joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401710
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [0x412ec0], 0
je 0x401732
mov eax, dword [0x412ec4]
push str._nQuerying_Server_Status......._n
push eax
call fcn.00401ff5
add esp, 8
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x401772
cmp dword [0x412ec0], eax
je 0x40176b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x412ec4]
push eax
push str._nError:_code__d_while_opening_SC_Manager_nFatal_Error..._n
push ecx
call fcn.00401ff5
add esp, 0xc
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push esi
push 0xf01ff
push str.IBM_LUM_LMD
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x4017ed
cmp dword [0x412ec0], 0
je 0x4017a7
mov edx, dword [0x412ec4]
push str._nService_LMD_Opened_n
push edx
call fcn.00401ff5
add esp, 8
lea ecx, [ebp - 0x1c]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x401818
cmp dword [0x412ec0], eax
je 0x4017d9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [0x412ec4]
push eax
push str._nError:_code__d_while_Querying_Service_Status__n
push edx
call fcn.00401ff5
add esp, 0xc
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push esi
call edi
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
cmp dword [0x412ec0], 0
je 0x401810
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x412ec4]
push str._nWarning:_unable_to_Open_Service_LMD__returned_code_is:__d_n
push eax
call fcn.00401ff5
add esp, 0xc
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
cmp dword [0x412ec0], 0
je case.default.0x40183f
mov eax, dword [0x412ec4]
push str._nLMD_Service_Status_is:
push eax
call fcn.00401ff5
mov eax, dword [ebp - 0x18]
add eax, 0xffffffff
add esp, 8
cmp eax, 6
ja case.default.0x40183f
jmp dword [eax*4 + 0x4018bc]
push str.SERVICE_CONTINUE_PENDING._n
jmp 0x40188f
mov edx, dword [0x412ec4]
push str.SERVICE_PAUSE_PENDING._n
push edx
jmp 0x401896
mov eax, dword [0x412ec4]
push str.SERVICE_PAUSED._n
push eax
jmp 0x401896
push str.SERVICE_RUNNING._n
jmp 0x40188f
mov edx, dword [0x412ec4]
push str.SERVICE_START_PENDING._n
push edx
jmp 0x401896
mov eax, dword [0x412ec4]
push str.SERVICE_STOP_PENDING._n
push eax
jmp 0x401896
push str.SERVICE_STOPPED._n
mov ecx, dword [0x412ec4]
push ecx
call fcn.00401ff5
add esp, 8
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
xor eax, eax
cmp dword [ebp - 0x18], 1
pop esi
setne al
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4018e0
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0xffffffffffffffff
push 0
push 3
push 0
push 1
push 0x80000000
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x401939
cmp dword [0x412ec0], 0
je 0x40192e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x412ec4]
push eax
push str.CreateFile_on_source_file_failed:__d
push ecx
call fcn.00401ff5
add esp, 0xc
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x18]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
jne 0x401985
cmp dword [0x412ec0], eax
je 0x401973
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [0x412ec4]
push eax
push str.GetFileTime_on_source_file_failed:__d
push edx
call fcn.00401ff5
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebx
mov eax, dword [ebp + 8]
push 0xffffffffffffffff
push 0
push 3
push 0
push 2
push 0x40000000
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x4019db
cmp dword [0x412ec0], 0
je 0x4019cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x412ec4]
push eax
push str.CreateFile_on_destination_file_failed:__d
push ecx
call fcn.00401ff5
add esp, 0xc
pop ebx
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x10]
push eax
mov ecx, edx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x401a23
cmp dword [0x412ec0], eax
je 0x401a14
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [0x412ec4]
push eax
push str.SetFileTime_on_destination_file_failed:__d
push edx
call fcn.00401ff5
add esp, 0xc
push esi
call ebx
pop ebx
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
push esi
call ebx
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401c00
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push ebx
push edi
mov dword [ebp - 0xc], 0
call fcn.00401b50
add esp, 8
test eax, eax
jne 0x401c46
cmp dword [0x412ec0], eax
je 0x401c3e
mov eax, dword [0x412ec4]
push 0x411054
push eax
call fcn.00401ff5
add esp, 8
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x412ec0], 0
je 0x401c65
mov ecx, dword [0x412ec4]
push edi
push ebx
push str._nInstall__s_in:__s_n
push ecx
call fcn.00401ff5
add esp, 0x10
push esi
push 0x411094
push ebx
call fcn.0040266f
mov esi, eax
add esp, 8
test esi, esi
jne 0x401ca3
cmp dword [0x412ec0], eax
je 0x401c97
mov edx, dword [0x412ec4]
push ebx
push str._nError____s_not_found_n
push edx
call fcn.00401ff5
add esp, 0xc
pop esi
pop edi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
push 0x4110b0
push edi
call fcn.0040266f
mov edi, eax
add esp, 8
test edi, edi
jne 0x401ce8
cmp dword [0x412ec0], eax
je 0x401cd3
mov eax, dword [0x412ec4]
push ebx
push str._nError___Cannot_copy__s_n
push eax
call fcn.00401ff5
add esp, 0xc
push esi
call fcn.0040252f
add esp, 4
pop esi
pop edi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
push 2
push 0
push esi
call fcn.00402e7b
push esi
call fcn.00402d86
push esi
mov ebx, eax
call fcn.00402b29
add esp, 0x14
test ebx, ebx
jle 0x401d35
mov dword [ebp - 8], ebx
lea ebx, [ebx]
push esi
push 1
lea ecx, [ebp - 1]
push 1
push ecx
call fcn.00402b0e
push edi
push 1
lea edx, [ebp - 1]
push 1
push edx
call fcn.00402824
add esp, 0x20
sub dword [ebp - 8], 1
jne 0x401d10
cmp dword [0x412ec0], 0
je 0x401d8a
push 2
push 0
push edi
call fcn.00402e7b
push edi
call fcn.00402d86
add esp, 0x10
cmp ebx, eax
jne 0x401d6c
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x412ec4]
push eax
push str._nCopy__s_Successful_n
push ecx
call fcn.00401ff5
jmp 0x401d87
mov edx, dword [ebp + 0xc]
mov eax, dword [0x412ec4]
push edx
push str._nCopy__s_Failed_n
push eax
call fcn.00401ff5
mov dword [ebp - 0xc], 1
add esp, 0xc
push esi
call fcn.0040252f
push edi
call fcn.0040252f
mov eax, dword [ebp - 0xc]
add esp, 8
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4023e8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411e5c]
jne 0x4023f2
repz ret
jmp fcn.00405a65
Function at 0x407d4f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.00407045
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00406ffa
add esp, 0xc
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x6a0], 0x8b
or byte [ebp - 0x69f], 0xff
mov byte [ebp - 0x69e], 0x55
call dword [ebp - 0x3a]
test dword [ebx - 7], esp
invalid
dec dword [ebx - 0x69b7a3a]
invalid
invalid
in al, dx
lea eax, [ebp - 0x694]
push eax
push 5
lea eax, [ebp - 0x6a0]
push eax
push dword [ebp - 0x33c]
push 0xffffffffffffffff
call dword [ebp - 0x690]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x6bc], eax
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x698], eax
call fcn.00407035
scasd eax, dword es:[edi]
mov dl, 0xb2
sbb bh, bh
mov ch, 0x68
stc
invalid
Function at 0x40a405
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00407fe8
xor ebx, ebx
cmp dword [0x413868], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x40a4da
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x40a445
xor eax, eax
jmp 0x40a59e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x40a43e
push eax
call fcn.00407f85
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x413868], eax
call esi
push eax
call fcn.00407f85
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41386c], eax
call esi
push eax
call fcn.00407f85
mov dword [0x413870], eax
lea eax, [ebp - 8]
push eax
call fcn.00404709
test eax, eax
pop ecx
pop ecx
je 0x40a4a8
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00404097
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x40a4da
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00407f85
cmp eax, ebx
pop ecx
mov dword [0x413878], eax
je 0x40a4da
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00407f85
pop ecx
mov dword [0x413874], eax
mov eax, dword [0x413874]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x40a553
cmp dword [0x413878], esi
je 0x40a553
push eax
call int.00407ff1
pop ecx
call eax
cmp eax, ebx
je 0x40a520
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x413878]
call int.00407ff1
pop ecx
call eax
test eax, eax
je 0x40a520
test byte [ebp - 0x18], 1
jne 0x40a553
lea eax, [ebp - 0xc]
push eax
call fcn.00404740
test eax, eax
pop ecx
je 0x40a53b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00404097
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x40a54a
or dword [ebp + 0x10], 0x200000
jmp 0x40a584
or dword [ebp + 0x10], 0x40000
jmp 0x40a584
mov eax, dword [0x41386c]
cmp eax, esi
je 0x40a584
push eax
call int.00407ff1
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40a584
mov eax, dword [0x413870]
cmp eax, esi
je 0x40a584
push dword [ebp - 4]
push eax
call int.00407ff1
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x413868]
call int.00407ff1
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406010
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ebx, dword [eax + 0x20]
push eax
add ebx, edx
test ecx, ecx
je 0x406056
xor edi, edi
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edx
xor eax, eax
ror edi, 0xd
lodsb al, byte [esi]
add edi, eax
cmp al, ah
jne 0x406022
add edi, dword [ebp - 8]
cmp edi, dword [ebp + 0x24]
jne 0x406016
pop eax
mov ebx, dword [eax + 0x24]
add ebx, edx
mov cx, word [ebx + ecx*2]
mov ebx, dword [eax + 0x1c]
add ebx, edx
mov eax, dword [ebx + ecx*4]
add eax, edx
mov dword [esp + 0x24], eax
pop ebx
pop ebx
popal
pop ecx
pop edx
push ecx
jmp eax
pop eax

Function at 0x4070d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
add byte [eax], al
mov ebp, dword [esp + ecx]
jns 0x407134
or esi, eax
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
mov dword [ebp - 0xc], eax
add byte [ebp + 0x10], 0x57
mov dword [ebp - 0x14], esi
mov al, byte [eax]
mov dword [ecx - 0x763f7b04], ebx
jne 0x4070d9
xor esi, dword [ebp - 0x10]
insd dword es:[edi], dx
jne 0x4070d7
mov dword [ebp - 0x24], edx
or eax, 0x825e1746
add byte [ebx*2 + 0x74253c14], dh
cmp al, 0x8b
inc ebp
hlt
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp + 0x10]
inc eax
mov dword [ebp - 0xc], eax
mov cl, byte [edx]
mov byte [eax - 1], cl
inc dword [ebp - 0x14]
jmp 0xbd407c17
Function at 0x40de40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, edx
mov edx, dword [esp + 0x14]
mov ebp, dword [esp + 0x20]
xor esi, esi
lea edx, [eax + edx*2]
movzx ebx, byte [eax + 1]
cmp byte [eax], ch
lea eax, [eax + 2]
lea edi, [esi + ebx]
jne 0x40de90
cmp esi, edi
ja 0x40def8
cmp edi, dword [esp + 0x1c]
ja 0x40df06
add esi, dword [esp + 0x18]
nop word [eax + eax]
test ebx, ebx
je 0x40de92
dec ebx
cmp byte [esi], cl
lea esi, [esi + 1]
jne 0x40de80
jmp 0x40deef
ja 0x40de98
cmp eax, edx
mov esi, edi
jne 0x40de53
mov edi, dword [esp + 0x24]
movzx ecx, cx
mov al, 1
add edi, ebp
nop word cs:[eax + eax]
nop dword [eax]
movzx edx, byte [ebp]
lea esi, [ebp + 1]
test dl, dl
js 0x40ded0
mov ebp, esi
sub ecx, edx
jns 0x40dee7
jmp 0x40def1
cmp esi, edi
je 0x40df16
movzx esi, byte [ebp + 1]
and edx, 0x7f
add ebp, 2
shl edx, 8
or edx, esi
sub ecx, edx
js 0x40def1
xor al, 1
cmp ebp, edi
jne 0x40deb0
jmp 0x40def1
xor eax, eax
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
mov edx, edi
push 0x43fb6c
call fcn.0043b000
mov edx, dword [esp + 0x1c]
mov ecx, edi
push 0x43fb6c
call fcn.0043ade0
mov ecx, 0x43fb5c
call fcn.0043b130
Function at 0x419f90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x42b9a0
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
movzx eax, byte [0x450a64]
test al, al
je 0x41a161
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x419fdc
cmp eax, 3
jne 0x41a15a
mov ebx, dword [0x450a68]
test ebx, ebx
je 0x41a15a
mov dword [ebp - 0x20], 0
jmp 0x41a007
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x41a038
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x41a1ab
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x41a000
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x41a000
test byte [ebp - 0x20], 1
je 0x41a15a
mov ebx, dword [0x450a68]
test ebx, ebx
je 0x41a15a
mov dword [ebp - 0x20], 0
jmp 0x41a067
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x41a098
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x41a1ab
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x41a060
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x41a060
test byte [ebp - 0x20], 1
je 0x41a15a
mov ebx, dword [0x450a68]
test ebx, ebx
je 0x41a15a
mov dword [ebp - 0x20], 0
jmp 0x41a0c7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x41a0f8
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x41a1ab
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x41a0c0
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x41a0c0
test byte [ebp - 0x20], 1
je 0x41a15a
mov ebx, dword [0x450a68]
test ebx, ebx
je 0x41a15a
mov dword [ebp - 0x20], 0
jmp 0x41a127
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x41a154
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x41a1ab
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x41a120
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x41a120
test byte [ebp - 0x20], 1
jne 0x41a174
movzx eax, byte [0x44c740]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov ebx, dword [0x450a68]
jmp 0x41a17f
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x41a15a
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x41a1ab
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x41a17c
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
jmp 0x41a17c
mov ecx, 0x4465b8
mov dword [ebp - 0x10], 0
call fcn.0043b130
ud2
Function at 0x41aca0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x450078]
test eax, eax
je 0x41ad55
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x41accc
cmp dword [eax + 4], 0
mov edi, eax
je 0x41accc
add edi, 8
jmp 0x41ad50
mov eax, dword [0x450078]
test eax, eax
je 0x41ad64
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x41ad4e
mov esi, eax
test eax, eax
jne 0x41ad24
movzx eax, byte [0x450ab0]
xor ecx, ecx
mov edx, 0xc
call fcn.00422a80
test eax, eax
je 0x41ad7f
mov dword [eax], 0x450078
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x450078]
test eax, eax
je 0x41ad73
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x41ad50
test ecx, ecx
je 0x41ad50
lock dec dword [ecx]
jne 0x41ad50
call fcn.0041a9a0
jmp 0x41ad50
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x450078
call fcn.0043c2b0
jmp 0x41acb0
mov ecx, 0x450078
call fcn.0043c2b0
jmp 0x41acda
mov ecx, 0x450078
call fcn.0043c2b0
jmp 0x41ad1c
mov ecx, 4
mov edx, 0xc
call fcn.0043ac30
int3

Function at 0x41b320
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x450088]
test eax, eax
je 0x41b3a1
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x41b33f
cmp byte [eax + 4], 0
mov esi, eax
jne 0x41b396
mov eax, dword [0x450088]
test eax, eax
je 0x41b3b0
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x41b39b
mov esi, eax
test eax, eax
jne 0x41b390
movzx eax, byte [0x450ab0]
xor ecx, ecx
mov edx, 8
call fcn.00422a80
test eax, eax
je 0x41b3c8
mov dword [eax], 0x450088
mov byte [eax + 4], 0
mov esi, eax
mov eax, dword [0x450088]
test eax, eax
je 0x41b3bc
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov word [esi + 4], 1
add esi, 5
jmp 0x41b39d
xor esi, esi
mov eax, esi
pop esi
ret
mov ecx, 0x450088
call fcn.0043c2b0
jmp 0x41b32b
mov ecx, 0x450088
call fcn.0043c2b0
jmp 0x41b349
mov ecx, 0x450088
call fcn.0043c2b0
jmp 0x41b388
mov ecx, 4
mov edx, 8
call fcn.0043ac30
int3
Function at 0x41c2b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x450068]
test eax, eax
je 0x41c345
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x41c2d6
cmp dword [eax + 4], 0
je 0x41c2d6
add eax, 8
pop esi
ret
mov eax, dword [0x450068]
test eax, eax
je 0x41c354
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x41c341
mov esi, eax
test eax, eax
jne 0x41c32a
movzx eax, byte [0x450ab0]
xor ecx, ecx
mov edx, 0x10
call fcn.00422a80
test eax, eax
je 0x41c36c
mov dword [eax], 0x450068
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x450068]
test eax, eax
je 0x41c360
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
lea eax, [esi + 8]
mov byte [esi + 0xc], 0
pop esi
ret
xor eax, eax
pop esi
ret
mov ecx, 0x450068
call fcn.0043c2b0
jmp 0x41c2bf
mov ecx, 0x450068
call fcn.0043c2b0
jmp 0x41c2e0
mov ecx, 0x450068
call fcn.0043c2b0
jmp 0x41c322
mov ecx, 4
mov edx, 0x10
call fcn.0043ac30
int3
Function at 0x42c571
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42c5b0
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42c5b0
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42c5b0
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42c5b0
cmp dword [ecx + 0x74], 0xe
jbe 0x42c5b0
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x433893
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x433930
push ebx
push esi
call fcn.0043385c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004337f0
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4338dd
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x43392f
push edi
push eax
call fcn.004344b0
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4338fd
call fcn.00432351
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x43392e
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004337f0
add esp, 0x20
test eax, eax
jne 0x43391c
push edi
call fcn.00432351
jmp 0x433924
push ebx
call fcn.00432351
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x434c2d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4498e8
push 0x4498e0
push str.FlsAlloc
push 0x1f
call fcn.00434aec
mov esi, eax
add esp, 0x10
test esi, esi
je 0x434c61
push dword [ebp + 8]
mov ecx, esi
call dword [0x43d1c4]
call esi
jmp 0x434c67
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x434cab
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4498f8
push 0x4498f0
push str.FlsGetValue
push 0x21
call fcn.00434aec
mov esi, eax
add esp, 0x10
test esi, esi
je 0x434ce2
push dword [ebp + 8]
mov ecx, esi
call dword [0x43d1c4]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x434cea
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x449900
push 0x4498f8
push str.FlsSetValue
push 0x22
call fcn.00434aec
mov esi, eax
add esp, 0x10
test esi, esi
je 0x434d24
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x43d1c4]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x43a190
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43a1bd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43a1bd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret