joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414f85
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0x10
mov eax, 0x43587d
call fcn.0041aaa7
mov esi, ecx
mov dword [ebp - 0x14], esi
lea eax, [esi + 0x1c]
push eax
mov dword [ebp - 0x18], eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov ebx, dword [ebp + 8]
test ebx, ebx
jle 0x41508f
cmp ebx, dword [esi + 0xc]
jge 0x41508f
push dword [esi]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov edi, eax
test edi, edi
je 0x414fdc
cmp ebx, dword [edi + 8]
jl 0x41507d
cmp dword [ebp + 0xc], 0
je 0x41507d
xor ebx, ebx
jmp 0x415016
xor ebx, ebx
push 0x10
mov dword [ebp - 4], ebx
call main
mov edi, eax
test edi, edi
je 0x414ff6
mov dword [edi], vtable.CThreadData.0
jmp 0x414ff8
mov edi, ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [esi + 0x14]
push edi
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
call main
mov ecx, dword [esi + 0x14]
mov dword [eax], ecx
mov dword [esi + 0x14], edi
mov esi, dword [ebp - 0x14]
cmp dword [edi + 0xc], ebx
jne 0x415031
push 4
push dword [esi + 0xc]
call main
pop ecx
pop ecx
push eax
push ebx
call dword [sym.imp.kernel32.dll_LocalAlloc]
jmp 0x415049
push 2
push 4
push dword [esi + 0xc]
call main
pop ecx
pop ecx
push eax
push dword [edi + 0xc]
call dword [sym.imp.kernel32.dll_LocalReAlloc]
mov edx, eax
test edx, edx
je 0x4150b6
mov ecx, dword [edi + 8]
mov dword [edi + 0xc], edx
mov eax, dword [esi + 0xc]
sub eax, ecx
shl eax, 2
push eax
lea eax, [edx + ecx*4]
push ebx
push eax
call fcn.0041bf90
mov eax, dword [esi + 0xc]
add esp, 0xc
mov dword [edi + 8], eax
push edi
push dword [esi]
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ebx, dword [ebp + 8]
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x41508f
cmp ebx, dword [edi + 8]
jge 0x41508f
mov eax, dword [ebp + 0xc]
mov dword [ecx + ebx*4], eax
push dword [ebp - 0x18]
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
call fcn.0041aa05
ret 8
push dword [ebp - 0x18]
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
call main
int3
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x4085a6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x4085b5
pop dword [ebp - 0x24]
mov eax, 0xfe9c2d67
sub eax, 0xfe5ba7b2
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x26baca3a
sub dword [ebp - 0x34], 0xd86884ef
mov dword [ebp - 0x30], 0xfbd1b4cd
sub dword [ebp - 0x30], 0xc99e6888
mov dword [ebp - 0x2c], 0x5238831
add dword [ebp - 0x2c], 0x4728bbfd
mov dword [ebp - 0x28], 0x738b20d7
sub dword [ebp - 0x28], 0x738b20d7
lea eax, [ebp - 0x34]
push eax
mov eax, 0x28fc684a
sub eax, 0x28ba37d6
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x8bca5c5b
add dword [ebp - 0x34], 0xe8a80cfb
mov dword [ebp - 0x30], 0x8a699a76
sub dword [ebp - 0x30], 0x48fd3901
mov dword [ebp - 0x2c], 0xf6fe0c2d
sub dword [ebp - 0x2c], 0x938e9fc1
mov dword [ebp - 0x28], 0x1ae74c1d
add dword [ebp - 0x28], 0xe518b3e3
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x7c6b24b7
add eax, 0x83d70c6d
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3ee7c
push 0
call eax
mov ecx, 0x4cc4
mov edi, eax
mov ebx, 0xb74ce41b
add ebx, 0x48f65fe5
add ebx, dword [ebp - 0x24]
mov esi, 0xfb9672ea
add esi, 0x7349d34
mov dword [ebp - 4], 0x13734685
mov edx, dword [ebx]
sub dword [ebp - 0xc], edx
xor edx, esi
mov dword [edi], edx
sub dword [ebp - 0x10], ecx
add edi, 4
add ebx, 0x36d881f0
sub ebx, 0x36d881ec
loop 0x4086d1
add eax, 0x1f31bf89
add eax, 0xe0cf665a
mov ebx, eax
add eax, 0xd2d3383d
sub eax, 0xd2d33838
mov ecx, 0x226302bd
sub ecx, 0x222302bd
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x40145b
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
jmp 0x418500
push esi
xor esi, esi
cmp dword [esp + 0xc], esi
jbe 0x41864c
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDisablePredefinedCacheEx]
push edi
mov edi, dword [esp + 0x10]
call ebx
add byte [esi + edi], 0x65
call ebx
add byte [esi + edi], 0xc9
call ebx
xor byte [esi + edi], 6
call ebx
add byte [esi + edi], 0x36
call ebx
add byte [esi + edi], 0x40
call ebx
add byte [esi + edi], 0x54
call ebx
add byte [esi + edi], 0x47
call ebx
xor byte [esi + edi], 0x12
call ebx
add byte [esi + edi], 0x44
call ebx
add byte [esi + edi], 0x4b
call ebx
xor byte [esi + edi], 0xca
call ebx
add byte [esi + edi], 0xc9
call ebx
add byte [esi + edi], 0x3a
call ebx
add byte [esi + edi], 0x76
call ebx
add byte [esi + edi], 0xb2
call ebx
add byte [esi + edi], 0xf
call ebx
xor byte [esi + edi], 0x61
call ebx
add byte [esi + edi], 0xb3
call ebx
add byte [esi + edi], 0x96
call ebx
add byte [esi + edi], 0x2e
call ebx
add byte [esi + edi], 0xdf
call ebx
add byte [esi + edi], 0x97
call ebx
add byte [esi + edi], 0x8e
call ebx
add byte [esi + edi], 0xde
call ebx
add byte [esi + edi], 7
call ebx
xor byte [esi + edi], 0xb
call ebx
add byte [esi + edi], 0x12
call ebx
add byte [esi + edi], 0xcb
call ebx
add byte [esi + edi], 0x5c
call ebx
add byte [esi + edi], 0xf2
call ebx
add byte [esi + edi], 0x6b
call ebx
xor byte [esi + edi], 0xb2
call ebx
xor byte [esi + edi], 0x8e
call ebx
xor byte [esi + edi], 0x54
call ebx
add byte [esi + edi], 0xcf
call ebx
add byte [esi + edi], 0xef
call ebx
xor byte [esi + edi], 0x89
call ebx
add byte [esi + edi], 0x42
call ebx
add byte [esi + edi], 0x24
call ebx
xor byte [esi + edi], 0x23
call ebx
add byte [esi + edi], 0x7a
call ebx
xor byte [esi + edi], 0x61
call ebx
add byte [esi + edi], 0xf3
call ebx
xor byte [esi + edi], 0x7c
call ebx
add byte [esi + edi], 4
call ebx
xor byte [esi + edi], 0x55
call ebx
add byte [esi + edi], 0xae
call ebx
add byte [esi + edi], 0xac
call ebx
add byte [esi + edi], 0xe2
inc esi
cmp esi, dword [esp + 0x14]
jb 0x418519
pop edi
pop ebx
pop esi
ret

Function at 0x40267b
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
jmp 0x418fe2
push esi
push edi
push 1
call dword [sym.imp.USER32.dll_GetClipCursor]
call dword [sym.imp.KERNEL32.dll_FreeConsole]
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x6087c8], eax
pop edi
pop esi
ret
Function at 0x4042ae
Capabilities:
Encode data using xor

Disassembly:
adc edx, dword [ebx + 0x49d92152]
call 0x404197
xor ecx, ecx
sub ecx, 0xffffff82
call 0x4042ae
rcr byte [esi - 0x7f], 0x76
push cs
adc dword [ebx], 0xee8369ee
cld
xor dword [esi + 0xe], 0x69ee1381
sub esi, 0xfffffffc
loop 0x4042b1
push 0x30
mov ch, 0xe0
pop esi
mov dword [0x662f9538], eax
adc esp, eax
js 0x404265
xor bl, ah
xchg dword [ebx], esp
jmp 0xd1d32a02

Function at 0x405f20
Capabilities:
Allocate thread local storage
Initialize winsock library

Disassembly:
inc ebp
or bh, al
add al, 0x8f
add dl, bl
add byte [eax], al
mov dword [eax], edi
push esi
mov eax, ebx
pop esi
iretd
clc
mov ebp, esp
sub esp, 0x198
mov eax, dword [0xdc03a9]
mov ecx, eax
inc eax
test ecx, ecx
add ebx, esp
add byte [ebx - 0x367abf38], cl
mov dword [0x410388], eax
je 0x405f40
xor eax, eax
adc eax, 0x8dc35de5
push ebp
clc
lea edx, [ebp - 8]
push edx
call fcn.0040a720
add esp, 4
test eax, eax
jne 0x5540604a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0xf7c02], eax
call 0xea3fe740
test eax, eax
jne 0x405f2b
push eax
push eax
push eax
lea eax, [ebp - 4]
clc
call fcn.00404f60
test eax, eax
je 0x405f03
mov eax, 0xc69422
mov ebx, esp
cmp al, bl
mov ecx, dword [ebp - 4]
push str.apr_initialize
push ecx
call 0x73f66f0
lea edx, [ebp - 0x15a]
push edx
push 2
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
invalid
Function at 0x4033e4
Capabilities:
Delete directory
Get common file path
Get file attributes
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4c
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [eax]
mov eax, dword [eax + 4]
xor ebx, ebx
cmp dword [0x2420918], 0x594
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], eax
jne 0x403430
push 0x402e10
push 0x402e20
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointA]
push 0x402e3c
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
mov eax, dword [str.Fw8]
mov dword [ebp - 0x28], eax
mov eax, dword [0x4284bc]
mov dword [ebp - 0x30], eax
push edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
call fcn.004033dd
mov eax, dword [0x4284c0]
add dword [ebp - 0x10], 0x23f
mov dword [ebp - 0x2c], eax
mov eax, dword [0x4284c4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0x20
jmp 0x40346f
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, esi
shl eax, 4
cmp dword [0x2420918], 0xc
mov dword [ebp - 4], eax
jne 0x4034d1
push ebx
lea eax, [ebp - 0x44c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor eax, eax
mov word [ebp - 0x1c], ax
lea edi, [ebp - 0x1a]
stosw word es:[edi], ax
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp - 0xc4c]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterW]
lea eax, [ebp - 0x38]
push eax
push ebx
lea eax, [ebp - 0x4c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov eax, dword [0x2420918]
cmp eax, 0xfa9
jne 0x4034ed
mov dword [0x241feb4], 0xedeb2e40
cmp eax, 0x3eb
jne 0x4034fa
mov dword [0x241f860], ebx
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov edx, esi
shr edx, cl
lea eax, [edi + esi]
mov dword [ebp - 0x18], eax
mov dword [0x241feb0], 0xf4ea3dee
add edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
xor dword [ebp - 4], eax
xor edx, dword [ebp - 4]
cmp dword [0x2420918], 0x213
mov dword [ebp - 0x18], edx
jne 0x40353a
push 0x402e54
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov eax, dword [ebp - 0x18]
add dword [ebp - 8], 0x64
sub dword [ebp - 8], eax
sub dword [ebp - 8], 0x64
mov eax, dword [ebp - 8]
lea ecx, [ebp - 4]
call fcn.004033d7
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
add dword [ebp - 0x10], 0x61c88647
mov eax, edx
shr eax, cl
lea esi, [edi + edx]
add eax, dword [ebp - 0x30]
xor eax, esi
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 0x14], eax
dec dword [ebp - 0x20]
jne 0x40346c
cmp dword [0x2420918], 0xa6d
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp + 8]
mov dword [esi], eax
pop edi
jne 0x4035a4
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov edx, dword [ebp - 8]
mov dword [esi + 4], edx
pop esi
pop ebx
leave
ret 4
Function at 0x401550
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, 8
sub esp, 0x18
push esi
push edi
test eax, eax
jne 0x4019b9
call fcn.00403620
inc eax
int3
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov dword [ebp - 0xc], esi
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, eax
mov esi, dword [ebp + 0xc]
lodsb al, byte [esi]
inc ecx
test eax, eax
jne 0x4018f1
dec ecx
mov dword [ebp - 0x10], ecx
test ecx, ecx
jne 0x401deb
daa
push 4
push 1
push eax
call 0x44638d
mov eax, dword [esi + 0x14]
push 3
push 1
push eax
call 0x44638d
mov ecx, dword [esi + 0x14]
push 2
push 1
push ecx
call 0x44638d
add esp, 0x24
mov eax, esi
pop esi
pop ebx
ret
mov edi, dword [0x4051a7]
push 0x10000
mov edx, dword [ebp + 8]
pop esi
mov eax, dword [0x405144]
and edx, eax
mov eax, dword [edx]
cmp ax, di
je 0x4019da
sub edx, esi
jmp 0x4019cf
mov dword [ebp - 8], edx
mov eax, edx
mov ecx, dword [eax + 0x3c]
add eax, 0x78
and ecx, 0xffff
add eax, ecx
mov eax, dword [eax]
mov esi, dword [ebp - 8]
push esi
add esi, eax
mov eax, dword [esi + 0x20]
pop edi
add edi, eax
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x14], eax
jmp 0x4018e4
push dword [ebp - 0x14]
pop ecx
mov eax, dword [edi]
mov esi, dword [ebp - 8]
add esi, eax
xor eax, eax
push ecx
mov ecx, eax
push esi
add edi, 4
lodsb al, byte [esi]
add ecx, 1
test eax, eax
jne 0x401dff
dec ecx
pop esi
cmp ecx, dword [ebp - 0x10]
je 0x401e14
inc dword [ebp - 4]
pop ecx
loop 0x401def
push esi
push dword [ebp + 0xc]
call fcn.00403620
test eax, eax
jne 0x401e0e
je 0x403370
add dword [ebx + ecx - 0x73], esi
lea eax, [edi + edi*8 - 1]
invalid
mov eax, dword [ebp - 4]
mov esi, dword [ebp - 0xc]
mov ecx, dword [esi + 0x24]
add eax, eax
add ecx, dword [ebp - 8]
add ecx, eax
movzx eax, word [ecx]
mov ecx, dword [esi + 0x1c]
lea eax, [ecx + eax*4]
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + eax]
add eax, ecx
test eax, eax
jne 0x401876
pop esi
and byte [eax + 0x68b105e], cl
cmp eax, ebx
je 0x4033ad
push eax
call 0x469e19
add esp, 4
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
pop esi
pop ebx
ret
Function at 0x4033fa
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4046f8
push 0x403ca4
push eax
mov eax, dword [0x405414]
mov dword fs:[0], esp
mov ecx, dword [sym.imp.CRTDLL.dll__fmode_dll]
sub esp, 0x6c
mov dword [ecx], eax
mov edx, dword [0x405410]
mov eax, dword [sym.imp.CRTDLL.dll__commode_dll]
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [eax], edx
call fcn.00401930
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x2c]
push dword [0x40540c]
push edx
push eax
lea ecx, [ebp - 0x30]
push ecx
call sub.CRTDLL.dll___GetMainArgs
add esp, 0x10
push 0x4040d8
push 0x4040d4
call sub.CRTDLL.dll__initterm
add esp, 8
mov dword [ebp - 4], 0
mov eax, dword [sym.imp.CRTDLL.dll__acmdln_dll]
mov esi, dword [eax]
mov al, byte [esi]
cmp al, 0x22
jne 0x403495
mov al, byte [ebp - 0x34]
inc esi
mov al, byte [esi]
test al, al
je 0x40348d
cmp al, 0x22
jne 0x403482
cmp byte [esi], 0x22
jne 0x40349f
inc esi
jmp 0x40349f
cmp al, 0x20
jbe 0x40349f
inc esi
cmp byte [esi], 0x20
ja 0x403499
cmp byte [esi], 0
je 0x4034af
cmp byte [esi], 0x20
ja 0x4034af
inc esi
cmp byte [esi], 0
jne 0x4034a4
mov dword [ebp - 0x50], 0
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x50], 1
mov eax, 0xa
je 0x4034cf
movzx eax, word [ebp - 0x4c]
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call sub.CRTDLL.dll_exit
jmp 0x40350b
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4013c9
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x51e04c], 1
mov dword [0x51e050], 1
mov dword [0x51e054], 1
mov dword [ebp - 4], 0x400000
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40140a
mov eax, 0
jmp 0x4014a4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40142d
mov eax, 0
jmp 0x4014a4
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
movzx eax, ax
cmp eax, 0x10b
je 0x40144f
cmp eax, 0x20b
je 0x401474
jmp 0x40149f
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x5c]
cmp eax, 0xe
ja 0x401461
mov eax, 0
jmp 0x4014a4
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x4014a4
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x6c]
cmp eax, 0xe
ja 0x40148c
mov eax, 0
jmp 0x4014a4
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x4014a4
mov eax, 0
leave
ret

Function at 0x40a7b8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call fcn.004193f0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call fcn.004193f0
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort

Function at 0x40b38c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40b3ab
mov eax, 0
jmp 0x40b3ef
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40b3ce
mov eax, 0
jmp 0x40b3ef
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x40b3ea
mov eax, 0
jmp 0x40b3ef
mov eax, 1
leave
ret
Function at 0x40b3f1
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x40b450
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x40b448
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x40b448
mov eax, dword [ebp - 4]
jmp 0x40b464
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x40b425
mov eax, 0
leave
ret

Function at 0x41c56f
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
add esp, 0xffffff80
cmp dword [ebp + 8], 0
je 0x41c688
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0041bd8c
cmp eax, 1
jne 0x41c67e
mov dword [ebp - 0x77], 0x6f727245
mov dword [ebp - 0x73], 0x6c632072
mov dword [ebp - 0x6f], 0x696e6165
mov dword [ebp - 0x6b], 0x7520676e
mov dword [ebp - 0x67], 0x70732070
mov dword [ebp - 0x63], 0x6b5f6e69
mov dword [ebp - 0x5f], 0x20737965
mov dword [ebp - 0x5b], 0x20726f66
mov dword [ebp - 0x57], 0x65726874
mov dword [ebp - 0x53], 0x206461
lea eax, [ebp - 0x4f]
mov ecx, 0x43
mov ebx, 0
mov dword [eax], ebx
mov dword [eax + ecx - 4], ebx
lea edx, [eax + 4]
and edx, 0xfffffffc
sub eax, edx
add ecx, eax
and ecx, 0xfffffffc
shr ecx, 2
mov edi, edx
mov eax, ebx
rep stosd dword es:[edi], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov dword [esp + 8], 0xa
lea edx, [ebp - 0x77]
add edx, 0x27
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__ultoa]
call eax
mov dword [ebp - 0xc], 0x27
jmp 0x41c634
add dword [ebp - 0xc], 1
lea edx, [ebp - 0x77]
mov eax, dword [ebp - 0xc]
add eax, edx
movzx eax, byte [eax]
test al, al
je 0x41c64b
mov eax, dword [ebp - 0xc]
cmp eax, 0x69
jbe 0x41c630
mov eax, dword [ebp - 0xc]
cmp eax, 0x69
ja 0x41c669
lea edx, [ebp - 0x77]
mov eax, dword [ebp - 0xc]
add eax, edx
mov byte [eax], 0xa
mov eax, dword [ebp - 0xc]
add eax, 1
mov byte [ebp + eax - 0x77], 0
lea eax, [ebp - 0x77]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call eax
sub esp, 4
call sub.msvcrt.dll_abort
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [eax], edx
jmp 0x41c689
nop
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret
Function at 0x41d60f
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [ebp - 0x1c], 0xffffffff
mov dword [esp + 4], 0x41d47e
mov dword [esp], 0x51eaac
call fcn.0041cbe4
mov eax, dword [0x4cd09c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x41d656
mov eax, dword [ebp - 0x20]
jmp 0x41d7a1
call fcn.0041c478
mov dword [ebp - 0x20], eax
mov eax, dword [entry3]
test eax, eax
je 0x41d66d
cmp dword [ebp - 0x20], 0
jne 0x41d677
mov eax, 0
jmp 0x41d7a1
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x24], 1
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateEventA]
call eax
sub esp, 0x10
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x1c], 0xffffffff
mov eax, dword [ebp - 0x20]
lea edx, [eax + 0x38]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.0041c56f
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x64], 0
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x20]
lea edi, [eax + 0x14]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call eax
mov ebx, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
call eax
sub esp, 0x1c
test eax, eax
jne 0x41d749
call sub.msvcrt.dll_abort
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetThreadPriority]
call eax
sub esp, 4
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x6c], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x68], 0
mov eax, dword [ebp - 0x20]
movzx edx, byte [eax + 0x20]
and edx, 0xffffffcf
or edx, 0x10
mov byte [eax + 0x20], dl
mov eax, dword [0x4cd09c]
mov edx, dword [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
test eax, eax
jne 0x41d79e
call sub.msvcrt.dll_abort
mov eax, dword [ebp - 0x20]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret