joyce8/EMBER2024-capa huggingface dataset:
Function at 0xde03c8
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00de0518
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xde03ee
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xde03da
add dl, dl
jne 0xde03f9
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xde044c
xor eax, eax
add dl, dl
jne 0xde0406
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xde04ed
add dl, dl
jne 0xde0415
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xde0420
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xde042b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xde0436
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xde0442
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xde03e5
mov eax, 1
add dl, dl
jne 0xde045a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xde0465
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xde0451
sub eax, ebx
mov ebx, 1
jne 0xde0498
mov ecx, 1
add dl, dl
jne 0xde047e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xde0489
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xde0475
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xde03e5
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xde04af
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xde04ba
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xde04a6
cmp eax, 0x7d00
jae 0xde04dd
cmp eax, 0x500
jb 0xde04d8
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xde03e5
cmp eax, 0x7f
ja 0xde04e0
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xde03e5
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xde050e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xde03e5
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x2e013ece
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x2e03021f
call fcn.2e00153c
mov edi, ecx
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov byte [edi], bl
mov dword [ebp - 4], ebx
call fcn.2e014c10
test ax, ax
je 0x2e013f76
lea eax, [ebp - 0x10]
push eax
push str.softwaremicrosoftwindows_shell_associationsurlassociationshttpuserchoice
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e013f76
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push str.progid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e013f6d
mov eax, dword [ebp - 0x14]
inc eax
push eax
call fcn.2e014e48
mov esi, eax
pop ecx
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
push esi
push ebx
push ebx
push str.progid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e013f60
push esi
mov ecx, edi
call fcn.2e010c49
push 1
push esi
mov byte [ebp - 4], bl
call fcn.2e014e48
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
call fcn.2e001586
ret

Function at 0x2e0149fe
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x2e030292
call fcn.2e02e16c
mov esi, dword [ebp + 8]
xor eax, eax
mov bl, al
mov edi, dword [ebp + 0xc]
cmp dword [ecx + 0x10], eax
jbe 0x2e014b02
push ecx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
call fcn.2e0148ed
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push esi
call fcn.2e010b76
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x30]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014ac0
lea eax, [ebp - 0x2c]
push eax
push 0
push 0x2e032941
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e014ab7
mov eax, dword [ebp - 0x2c]
inc eax
push eax
call fcn.2e014e48
mov esi, eax
pop ecx
mov dword [ebp - 0x34], esi
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
push eax
push esi
push 0
push 0
push 0x2e032941
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014aa9
push esi
mov ecx, edi
call fcn.2e010c49
mov bl, 1
push 1
push esi
mov byte [ebp - 4], 0
call fcn.2e014e48
pop ecx
pop ecx
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x2e014b02
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 4], 2
cmp eax, 0x1000
jb 0x2e014af9
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.2e014e48
mov eax, dword [ebp - 0x2c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x34]
push eax
push ecx
call fcn.2e014e48
pop ecx
pop ecx
mov al, bl
call fcn.2e02e14a
ret 8
Function at 0x2e014b3c
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x2e0302bf
call fcn.2e00153c
lea eax, [ebp - 0x10]
xor ebx, ebx
push eax
push dword [ebp + 8]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x2e014b76
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014bdc
lea eax, [ebp - 0x14]
mov edi, 0x2e032941
push eax
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e014bd3
mov eax, dword [ebp - 0x14]
test eax, eax
js 0x2e014bd3
inc eax
push eax
call fcn.2e014e48
mov esi, eax
pop ecx
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x14]
mov dword [ebp - 4], ebx
push eax
push esi
push ebx
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014bc5
mov ecx, dword [ebp + 0xc]
push esi
call fcn.2e010c49
mov bl, 1
or dword [ebp - 4], 0xffffffff
push 1
push esi
call fcn.2e014e48
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
call fcn.2e001586
ret 8

Function at 0x2e014e48
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x2e014e57
pop dword [ebp - 8]
mov eax, 0x848c73aa
sub eax, 0x568b2553
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x92281e9e
add dword [ebp - 0x18], 0xbc2a26ad
mov dword [ebp - 0x14], 0x880db572
add dword [ebp - 0x14], 0xaa2596d3
mov dword [ebp - 0x10], 0xc5e98255
sub dword [ebp - 0x10], 0x799d3e27
mov dword [ebp - 0xc], 0x379d96c1
sub dword [ebp - 0xc], 0x379d96c1
lea eax, [ebp - 0x18]
push eax
mov eax, 0x9d659b64
sub eax, 0x6f627a9c
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xdc67dee5
sub dword [ebp - 0x18], 0x67f5758f
mov dword [ebp - 0x14], 0xdb1bdbf9
add dword [ebp - 0x14], 0x6650857c
mov dword [ebp - 0x10], 0x6c2f54a4
sub dword [ebp - 0x10], 0x8bfe838
mov dword [ebp - 0xc], 0xe376f704
sub dword [ebp - 0xc], 0xe376f704
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x38d627bc
add eax, 0xf52cf900
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3f939
push 0
call eax
mov ecx, 0xbe0ccd2d
sub ecx, 0xbe0c8b26
xor ebx, ebx
add ebx, eax
mov edx, 0x2e056e00
add edx, dword [ebp - 8]
mov edi, 0xa2f2b16a
sub dword [ebp - 4], 0x7c41ffd0
mov esi, dword [edx]
xor esi, edi
sub dword [ebp - 4], eax
mov dword [ebx], esi
xor dword [ebp - 4], 0x544ee17a
add ebx, 0x793297e3
add ebx, 0x86cd6821
add edx, 0x95e65835
sub edx, 0x95e65831
loop 0x2e014f6f
add eax, 0x54847dd8
add eax, 0xab7c7d17
mov ebx, eax
add eax, 5
mov ecx, 0x2e000000
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x2e01e341
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x2e030586
call fcn.2e02e16c
lea eax, [ebp - 0x2c]
xor ebx, ebx
push eax
push str.softwaremicrosoftwindows_shell_associationsurlassociationshttpuserchoice
push 0x80000001
mov edi, ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e01e45f
lea eax, [ebp - 0x30]
push eax
push ebx
push ebx
push ebx
push str.progid
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e01e456
mov eax, dword [ebp - 0x30]
inc eax
push eax
call fcn.2e014e48
mov esi, eax
pop ecx
mov dword [ebp - 0x3c], esi
lea eax, [ebp - 0x30]
mov dword [ebp - 4], ebx
push eax
push esi
push ebx
push ebx
push str.progid
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor ecx, ecx
inc ecx
test eax, eax
jne 0x2e01e449
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.2e010c49
push str.IE.HTTP
lea ecx, [ebp - 0x28]
call fcn.2e014e48
test al, al
jne 0x2e01e3fc
push ebx
push str.AppX
lea ecx, [ebp - 0x28]
call fcn.2e014e48
push 1
test eax, eax
pop edx
cmove edi, edx
jmp 0x2e01e3ff
xor edx, edx
inc edx
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x2e01e439
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
mov byte [ebp - 4], dl
cmp eax, 0x1000
jb 0x2e01e430
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.2e014e48
mov eax, dword [ebp - 0x34]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x38]
push eax
push ecx
call fcn.2e014e48
pop ecx
pop ecx
xor ecx, ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
inc ecx
mov byte [ebp - 0x28], bl
or dword [ebp - 4], 0xffffffff
push ecx
push esi
call fcn.2e014e48
pop ecx
pop ecx
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ax, di
call fcn.2e02e14a
ret
Function at 0x40b44b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x40b45a
pop dword [ebp - 0x20]
mov eax, 0xe7c53a73
add eax, 0x187b79e7
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x3d7e1
push 0
mov eax, 0xe77856cd
sub eax, 0xe73684cd
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0xe6797642
add ecx, 0x1986d29d
mov edx, eax
mov edi, 0x436000
add edi, dword [ebp - 0x20]
mov esi, 0x29bf390
add esi, 0x28ea0214
xor dword [ebp - 0x10], ebx
mov ebx, dword [edi]
sub ebx, esi
xor dword [ebp - 0x1c], ebx
mov dword [edx], ebx
sub dword [ebp - 0x1c], 0x2e61941b
add edx, 0xd28e9aa7
sub edx, 0xd28e9aa3
add edi, 0x1cc68324
add edi, 0xe3397ce0
loop 0x40b4b3
add eax, 0xbae5ee50
add eax, 0x451b27ff
mov ebx, eax
add eax, 0x8cf5dcc0
sub eax, 0x8cf5dcbb
mov ecx, 0xbc514937
sub ecx, 0xbc114937
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x4025b8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp], 0x26
mov eax, dword [sym.imp.USER32.dll_GetAsyncKeyState]
call eax
sub esp, 4
test ax, ax
js 0x4025ea
mov dword [esp], 0x57
mov eax, dword [sym.imp.USER32.dll_GetAsyncKeyState]
call eax
sub esp, 4
test ax, ax
jns 0x4025f1
mov eax, 1
jmp 0x4025f6
mov eax, 0
test al, al
je 0x40261e
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x2584]
cmp eax, 1
je 0x40272d
mov eax, dword [ebp + 8]
mov dword [eax + 0x2584], 0
jmp 0x40272d
mov dword [esp], 0x28
mov eax, dword [sym.imp.USER32.dll_GetAsyncKeyState]
call eax
sub esp, 4
test ax, ax
js 0x40264a
mov dword [esp], 0x53
mov eax, dword [sym.imp.USER32.dll_GetAsyncKeyState]
call eax
sub esp, 4
test ax, ax
jns 0x402651
mov eax, 1
jmp 0x402656
mov eax, 0
test al, al
je 0x40267d
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x2584]
test eax, eax
je 0x40272d
mov eax, dword [ebp + 8]
mov dword [eax + 0x2584], 1
jmp 0x40272d
mov dword [esp], 0x25
mov eax, dword [sym.imp.USER32.dll_GetAsyncKeyState]
call eax
sub esp, 4
test ax, ax
js 0x4026a9
mov dword [esp], 0x41
mov eax, dword [sym.imp.USER32.dll_GetAsyncKeyState]
call eax
sub esp, 4
test ax, ax
jns 0x4026b0
mov eax, 1
jmp 0x4026b5
mov eax, 0
test al, al
je 0x4026d6
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x2584]
cmp eax, 3
je 0x40272d
mov eax, dword [ebp + 8]
mov dword [eax + 0x2584], 2
jmp 0x40272d
mov dword [esp], 0x27
mov eax, dword [sym.imp.USER32.dll_GetAsyncKeyState]
call eax
sub esp, 4
test ax, ax
js 0x402702
mov dword [esp], 0x44
mov eax, dword [sym.imp.USER32.dll_GetAsyncKeyState]
call eax
sub esp, 4
test ax, ax
jns 0x402709
mov eax, 1
jmp 0x40270e
mov eax, 0
test al, al
je 0x40272d
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x2584]
cmp eax, 2
je 0x40272d
mov eax, dword [ebp + 8]
mov dword [eax + 0x2584], 3
leave
ret

Function at 0x402d90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
movzx edx, word [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push ebx
xor ebx, ebx
mov esi, esi
mov eax, edx
xor ecx, ecx
and eax, 1
test al, al
je 0x402dbc
nop
lea esi, [esi]
shr edx, 1
inc ecx
mov eax, edx
and eax, 1
test al, al
jne 0x402db0
mov dword [esi + ebx*4], ecx
inc ebx
test edx, edx
je 0x402de3
mov al, dl
xor ecx, ecx
xor al, 1
and al, 1
test al, al
je 0x402ddd
shr edx, 1
inc ecx
mov al, dl
xor al, 1
and al, 1
test al, al
jne 0x402dd0
mov dword [esi + ebx*4], ecx
inc ebx
jmp 0x402da0
mov edx, 0x10
sub edx, ecx
mov dword [esi + ebx*4], edx
inc ebx
mov eax, ebx
pop ebx
pop esi
pop ebp
ret

Function at 0x414ce0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._vfprintf
call sym._abort
jmp dbg.mark_section_writable
Function at 0x414d40
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x4997f8]
test esi, esi
jle 0x414e2d
mov edi, dword [0x4997fc]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x414d74
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x414e26
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x414d60
mov dword [esp], eax
mov ebx, eax
call dbg.__mingw_GetSectionForAddress
test eax, eax
mov edi, eax
je 0x414e6a
lea ebx, [esi + esi*2]
mov esi, dword [0x4997fc]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call dbg._GetPEImageBase
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x4997fc]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x414e4a
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x414e1f
sub eax, 0x40
and eax, 0xffffffbf
je 0x414e1f
mov eax, dword [esp + 0x20]
add ebx, dword [0x4997fc]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x414e34
add dword [0x4997f8], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor esi, esi
jmp 0x414d7e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
mov eax, dword [0x4997fc]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]

Function at 0x415330
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x499bc8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x499bc0]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x415385
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x41537e
test esi, esi
je 0x41537e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x415360
mov dword [esp], 0x499bc8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4155a0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x4155d8
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x4155ce
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x4155da
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x4155c0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x416a10
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call sym._strlen
mov esi, eax
lea eax, [eax + 0x41]
and eax, 0xfffffff0
call fcn.004158b0
mov edx, 0x326d
sub esp, eax
lea eax, [esp + 0x1b]
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
lea edi, [esp + 0xc]
mov word [esp + 0x18], dx
mov dword [esp + 0xc], 0x2d636367
mov dword [esp], eax
mov dword [esp + 0x10], 0x656d6873
mov dword [esp + 0x14], 0x64742d6d
mov byte [esp + 0x1a], 0x2d
call sym._memcpy
lea eax, [esi + 0x10]
lea edx, [edi + eax]
mov dword [ebp - 0x20], eax
mov dword [edx], 0x61616161
mov dword [edx + 4], 0x61616161
mov dword [edx + 8], 0x61616161
mov dword [edx + 0xc], 0x61616161
mov dword [edx + 0x10], 0x61616161
mov dword [edx + 0x14], 0x61616161
mov dword [edx + 0x18], 0x61616161
mov dword [edx + 0x1c], 0x61616161
mov dword [ebp - 0x24], edx
mov byte [esp + esi + 0x3c], 0
mov byte [esp + esi + 0x1b], 0
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
sub esp, 0xc
mov byte [edi + esi + 0xf], 0x2d
mov dword [ebp - 0x1c], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
mov edx, dword [ebp - 0x24]
je 0x416aff
int3
mov dword [ebp - 0x24], edx
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_FindAtomA]
sub esp, 4
test ax, ax
mov edx, dword [ebp - 0x24]
jne 0x416ba3
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], edx
mov dword [esp], eax
call sym._malloc
mov edx, dword [ebp - 0x24]
mov ebx, eax
mov eax, 0x20
bt ebx, eax
jae 0x416b3a
mov byte [edx], 0x41
add edx, 1
sub eax, 1
jne 0x416b32
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_AddAtomA]
sub esp, 4
test ax, ax
je 0x416ba0
lea ecx, [esi + 0x31]
mov esi, dword [ebp - 0x20]
movzx eax, ax
mov edx, edi
mov dword [esp], esi
call dbg.get_ptr_from_atom
cmp eax, ebx
mov esi, eax
je 0x416bba
mov dword [esp], ebx
call sym._free
mov edi, dword [ebp - 0x1c]
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
int3
lea ecx, [esi + 0x31]
mov esi, dword [ebp - 0x20]
movzx eax, ax
mov edx, edi
mov dword [esp], esi
call dbg.get_ptr_from_atom
mov esi, eax
jmp 0x416b74
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [esp + 8], eax
call sym._memset
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x416b74
mov dword [esp], ebx
call dword [ebp + 0x10]
jmp 0x416b74
Function at 0x423730
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [0x49a610]
test ebx, ebx
je 0x423760
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [ebx], eax
mov eax, dword [0x49a610]
test eax, eax
je 0x423785
cmp dword [eax], 0xffffffff
je 0x4237a8
add esp, 0x18
pop ebx
ret
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov ebx, eax
mov dword [0x49a610], eax
jmp 0x42373e
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x49a610], eax
jmp 0x42374f
call sym._abort
lea esi, [esi]
Function at 0x423c40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [0x49a614]
test eax, eax
je 0x423d94
call sym.__pthread_once_raw.constprop.5
mov eax, dword [0x49a610]
test eax, eax
je 0x423dc0
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x423c80
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
call sym._pop_pthread_mem
test eax, eax
mov ebx, eax
je 0x423e0c
mov eax, dword [entry3]
test eax, eax
je 0x423e0c
mov dword [ebx + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 0x38], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
sub esp, 0x10
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], 0xffffffff
mov dword [ebx + 0x34], 0xffffffff
mov dword [ebx + 0x60], 0
mov dword [ebx + 0x14], 0
call esi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, eax
call esi
mov edx, eax
lea eax, [ebx + 0x14]
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebp
mov dword [esp + 4], edi
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
sub esp, 0x1c
test eax, eax
je 0x423e13
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [ebx + 0x68], eax
movzx eax, byte [ebx + 0x20]
sub esp, 4
mov dword [ebx + 0x64], 0
and eax, 0xffffffcf
or eax, 0x10
mov byte [ebx + 0x20], al
mov eax, dword [0x49a610]
test eax, eax
je 0x423de6
mov dword [esp + 4], ebx
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x423e13
mov eax, ebx
jmp 0x423c78
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_once_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x49a614], eax
jmp 0x423c54
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x49a610], eax
jmp 0x423c66
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x49a610], eax
jmp 0x423d73
xor eax, eax
jmp 0x423c78
call sym._abort
nop
lea esi, [esi]