joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4069c8
Capabilities:
Access peb ldr_data

Disassembly:
call fcn.00406988
and sp, 0xfffc
xor esi, esi
mov esi, dword fs:[esi + 0x30]
mov esi, dword [esi + 0xc]
mov esi, dword [esi + 0x1c]
push esi
mov si, 0x1aaa

Function at 0x4069e6
Capabilities:
Encode data using xor

Disassembly:
pop edi
mov ebp, dword [edi + 8]
or bh, bh
aaa
or bh, bh
aaa
mov ebx, dword [ebp + 0x3c]
mov ebx, dword [ebp + ebx + 0x78]
add ebx, ebp
mov ecx, dword [ebx + 0x18]
jcxz 0x4069e3
mov edi, dword [ebx + 0x20]
add edi, ebp
mov edi, dword [edi + ecx*4 - 4]
cld
add edi, ebp
xor eax, eax
cdq
xor dl, byte [edi]
ror dx, 1
scasb al, byte es:[edi]
jne 0x406a06
dec ecx
cmp dx, si
je 0x406a1d
jcxz 0x4069e3
jmp 0x4069f8
mov esi, dword [ebx + 0x24]
add esi, ebp
movzx esi, word [esi + ecx*2]
mov eax, dword [ebx + 0x1c]
add eax, ebp
mov edi, dword [eax + esi*4]
add edi, ebp
xor esi, esi
cmp dx, 0xf0da
je 0x406a54
cmp dx, 0x2769
je 0x406a60
push 0x32
push 0x33656c6f
push esp
call edi
xchg ebp, eax
mov si, 0xf0da
jmp 0x4069e9
push esi
call edi
mov si, 0x2769
jmp 0x4069e9
push 0xd422046e
push 0x99efeca1
push 0x499272b9
push 0x6c44df74
mov eax, esp
push 0x9673794f
push 0xc001e39e
dec dword [esp + 2]
push 0x11d23391
push 0x96749377
mov ebx, esp
push esi
push esp
push eax
push 0x17
push esi
push ebx
call edi
pop ebx
push 0x5520676f
push 0x7420706f
push 0x686e6421
xchg esi, eax
mov esi, esp
push eax
lodsb al, byte [esi]
push ax
cmp al, 0x55
jne 0x406aad
mov ecx, esp
xor eax, eax
push eax
push eax
push ecx
push ebx
mov edx, dword [ebx]
mov ecx, dword [edx + 0x50]
call ecx
int3

Function at 0x408560
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
push eax
enter 0x1045, 0x6a
add byte [ecx - 0x19], dl
dec ebp
add dword [edx - 0x75], edx
pop ecx
or dl, bl
add ecx, 0xfff96ee8
xchg ebx, eax
add dword [edi - 0x6f3ca2e4], 0xffffff90
nop
nop
nop
nop
nop
nop
nop
Function at 0x1b00a769
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x1b00e190
cmp edx, dword [eax]
je 0x1b00a78b
add eax, 8
inc ecx
cmp eax, 0x1b00e220
jl 0x1b00a77c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x1b00e190]
jne 0x1b00a8b9
mov eax, dword [0x1b00ebb0]
cmp eax, 1
je 0x1b00a893
test eax, eax
jne 0x1b00a7bc
cmp dword [0x1b00e0e4], 1
je 0x1b00a893
cmp edx, 0xfc
je 0x1b00a8b9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1b00a7f3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.1b00b670
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.1b00b490
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x1b00a836
lea eax, [ebp - 0x1a4]
push eax
call fcn.1b00b490
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x1b00d45c
push edi
call fcn.1b00bf00
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.1b00b670
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.1b00b680
lea eax, [ebp - 0xa0]
push 0x1b00d43c
push eax
call fcn.1b00b680
push dword [esi + 0x1b00e194]
lea eax, [ebp - 0xa0]
push eax
call fcn.1b00b680
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.1b00be75
add esp, 0x2c
pop edi
jmp 0x1b00a8b9
lea eax, [ebp + 8]
lea esi, [esi + 0x1b00e194]
push 0
push eax
push dword [esi]
call fcn.1b00b490
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x173e3fd0
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x403e77f5
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x4013a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x401c20
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x18]
mov edx, dword [ebp + 8]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov ecx, dword [esi]
mov edi, dword [edx]
mov ebx, dword [edx + 4]
mov dword [ebp - 0x24], ecx
mov ecx, dword [esi + 4]
cmp edi, ebx
je 0x4014c5
mov esi, dword [edx + 0xc]
mov eax, dword [edx + 8]
mov edx, dword [edx + 0x10]
sub ebx, edi
mov dword [ebp - 0x2c], esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x38], eax
mov esi, dword [esi + 8]
mov dword [ebp - 0x34], esi
nop word cs:[eax + eax]
nop
mov dword [ebp - 0x28], ecx
movzx ecx, byte [edi]
mov edx, dword [ebp - 0x30]
mov byte [ebp - 0x1e], cl
mov ecx, dword [eax]
inc ecx
movzx ecx, cl
mov dword [eax], ecx
mov esi, dword [edx + 8]
cmp ecx, esi
jae 0x4014db
mov esi, dword [edx + 4]
mov dword [ebp - 0x40], edi
mov edi, dword [ebp - 0x2c]
movzx ecx, byte [esi + ecx]
add cl, byte [edi]
movzx esi, cl
mov dword [edi], esi
mov edi, dword [edx + 8]
mov ecx, dword [eax]
cmp ecx, edi
jae 0x4014f3
cmp edi, esi
jbe 0x40150b
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x3c], ebx
mov edi, dword [edx + 4]
movzx ebx, byte [edi + ecx]
mov bh, byte [edi + esi]
mov byte [ebp - 0x1d], bl
mov byte [edi + ecx], bh
mov ch, byte [ebp - 0x1d]
mov byte [edi + esi], ch
mov edi, dword [eax]
mov esi, dword [edx + 8]
cmp edi, esi
jae 0x401523
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
cmp ecx, esi
jae 0x40153b
mov ebx, dword [edx + 4]
movzx ecx, byte [ebx + ecx]
add cl, byte [ebx + edi]
movzx ecx, cl
cmp esi, ecx
jbe 0x401553
movzx edx, byte [ebp - 0x1e]
mov eax, dword [ebp - 0x34]
mov edi, dword [ebp - 0x40]
xor dl, byte [ebx + ecx]
mov ecx, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x3c]
inc edi
mov byte [eax + ecx], dl
mov eax, dword [ebp - 0x38]
inc ecx
dec ebx
jne 0x401410
mov eax, dword [ebp - 0x24]
mov dword [eax], ecx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
push 0x41c3c0
push esi
push ecx
call fcn.0041ae80
add esp, 0xc
jmp 0x401569
mov dword [ebp - 0x10], 0
push 0x41c3d0
push edi
push ecx
call fcn.0041ae80
add esp, 0xc
jmp 0x401569
mov dword [ebp - 0x10], 0
push 0x41c3d0
push edi
push esi
call fcn.0041ae80
add esp, 0xc
jmp 0x401569
mov dword [ebp - 0x10], 0
push 0x41c3e0
push esi
push edi
call fcn.0041ae80
add esp, 0xc
jmp 0x401569
mov dword [ebp - 0x10], 0
push 0x41c3f0
push esi
push ecx
call fcn.0041ae80
add esp, 0xc
jmp 0x401569
mov dword [ebp - 0x10], 0
push 0x41c400
push esi
push ecx
call fcn.0041ae80
add esp, 0xc
ud2
Function at 0x4040d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x438
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x40dee0
mov esi, 0x200
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 2
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 2
mov dword [ebp - 0x2c], 0
cmp esi, 0x201
jae 0x404160
jmp 0x40414e
jbe 0x4041e6
cmp esi, 0x201
jae 0x404160
mov dword [ebp - 0x28], 0x200
lea ebx, [ebp - 0x444]
mov edi, esi
jmp 0x404191
mov edi, dword [ebp - 0x20]
sub esi, edi
je 0x404185
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x34]
mov edx, edi
push esi
call fcn.0041a450
add esp, 4
mov edi, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
test eax, eax
jne 0x4041b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x404249
cmp esi, edi
jne 0x404140
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x404268
lea esi, [edi + edi]
test edi, edi
mov eax, 0xffffffff
cmovs esi, eax
cmp esi, 0x201
jb 0x40414e
jmp 0x404160
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], 0
cmp esi, eax
ja 0x404285
lea eax, [ebp - 0x44]
push esi
push ebx
push eax
call fcn.00405fd0
add esp, 0xc
movsd xmm0, qword [ebp - 0x44]
mov esi, dword [ebp + 8]
movsd xmm1, qword [ebp - 0x3c]
movsd qword [esi + 8], xmm1
movsd qword [esi], xmm0
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x404233
add eax, eax
push 2
push eax
push dword [ebp - 0x24]
call fcn.00401c70
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x438
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 8]
mov byte [esi + 4], 0
mov dword [esi + 8], eax
mov dword [esi], 0x80000000
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x404223
jmp 0x404233
mov dword [ebp - 0x10], 0
push 0x41def0
push 0x28
push str.internal_error:_entered_unreachable_code_rustc_25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04library_alloc_src_vecmod.rs
call fcn.0041ade0
add esp, 0xc
jmp 0x404294
push 0x41dee0
push eax
push esi
call fcn.0041b160
add esp, 0xc
ud2
Function at 0x40ab40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, ecx
mov ecx, dword [ebp + 0xc]
cmp dword [ebp + 0x10], 0
mov edi, edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x103
je 0x40ab84
mov eax, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x18]
lea edx, [esp + 0x20]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], eax
xor eax, eax
mov ebx, 1
jmp 0x40ab8a
xor ebx, ebx
xor eax, eax
xor edx, edx
mov dword [esp + 0x1c], eax
lea eax, [esp + 8]
mov dword [esp + 0x18], ebx
push 0
push edx
push ecx
push dword [ebp + 8]
push eax
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x40abc6
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 8]
cmp eax, 0x103
je 0x40abeb
test eax, eax
js 0x40abd5
mov eax, dword [esp + 0xc]
mov dword [esi + 4], eax
mov al, 4
jmp 0x40abe1
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [esi + 4], eax
xor eax, eax
mov byte [esi], al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esp + 4]
mov dword [esp + 0x18], 0x41d944
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
lea ecx, [esp + 0x10]
lea edx, [esp + 0x34]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x24], 0
push eax
push ecx
push edx
call fcn.00405b70
add esp, 0xc
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
call fcn.004026d0
mov ecx, 7
int 0x29
ud2
Function at 0x40bd50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x40e150
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
movzx eax, byte [0x4231ec]
test al, al
je 0x40bf21
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x40bd9c
cmp eax, 3
jne 0x40bf1a
mov ebx, dword [0x4231f0]
test ebx, ebx
je 0x40bf1a
mov dword [ebp - 0x20], 0
jmp 0x40bdc7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x40bdf8
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x40bf6b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x40bdc0
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x40bdc0
test byte [ebp - 0x20], 1
je 0x40bf1a
mov ebx, dword [0x4231f0]
test ebx, ebx
je 0x40bf1a
mov dword [ebp - 0x20], 0
jmp 0x40be27
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x40be58
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x40bf6b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x40be20
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x40be20
test byte [ebp - 0x20], 1
je 0x40bf1a
mov ebx, dword [0x4231f0]
test ebx, ebx
je 0x40bf1a
mov dword [ebp - 0x20], 0
jmp 0x40be87
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x40beb8
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x40bf6b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x40be80
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x40be80
test byte [ebp - 0x20], 1
je 0x40bf1a
mov ebx, dword [0x4231f0]
test ebx, ebx
je 0x40bf1a
mov dword [ebp - 0x20], 0
jmp 0x40bee7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x40bf14
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x40bf6b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x40bee0
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x40bee0
test byte [ebp - 0x20], 1
jne 0x40bf34
movzx eax, byte [0x420240]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov ebx, dword [0x4231f0]
jmp 0x40bf3f
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x40bf1a
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x40bf6b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x40bf3c
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
jmp 0x40bf3c
mov dword [ebp - 0x10], 0
push 0x41de2c
call fcn.0041ac90
add esp, 4
ud2
Function at 0x40d9c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x423038]
mov esi, ecx
test eax, eax
je 0x40d9e6
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x40d9ff
cmp dword [eax + 4], 0
je 0x40d9ff
add eax, 8
pop esi
pop edi
ret
push 0x423038
call fcn.0041a670
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jae 0x40d9da
mov eax, dword [0x423038]
test eax, eax
je 0x40da96
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x40dab3
mov edi, eax
test eax, eax
jne 0x40da5f
movzx eax, byte [0x423161]
push 4
push 0x10
call fcn.00401c60
add esp, 8
test eax, eax
je 0x40dac7
mov dword [eax], 0x423038
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x423038]
test eax, eax
je 0x40dab8
dec eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
je 0x40da7f
mov eax, dword [esi]
xor ecx, ecx
mov edx, 0
mov dword [esi], 0
cmp eax, 1
jne 0x40da83
mov ecx, dword [esi + 4]
mov edx, dword [esi + 8]
jmp 0x40da83
xor ecx, ecx
xor edx, edx
lea eax, [edi + 8]
mov dword [edi + 4], 1
mov dword [edi + 8], ecx
mov byte [edi + 0xc], dl
pop esi
pop edi
ret
push 0x423038
call fcn.0041a670
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x40da1d
xor eax, eax
pop esi
pop edi
ret
push 0x423038
call fcn.0041a670
add esp, 4
jmp 0x40da57
push 0x10
push 4
call fcn.0041ac30

Function at 0x40dad0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
sub esp, 8
mov eax, dword [0x423048]
mov esi, ecx
test eax, eax
je 0x40dbaa
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x40dafd
cmp dword [eax + 4], 0
mov edi, eax
jne 0x40dba5
mov eax, dword [0x423048]
test eax, eax
je 0x40dbcc
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x40dbe9
mov edi, eax
test eax, eax
jne 0x40db61
movzx eax, byte [0x423161]
push 4
push 0xc
call fcn.00401c60
add esp, 8
test eax, eax
je 0x40dc05
mov dword [eax], 0x423048
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x423048]
test eax, eax
je 0x40dbf3
dec eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
je 0x40db76
mov eax, dword [esi]
mov dword [esi], 0
test eax, eax
je 0x40db78
mov eax, dword [esi + 4]
jmp 0x40db78
xor eax, eax
mov edx, dword [edi + 4]
mov ecx, dword [edi + 8]
test edx, edx
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [edi + 4], 1
mov dword [edi + 8], eax
je 0x40dba5
test ecx, ecx
je 0x40dba5
lock dec dword [ecx]
jne 0x40dba5
lea ecx, [esp + 4]
call fcn.00403210
add edi, 8
jmp 0x40dbeb
push 0x423048
call fcn.0041a670
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jae 0x40daf1
jmp 0x40dafd
push 0x423048
call fcn.0041a670
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x40db1b
xor edi, edi
mov eax, edi
add esp, 8
pop esi
pop edi
ret
push 0x423048
call fcn.0041a670
add esp, 4
jmp 0x40db59
push 0xc
push 4
call fcn.0041ac30
int3
Function at 0x40dc10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x423058]
mov esi, ecx
test eax, eax
je 0x40dc36
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x40dc4f
cmp byte [eax + 4], 0
je 0x40dc4f
add eax, 5
pop esi
pop edi
ret
push 0x423058
call fcn.0041a670
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jae 0x40dc2a
mov eax, dword [0x423058]
test eax, eax
je 0x40dcc2
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x40dcdb
mov edi, eax
test eax, eax
jne 0x40dca0
movzx eax, byte [0x423161]
push 4
push 8
call fcn.00401c60
add esp, 8
test eax, eax
je 0x40dcef
mov dword [eax], 0x423058
mov byte [eax + 4], 0
mov edi, eax
mov eax, dword [0x423058]
test eax, eax
je 0x40dce0
dec eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test esi, esi
je 0x40dcb5
cmp byte [esi], 0
mov byte [esi], 0
movzx eax, byte [esi + 1]
cmove eax, ecx
mov ecx, eax
lea eax, [edi + 5]
mov byte [edi + 4], 1
mov byte [edi + 5], cl
pop esi
pop edi
ret
push 0x423058
call fcn.0041a670
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x40dc65
xor eax, eax
pop esi
pop edi
ret
push 0x423058
call fcn.0041a670
add esp, 4
jmp 0x40dc98
push 8
push 4
call fcn.0041ac30
int3

Function at 0x40dd00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
sub esp, 8
mov eax, dword [0x423068]
mov esi, ecx
test eax, eax
je 0x40ddda
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x40dd2d
cmp dword [eax + 4], 0
mov edi, eax
jne 0x40ddd5
mov eax, dword [0x423068]
test eax, eax
je 0x40ddfc
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x40de19
mov edi, eax
test eax, eax
jne 0x40dd91
movzx eax, byte [0x423161]
push 4
push 0xc
call fcn.00401c60
add esp, 8
test eax, eax
je 0x40de35
mov dword [eax], 0x423068
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x423068]
test eax, eax
je 0x40de23
dec eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
je 0x40dda6
mov eax, dword [esi]
mov dword [esi], 0
test eax, eax
je 0x40dda8
mov eax, dword [esi + 4]
jmp 0x40dda8
xor eax, eax
mov edx, dword [edi + 4]
mov ecx, dword [edi + 8]
test edx, edx
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [edi + 4], 1
mov dword [edi + 8], eax
je 0x40ddd5
test ecx, ecx
je 0x40ddd5
lock dec dword [ecx]
jne 0x40ddd5
lea ecx, [esp + 4]
call fcn.00403250
add edi, 8
jmp 0x40de1b
push 0x423068
call fcn.0041a670
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jae 0x40dd21
jmp 0x40dd2d
push 0x423068
call fcn.0041a670
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x40dd4b
xor edi, edi
mov eax, edi
add esp, 8
pop esi
pop edi
ret
push 0x423068
call fcn.0041a670
add esp, 4
jmp 0x40dd89
push 0xc
push 4
call fcn.0041ac30
int3
Function at 0x418890
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4188e8
mov esi, dword [esp + 0x18]
lea edi, [edx + eax*2]
xor ebx, ebx
movzx eax, byte [edx + 1]
cmp byte [edx], ch
lea edx, [edx + 2]
lea ebp, [ebx + eax]
jne 0x4188e0
cmp ebx, ebp
ja 0x418956
cmp ebp, dword [esp + 0x1c]
ja 0x418962
add ebx, esi
nop word [eax + eax]
test eax, eax
je 0x4188e2
dec eax
cmp byte [ebx], cl
lea ebx, [ebx + 1]
jne 0x4188d0
jmp 0x41893f
ja 0x4188e8
cmp edx, edi
mov ebx, ebp
jne 0x4188a5
mov edx, dword [esp + 0x24]
test edx, edx
je 0x418943
mov esi, dword [esp + 0x20]
movzx ecx, cx
mov al, 1
add edx, esi
nop dword [eax + eax]
movzx ebx, byte [esi]
lea edi, [esi + 1]
test bl, bl
js 0x418920
mov esi, edi
sub ecx, ebx
jns 0x418937
jmp 0x418945
cmp edi, edx
je 0x41894c
movzx edi, byte [esi + 1]
and ebx, 0x7f
add esi, 2
shl ebx, 8
or ebx, edi
sub ecx, ebx
js 0x418945
xor al, 1
cmp esi, edx
jne 0x418900
jmp 0x418945
xor eax, eax
jmp 0x418945
mov al, 1
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x41f69c
call fcn.0041ac90
push 0x41f6ac
push ebp
push ebx
call fcn.0041b1d0
push 0x41f6ac
push dword [esp + 0x20]
push ebp
call fcn.0041b160
int3

Function at 0x419d41
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x419d80
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x419d80
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x419d80
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x419d80
cmp dword [ecx + 0x74], 0xe
jbe 0x419d80
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x41a670
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x30]
cmp dword [edi + 4], 0
je 0x41a6f1
lea ebx, [edi + 0xc]
mov dword [esp + 4], 0
lea eax, [esp + 4]
push 0
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_InitOnceBeginInitialize]
cmp eax, 1
mov dword [esp], eax
jne 0x41a72c
cmp dword [esp + 4], 0
je 0x41a713
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x41a74a
mov esi, eax
inc eax
mov dword [edi], eax
mov eax, dword [0x4231f0]
nop word [eax + eax]
mov dword [edi + 8], eax
lock cmpxchg dword [0x4231f0], edi
jne 0x41a6d0
mov byte [0x4231ec], 1
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_InitOnceComplete]
jmp 0x41a723
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esp], eax
je 0x41a78c
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [edi], ecx
jne 0x41a717
mov esi, dword [esp]
jmp 0x41a723
mov esi, dword [edi]
jmp 0x41a722
mov esi, eax
push dword [esp]
call dword [sym.imp.KERNEL32.dll_TlsFree]
dec esi
mov eax, esi
add esp, 0x20
pop esi
pop edi
pop ebx
ret
mov dword [esp + 8], 0
lea eax, [esp + 8]
mov ecx, esp
mov edx, 0x41db0c
push 0x41de08
push eax
call fcn.0041a330
push 0
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_InitOnceComplete]
mov dword [esp + 8], 0x41ddbc
mov dword [esp + 0xc], 1
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], 0x41c520
mov dword [esp + 0x14], 0
lea eax, [esp + 8]
push 0x41ddf8
push eax
call fcn.0041ad00
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0x41ddbc
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 0x41c520
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.0041a390
int3