joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411d20
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [0x42741c]
test eax, eax
je 0x411e88
cmp dword [eax], 1
je 0x411d3e
call fcn.00411bf0
mov eax, dword [0x427418]
test eax, eax
je 0x411eb0
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x411d70
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.00411590
mov esi, eax
mov eax, dword [entry3]
test eax, eax
je 0x411d5f
test esi, esi
je 0x411d5f
mov dword [esi + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x1c], 0xffffffff
mov dword [esi + 0x18], eax
sub esp, 0x10
lea eax, [esi + 0x38]
call fcn.00411c70
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esi + 0x64], 0
mov dword [esi + 0x14], 0
call ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ebx, eax
call ebp
lea edx, [esi + 0x14]
mov dword [esp + 8], edi
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
sub esp, 0x1c
test eax, eax
je 0x41a6e9
mov eax, dword [esi + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], eax
movzx eax, byte [esi + 0x20]
sub esp, 4
and eax, 0xffffffcf
or eax, 0x10
mov byte [esi + 0x20], al
mov eax, dword [0x427418]
test eax, eax
je 0x411ee0
mov dword [esp + 4], esi
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x41a6e9
add esp, 0x2c
mov ebx, esi
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_once_shmem
call fcn.004150b0
mov dword [0x42741c], eax
jmp 0x411d34
mov dword [esp + 8], 0x410bc0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.004150b0
mov dword [0x427418], eax
jmp 0x411d4b
mov dword [esp + 8], 0x410bc0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.004150b0
mov dword [0x427418], eax
jmp 0x411e5e
call sub.msvcrt.dll_abort
Function at 0x4124a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x4124d0
mov edi, dword [esp + 0x28]
test edi, edi
je 0x412580
add esp, 0x10
mov eax, 1
pop ebx
pop esi
pop edi
ret 0xc
cmp eax, 1
je 0x4125b0
cmp eax, 3
jne 0x4124ba
mov eax, dword [0x427418]
test eax, eax
je 0x4126c0
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x4124ba
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x4124ba
test byte [eax + 0x20], 0x30
je 0x4125e0
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x41251d
call fcn.00412290
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x41254f
mov dword [esp], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x412541
mov dword [esp], eax
call esi
sub esp, 4
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x14], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call fcn.00410a10
lea eax, [ebx + 0x38]
call fcn.00411c70
mov esi, dword [ebx + 0xb0]
test esi, esi
jne 0x412668
mov eax, ebx
call fcn.004117f0
jmp 0x412668
mov eax, dword [0x427430]
test eax, eax
je 0x4124ba
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
mov dword [0x427430], 0
sub esp, 4
jmp 0x4124ba
mov dword [esp + 4], 0x410bf0
mov dword [esp], 1
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
sub esp, 8
mov dword [0x427430], eax
mov eax, 1
add esp, 0x10
pop ebx
pop esi
pop edi
ret 0xc
mov edx, dword [ebx + 0x68]
mov eax, dword [eax + 0x18]
test edx, edx
jne 0x412690
test eax, eax
je 0x4125fe
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebx + 0xb4]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x68], 1
test eax, eax
je 0x41261b
call fcn.00412290
lea edi, [ebx + 0x1c]
lea esi, [ebx + 0x38]
test byte [ebx + 0x24], 4
je 0x4126f0
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x412644
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebx + 0x14], 0
mov dword [esp], edi
call fcn.00410a10
mov eax, esi
call fcn.00411c70
mov ecx, dword [ebx + 0xb0]
test ecx, ecx
je 0x412570
mov eax, dword [0x427418]
test eax, eax
je 0x412704
mov dword [esp + 4], 0
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
jmp 0x4124ba
test eax, eax
je 0x4126a0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
lea eax, [ebx + 0x1c]
mov dword [ebx + 0x18], 0
mov dword [esp], eax
call fcn.00410a10
lea eax, [ebx + 0x38]
call fcn.00411c70
jmp 0x4124ba
mov dword [esp + 8], 0x410bc0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.004150b0
mov dword [0x427418], eax
jmp 0x4124eb
mov dword [esp], edi
call fcn.00410a10
mov eax, esi
call fcn.00411c70
jmp 0x4124ba
mov dword [esp + 8], 0x410bc0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.004150b0
mov dword [0x427418], eax
jmp 0x412675
Function at 0x413980
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call fcn.00411d20
mov dword [eax + 4], esi
mov ebx, eax
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x4139a2
call fcn.00412290
test byte [ebx + 0x20], 0x30
je 0x413a04
mov eax, dword [0x427418]
test eax, eax
je 0x413a8b
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x4139fb
cmp dword [ebx + 0x14], 0
mov eax, dword [eax + 0x18]
je 0x413a5b
mov dword [ebx + 0x68], 1
mov esi, dword [ebx + 4]
test eax, eax
je 0x4139ee
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
mov dword [ebx + 0x18], 0
test byte [ebx + 0x24], 4
jne 0x413a18
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
add ebx, 0x70
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_longjmp]
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
cmp dword [ebx + 0xb0], 0
mov dword [ebx + 0x14], 0
je 0x413a82
mov eax, dword [0x427418]
test eax, eax
je 0x413ab1
mov dword [esp + 4], 0
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push eax
push eax
jmp 0x4139fb
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x413a6f
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
cmp dword [ebx + 0xb0], 0
mov esi, dword [ebx + 4]
mov dword [ebx + 0x18], 0
jne 0x413a3b
mov eax, ebx
call fcn.004117f0
jmp 0x413a3b
mov dword [esp + 8], 0x410bc0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.004150b0
mov dword [0x427418], eax
jmp 0x4139b5
mov dword [esp + 8], 0x410bc0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.004150b0
mov dword [0x427418], eax
jmp 0x413a44
Function at 0x4150b0
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [ebp + 8]
mov dword [esp], esi
call sub.MSVCR120D.dll_strlen
mov ebx, eax
add eax, 0x10
mov dword [ebp - 0x1c], eax
lea eax, [ebx + 0x40]
lea ecx, [ebx + 0x30]
shr eax, 4
mov dword [ebp - 0x20], ecx
shl eax, 4
call fcn.0040f180
mov edx, 0x326d
sub esp, eax
lea eax, [esp + 0x1b]
mov dword [esp + 8], ebx
lea edi, [esp + 0xc]
mov dword [esp + 4], esi
mov dword [esp], eax
mov word [esp + 0x18], dx
mov dword [esp + 0xc], 0x2d636367
mov dword [esp + 0x10], 0x656d6873
mov dword [esp + 0x14], 0x64742d6d
mov byte [esp + 0x1a], 0x2d
call sub.MSVCR120D.dll_memcpy
lea eax, [ebx + 0x10]
add eax, edi
mov dword [eax], 0x61616161
mov dword [eax + 4], 0x61616161
mov dword [eax + 8], 0x61616161
mov dword [eax + 0xc], 0x61616161
mov dword [eax + 0x10], 0x61616161
mov dword [eax + 0x14], 0x61616161
mov dword [eax + 0x18], 0x61616161
mov dword [eax + 0x1c], 0x61616161
mov byte [esp + ebx + 0x3c], 0
mov byte [esp + ebx + 0x1b], 0
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov byte [edi + ebx + 0xf], 0x2d
sub esp, 0xc
mov dword [ebp - 0x24], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
je 0x4151a4
int3
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_FindAtomA]
sub esp, 4
test ax, ax
je 0x4151f0
mov ecx, dword [ebp - 0x1c]
movzx eax, ax
mov edx, edi
mov dword [esp], ecx
mov ecx, dword [ebp - 0x20]
call fcn.00415040
mov ebx, eax
mov edi, dword [ebp - 0x24]
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0xc]
add ebx, edi
mov dword [esp], eax
call sub.MSVCR120D.dll_malloc
mov edx, 0x20
mov esi, eax
lea esi, [esi]
bt esi, edx
jae 0x415216
mov eax, edx
neg eax
mov byte [ebx + eax + 0x30], 0x41
sub edx, 1
jne 0x415208
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_AddAtomA]
sub esp, 4
test ax, ax
jne 0x41522d
int3
mov ecx, dword [ebp - 0x1c]
movzx eax, ax
mov edx, edi
mov dword [esp], ecx
mov ecx, dword [ebp - 0x20]
call fcn.00415040
mov ebx, eax
cmp esi, eax
je 0x415253
mov dword [esp], esi
call sub.msvcrt.dll_free
jmp 0x4151ca
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [esp + 8], eax
call sub.MSVCR120D.dll_memset
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4151ca
mov dword [esp], ebx
call dword [ebp + 0x10]
jmp 0x4151ca
Function at 0x4158d0
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x24
mov eax, dword [0x427438]
test eax, eax
je 0x415920
mov dword [esp], eax
call fcn.00416650
mov eax, dword [ebx]
cmp dword [eax], 0xbab1f0ed
jne 0x415979
mov eax, dword [ebx]
mov eax, dword [eax + 4]
test eax, eax
jle 0x415979
mov eax, dword [ebx]
sub dword [eax + 4], 1
mov eax, dword [0x427438]
test eax, eax
je 0x415948
mov dword [esp], eax
call fcn.004166a0
add esp, 0x24
mov eax, esi
pop ebx
pop esi
ret
mov dword [esp + 8], 0x415620
mov dword [esp + 4], 4
mov dword [esp], str.rwl_global_shmem
call fcn.004150b0
mov dword [0x427438], eax
jmp 0x4158e2
mov dword [esp + 8], 0x415620
mov dword [esp + 4], 4
mov dword [esp], str.rwl_global_shmem
call fcn.004150b0
mov dword [esp], eax
mov dword [0x427438], eax
call fcn.004166a0
add esp, 0x24
mov eax, esi
pop ebx
pop esi
ret
mov dword [esp], 2
call dword [0x41b01c]
mov dword [esp + 0x10], 0x2e
mov dword [esp + 0xc], str.C:_crossdev_src_winpthreads_v7_git20191109_src_rwlock.c
mov dword [esp + 8], str.___rwlock_t__rwl___valid__LIFE_RWLOCK______rwlock_t__rwl___busy___0_
mov dword [esp + 4], str.Assertion_failed:___s___file__s__line__d_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp], 1
call sub.MSVCR120D.dll_exit
lea esi, [esi]
mov eax, dword [esp + 4]
mov dword [eax], 0xffffffff
ret

Function at 0x415f70
Capabilities:
Terminate process

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [esp + 0x30]
mov eax, ebx
call fcn.00415d20
test eax, eax
je 0x415f90
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, dword [ebx]
lea edi, [esi + 0x14]
mov dword [esp], edi
call fcn.00410530
test eax, eax
jne 0x415fb7
lock add dword [esi + 0xc], 1
cmp dword [esi + 0xc], 0x7fffffff
je 0x415fd0
mov dword [esp], edi
call fcn.00410880
mov edx, eax
add esp, 0x1c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004158d0
lea eax, [esi + 0x18]
mov dword [esp], eax
call fcn.00410530
mov ebp, eax
test eax, eax
je 0x415ff0
mov dword [esp], edi
call fcn.00410880
mov edx, ebp
jmp 0x415fb9
mov eax, dword [esi + 0x10]
sub dword [esi + 0xc], eax
xor edx, edx
mov eax, esi
mov dword [esi + 0x10], 0
call fcn.00415860
jmp 0x415fb7

Function at 0x416230
Capabilities:
Terminate process

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov ebx, dword [esp + 0x30]
mov eax, ebx
call fcn.00415730
test eax, eax
jne 0x4162a0
mov esi, dword [ebx]
mov edx, dword [esi + 8]
test edx, edx
je 0x416270
lock sub dword [esi + 8], 1
xor edx, edx
mov eax, esi
call fcn.00415860
mov edx, eax
add esp, 0x20
mov eax, ebx
pop ebx
pop esi
pop edi
jmp fcn.004158d0
lea edi, [esi + 0x18]
mov dword [esp], edi
call fcn.00410530
mov edx, eax
test eax, eax
jne 0x41625e
lock add dword [esi + 0x10], 1
mov eax, dword [esi + 0x10]
test eax, eax
je 0x4162b0
mov dword [esp], edi
call fcn.00410880
mov edx, eax
jmp 0x41625e
add esp, 0x20
pop ebx
pop esi
pop edi
ret
add esi, 0x1c
mov dword [esp], esi
call fcn.00417290
mov dword [esp], edi
mov dword [esp + 0x1c], eax
call fcn.00410880
mov edx, dword [esp + 0x1c]
test edx, edx
cmove edx, eax
jmp 0x41625e
Function at 0x1001cc37
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 0x2d], 0
jne 0x1001ccba
push ebx
mov ebx, dword [ebp + 0x10]
push edi
push 0
lea eax, [ebp + 0x10]
push eax
push ebx
push dword [ebp + 0xc]
push dword [esi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, dword [ebp + 0x10]
cmp edi, ebx
je 0x1001cc84
mov byte [esi + 0x2d], 0xff
test edi, edi
je 0x1001cc84
cmp edi, ebx
jge 0x1001cc84
mov eax, dword [ebp + 0xc]
mov ecx, ebx
sub ecx, edi
push ecx
add eax, edi
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
cmp dword [esi + 0x18], 0
je 0x1001ccb4
add dword [esi + 0x1c], ebx
cmp dword [esi + 0x1c], 0xffff
jle 0x1001ccb4
xor eax, eax
mov word [esi + 0x1e], ax
mov eax, dword [esi]
push esi
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x18]
mov edx, dword [ecx]
push 1
push dword [esi + 0x20]
push eax
push ecx
call dword [edx + 0xc]
mov edi, dword [ebp + 0x10]
mov eax, edi
pop edi
pop ebx
jmp 0x1001cccc
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
pop esi
pop ebp
ret 0xc

Function at 0x1001cf62
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100268b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0xc]
cmp byte [0x100269c0], al
je 0x1001cf99
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x1001cffd
push 0x103
push eax
mov byte [ebp - 0x108], al
lea eax, [ebp - 0x107]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.10007ff2
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.10007ff2
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
push ebx
lea eax, [ebp - 0x108]
push eax
call fcn.10007ff2
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001ddeb
leave
ret 0x10

Function at 0x1001d00e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100268b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100269c0], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1001d03a
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x1001d06b
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x1001d069
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.10007ff2
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x1001d06b
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1001ddeb
leave
ret 8
Function at 0x1001d106
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100268b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100269c0], 0
mov eax, dword [ebp + 8]
je 0x1001d12e
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x1001d148
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.10007ff2
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.1001ddeb
leave
ret 4

Function at 0x1001ddeb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100268b0]
jne 0x1001ddf5
repz ret
jmp fcn.1001e62c

Function at 0x4179d0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x10000]
push edi
or ebp, 0xffffffff
jmp 0x4179f2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4179f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4179e8
mov eax, 1
add ebx, ebx
jne 0x417a0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x417a00
jne 0x417a1c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x417a00
xor ecx, ecx
sub eax, 3
jb 0x417a30
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x417aa2
mov ebp, eax
add ebx, ebx
jne 0x417a3b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x417a48
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x417a6c
inc ecx
add ebx, ebx
jne 0x417a58
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x417a4d
jne 0x417a69
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x417a4d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x417a8c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x417a7d
jmp 0x4179ee
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x417a8c
add edi, ecx
jmp 0x4179ee
pop esi
mov edi, esi
mov ecx, 0x50b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x417aaa
cmp byte [edi], 0
jne 0x417aaa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x417aaf
lea edi, [esi + 0x15000]
mov eax, dword [edi]
or eax, eax
je 0x417b1e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x171e8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1724c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x417adc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x17250]
or eax, eax
je 0x417b18
mov dword [ebx], eax
add ebx, 4
jmp 0x417af9
call dword [esi + 0x17254]
popal
jmp 0x40c360
Function at 0x42b538
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x43c510
call fcn.0042be5e
push 1
call fcn.0042b6a2
pop ecx
test al, al
jne 0x42b3e1
push 7
call fcn.0042c0e7
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0042b66d
mov byte [ebp - 0x24], al
mov eax, dword [0x447fe8]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x42b3da
test eax, eax
jne 0x42b44b
mov dword [0x447fe8], ecx
push 0x42f2f4
push 0x42f2dc
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x42b42e
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x42b532
push 0x42f2d8
push 0x42f2b0
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x447fe8], 2
jmp 0x42b450
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.0042b7ff
pop ecx
call fcn.0042c0db
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x42b480
push esi
call fcn.0042b772
pop ecx
test al, al
je 0x42b480
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.0042c316
call esi
call fcn.0042c0e1
mov esi, eax
cmp dword [esi], edi
je 0x42b49e
push esi
call fcn.0042b772
pop ecx
test al, al
je 0x42b49e
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
push edi
call sub.VCRUNTIME140.dll___telemetry_main_invoke_trigger
pop ecx
call fcn.0042c1fc
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_narrow_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
push edi
call sub.VCRUNTIME140.dll___telemetry_main_return_trigger
pop ecx
call fcn.0042c22f
test al, al
jne 0x42b4d7
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test bl, bl
jne 0x42b4e0
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.0042b81c
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x42b532
call fcn.0042bea4
ret
call fcn.0042b247
jmp 0x42b3c2

Function at 0x43b64c
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x43b3c1
inc edx
or edi, edx
call fcn.0043b678
or edi, edx
xor dword [ecx], esi
and edi, edi
inc edi
add edx, edi
add ecx, 1
add edi, edi
and edx, edx
cmp ecx, eax
jne fcn.0043b64c
add edx, edx
inc edi
ret
Function at 0x40e390
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc0
mov esi, dword [esp + 0xdc]
mov edi, dword [esp + 0xe0]
lea eax, [esp + 4]
push dword [esp + 0xd8]
push dword [esp + 0xd8]
push eax
call fcn.0040e580
add esp, 0xc
lea eax, [esp + 0xa0]
push edi
push esi
push eax
call fcn.0040e580
add esp, 0xc
lea ebp, [esp + 0x49]
lea esi, [esp + 0x60]
nop dword [eax]
movzx edx, byte [esp + 0xc]
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edi, esi
cmp dl, 6
je 0x40e415
lea esi, [esp + 4]
mov ebx, dword [esi + 0x18]
movsd xmm0, qword [esi + 9]
movsd xmm1, qword [esi + 0x11]
mov dword [esp + 0x6f], ebx
movsd qword [esp + 0x68], xmm1
movsd qword [esp + 0x60], xmm0
mov dword [esp + 0x40], eax
movzx ebx, byte [esp + 0x20]
movsd xmm1, qword [esp + 0x68]
mov eax, dword [esp + 0x6f]
movzx esi, word [esp + 0x21]
movsd xmm0, qword [esp + 0x60]
mov dword [esp + 0x44], ecx
mov byte [esp + 0x48], dl
movsd qword [ebp + 8], xmm1
mov dword [ebp + 0xf], eax
lea eax, [esp + 0x40]
test bl, bl
movsd qword [ebp], xmm0
setne byte [esp + 0x5c]
mov word [esp + 0x5d], si
push eax
mov esi, edi
push edi
call fcn.0040dfa0
add esp, 8
lea eax, [esp + 0xa0]
push eax
lea edi, [esp + 0x84]
push edi
call fcn.0040dfa0
add esp, 8
mov ecx, dword [esp + 0x80]
cmp dword [esp + 0x60], 5
je 0x40e4d5
cmp ecx, 5
je 0x40e4dc
mov ecx, esi
mov edx, edi
call fcn.00411d60
test al, al
je 0x40e525
movsd xmm1, qword [esp + 0x48]
movsd xmm0, qword [esp + 0x40]
movsd xmm2, qword [esp + 0x50]
movsd qword [esp + 0xc], xmm1
movsd xmm1, qword [esp + 0x58]
movsd qword [esp + 4], xmm0
movsd qword [esp + 0x14], xmm2
movsd qword [esp + 0x1c], xmm1
jmp 0x40e3e0
mov al, 2
cmp ecx, 5
jne 0x40e51d
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 4]
movsd xmm0, qword [esp + 0x14]
movsd xmm1, qword [esp + 0xc]
mov dword [esp + 0x3c], eax
movzx eax, word [ecx + 0x1d]
movsd qword [esp + 0x34], xmm0
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x2c], xmm1
mov word [esp], ax
mov al, byte [ecx + 0x1f]
movsd qword [esp + 0x24], xmm0
mov byte [esp + 2], al
mov eax, ebx
cmp al, 2
jne 0x40e52b
xor eax, eax
jmp 0x40e575
mov al, 2
cmp al, 2
je 0x40e521
mov ecx, dword [esp + 0x3c]
movsd xmm0, qword [esp + 0x34]
movsd xmm2, qword [esp + 0x24]
movsd xmm1, qword [esp + 0x2c]
mov dword [esp + 0x78], ecx
movsd qword [esp + 0x70], xmm0
movsd qword [esp + 0x68], xmm1
movsd qword [esp + 0x60], xmm2
mov byte [esp + 0x7c], al
movzx eax, word [esp]
mov word [esp + 0x7d], ax
mov al, byte [esp + 2]
mov byte [esp + 0x7f], al
push esi
call fcn.0040d970
add esp, 4
add esp, 0xc0
pop esi
pop edi
pop ebx
pop ebp
ret