp + 0x10], edx
lea edx, [ebp - 0x34]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], str.PendingFileRenameOperations
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
test eax, eax
sete al
test al, al
je 0x418e67
call fcn.00411583
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x38]
cmp edx, eax
jae 0x418e67
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
add eax, edx
movzx eax, byte [eax]
test al, al
je 0x418e67
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
add eax, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
add eax, 1
add dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
add eax, edx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
add eax, 1
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sub.msvcrt.dll_strstr
test eax, eax
je 0x418e44
mov byte [ebp - 9], 1
mov eax, dword [ebp - 0x28]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], eax
mov dword [esp], str.___s_____s__
call fcn.00411655
add dword [ebp - 0x10], 1
jmp 0x418dc5
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov dword [esp], str.
call fcn.00411655
movzx eax, byte [ebp - 9]
leave
ret
Function at 0x4194a2
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, 0x1034
call fcn.00424e30
sub esp, eax
mov dword [ebp - 0x1010], 0x1000
call fcn.0041151b
test eax, eax
setne al
test al, al
je 0x419616
mov dword [esp], 0xf003f
call fcn.00411563
mov ebx, eax
mov ecx, 0x467064
call fcn.004350a0
lea edx, [ebp - 0xc]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x419606
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x1010]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x100c]
mov dword [esp + 0x10], edx
lea edx, [ebp - 0x1014]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], str.PreviousGinaDll
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
test eax, eax
sete al
test al, al
je 0x419606
call fcn.00411583
mov dword [esp + 4], eax
lea eax, [ebp - 0x100c]
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
lea eax, [ebp - 0x100c]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edx, eax
lea eax, [ebp - 0x100c]
add eax, edx
mov dword [eax], 0x7961535c
mov dword [eax + 4], 0x47616b61
mov dword [eax + 8], 0x2e616e69
mov dword [eax + 0xc], 0x6c6c64
lea eax, [ebp - 0x100c]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edx, dword [ebp - 0xc]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x100c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.PreviousGinaDll
mov dword [esp], edx
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov ecx, 0x4670c4
call fcn.004350a0
mov dword [esp], eax
call fcn.00416d63
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
nop
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x41961c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1098
call fcn.00424e30
sub esp, eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_s
lea eax, [ebp - 0x105c]
mov dword [esp], eax
call fcn.00431940
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov dword [ebp - 0x5c], 0x44
mov word [ebp - 0x2c], 1
lea eax, [ebp - 0x18]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x5c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x20
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
lea eax, [ebp - 0x105c]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessA]
call eax
sub esp, 0x28
test eax, eax
sete al
test al, al
je 0x4196e5
call fcn.00411b5a
mov eax, 0xffffffff
jmp 0x4196ea
mov eax, 0
leave
ret
Function at 0x41afa7
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [0x467104], 0
mov eax, dword [0x467100]
test eax, eax
je 0x41afca
mov dword [0x467100], 0
mov eax, dword [0x467108]
test eax, eax
je 0x41b009
mov eax, dword [0x467108]
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
call eax
sub esp, 8
mov eax, dword [0x467108]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_DestroyWindow]
call eax
sub esp, 4
mov dword [0x467108], 0
nop
leave
ret

Function at 0x41b00c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x838
lea eax, [ebp + 0xc]
mov dword [ebp - 0x80c], eax
mov eax, dword [ebp - 0x80c]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x808]
mov dword [esp], eax
call fcn.0041abf8
lea eax, [ebp - 0x808]
mov dword [esp], eax
mov ecx, 0x4670e8
call fcn.0043e0c0
sub esp, 4
mov eax, dword [0x467100]
test eax, eax
jne 0x41b0ab
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x41acfc
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [0x467100], eax
mov dword [esp], 0x1f4
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [0x467104]
test eax, eax
je 0x41b0d0
mov eax, dword [0x467104]
lea edx, [ebp - 0x808]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_SetWindowTextA]
call eax
sub esp, 8
nop
leave
ret

Function at 0x4241c0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.004311f0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.004311f0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]
Function at 0x424220
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x467138]
test esi, esi
jle 0x424340
mov eax, dword [0x46713c]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x424254
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x4242d7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x424240
mov dword [esp], ebx
call fcn.00424bb0
mov edi, eax
test eax, eax
je 0x424367
mov eax, dword [0x46713c]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00424cc0
mov edx, dword [0x46713c]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x424347
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x4242d0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x4242e0
add dword [0x467138], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x46713c]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4242d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.004241c0
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x42425e
mov eax, dword [0x46713c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.004241c0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.004241c0
lea esi, [esi]
nop

Function at 0x424820
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x467154
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x46714c]
sub esp, 4
test ebx, ebx
je 0x424875
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x42486e
test esi, esi
je 0x42486e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x424850
mov dword [esp], 0x467154
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x424ee0
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [0x467150]
test eax, eax
jne 0x4248a0
ret
push ebx
sub esp, 0x18
mov dword [esp + 4], 0xc
mov dword [esp], 1
call sub.msvcrt.dll_calloc
mov ebx, eax
test eax, eax
je 0x424900
mov eax, dword [esp + 0x20]
mov dword [esp], 0x467154
mov dword [ebx], eax
mov eax, dword [esp + 0x24]
mov dword [ebx + 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x46714c]
mov dword [0x46714c], ebx
sub esp, 4
mov dword [ebx + 8], eax
mov dword [esp], 0x467154
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
sub esp, 4
add esp, 0x18
pop ebx
ret
or eax, 0xffffffff
jmp 0x4248fb
push esi
push ebx
sub esp, 4
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x424f10
mov dword [esi], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
add esp, 4
pop ebx
pop esi
jmp 0x431500
add esp, 4
pop ebx
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esp + 8]
test eax, eax
jne 0x431510
xor eax, eax
ret
jmp 0x424890

Function at 0x424f50
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x424f90
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x424fb8
xor eax, eax
add esp, 0x1c
ret
add esp, 0x1c
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x4331e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ecx, 0x1a
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x80]
mov esi, 0x44cf6d
push ebx
sub esp, 0x9c
mov eax, dword [str.not_enough_space_for_format_expansion__Please_submit_full_bug_report_at_https:__gcc.gnu.org_bugs__:_n]
mov dword [ebp - 0x81], eax
mov eax, dword [0x44cfd1]
mov dword [ebp - 0x1c], eax
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp + 8]
lea eax, [edx + 0x84]
and eax, 0xfffffff0
call fcn.00424e30
mov ecx, 0x1a
sub esp, eax
lea esi, [ebp - 0x81]
mov dword [ebp - 0x8c], edx
lea ebx, [esp + 0x1b]
and ebx, 0xfffffff0
mov edi, ebx
lea eax, [ebx + 0x68]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 8]
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], ecx
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x8c]
mov byte [ebx + edx + 0x68], 0
mov dword [esp], ebx
call fcn.00443110
nop
nop
nop
nop
nop
nop
nop
push edi
push esi
push ebx
sub esp, 0x20
cmp byte [0x446dd8], 0
jne 0x433306
mov byte [0x446dd8], 1
call fcn.00442290
test eax, eax
je 0x4332d4
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
sete al
mov dword [esp + 4], 0
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call fcn.00423dc0
mov dword [esp], 2
mov esi, dword [fcn.004311f0]
mov edi, eax
call esi
mov dword [esp + 8], 0x30
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
call sub.msvcrt.dll_fwrite
mov edx, dword [esp + 0x1c]
mov dword [esp], 2
test edx, edx
je 0x4332c4
call esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x44b1bd
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x442e38
jmp 0x442e30
call esi
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
jmp 0x43328a
mov dword [esp], 2
call dword [0x446d40]
mov dword [esp + 8], 0x2d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
call sub.msvcrt.dll_fwrite
jmp 0x442e2b
mov dword [esp], 2
call dword [0x446d40]
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_recursively_n
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x414ac0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xafbddbf5
dec ecx
mov ecx, 0x51f05042
push 0xa9460e0f
inc esp
push cs
mov word [edx], ss
or dword [eax + 0x366daab9], esi
inc edi
mov ebp, 0x47cd31d5
mov eax, 0xafbde605
cmp byte [ebx + 0x4e], bh
push eax
movsb byte es:[edi], byte [esi]
xor byte [edi + 0x1369f496], ah
adc ecx, esi
mov eax, 0xfb33802a
inc edx
cmp al, byte [edi]
push ecx
cmp byte [ebp - 0x47edb9f1], dl
push ebp
jg 0x414a97
scasd eax, dword es:[edi]
dec eax
mov ecx, 0x3f112a2
inc esi
mov al, 0xb3
mov ecx, 0xf89160fa
inc edx
mov eax, 0xafbd46a1
sbb edx, esp
mov ebp, 0x52010eaf
xor byte [eax + 0x7781aab9], dh
inc esi
mov ebp, 0x42b93299
push eax
int1
mov ecx, 0xb9f15042
inc edx
push eax
int1
mov ecx, 0x460e5042
mov ebp, 0x42b9f1af
push eax
push cs
inc esi
mov ebp, 0x42b9f1af
push eax
int1
mov ecx, 0xb9f15042
inc edx
push eax
int1
mov ecx, 0x7ef5bcc1
inc esi
je 0x414b4e
adc dword [eax], eax
push eax
clc
inc edx
or eax, 0x3c9f138
push eax
mov edi, 0x7388fafe
add esp, 0xffffffeb
notrack call 0x4719606c
add al, 0xe9
int1
test eax, 0x7e705002
inc ebx
add dl, byte [eax + 0x70]
jle 0x414b96
push eax
int1
mov ecx, 0xcf18bec3
dec edx
mov dl, 0x70
push edi
inc ebx
push eax
int1
mov ecx, 0xf8ba70f8
inc edx
rcr dword [esi], 1
sbb ecx, dword [esi - 0x42472a9c]
mov eax, 0x5042b9da
dec edx
xchg ebx, eax
das
mov esi, dword [eax]
imul esp, dword [esi - 0x2c995286], 0x35
mov ebp, 0x897197c3
jne 0x414b98
sbb dword [ebx - 0x470eafbe], ebp
mov esp, 0xbdb80659
cdq
mov edx, 0xfd929d90
popfd
xchg edx, eax
std
mov ecx, 0x4ef8a66b
or dword [ecx - 0x10], esp
pop es
mov ebp, 0xc37a2b43
xchg ecx, eax
cmc
mov ecx, 0x42d05042
adc eax, 0xa356700b
fstp dword [ecx]
invalid