joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4401d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [esp], 0x101f1e1d
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax]
lea edx, [eax + 0xb2371c5]
lea ebx, [eax + 0xc5]
and ebx, ecx
or edx, ecx
xor edx, ebx
mov ecx, edx
and ecx, 1
or edx, 1
add edx, ecx
add dl, 0x26
mov byte [esp + eax], dl
mov ecx, eax
and ecx, 5
xor eax, 0x26208d95
lea eax, [eax + ecx*2]
add eax, 0xd9df726c
cmp eax, 7
jb 0x440200
mov eax, dword [esp]
mov edx, dword [0x44bcdc]
test edx, edx
je 0x440298
xor ebx, ebx
mov ecx, dword [0x44bce0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ecx + ebx*8], 0x9c142cda
je 0x440270
inc ebx
cmp edx, ebx
jne 0x440260
jmp 0x440298
mov edx, dword [ecx + ebx*8 + 4]
cmp edx, eax
je 0x440298
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0x18
push eax
push ecx
push dword [ebp + 8]
push 0x14
push edx
push dword [0x44bce4]
call fcn.0043d7a0
add esp, 0x20
test edi, edi
je 0x4402a2
mov ecx, dword [esp + 8]
mov dword [edi], ecx
test esi, esi
je 0x4402ae
cmp byte [esp + 0x15], 0
setne byte [esi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x440470
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov dword [esp], 0x101f1e1d
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax]
lea ebx, [eax + 0xb2371c5]
lea ebp, [eax + 0xc5]
and ebp, edi
or ebx, edi
xor ebx, ebp
mov edi, ebx
and edi, 1
or ebx, 1
add ebx, edi
add bl, 0x26
mov byte [esp + eax], bl
mov edi, eax
and edi, 5
xor eax, 0x26208d95
lea eax, [eax + edi*2]
add eax, 0xd9df726c
cmp eax, 7
jb 0x4404a0
mov eax, dword [esp]
mov ebx, dword [0x44bcdc]
test ebx, ebx
je 0x44053e
xor ebp, ebp
mov edi, dword [0x44bce0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + ebp*8], 0xa2545bf7
je 0x440510
inc ebp
cmp ebx, ebp
jne 0x440500
jmp 0x44053e
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x44053e
lea eax, [esp + 8]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 0x24
push ebx
push dword [0x44bce4]
call fcn.0043d7a0
add esp, 0x30
cmp eax, 0x103
jne 0x4405f9
mov dword [esp], 0x101f1e1d
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
nop
movzx edx, byte [esp + eax]
lea ecx, [eax + 0xb2371c5]
lea edi, [eax + 0xc5]
and edi, edx
or ecx, edx
xor ecx, edi
mov edx, ecx
and edx, 1
or ecx, 1
add ecx, edx
add cl, 0x26
mov byte [esp + eax], cl
mov ecx, eax
and ecx, 5
xor eax, 0x26208d95
lea eax, [eax + ecx*2]
add eax, 0xd9df726c
cmp eax, 7
jb 0x440560
mov eax, dword [esp]
mov ecx, dword [0x44bcdc]
test ecx, ecx
je 0x4405f1
xor edx, edx
mov edi, dword [0x44bce0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x4c697c35
je 0x4405d0
inc edx
cmp ecx, edx
jne 0x4405c0
jmp 0x4405f1
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x4405f1
push 0
push 0
push dword [esp + 0x2c]
push 0xc
push ecx
push dword [0x44bce4]
call fcn.0043d7a0
add esp, 0x18
test eax, eax
js 0x4405f9
mov eax, dword [esp + 8]
test esi, esi
je 0x440603
mov ecx, dword [esp + 0xc]
mov dword [esi], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40cb36
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x415004]
jne 0x40cb40
repz ret
jmp fcn.0040ccf6

Function at 0x40edc3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040dca4
and dword [ebp - 4], 0
cmp dword [0x43a108], 0
mov ebx, eax
jne 0x40ee74
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40ef25
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40ef25
push eax
call fcn.0040dc32
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43a108], eax
call esi
push eax
call fcn.0040dc32
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43a10c], eax
call esi
push eax
call fcn.0040dc32
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43a110], eax
call esi
push eax
call fcn.0040dc32
pop ecx
mov dword [0x43a118], eax
test eax, eax
je 0x40ee74
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040dc32
pop ecx
mov dword [0x43a114], eax
mov eax, dword [0x43a114]
cmp eax, ebx
je 0x40eecc
cmp dword [0x43a118], ebx
je 0x40eecc
push eax
call fcn.0040dcad
push dword [0x43a118]
mov esi, eax
call fcn.0040dcad
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40eecc
test edi, edi
je 0x40eecc
call esi
test eax, eax
je 0x40eec3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40eec3
test byte [ebp - 0xc], 1
jne 0x40eecc
or dword [ebp + 0x10], 0x200000
jmp 0x40ef05
mov eax, dword [0x43a10c]
cmp eax, ebx
je 0x40ef05
push eax
call fcn.0040dcad
pop ecx
test eax, eax
je 0x40ef05
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40ef05
mov eax, dword [0x43a110]
cmp eax, ebx
je 0x40ef05
push eax
call fcn.0040dcad
pop ecx
test eax, eax
je 0x40ef05
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43a108]
call fcn.0040dcad
pop ecx
test eax, eax
je 0x40ef25
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40ef27
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x42e072
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x5997441f
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x42e060
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
je 0x42e0d2
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x50485b18
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x401cda
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], ecx
mov eax, 0x14
cmp eax, 0x14
je 0x401d09
mov dword [esp + 8], 0x34
mov dword [esp + 4], str.C:codehomework6_cs212_sha1_sha1.cpp
mov dword [esp], str.sizeof__Uint32____5__20
call sub.msvcrt.dll__assert
mov eax, dword [ebp - 0xc]
mov dword [eax], 0x67452301
mov eax, dword [ebp - 0xc]
mov dword [eax + 4], 0xefcdab89
mov eax, dword [ebp - 0xc]
mov dword [eax + 8], 0x98badcfe
mov eax, dword [ebp - 0xc]
mov dword [eax + 0xc], 0x10325476
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x10], 0xc3d2e1f0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x54], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x58], 0
leave
ret
Function at 0x41d270
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x28
mov ebx, dword [sym.imp.msvcrt.dll__iob]
lea eax, [esp + 0x34]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
add ebx, 0x40
mov dword [esp + 0xc], ebx
mov dword [esp], str.Mingw_runtime_failure:_n
mov dword [esp + 0x1c], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x1c]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]

Function at 0x41d2d0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x5c
mov dword [esp + 0x4c], ebx
mov ebx, eax
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [esp + 0x50], esi
mov esi, edx
mov dword [esp + 0x54], edi
mov edi, ecx
mov dword [esp + 0x58], ebp
call sub.KERNEL32.DLL_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x41d3c6
mov eax, dword [esp + 0x38]
cmp eax, 4
jne 0x41d340
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
mov ebx, dword [esp + 0x4c]
mov esi, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
mov ebp, dword [esp + 0x58]
add esp, 0x5c
ret
cmp eax, 0x40
je 0x41d315
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.DLL_VirtualProtect
sub esp, 0x10
mov eax, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
cmp eax, 0x40
setne byte [esp + 0x1e]
cmp eax, 4
setne byte [esp + 0x1f]
call sub.msvcrt.dll_memcpy
cmp byte [esp + 0x1f], 0
je 0x41d325
cmp byte [esp + 0x1e], 0
je 0x41d325
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.DLL_VirtualProtect
sub esp, 0x10
jmp 0x41d325
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.0041d270
nop

Function at 0x41d660
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x49131c
call sub.KERNEL32.DLL_EnterCriticalSection
mov ebx, dword [0x491334]
sub esp, 4
test ebx, ebx
je 0x41d6ab
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.DLL_TlsGetValue
sub esp, 4
mov esi, eax
call sub.KERNEL32.DLL_GetLastError
test eax, eax
jne 0x41d6a4
test esi, esi
je 0x41d6a4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x41d680
mov dword [esp], 0x49131c
call sub.KERNEL32.DLL_LeaveCriticalSection
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret
Function at 0x41eb50
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov esi, eax
lea eax, [eax + 0x41]
and eax, 0xfffffff0
call fcn.0041ed20
mov edx, 0x326d
sub esp, eax
lea eax, [esp + 0x1b]
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
lea edi, [esp + 0xc]
mov word [esp + 0x18], dx
mov dword [esp + 0xc], 0x2d636367
mov dword [esp], eax
mov dword [esp + 0x10], 0x656d6873
mov dword [esp + 0x14], 0x64742d6d
mov byte [esp + 0x1a], 0x2d
call sub.msvcrt.dll_memcpy
lea eax, [esi + 0x10]
lea edx, [edi + eax]
mov dword [ebp - 0x20], eax
mov dword [edx], 0x61616161
mov dword [edx + 4], 0x61616161
mov dword [edx + 8], 0x61616161
mov dword [edx + 0xc], 0x61616161
mov dword [edx + 0x10], 0x61616161
mov dword [edx + 0x14], 0x61616161
mov dword [edx + 0x18], 0x61616161
mov dword [edx + 0x1c], 0x61616161
mov byte [esp + esi + 0x3c], 0
mov byte [esp + esi + 0x1b], 0
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [ebp - 0x24], edx
call sub.KERNEL32.DLL_CreateMutexA
sub esp, 0xc
mov byte [edi + esi + 0xf], 0x2d
mov dword [ebp - 0x1c], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sub.KERNEL32.DLL_WaitForSingleObject
sub esp, 8
test eax, eax
mov edx, dword [ebp - 0x24]
je 0x41ec3d
int3
mov dword [esp], edi
mov dword [ebp - 0x24], edx
call sub.KERNEL32.DLL_FindAtomA
sub esp, 4
test ax, ax
mov edx, dword [ebp - 0x24]
jne 0x41ece0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], edx
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov edx, dword [ebp - 0x24]
mov ebx, eax
mov eax, 0x20
nop
bt ebx, eax
jae 0x41ec78
mov byte [edx], 0x41
add edx, 1
sub eax, 1
jne 0x41ec70
mov dword [esp], edi
call sub.KERNEL32.DLL_AddAtomA
sub esp, 4
test ax, ax
je 0x41ecd4
lea ecx, [esi + 0x31]
mov esi, dword [ebp - 0x20]
movzx eax, ax
mov edx, edi
mov dword [esp], esi
call fcn.0041ead0
cmp eax, ebx
mov esi, eax
je 0x41ecf7
mov dword [esp], ebx
call fcn.00427320
mov edi, dword [ebp - 0x1c]
mov dword [esp], edi
call sub.KERNEL32.DLL_ReleaseMutex
sub esp, 4
mov dword [esp], edi
call sub.KERNEL32.DLL_CloseHandle
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
int3
lea ecx, [esi + 0x31]
mov esi, dword [ebp - 0x20]
movzx eax, ax
mov edx, edi
mov dword [esp], esi
call fcn.0041ead0
mov esi, eax
jmp 0x41ecb1
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [esp + 8], eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x41ecb1
mov dword [esp], ebx
call dword [ebp + 0x10]
jmp 0x41ecb1
Function at 0x428010
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [0x491d34]
test ebx, ebx
je 0x428040
call sub.KERNEL32.DLL_TlsAlloc
mov dword [ebx], eax
mov eax, dword [0x491d34]
test eax, eax
je 0x428065
cmp dword [eax], 0xffffffff
je 0x428088
add esp, 0x18
pop ebx
ret
mov dword [esp + 8], 0x4274a0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.0042d630
mov ebx, eax
mov dword [0x491d34], eax
jmp 0x42801e
mov dword [esp + 8], 0x4274a0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.0042d630
mov dword [0x491d34], eax
jmp 0x42802e
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x428520
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov eax, dword [0x491d38]
test eax, eax
je 0x428670
call fcn.004284a0
mov eax, dword [0x491d34]
test eax, eax
je 0x4286a0
mov eax, dword [eax]
mov dword [esp], eax
call sub.KERNEL32.DLL_TlsGetValue
sub esp, 4
test eax, eax
je 0x428560
add esp, 0x20
pop ebx
pop esi
pop edi
ret
call fcn.00427e60
test eax, eax
mov ebx, eax
je 0x4286ec
mov eax, dword [entry3]
test eax, eax
je 0x4286ec
mov dword [ebx + 0x24], 1
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [ebx + 0x38], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call sub.KERNEL32.DLL_CreateEventA
mov dword [ebx + 0x1c], 0xffffffff
sub esp, 0x10
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x34], 0xffffffff
mov dword [ebx + 0x60], 0
mov dword [ebx + 0x14], 0
call sub.KERNEL32.DLL_GetCurrentProcess
mov edi, eax
call sub.KERNEL32.DLL_GetCurrentThread
mov esi, eax
call sub.KERNEL32.DLL_GetCurrentProcess
mov edx, eax
lea eax, [ebx + 0x14]
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], edx
call sub.KERNEL32.DLL_DuplicateHandle
sub esp, 0x1c
test eax, eax
je 0x4286f3
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call sub.KERNEL32.DLL_GetThreadPriority
mov dword [ebx + 0x68], eax
movzx eax, byte [ebx + 0x20]
sub esp, 4
mov dword [ebx + 0x64], 0
and eax, 0xffffffcf
or eax, 0x10
mov byte [ebx + 0x20], al
mov eax, dword [0x491d34]
test eax, eax
je 0x4286c6
mov dword [esp + 4], ebx
mov eax, dword [eax]
mov dword [esp], eax
call sub.KERNEL32.DLL_TlsSetValue
sub esp, 8
test eax, eax
je 0x4286f3
mov eax, ebx
jmp 0x428556
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_once_shmem
call fcn.0042d630
mov dword [0x491d38], eax
jmp 0x428533
mov dword [esp + 8], 0x4274a0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.0042d630
mov dword [0x491d34], eax
jmp 0x428545
mov dword [esp + 8], 0x4274a0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.0042d630
mov dword [0x491d34], eax
jmp 0x42864e
xor eax, eax
jmp 0x428556
call sub.msvcrt.dll_abort
nop
lea esi, [esi]
sub esp, 0x1c
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_key_dest_shmem
call fcn.0042d630
add esp, 0x1c
ret
Function at 0x428c60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
sub esp, 0x18
cmp dword [esp + 0x24], 3
je 0x428c80
add esp, 0x18
mov eax, 1
pop ebx
ret 0xc
mov eax, dword [0x491d34]
test eax, eax
je 0x428df0
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x428c6b
mov dword [esp], eax
call sub.KERNEL32.DLL_TlsGetValue
sub esp, 4
test eax, eax
mov ebx, eax
je 0x428c6b
test byte [eax + 0x20], 0x30
je 0x428d40
mov eax, dword [eax + 0xb0]
test eax, eax
jne 0x428de0
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x428cef
mov dword [esp], eax
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x428ce1
mov dword [esp], eax
call sub.KERNEL32.DLL_CloseHandle
sub esp, 4
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x14], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call fcn.0042c190
mov edx, dword [ebx + 0xac]
mov dword [ebx + 0x34], 0xffffffff
test edx, edx
je 0x428e46
mov eax, dword [0x491d34]
test eax, eax
je 0x428e20
mov dword [esp + 4], 0
mov eax, dword [eax]
mov dword [esp], eax
call sub.KERNEL32.DLL_TlsSetValue
sub esp, 8
mov eax, 1
add esp, 0x18
pop ebx
ret 0xc
mov eax, dword [eax + 0x64]
test eax, eax
mov eax, dword [ebx + 0x18]
jne 0x428da0
test eax, eax
je 0x428d59
mov dword [esp], eax
call sub.KERNEL32.DLL_CloseHandle
sub esp, 4
mov eax, dword [ebx + 0xb0]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x64], 1
test eax, eax
jne 0x428dd0
test byte [ebx + 0x24], 4
je 0x428db6
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x428ce8
mov dword [esp], eax
call sub.KERNEL32.DLL_CloseHandle
sub esp, 4
jmp 0x428ce8
test eax, eax
je 0x428daf
mov dword [esp], eax
call sub.KERNEL32.DLL_CloseHandle
sub esp, 4
mov dword [ebx + 0x18], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call fcn.0042c190
mov dword [ebx + 0x34], 0xffffffff
jmp 0x428c6b
call fcn.00428a70
jmp 0x428d71
call fcn.00428a70
jmp 0x428cbd
mov dword [esp + 8], 0x4274a0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.0042d630
mov dword [0x491d34], eax
jmp 0x428c8d
mov dword [esp + 8], 0x4274a0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.0042d630
mov dword [0x491d34], eax
jmp 0x428d1c
mov eax, ebx
call fcn.00428090
jmp 0x428d0f
Function at 0x429fe0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call fcn.00428520
mov ebx, eax
mov dword [eax + 4], esi
mov eax, dword [eax + 0xb0]
test eax, eax
jne 0x42a070
test byte [ebx + 0x20], 0x30
je 0x42a15a
mov eax, dword [0x491d34]
test eax, eax
je 0x42a0e0
mov eax, dword [eax]
mov dword [esp], eax
call sub.KERNEL32.DLL_TlsGetValue
sub esp, 4
test eax, eax
mov ebx, eax
je 0x42a05b
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x42a080
mov esi, dword [eax + 4]
mov dword [eax + 0x64], 1
mov eax, dword [eax + 0x18]
test eax, eax
je 0x42a04a
mov dword [esp], eax
call sub.KERNEL32.DLL_CloseHandle
sub esp, 4
test byte [ebx + 0x24], 4
mov dword [ebx + 0x18], 0
jne 0x42a106
mov dword [esp + 0x20], esi
add esp, 0x14
pop ebx
pop esi
jmp sub.msvcrt.dll__endthreadex
call fcn.00428a70
jmp 0x429ffd
mov dword [eax], 0xdeadbeef
mov eax, dword [eax + 0x18]
test eax, eax
je 0x42a098
mov dword [esp], eax
call sub.KERNEL32.DLL_CloseHandle
sub esp, 4
mov edx, dword [ebx + 0xac]
mov dword [ebx + 0x18], 0
mov esi, dword [ebx + 4]
test edx, edx
je 0x42a128
mov eax, dword [0x491d34]
test eax, eax
je 0x42a134
mov dword [esp + 4], 0
mov eax, dword [eax]
mov dword [esp], eax
call sub.KERNEL32.DLL_TlsSetValue
sub esp, 8
mov dword [esp + 0x20], esi
add esp, 0x14
pop ebx
pop esi
jmp sub.msvcrt.dll__endthreadex
mov dword [esp + 8], 0x4274a0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.0042d630
mov dword [0x491d34], eax
jmp 0x42a014
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call sub.KERNEL32.DLL_CloseHandle
push eax
cmp dword [ebx + 0xac], 0
mov dword [ebx + 0x14], 0
jne 0x42a0ac
mov eax, ebx
call fcn.00428090
jmp 0x42a0ac
mov dword [esp + 8], 0x4274a0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.0042d630
mov dword [0x491d34], eax
jmp 0x42a0b5
add ebx, 0x6c
mov dword [esp + 4], 1
mov dword [esp], ebx
call sub.msvcrt.dll_longjmp
lea esi, [esi]
Function at 0x42d630
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [ebp + 8]
mov dword [esp], edi
call sub.msvcrt.dll_strlen
mov ebx, eax
lea eax, [eax + 0x40]
and eax, 0xfffffff0
call fcn.0041ed20
mov edx, 0x326d
sub esp, eax
lea eax, [esp + 0x1b]
mov dword [esp + 4], edi
mov dword [esp + 8], ebx
lea esi, [esp + 0xc]
mov word [esp + 0x18], dx
mov dword [esp + 0xc], 0x2d636367
mov dword [esp], eax
mov dword [esp + 0x10], 0x656d6873
mov dword [esp + 0x14], 0x64742d6d
mov byte [esp + 0x1a], 0x2d
call sub.msvcrt.dll_memcpy
lea eax, [ebx + 0x10]
lea edi, [esi + eax]
mov dword [ebp - 0x24], eax
lea eax, [ebx + 0x30]
mov dword [edi], 0x61616161
mov dword [edi + 4], 0x61616161
mov dword [edi + 8], 0x61616161
mov dword [edi + 0xc], 0x61616161
mov dword [edi + 0x10], 0x61616161
mov dword [edi + 0x14], 0x61616161
mov dword [edi + 0x18], 0x61616161
mov dword [edi + 0x1c], 0x61616161
mov byte [esp + ebx + 0x3c], 0
mov byte [esp + ebx + 0x1b], 0
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [ebp - 0x1c], eax
call sub.KERNEL32.DLL_CreateMutexA
sub esp, 0xc
mov byte [esi + ebx + 0xf], 0x2d
mov dword [ebp - 0x20], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sub.KERNEL32.DLL_WaitForSingleObject
sub esp, 8
test eax, eax
je 0x42d71d
int3
mov dword [esp], esi
call sub.KERNEL32.DLL_FindAtomA
sub esp, 4
test ax, ax
jne 0x42d7b3
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov edx, edi
mov ebx, eax
mov eax, 0x20
bt ebx, eax
jae 0x42d74d
mov byte [edx], 0x41
add edx, 1
sub eax, 1
jne 0x42d745
mov dword [esp], esi
call sub.KERNEL32.DLL_AddAtomA
sub esp, 4
test ax, ax
je 0x42d7b0
mov ecx, dword [ebp - 0x24]
mov edx, esi
movzx eax, ax
mov dword [esp], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.0042d5b0
cmp eax, ebx
mov esi, eax
je 0x42d7ca
mov dword [esp], ebx
call fcn.00427320
mov edi, dword [ebp - 0x20]
mov dword [esp], edi
call sub.KERNEL32.DLL_ReleaseMutex
sub esp, 4
mov dword [esp], edi
call sub.KERNEL32.DLL_CloseHandle
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
int3
mov ecx, dword [ebp - 0x24]
mov edx, esi
movzx eax, ax
mov dword [esp], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.0042d5b0
mov esi, eax
jmp 0x42d786
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [esp + 8], eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x42d786
mov dword [esp], ebx
call dword [ebp + 0x10]
jmp 0x42d786