joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401f20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push dword [ebp + 0xc]
push esi
call fcn.00401fd0
add esp, 8
mov eax, dword [0x6cebec]
mov ecx, dword [0x5f75b4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x401f7e
inc esi
push dword [0x5f50f8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 0xfffffffc
je 0x401fbf
mov ecx, dword [0x6cebe4]
mov dword [eax + ecx*8], esi
mov ecx, dword [0x6cebe8]
mov edx, dword [0x6cebe4]
mov dword [eax + edx*8 + 4], ecx
pop esi
pop ebp
ret
push 0x6cebec
call fcn.00510c6d
add esp, 4
cmp dword [0x6cebec], 0xffffffff
jne 0x401f50
mov dword [0x6cebe4], 0xffffffff
xor eax, eax
mov dword [0x6cebe8], eax
mov ecx, 0x6cebe4
push eax
call fcn.0040c200
push 0x6cebec
call fcn.00510d9d
add esp, 4
jmp 0x401f50
test esi, esi
je 0x401f7b
call fcn.00404220
jmp 0x401f62

Function at 0x403c30
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
mov eax, dword [ebp + 8]
mov dword [ecx], eax
test eax, eax
je 0x403c44
lock inc dword [eax + 4]
mov dword [esi + 4], eax
mov eax, dword [0x6bee80]
mov ecx, dword [0x5f75b4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x403cf0
lea edi, [esi + 4]
push dword [0x5f50f8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 0xfffffffc
je 0x403d88
mov ecx, dword [0x6bee78]
mov dword [eax + ecx*8], edi
mov ecx, dword [0x6bee7c]
mov edx, dword [0x6bee78]
mov dword [eax + edx*8 + 4], ecx
mov eax, dword [0x6cebc8]
mov ecx, dword [0x5f75b4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x403d3c
push dword [0x5f50f8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 0xfffffffc
je 0x403d9a
mov ecx, dword [0x6cebc0]
mov dword [eax + ecx*8], esi
mov ecx, dword [0x6cebc4]
mov edx, dword [0x6cebc0]
mov dword [eax + edx*8 + 4], ecx
mov eax, esi
pop esi
pop edi
pop ebp
ret 4
push 0x6bee80
call fcn.00510c6d
add esp, 4
cmp dword [0x6bee80], 0xffffffff
jne 0x403c68
mov dword [0x6bee7c], 0
mov dword [0x6bee78], 0xffffffff
mov ecx, 0x6bee78
push 0
call fcn.0040c200
push 0x6bee80
call fcn.00510d9d
add esp, 4
jmp 0x403c68
push 0x6cebc8
call fcn.00510c6d
add esp, 4
cmp dword [0x6cebc8], 0xffffffff
jne 0x403cba
mov dword [0x6cebc4], 0
mov dword [0x6cebc0], 0xffffffff
mov ecx, 0x6cebc0
push 0
call fcn.0040c200
push 0x6cebc8
call fcn.00510d9d
add esp, 4
jmp 0x403cba
test edi, edi
je 0x403c99
call fcn.00404220
jmp 0x403c80
test esi, esi
je 0x403ce8
call fcn.00404220
jmp 0x403ccf
Function at 0x403db0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
mov eax, dword [0x6cebc8]
mov ecx, dword [0x5f75b4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x403f26
push dword [0x5f50f8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 0xfffffffc
je 0x403e06
mov ecx, dword [0x6cebc0]
mov dword [eax + ecx*8], 0
mov ecx, dword [0x6cebc4]
mov edx, dword [0x6cebc0]
mov dword [eax + edx*8 + 4], ecx
mov eax, dword [0x6bee80]
mov ecx, dword [0x5f75b4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x403eda
push dword [0x5f50f8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 0xfffffffc
je 0x403e55
mov ecx, dword [0x6bee78]
mov dword [eax + ecx*8], 0
mov ecx, dword [0x6bee7c]
mov edx, dword [0x6bee78]
mov dword [eax + edx*8 + 4], ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x403e66
lock dec dword [eax + 4]
je 0x403fb6
mov esi, dword [esi]
test esi, esi
je 0x403e72
lock dec dword [esi + 4]
je 0x403e76
pop esi
pop edi
pop ebp
ret
mov eax, dword [esi]
mov ecx, dword [eax + 8]
cmp ecx, 0x50b580
jne 0x403eb9
mov edi, dword [eax + 4]
cmp edi, 0x501670
jne 0x403eca
mov eax, dword [esi + 0xc]
test eax, eax
je 0x403e9e
lock dec dword [eax]
je 0x403fa8
mov edi, dword [esi + 8]
test edi, edi
je 0x403eae
lock dec dword [edi]
je 0x403f72
push esi
call fcn.0050fc7c
add esp, 4
jmp 0x403e72
mov edi, ecx
call dword [section..00cfg]
mov ecx, esi
mov eax, edi
pop esi
pop edi
pop ebp
jmp eax
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push 1
call edi
jmp 0x403e72
push 0x6bee80
call fcn.00510c6d
add esp, 4
cmp dword [0x6bee80], 0xffffffff
jne 0x403e27
mov dword [0x6bee7c], 0
mov dword [0x6bee78], 0xffffffff
mov ecx, 0x6bee78
push 0
call fcn.0040c200
push 0x6bee80
call fcn.00510d9d
add esp, 4
jmp 0x403e27
push 0x6cebc8
call fcn.00510c6d
add esp, 4
cmp dword [0x6cebc8], 0xffffffff
jne 0x403dd8
mov dword [0x6cebc4], 0
mov dword [0x6cebc0], 0xffffffff
mov ecx, 0x6cebc0
push 0
call fcn.0040c200
push 0x6cebc8
call fcn.00510d9d
add esp, 4
jmp 0x403dd8
mov eax, dword [edi + 0x10]
mov ecx, eax
shr ecx, 0xe
mov edx, eax
shr edx, 0x13
mov edx, dword [edx*4 + 0x6c24fc]
bt edx, ecx
jb 0x403fc4
mov dword [edi + 0x10], 0
lea ecx, [edi + 4]
call fcn.0040dae0
push edi
call fcn.0050fc7c
add esp, 4
jmp 0x403eae
push eax
call fcn.0050fc7c
add esp, 4
jmp 0x403e9e
push eax
call fcn.0050b620
add esp, 4
jmp 0x403e66
push eax
call fcn.004e3ba0
add esp, 4
jmp 0x403f8b
Function at 0x404220
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x804
mov eax, dword [0x5f3418]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov esi, dword [0x5f50f8]
cmp esi, 0xffffffff
je 0x4042b5
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x4042e7
mov ebx, 0x800
lea eax, [ebp - 0x810]
push ebx
push 0
push eax
call fcn.005191b0
add esp, 0xc
lea eax, [ebp - 0x80d]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ebx
call fcn.00510d94
add esp, 4
mov edi, eax
push ebx
lea eax, [ebp - 0x810]
push eax
push edi
call fcn.00518c30
add esp, 0xc
mov eax, edi
or eax, 3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512ee3
mov eax, edi
add esp, 0x804
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x4042ea
mov esi, eax
xor eax, eax
dec eax
lock cmpxchg dword [0x5f50f8], esi
je 0x404241
push esi
call fcn.00584bf0
add esp, 4
mov esi, dword [0x5f50f8]
jmp 0x404241
int3
int3

Function at 0x405220
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [0x5f3418]
xor eax, ebp
mov dword [esp + 8], eax
push 0x6cf670
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x405330
cmp byte [0x6cf674], 0
je 0x4052d8
mov eax, dword [0x6cf684]
mov ecx, dword [0x6cf680]
mov edx, dword [0x6cf678]
mov ebx, dword [0x6cf67c]
mov esi, ebx
shld esi, edx, 0x17
mov edi, edx
shl edi, 0x17
xor edi, edx
xor esi, ebx
mov ebx, esi
shld ebx, edi, 0xf
mov edx, eax
shld edx, ecx, 6
xor edx, ecx
xor edx, edi
xor edx, ebx
mov edi, eax
shr edi, 0x1a
xor edi, eax
xor edi, esi
shr esi, 0x11
xor esi, edi
mov dword [0x6cf678], ecx
mov dword [0x6cf67c], eax
mov dword [0x6cf680], edx
add edx, ecx
mov dword [0x6cf684], esi
adc esi, eax
push 0x6cf670
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov ecx, dword [esp + 8]
xor ecx, ebp
call fcn.00512ee3
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xorps xmm0, xmm0
movups xmmword [0x6cf678], xmm0
xor edi, edi
dec edi
mov esi, esp
mov dword [esi + 4], edi
mov dword [esi], edi
push 8
push esi
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x40533f
mov eax, dword [esp]
mov ecx, dword [esp + 4]
mov dword [0x6cf67c], ecx
mov dword [0x6cf678], eax
mov dword [esp + 4], edi
mov dword [esp], edi
push 8
push esi
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x405342
mov ecx, dword [esp]
mov eax, dword [esp + 4]
mov byte [0x6cf674], 1
jmp 0x405262
mov ecx, 0x6cf670
call fcn.004ef6b0
jmp 0x40524a
int3
int3
Function at 0x407cb0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
test byte [0x5f5168], 0x19
jne 0x407cc8
mov ecx, esi
pop esi
pop ebp
jmp fcn.004f9b80
xor eax, eax
push eax
push eax
push 0x5e2088
push 0x5db484
push 0x5f5168
push 0x45
call fcn.005553e0
add esp, 0x18
jmp 0x407cbf
Function at 0x408690
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x100c
call fcn.00517ca0
mov esi, ecx
mov eax, dword [0x5f3418]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov edi, 0x800
lea ebx, [ebp - 0x810]
push edi
push 0xff
push ebx
call fcn.005191b0
add esp, 0xc
lea eax, [ebp - 0x1014]
mov dword [eax], 1
lea ecx, [ebp - 0x1018]
mov dword [ecx], edi
push ecx
push ebx
push eax
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x408729
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x1014]
cmp eax, 1
jne 0x40872d
push ebx
call fcn.00510eb5
add esp, 4
mov ecx, esi
push eax
push ebx
call fcn.00547750
xor edi, edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512ee3
mov eax, edi
add esp, 0x100c
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov edi, eax
jmp 0x408710
mov edi, 0x3f4
cmp eax, 2
jne 0x408710
lea edi, [ebp - 0x1010]
push 0x800
push 0xff
push edi
call fcn.005191b0
add esp, 0xc
push 0x400
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x1018], eax
add eax, 0xfffffbff
mov edi, 0xea
cmp eax, 0xfffffc00
jb 0x408710
lea edi, [ebp - 0x1010]
push edi
call fcn.00510eb5
add esp, 4
mov ecx, esi
push eax
push edi
jmp 0x408709
Function at 0x409790
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov eax, dword [0x5f3418]
xor eax, ebp
mov dword [esp + 0x40], eax
movsd xmm0, qword [0x6c0278]
xorpd xmm1, xmm1
ucomisd xmm0, xmm1
jne 0x4097bb
jnp 0x4097e0
movsd qword [esp + 0x18], xmm0
fld qword [esp + 0x18]
fstp xword [esp + 0xc]
mov ecx, dword [esp + 0x40]
xor ecx, ebp
call fcn.00512ee3
fld xword [esp + 0xc]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esp + 0xc], eax
call esi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x6c0288]
mov ecx, dword [0x5f75b4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x409915
mov eax, dword [0x6c0298]
mov ecx, dword [0x5f75b4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x40994e
rdtsc
mov dword [esp + 8], eax
mov dword [esp + 4], edx
xor eax, eax
lea edi, [esp + 0x38]
mov dword [edi + 4], eax
mov dword [edi], eax
push edi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov esi, dword [edi]
mov ebx, dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor eax, eax
mov dword [edi + 4], eax
mov dword [edi], eax
push edi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub esi, dword [0x6c0290]
sbb ebx, dword [0x6c0294]
movd xmm0, ebx
movd xmm1, esi
punpckldq xmm1, xmm0
movq qword [esp + 0x28], xmm1
fild qword [esp + 0x28]
fstp qword [esp + 0x20]
movsd xmm1, qword [esp + 0x20]
fild qword [esp + 0x38]
fstp qword [esp + 0x30]
divsd xmm1, qword [esp + 0x30]
pxor xmm0, xmm0
movsd xmm2, qword [0x5e0b38]
ucomisd xmm2, xmm1
ja 0x4097bb
mov eax, dword [esp + 8]
sub eax, dword [0x6c0280]
mov ecx, dword [esp + 4]
sbb ecx, dword [0x6c0284]
movd xmm2, ecx
movd xmm0, eax
punpckldq xmm0, xmm2
punpckldq xmm0, xmmword [0x5e0b10]
subpd xmm0, xmmword [0x5e0b20]
haddpd xmm0, xmm0
divsd xmm0, xmm1
movsd qword [0x6c0278], xmm0
jmp 0x4097bb
push 0x6c0288
call fcn.00510c6d
add esp, 4
cmp dword [0x6c0288], 0xffffffff
jne 0x40981f
rdtsc
mov dword [0x6c0280], eax
mov dword [0x6c0284], edx
push 0x6c0288
call fcn.00510d9d
add esp, 4
jmp 0x40981f
push 0x6c0298
call fcn.00510c6d
add esp, 4
cmp dword [0x6c0298], 0xffffffff
jne 0x409840
xor eax, eax
lea esi, [esp + 0x38]
mov dword [esi + 4], eax
mov dword [esi], eax
push esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [0x6c0294], ecx
mov dword [0x6c0290], eax
push 0x6c0298
call fcn.00510d9d
add esp, 4
jmp 0x409840
Function at 0x409da0
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov eax, dword [0x5f3418]
xor eax, ebp
mov dword [esp + 0x4c], eax
mov eax, dword [0x6bee70]
mov ecx, dword [0x5f75b4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x409ded
mov bl, byte [0x6bee6c]
mov ecx, dword [esp + 0x4c]
xor ecx, ebp
call fcn.00512ee3
mov eax, ebx
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
push 0x6bee70
call fcn.00510c6d
add esp, 4
cmp dword [0x6bee70], 0xffffffff
jne 0x409dd3
mov esi, dword [0x6bedd8]
mov ecx, esi
push str.enable_low_end_device_mode
call fcn.004fd6b0
test al, al
jne 0x409e97
mov ecx, esi
push str.disable_low_end_device_mode
call fcn.004fd6b0
test al, al
jne 0x409e9b
mov ecx, dword [0x6bedd8]
push str.enable_low_end_device_mode
call fcn.004fd6b0
mov ebx, eax
pcmpeqd xmm0, xmm0
mov eax, esp
movdqa xmmword [eax], xmm0
movdqa xmmword [eax + 0x30], xmm0
movdqa xmmword [eax + 0x20], xmm0
movdqa xmmword [eax + 0x10], xmm0
mov dword [eax], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov ecx, eax
test eax, eax
je 0x409e6f
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
test bl, bl
jne 0x409e9f
shld eax, ecx, 0xc
dec eax
cmp eax, 0x1000
setb al
mov byte [0x6bee6c], al
push 0x6bee70
call fcn.00510d9d
add esp, 4
jmp 0x409dd3
mov al, 1
jmp 0x409e80
xor eax, eax
jmp 0x409e80
mov edx, 0x20000000
cmp ecx, edx
cmovae ecx, edx
test eax, eax
cmovne ecx, edx
shr ecx, 0x14
mov eax, ecx
jmp 0x409e77
Function at 0x40ba20
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, edx
mov eax, dword [0x5f3418]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ecx, ecx
mov ebx, 0x100000
cmovne ebx, ecx
push 0x10
call fcn.00510d64
add esp, 4
mov esi, eax
mov eax, edi
shr eax, 0xe
mov ecx, edi
shr ecx, 0x13
mov ecx, dword [ecx*4 + 0x6c24fc]
bt ecx, eax
jae 0x40ba6c
push edi
call fcn.004e3a80
add esp, 4
jmp 0x40ba78
mov eax, edi
shr eax, 0x15
mov byte [eax + 0x6ca4fc], 1
mov dword [esi], edi
mov eax, dword [ebp + 8]
test eax, eax
setne byte [esi + 4]
mov eax, dword [ebp + 0xc]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0xc], eax
xor eax, eax
push eax
push 0x10000
push esi
push 0x401820
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test eax, eax
je 0x40babd
mov eax, dword [ebp + 8]
test eax, eax
je 0x40bb53
mov dword [eax], edi
jmp 0x40bb5a
mov dword [ebp - 0x20], edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
je 0x40bb73
mov edi, eax
cmp eax, 0x5af
je 0x40bb73
cmp edi, 0xe
je 0x40bb73
mov eax, dword [0x6bfac0]
mov ecx, dword [0x5f75b4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x40bb79
lea ebx, [ebp - 0x1c]
push edi
push ebx
call fcn.004d2300
add esp, 8
cmp byte [ebx + 0xb], 0
jns 0x40bb20
push dword [ebp - 0x1c]
call fcn.0050fc7c
add esp, 4
test esi, esi
mov edi, dword [ebp - 0x20]
je 0x40bb5a
mov eax, dword [esi]
mov ecx, eax
shr ecx, 0xe
mov edx, eax
shr edx, 0x13
mov edx, dword [edx*4 + 0x6c24fc]
bt edx, ecx
jae 0x40bb48
push eax
call fcn.004e3ba0
add esp, 4
push esi
call fcn.0050fc7c
add esp, 4
jmp 0x40bb5a
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512ee3
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
push ebx
call fcn.004d1f90
push 0x6bfac0
call fcn.00510c6d
add esp, 4
cmp dword [0x6bfac0], 0xffffffff
jne 0x40bb02
push 0x6bfac0
call fcn.00510d9d
add esp, 4
jmp 0x40bb02
Function at 0x40c200
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov eax, dword [0x5f50f8]
cmp eax, 0xffffffff
je 0x40c2c1
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
je 0x40c2c1
mov eax, dword [0x6bfa8c]
mov ecx, dword [0x5f75b4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x40c2cb
mov edi, dword [0x6bfa88]
push edi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x40c30c
mov ecx, dword [0x6bee84]
inc ecx
xor edx, edx
lea eax, [ecx + edx]
movzx ebx, al
lea eax, [ebx + ebx*2]
cmp dword [eax*4 + 0x6bee88], 0
jne 0x40c318
lea eax, [eax*4 + 0x6bee88]
mov dword [eax], 1
lea eax, [ebx*4]
mov ecx, dword [ebp + 8]
mov dword [eax + eax*2 + 0x6bee8c], ecx
mov dword [0x6bee84], ebx
mov dword [esi], ebx
mov eax, dword [eax + eax*2 + 0x6bee90]
mov dword [esi + 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
cmp dword [esi], 0x100
jae 0x40c327
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.00404220
jmp 0x40c225
push 0x6bfa8c
call fcn.00510c6d
add esp, 4
cmp dword [0x6bfa8c], 0xffffffff
jne 0x40c246
push 4
call fcn.00510d64
add esp, 4
mov dword [eax], 0
mov dword [0x6bfa88], eax
push 0x6bfa8c
call fcn.00510d9d
add esp, 4
jmp 0x40c246
mov ecx, edi
call fcn.004f8930
jmp 0x40c25b
inc edx
cmp edx, 0x100
jne 0x40c264
jmp 0x40c2ab
int3
Function at 0x40d9a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov ebx, edx
mov eax, dword [0x5f3418]
xor eax, ebp
mov dword [esp + 0x18], eax
xor esi, esi
lea edi, [esp + 8]
mov dword [edi + 4], esi
mov dword [edi], esi
mov dword [edi + 8], esi
push edi
push edx
mov dword [esp + 0xc], ecx
push ecx
call fcn.004fe880
add esp, 0xc
cmp byte [edi + 0xb], 0
jns 0x40d9e0
mov edi, dword [esp + 8]
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
cmp byte [esp + 0x13], 0
jns 0x40d9fe
push dword [esp + 8]
call fcn.0050fc7c
add esp, 4
cmp dword [ebp + 8], 0
je 0x40da08
test esi, esi
jne 0x40da22
test esi, esi
setne bl
mov ecx, dword [esp + 0x18]
xor ecx, ebp
call fcn.00512ee3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esi + esi]
xor ecx, ecx
dec ecx
test esi, esi
cmovns ecx, eax
push ecx
call fcn.00510d94
add esp, 4
mov dword [esp], eax
xor eax, eax
lea edi, [esp + 8]
mov dword [edi + 4], eax
mov dword [edi], eax
mov dword [edi + 8], eax
push edi
push ebx
push dword [esp + 0xc]
call fcn.004fe880
add esp, 0xc
cmp byte [edi + 0xb], 0
jns 0x40da5f
mov edi, dword [esp + 8]
push esi
push dword [esp + 4]
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp byte [esp + 0x13], 0
jns 0x40da7e
push dword [esp + 8]
call fcn.0050fc7c
add esp, 4
cmp dword [esp], 0
je 0x40dad9
mov edi, dword [esp]
push edi
call fcn.00510eb5
add esp, 4
lea ecx, [esp + 8]
push eax
push edi
push ecx
call fcn.00501f70
add esp, 0xc
mov eax, dword [ebp + 8]
cmp byte [eax + 0xb], 0
jns 0x40dab5
mov eax, dword [ebp + 8]
push dword [eax]
call fcn.0050fc7c
add esp, 4
mov eax, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
movsd xmm0, qword [esp + 8]
movsd qword [ecx], xmm0
push dword [esp]
call fcn.00510d5f
add esp, 4
jmp 0x40da08
int3

Function at 0x40dc60
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [0x6bedd8]
test ebx, ebx
jne 0x40dce0
push 0x28
call fcn.00510d64
add esp, 4
mov esi, eax
xor edi, edi
mov dword [eax], edi
mov dword [eax + 4], edi
mov byte [eax + 8], 0
push 0xc
call fcn.00510d64
add esp, 4
mov dword [esi + 0xc], eax
lea ecx, [eax + 0xc]
mov dword [esi + 0x14], ecx
mov dword [eax + 8], edi
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [esi + 0x10], ecx
lea eax, [esi + 0x1c]
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x18], eax
mov dword [esi + 0x24], 1
mov dword [0x6bedd8], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
je 0x40dcea
mov edi, eax
push eax
call fcn.00510eb5
add esp, 4
mov ecx, esi
mov edx, edi
push eax
call fcn.0040dcf0
add esp, 4
test ebx, ebx
sete al
pop esi
pop edi
pop ebx
pop ebp
ret
int3
Function at 0x414c50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
lea eax, [ebp - 0x18]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x4d13c0
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov ecx, dword [ebp + 0x10]
mov dword fs:[0], eax
test byte [ecx + 4], 1
jne 0x414cc1
movzx ebx, byte [ebp + 0x18]
mov eax, dword [esi]
mov edi, dword [eax + 0x18]
mov ecx, edi
call dword [section..00cfg]
movsx eax, byte [ebp + 0x14]
mov ecx, esi
push ebx
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push esi
call edi
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0x1c]
lea ecx, [ebp - 0x30]
mov dword [ecx], eax
mov dword [ebp - 0x20], eax
lock inc dword [eax + 4]
mov dword [ebp - 0x10], 0
push 0x6be714
call fcn.00506190
mov esi, eax
xor ebx, ebx
dec ebx
mov eax, ebx
mov ecx, dword [ebp - 0x20]
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x414d19
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov edi, dword [eax + 4]
mov dword [ebp - 0x10], 0xffffffff
mov ecx, edi
call dword [section..00cfg]
mov ecx, dword [ebp - 0x20]
call edi
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov eax, dword [esi]
mov cl, byte [ebp + 0x18]
xor cl, 1
movzx ecx, cl
mov edi, dword [eax + ecx*4 + 0x14]
mov dword [ebp - 0x10], ebx
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
lea esi, [ebp - 0x30]
push esi
call edi
mov cl, byte [ebp - 0x25]
test cl, cl
mov eax, dword [ebp - 0x30]
cmovs esi, eax
mov dword [ebp - 0x20], esi
lea edx, [ebp - 0x30]
test cl, cl
cmovs edx, eax
js 0x414da2
movzx esi, cl
add edx, esi
cmp dword [ebp - 0x20], edx
je 0x414dd7
cmp dword [ebp - 0x24], 0
je 0x414dac
mov eax, dword [ebp - 0x20]
mov al, byte [eax]
movzx esi, al
mov edx, dword [ebp - 0x24]
mov ecx, dword [edx + 0x18]
cmp ecx, dword [edx + 0x1c]
je 0x414db0
lea edx, [ecx + 1]
mov edi, dword [ebp - 0x24]
mov dword [edi + 0x18], edx
mov byte [ecx], al
xor edx, edx
cmp esi, 0xffffffff
je 0x414d94
mov edx, dword [ebp - 0x24]
mov cl, byte [ebp - 0x25]
mov eax, dword [ebp - 0x30]
inc dword [ebp - 0x20]
mov dword [ebp - 0x24], edx
jmp 0x414d52
add edx, dword [ebp - 0x2c]
cmp dword [ebp - 0x20], edx
jne 0x414d66
jmp 0x414df0
xor edx, edx
jmp 0x414d9a
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebx]
mov edi, dword [eax + 0x30]
mov dword [ebp - 0x10], 0xffffffff
mov ecx, edi
call dword [section..00cfg]
mov dword [ebp - 0x10], 1
mov ecx, ebx
push esi
call edi
mov esi, eax
jmp 0x414d8a
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x24]
mov dword [eax], ecx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
jmp 0x414cb7
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x24]
mov dword [ecx], edx
push eax
call fcn.0050fc7c
add esp, 4
jmp 0x414ddf