joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000d030
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10026100
mov eax, dword fs:[0]
push eax
sub esp, 0x4a0
mov eax, dword [0x10031740]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0x20]
call fcn.1000d450
mov dword [ebp - 0x2a0], 0xffffffff
mov byte [ebp - 0x285], 1
push 0x1002d89f
lea eax, [ebp + 8]
push eax
call fcn.10008db0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x1000d0a7
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10002b10
jmp 0x1000d1e9
lea edx, [ebp + 8]
push edx
lea eax, [ebp - 0x28]
push eax
call fcn.10006840
add esp, 8
mov byte [ebp - 4], 1
mov dword [ebp - 0x29c], 0
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x284], 0x22c
lea ecx, [ebp - 0x284]
push ecx
mov edx, dword [ebp - 0x28c]
push edx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov dword [ebp - 0x290], eax
xor eax, eax
mov word [ebp - 0x4ac], ax
push 0x208
push 0
lea ecx, [ebp - 0x4aa]
push ecx
call fcn.100134b0
add esp, 0xc
mov dword [ebp - 0x294], 0
mov dword [ebp - 0x298], 0
cmp dword [ebp - 0x290], 0
je 0x1000d1c1
lea edx, [ebp - 0x260]
push edx
lea eax, [ebp - 0x40]
push eax
call fcn.10006790
add esp, 8
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x58]
push edx
call fcn.10006840
add esp, 8
mov byte [ebp - 4], 3
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x58]
push ecx
call fcn.10008de0
add esp, 8
movzx edx, al
test edx, edx
je 0x1000d18a
lea eax, [ebp - 0x27c]
push eax
mov ecx, dword [ebp + 0x20]
call fcn.1000d340
lea ecx, [ebp - 0x284]
push ecx
mov edx, dword [ebp - 0x28c]
push edx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
mov dword [ebp - 0x290], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x58]
call fcn.10002b10
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.10002b10
jmp 0x1000d12c
mov eax, dword [ebp - 0x28c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.10002b10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10002b10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000e532
mov esp, ebp
pop ebp
ret

Function at 0x1000d210
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x4080c0
Capabilities:
Encrypt data using rc4 via systemfunction032
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
call sub.kernel32.dll_CreateTimerQueue
test eax, eax
je 0x4080f5
mov esi, eax
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
test eax, eax
je 0x4080f5
push 0
call sub.kernel32.dll_GetModuleHandleA
test eax, eax
je 0x4080f5
add eax, dword [eax + 0x3c]
jne 0x4080fd
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
push str.ntdll
call sub.kernel32.dll_LoadLibraryA
push str.RtlCaptureContext
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [ebp - 0x18], eax
push str.ntdll
call sub.kernel32.dll_GetModuleHandleA
push str.NtContinue
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [ebp - 0x14], eax
push str.Advapi32
call sub.kernel32.dll_LoadLibraryA
push str.SystemFunction032
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [ebp - 0x10], eax
push str.kernel32.dll
call sub.kernel32.dll_LoadLibraryA
push str.VirtualProtect
push eax
call sub.kernel32.dll_GetProcAddress
mov edi, eax
push str.kernel32.dll
call sub.kernel32.dll_LoadLibraryA
push str.WaitForSingleObject
push eax
call sub.kernel32.dll_GetProcAddress
mov ebx, eax
push str.kernel32.dll
call sub.kernel32.dll_LoadLibraryA
push str.SetEvent
push eax
call sub.kernel32.dll_GetProcAddress
movd xmm0, dword [ebp - 0x18]
movd xmm1, dword [ebp - 0x14]
movd xmm3, dword [ebp - 0x10]
movd xmm2, edi
punpckldq xmm1, xmm0
punpckldq xmm3, xmm2
punpcklqdq xmm1, xmm3
pxor xmm3, xmm3
pcmpeqd xmm3, xmm1
movmskps ecx, xmm3
test ecx, ecx
jne 0x4080f5
test ebx, ebx
je 0x4080f5
test eax, eax
je 0x4080f5
push 0
push 0
push 1
push 0
call sub.kernel32.dll_CreateEventW
test eax, eax
je 0x4080f5
mov edi, eax
push dword [ebp + 8]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
jne 0x4080f5
push edi
call sub.kernel32.dll_SetEvent
push esi
call sub.kernel32.dll_DeleteTimerQueue
jmp 0x4080f5
Function at 0x409330
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov eax, dword fs:[0x18]
mov edi, esp
lea ebx, [esp + 0x14]
mov eax, dword [eax + 0x30]
mov esi, dword [eax + 0xc]
add esi, 0xc
nop word cs:[eax + eax]
nop dword [eax + eax]
mov esi, dword [esi]
cmp dword [esi + 0x18], 0
je 0x4093ff
mov eax, dword [esi + 0x30]
movzx ecx, word [esi + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
push 0
push edi
push ebx
call fcn.00408a80
add esp, 0xc
cmp byte [esp + 0x14], 4
jne 0x409407
cmp dword [esp + 0x18], 0xaddfe535
jne 0x409360
mov esi, dword [esi + 0x18]
mov ecx, esp
mov edx, esi
push 0xa2b1807f
call fcn.00409450
add esp, 4
mov ecx, esp
mov edx, esi
push 0xced7e31f
call fcn.00409450
add esp, 4
mov ecx, esp
mov edx, esi
push 0x91c3ed4a
call fcn.00409450
add esp, 4
mov ecx, esp
mov edx, esi
push 0xb2036547
call fcn.00409450
add esp, 4
mov ecx, esp
mov edx, esi
push 0xa596d8ce
call fcn.00409450
add esp, 4
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
movsd xmm0, qword [esp + 0x14]
movsd qword [esp + 0x1c], xmm0
lea edi, [esp + 0x1c]
push 0x56ff3c
push 0x56fe98
push edi
push 0
push 1
call fcn.004da120
add esp, 0x14
ud2
Function at 0x409450
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
movzx eax, word [edx]
mov edi, edx
xor edx, edx
cmp eax, 0x5a4d
jne 0x409591
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi], 0x4550
jne 0x409591
mov eax, dword [edi + eax + 0x78]
mov dword [esp + 4], ecx
mov esi, dword [eax + edi + 0x20]
mov edx, dword [eax + edi + 0x1c]
mov ecx, dword [eax + edi + 0x14]
mov ebx, dword [eax + edi + 0x18]
mov eax, dword [eax + edi + 0x24]
add eax, edi
add edx, edi
add esi, edi
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], edx
nop word cs:[eax + eax]
nop dword [eax]
cmp eax, dword [esp + 0x14]
je 0x40958b
mov ebx, eax
mov eax, dword [esi + eax*4]
mov ecx, 0xffffffff
add eax, edi
nop word cs:[eax + eax]
cmp byte [eax + ecx + 1], 0
lea ecx, [ecx + 1]
jne 0x4094e0
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
push 0
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00408a80
add esp, 0xc
cmp byte [esp + 0x18], 4
jne 0x40959b
mov ecx, dword [ebp + 8]
lea eax, [ebx + 1]
cmp dword [esp + 0x1c], ecx
jne 0x4094c0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
movzx eax, word [eax + ebx*2]
cmp ecx, eax
jbe 0x4095c4
mov ecx, dword [esp + 8]
mov edx, 0
mov eax, dword [ecx + eax*4]
mov ecx, dword [esp + 4]
cmp byte [eax + edi], 0x4c
jne 0x409591
add eax, edi
cmp byte [eax + 1], 0x8b
jne 0x409591
cmp byte [eax + 2], 0xd1
jne 0x409591
cmp byte [eax + 3], 0xb8
jne 0x409591
cmp byte [eax + 6], 0
jne 0x409591
cmp byte [eax + 7], 0
jne 0x409591
movzx edx, byte [eax + 4]
or dl, byte [eax + 5]
mov dword [ecx + 4], eax
movzx edx, dl
mov word [ecx + 8], dx
mov edx, 1
jmp 0x409591
mov ecx, dword [esp + 4]
xor edx, edx
mov dword [ecx], edx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
movsd xmm0, qword [esp + 0x18]
movsd qword [esp + 0x34], xmm0
lea edi, [esp + 0x34]
push 0x56ff3c
push 0x56fe98
push edi
push 0
push 1
call fcn.004da120
add esp, 0x14
ud2
push 0x56ff4c
push ecx
push eax
call fcn.004d9dd0
mov esi, eax
push edi
call fcn.00408f80
add esp, 4
push esi
call fcn.004f2f90
call fcn.004d9ee0
nop word cs:[eax + eax]
Function at 0x410330
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 0xc]
xor esi, esi
test ebx, ebx
je 0x41036b
push 2
push ebx
push dword [ebp + 8]
push 0
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, 0xc0000000
jb 0x41036b
mov edi, eax
push ebx
push dword [ebp + 8]
call sub.advapi32.dll_SystemFunction036
and edi, 0x7fffffff
xor esi, esi
test al, al
cmove esi, edi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x413260
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x10]
push eax
push 0x570c88
push 1
push 0
push 0x570c98
call sub.ole32.dll_CoCreateInstance
test eax, eax
js 0x4132c8
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x4132f8
cmp dword [esi], 0
je 0x4132b2
push esi
call fcn.00447310
add esp, 4
mov dword [esi], ebx
movsd xmm0, qword [esi + 8]
movsd xmm1, qword [esi]
movsd qword [edi + 8], xmm0
movsd qword [edi], xmm1
jmp 0x41332a
lea ebx, [ebp - 0x20]
push eax
call fcn.0044ef00
add esp, 4
cmp dword [ebp - 0x24], 0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x1c], 1
jne 0x4132f0
push ebx
call fcn.00447310
add esp, 4
cmp dword [ebp - 0x14], 0
jne 0x413313
jmp 0x41331f
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 1
cmp dword [ebp - 0x14], 0
je 0x41331f
lea eax, [ebp - 0x14]
push eax
call fcn.0044ecd0
add esp, 4
mov byte [edi + 0xc], 2
mov ecx, esi
call fcn.00412380
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x413600
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
cmp dword [edx + 4], 0
mov esi, edx
mov edi, ecx
je 0x4136a3
mov dword [ebp - 0x10], edi
lea edi, [esi + 4]
push 0x570cba
call sub.oleaut32.dll_SysAllocString
mov ebx, eax
mov dword [ebp - 0x18], eax
push str.SELECT__FROM_MSAcpi_ThermalZoneTemperature
call sub.oleaut32.dll_SysAllocString
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x30]
lea ecx, [ebp - 0x18]
push 0
push 0x30
push edx
push ecx
push edi
push eax
call fcn.00428130
add esp, 0x18
push ebx
call sub.oleaut32.dll_SysFreeString
push dword [ebp - 0x14]
call sub.oleaut32.dll_SysFreeString
mov eax, dword [ebp - 0x28]
movsd xmm0, qword [ebp - 0x30]
mov dword [ebp - 0x1c], eax
movsd qword [ebp - 0x24], xmm0
lea eax, [ebp - 0x14]
push eax
call fcn.00446df0
add esp, 4
lea eax, [ebp - 0x18]
push eax
call fcn.00446df0
add esp, 4
mov edi, dword [ebp - 0x10]
cmp dword [ebp - 0x24], 0
je 0x4136b0
cmp dword [ebp - 0x1c], 0
je 0x4136a3
lea eax, [ebp - 0x1c]
push eax
call fcn.0044ecd0
add esp, 4
mov byte [edi + 0xc], 2
mov ecx, esi
call fcn.00412380
jmp 0x4136dd
mov ebx, dword [ebp - 0x20]
cmp dword [esi + 8], 0
je 0x4136c5
lea edi, [esi + 8]
push edi
call fcn.00447310
add esp, 4
mov dword [esi + 8], ebx
mov eax, dword [ebp - 0x10]
movsd xmm0, qword [esi]
movsd xmm1, qword [esi + 8]
movsd qword [eax], xmm0
movsd qword [eax + 8], xmm1
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41f000
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov esi, ecx
lea eax, [ebp - 0x24]
push eax
push edx
call sub.shell32.dll_CommandLineToArgvW
test eax, eax
mov dword [ebp - 0x1c], eax
je 0x41f0c2
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x10], 0
test ebx, ebx
je 0x41f0a6
mov edi, dword [ebp - 0x1c]
shl ebx, 2
jmp 0x41f079
mov eax, dword [ebp - 0x14]
movsd xmm0, qword [ebp - 0x34]
movsd xmm1, qword [ebp - 0x2c]
mov ecx, esi
add edi, 4
inc esi
shl ecx, 4
add ebx, 0xfffffffc
movsd qword [eax + ecx + 8], xmm1
movsd qword [eax + ecx], xmm0
mov dword [ebp - 0x10], esi
je 0x41f0a6
push edi
call fcn.0044d500
add esp, 4
push edx
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.0048e920
add esp, 0xc
mov esi, dword [ebp - 0x10]
cmp esi, dword [ebp - 0x18]
jne 0x41f050
lea eax, [ebp - 0x18]
push eax
call fcn.00422f10
add esp, 4
jmp 0x41f050
push dword [ebp - 0x1c]
call sub.kernel32.dll_LocalFree
movsd xmm0, qword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
movsd qword [ecx], xmm0
mov dword [ecx + 8], eax
jmp 0x41f0d6
mov dword [esi], 0
mov dword [esi + 4], 4
mov dword [esi + 8], 0
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x420350
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
movzx ebx, byte [ebp + 0x10]
mov esi, dword [ebp + 8]
cmp byte [ebp + 0xc], 0
je 0x4203d0
xorps xmm0, xmm0
lea eax, [esp + 0x10]
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp + 0x40], xmm0
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x20], xmm0
mov dword [esp + 0x10], 0x40
push eax
call sub.kernel32.dll_GlobalMemoryStatusEx
test eax, eax
je 0x4203a1
movups xmm0, xmmword [esp + 0x18]
movups xmmword [esi + 0x40], xmm0
jmp 0x4203d0
call fcn.0044ed20
movups xmm0, xmmword [esp + 0x18]
test edx, edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 4], 1
movups xmmword [esi + 0x40], xmm0
je 0x4203d0
lea eax, [esp + 0xc]
push eax
call fcn.0044ecd0
add esp, 4
test bl, bl
je 0x420439
xorps xmm0, xmm0
lea eax, [esp + 0x10]
movsd qword [esp + 0x40], xmm0
xorps xmm0, xmm0
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
push 0x38
push eax
call sub.kernel32.dll_K32GetPerformanceInfo
test eax, eax
je 0x420439
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x38]
xor ecx, ecx
mov edx, 0
sub eax, edi
sbb edx, edx
cmovb eax, ecx
mul ebx
mov dword [esi + 0x50], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x54], edx
mov edx, 0
sub eax, edi
sbb edx, edx
cmovb eax, ecx
mul ebx
mov dword [esi + 0x5c], edx
mov dword [esi + 0x58], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x421410
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x10], 0
lea edi, [ebp - 0x10]
push edi
push 0
push 5
call sub.kernel32.dll_GetComputerNameExW
xor ecx, ecx
test eax, eax
jne 0x421443
call fcn.0044ed20
mov ecx, 1
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
test ebx, ebx
je 0x4214a4
lea esi, [ebx + ebx]
cmp ebx, 0x3fffffff
ja 0x42157d
push 2
push esi
call fcn.00409ad0
add esp, 8
test eax, eax
je 0x421581
mov edi, eax
lea eax, [ebp - 0x10]
push eax
push edi
push 5
call sub.kernel32.dll_GetComputerNameExW
test eax, eax
je 0x421517
xor eax, eax
nop word [eax + eax]
cmp word [edi + eax*2], 0
je 0x42149f
inc eax
add esi, 0xfffffffe
jne 0x421490
mov eax, ebx
mov esi, dword [ebp + 8]
jmp 0x4214b9
push edi
push 2
push 5
call sub.kernel32.dll_GetComputerNameExW
test eax, eax
je 0x42151c
xor eax, eax
mov edi, 2
lea ecx, [ebp - 0x28]
push eax
push edi
push ecx
call fcn.004d0140
add esp, 0xc
cmp dword [ebp - 0x28], 0x80000000
jne 0x4214dc
mov dword [esi], 0x80000000
test ebx, ebx
jne 0x4214ef
jmp 0x4214fd
mov eax, dword [ebp - 0x20]
movsd xmm0, qword [ebp - 0x28]
mov dword [esi + 8], eax
movsd qword [esi], xmm0
test ebx, ebx
je 0x4214fd
add ebx, ebx
push 2
push ebx
push edi
call main
add esp, 0xc
cmp dword [ebp - 0x1c], 0
je 0x421573
cmp dword [ebp - 0x14], 0
je 0x421573
lea eax, [ebp - 0x14]
push eax
call fcn.0044ecd0
add esp, 4
jmp 0x421573
mov esi, dword [ebp + 8]
jmp 0x421521
mov edi, 2
call fcn.0044ed20
test edx, edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x28], 1
je 0x421543
lea eax, [ebp - 0x20]
push eax
call fcn.0044ecd0
add esp, 4
test ebx, ebx
je 0x421555
add ebx, ebx
push 2
push ebx
push edi
call main
add esp, 0xc
cmp dword [ebp - 0x1c], 0
je 0x42156d
cmp dword [ebp - 0x14], 0
je 0x42156d
lea eax, [ebp - 0x14]
push eax
call fcn.0044ecd0
add esp, 4
mov dword [esi], 0x80000000
mov eax, esi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x421586
mov eax, 2
push esi
push eax
call fcn.004ce340
add esp, 8
ud2
Function at 0x4218e0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [ebp + 8]
call 0x4218f1
pop edi
lea ebx, [ebp - 0x30]
push ebx
call fcn.00444010
add esp, 4
push ebx
call sub.kernel32.dll_GetSystemInfo
movzx eax, word [ebp - 0x30]
cmp eax, 0xe
ja 0x421aff
add edi, dword [eax*4 + 0x421b3c]
jmp edi
mov dword [esi], 0x80000000
mov eax, esi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x429850
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 8]
mov esi, dword [eax]
test esi, esi
je 0x4298d9
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x4298d1
je 0x429886
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x42988a
mov edi, dword [eax]
mov dword [eax], 0
test edi, edi
je 0x42988c
mov edi, dword [eax + 4]
jmp 0x42988c
xor eax, eax
jmp 0x4298d1
xor edi, edi
mov eax, dword [0x593ab0]
movzx eax, byte [eax]
push 4
push 8
call fcn.00409a80
add esp, 8
test eax, eax
je 0x4298f5
mov dword [eax], edi
mov dword [eax + 4], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x4298ce
push 4
push 8
push edi
call main
add esp, 0xc
mov eax, dword [ebp - 0x10]
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call fcn.004ab560
add esp, 4
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x42986c
jmp 0x4298d1
push 8
push 4
call fcn.004ce360
nop

Function at 0x429900
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 8]
mov esi, dword [eax]
test esi, esi
je 0x4299c8
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x4299c0
je 0x4299be
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x42993f
mov edi, dword [eax + 4]
cmp dword [eax], 0
mov dword [eax], 0
jne 0x42994f
call fcn.0045cc90
push eax
call fcn.0045bfc0
add esp, 4
mov edi, eax
mov eax, dword [0x593ab0]
movzx eax, byte [eax]
push 4
push 8
call fcn.00409a80
add esp, 8
test eax, eax
je 0x4299e4
mov dword [eax], edi
mov dword [eax + 4], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x4299b9
mov eax, dword [edi]
mov ecx, dword [eax + 0x410]
lea edx, [ecx - 1]
mov dword [eax + 0x410], edx
cmp dword [eax + 0x40c], 0
jne 0x4299ac
cmp ecx, 1
jne 0x4299ac
push eax
call fcn.0045b020
add esp, 4
push 4
push 8
push edi
call main
add esp, 0xc
mov eax, dword [ebp - 0x10]
jmp 0x4299c0
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call fcn.004ab560
add esp, 4
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x429924
jmp 0x4299c0
push 8
push 4
call fcn.004ce360
add esp, 8
ud2
Function at 0x429a40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [ebp + 8]
mov esi, dword [eax]
test esi, esi
je 0x429b11
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x429b09
je 0x429b07
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x429a96
mov ecx, dword [eax + 4]
mov edi, dword [eax + 8]
cmp dword [eax], 0
mov dword [eax], 0
je 0x429a96
mov eax, edi
mov ebx, edi
mov dword [ebp - 0x10], ecx
shr eax, 0x10
shr ebx, 0x18
mov dword [ebp - 0x14], eax
jmp 0x429aa6
mov dword [ebp - 0x14], 0
xor edi, edi
mov dword [ebp - 0x10], 0
mov eax, dword [0x593ab0]
movzx eax, byte [eax]
push 4
push 0xc
call fcn.00409a80
add esp, 8
test eax, eax
je 0x429b2d
movzx edx, byte [ebp - 0x14]
movzx ecx, bl
shl ecx, 0x18
shl edx, 0x10
or edx, ecx
movzx ecx, di
or ecx, edx
mov edx, dword [ebp - 0x10]
mov dword [eax + 4], ecx
mov dword [eax], edx
mov dword [eax + 8], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x429b02
push 4
push 0xc
push edi
call main
add esp, 0xc
mov eax, dword [ebp - 0x10]
jmp 0x429b09
xor eax, eax
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call fcn.004ab560
add esp, 4
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x429a66
jmp 0x429b09
push 0xc
push 4
call fcn.004ce360
nop word cs:[eax + eax]

Function at 0x429b40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [ebp + 8]
mov esi, dword [eax]
test esi, esi
je 0x429c02
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x429bfa
je 0x429bf8
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x429b8e
mov ecx, dword [eax]
movups xmm0, xmmword [eax + 8]
mov dword [eax], 0
or ecx, dword [eax + 4]
mov dword [eax + 4], 0
jne 0x429ba8
xorps xmm0, xmm0
lea eax, [esp + 0x10]
movaps xmmword [esp + 0x10], xmm0
push 0x10
push eax
call dword [sym.imp.bcryptprimitives.dll_ProcessPrng]
movaps xmm0, xmmword [esp + 0x10]
mov eax, dword [0x593ab0]
movaps xmmword [esp], xmm0
movzx eax, byte [eax]
push 8
push 0x18
call fcn.00409a80
add esp, 8
test eax, eax
je 0x429c1e
movaps xmm0, xmmword [esp]
movups xmmword [eax], xmm0
mov dword [eax + 0x10], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [esp], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x429bf3
push 8
push 0x18
push edi
call main
add esp, 0xc
mov eax, dword [esp]
jmp 0x429bfa
xor eax, eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call fcn.004ab560
add esp, 4
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x429b69
jmp 0x429bfa
push 0x18
push 8
call fcn.004ce360
nop word [eax + eax]