joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003d95c
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x10060826
call fcn.10044dac
mov esi, dword [ebp + 8]
cmp esi, dword [0x1009b844]
jne 0x1003d97a
xor eax, eax
jmp 0x1003dadf
and dword [ebp - 0x1c], 0
xor ecx, ecx
mov dword [ebp - 0x18], ecx
xor ebx, ebx
or edi, 0xffffffff
test ebx, ebx
jne 0x1003d99d
cmp dword [0x1009b838], ebx
je 0x1003da9f
push 2
pop edi
jmp 0x1003d9b7
cmp ebx, 1
jne 0x1003da9f
mov eax, esi
call fcn.1003d8f8
test al, al
je 0x1003da9f
xor edi, edi
and dword [ebp - 0x10], 0
lea ecx, [ebp + 0xb]
mov dword [ebp - 0x20], edi
call fcn.1003d91a
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
push eax
movzx eax, word [esi + 0xc]
shr eax, 1
and eax, 0x10
or eax, edi
jmp 0x1003da62
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x1003d9eb
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
lea ecx, [ebp - 0x18]
push ecx
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 0
push dword [esi]
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
cmp dword [ebp - 0x18], 2
mov edi, eax
jae 0x1003da17
cmp dword [ebp - 0x1c], 1
je 0x1003da14
cmp dword [ebp - 0x1c], 2
jne 0x1003da17
push 2
pop edi
mov eax, edi
call fcn.1003d111
test eax, eax
je 0x1003da7f
push 0x1c0496
xor edi, edi
push edi
call fcn.10043be9
mov eax, dword [esi + 8]
movzx eax, word [eax + 6]
push dword [ebp - 0x10]
and eax, 0xf
imul eax, eax, 0xc
mov ecx, 0x1009b848
mov dword [eax + 0x10069520], edi
call fcn.10043be9
movzx eax, word [esi + 0xc]
shr eax, 1
and eax, 0x10
or eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
push edi
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [esi + 8]
call fcn.1003d228
mov edi, eax
test edi, edi
je 0x1003d9df
jmp 0x1003da90
push dword [ebp - 0x10]
mov ecx, 0x1009b848
call fcn.10043be9
test edi, edi
je 0x1003daab
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xb]
call fcn.1003d93b
mov ecx, dword [ebp - 0x18]
inc ebx
cmp ebx, 2
jl 0x1003d985
jmp 0x1003daba
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xb]
call fcn.1003d93b
mov ecx, dword [ebp - 0x18]
test edi, edi
jne 0x1003dad5
cmp dword [ebp - 0x1c], 2
je 0x1003dacd
mov al, byte [esi + 0xc]
and al, 0xf
cmp al, 2
jne 0x1003dadd
push ecx
call fcn.10043be9
jmp 0x1003dadb
push esi
call fcn.10043be9
mov ecx, eax
mov eax, ecx
call fcn.10044e84
ret 4
Function at 0x10043be9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x10043bf8
pop dword [ebp - 0x40]
mov eax, 0x4d8ac613
add eax, 0xc27975e5
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xe145dec2
add dword [ebp - 0x50], 0x6d0c6689
mov dword [ebp - 0x4c], 0xc5714bb4
add dword [ebp - 0x4c], 0x6cc20091
mov dword [ebp - 0x48], 0x4a9aa249
add dword [ebp - 0x48], 0x1b1a1e5
mov dword [ebp - 0x44], 0x4e51ea88
sub dword [ebp - 0x44], 0x4e51ea88
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x8c232d63
sub dword [ebp - 0x50], 0x17b0c40d
mov dword [ebp - 0x4c], 0x4cd95b49
sub dword [ebp - 0x4c], 0xb6cf9d4
mov dword [ebp - 0x48], 0xf95d8fbf
add dword [ebp - 0x48], 0x6a11dcad
mov dword [ebp - 0x44], 0x4928fa0d
sub dword [ebp - 0x44], 0x4928fa0d
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x57dcab05
sub eax, 0x47dc98b9
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x491fb
push 0
call eax
mov ecx, 0x178626c4
add ecx, 0xe87a1f70
mov edx, eax
mov ebx, 0x100d2400
add ebx, dword [ebp - 0x40]
mov edi, 0x200490e
add dword [ebp - 4], edx
mov esi, dword [ebx]
xor dword [ebp - 8], 0xca5f22b1
xor esi, edi
add dword [ebp - 8], 0xbedc8da7
mov dword [edx], esi
xor dword [ebp - 8], edx
add edx, 0xa650e70d
add edx, 0x59af18f7
add ebx, 4
loop 0x10043d09
add eax, 0x10ba3
xor ebx, ebx
add ebx, eax
add eax, 0x813815fb
add eax, 0x7ec7ea0a
mov ecx, 0x6f308dba
sub ecx, 0x5f308dba
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x100443d6
Capabilities:
Accept command line arguments

Disassembly:
push 8
push 0x10065410
call fcn.100491c2
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x10044464
call fcn.10049190
test eax, eax
jne 0x100443fa
xor eax, eax
jmp 0x10044530
call fcn.10048570
test eax, eax
jne 0x1004440a
call fcn.100491ae
jmp 0x100443f3
call fcn.10049144
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x100a4814], eax
call fcn.10043be9
mov dword [0x1009c15c], eax
call fcn.10043be9
test eax, eax
jns 0x10044434
call fcn.10048249
jmp 0x10044403
call fcn.10043be9
test eax, eax
js 0x1004445d
call fcn.10048d7a
test eax, eax
js 0x1004445d
push 0
call fcn.10043be9
pop ecx
test eax, eax
jne 0x1004445d
inc dword [0x1009c158]
jmp 0x1004452d
call fcn.10048d27
jmp 0x1004442d
xor edi, edi
cmp eax, edi
jne 0x100444c3
cmp dword [0x1009c158], edi
jle 0x100443f3
dec dword [0x1009c158]
mov dword [ebp - 4], edi
cmp dword [0x1009c4d4], edi
jne 0x10044488
call fcn.10048ab5
cmp dword [ebp + 0x10], edi
jne 0x1004449c
call fcn.10048d27
call fcn.10048249
call fcn.100491ae
mov dword [ebp - 4], 0xfffffffe
call fcn.100444af
jmp 0x1004452d
cmp eax, 2
jne 0x10044521
call fcn.10048215
push 0x214
push 1
call fcn.10043be9
pop ecx
pop ecx
mov esi, eax
cmp esi, edi
je 0x100443f3
push esi
push dword [0x10099c00]
push dword [0x1009c4b4]
call dword [sym.imp.kernel32.dll_DecodePointer]
call eax
test eax, eax
je 0x10044515
push edi
push esi
call fcn.1004828a
pop ecx
pop ecx
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
mov dword [esi], eax
or dword [esi + 4], 0xffffffff
jmp 0x1004452d
push esi
call fcn.10043be9
pop ecx
jmp 0x100443f3
cmp eax, 3
jne 0x1004452d
push edi
call fcn.10043be9
pop ecx
xor eax, eax
inc eax
call fcn.10049207
ret 0xc

Function at 0x10044d52
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10099bf8]
jne 0x10045df9
repz ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x1009c280], eax
mov dword [0x1009c27c], ecx
mov dword [0x1009c278], edx
mov dword [0x1009c274], ebx
mov dword [0x1009c270], esi
mov dword [0x1009c26c], edi
mov word [0x1009c298], ss
mov word [0x1009c28c], cs
mov word [0x1009c268], ds
mov word [0x1009c264], es
mov word [0x1009c260], fs
mov word [0x1009c25c], gs
pushfd
pop dword [0x1009c290]
mov eax, dword [ebp]
mov dword [0x1009c284], eax
mov eax, dword [ebp + 4]
mov dword [0x1009c288], eax
lea eax, [ebp + 8]
mov dword [0x1009c294], eax
mov eax, dword [ebp - 0x320]
mov dword [0x1009c1d0], 0x10001
mov eax, dword [0x1009c288]
mov dword [0x1009c184], eax
mov dword [0x1009c178], 0xc0000409
mov dword [0x1009c17c], 1
mov eax, dword [0x10099bf8]
mov dword [ebp - 0x328], eax
mov eax, dword [0x10099bfc]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x1009c1c8], eax
push 1
call fcn.1004cb7b
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x10010bdc
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x1009c1c8], 0
jne 0x10045ee5
push 1
call fcn.1004cb7b
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x414c10
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x414d1c
test eax, eax
je 0x414d1c
push esi
push edi
mov ecx, 0x10
mov esi, 0x42ffe8
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x414d03
lea edi, [eax + 4]
jmp 0x414c67
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x414c7c
mov dword [ebp - 4], 2
jmp 0x414c9d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x414c93
mov dword [ebp - 4], 1
jmp 0x414c9d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x414d13
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x414cd6
mov byte [ecx], 0x3d
jmp 0x414ce2
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x414ced
mov byte [ecx], 0x3d
jmp 0x414cf3
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x414c64
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x408784
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x408784
lcall 0x5de5, 0x8b10c483
jmp int.008417c4
Function at 0x40632d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x40633c
pop dword [ebp - 0x48]
mov eax, 0x11eccaf0
add eax, 0xee53984c
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x3ea90b63
sub dword [ebp - 0x58], 0xf056c618
mov dword [ebp - 0x54], 0xa0f3b0d6
sub dword [ebp - 0x54], 0x6ec06491
mov dword [ebp - 0x50], 0xd6aa196a
add dword [ebp - 0x50], 0x75a22ac4
mov dword [ebp - 0x4c], 0x835b8d73
add dword [ebp - 0x4c], 0x7ca4728d
lea eax, [ebp - 0x58]
push eax
mov eax, 0x593ccadf
sub eax, 0x58fc5a7f
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x75516970
add dword [ebp - 0x58], 0xff20ffe6
mov dword [ebp - 0x54], 0xee69b534
add dword [ebp - 0x54], 0x5302ac41
mov dword [ebp - 0x50], 0xfa5ea367
sub dword [ebp - 0x50], 0x96ef36fb
mov dword [ebp - 0x4c], 0x2a74af37
sub dword [ebp - 0x4c], 0x2a74af37
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x39ac1
push 0
call eax
mov ecx, 0xe4b5f456
add ecx, 0x1b4a5fe1
xor esi, esi
add esi, eax
mov edi, 0x83786f86
sub edi, 0x83376f86
add edi, dword [ebp - 0x48]
mov ebx, 0xa47ff3b2
mov dword [ebp - 0x10], 0xefd599a8
mov edx, dword [edi]
xor dword [ebp - 0x28], 0x4cb2afe4
sub edx, ebx
add dword [ebp - 8], edx
mov dword [esi], edx
xor dword [ebp - 0x2c], 0xbd5d5db8
add esi, 4
add edi, 0xea33a5c8
add edi, 0x15cc5a3c
loop 0x406455
add eax, 0x143af
mov ebx, eax
add eax, 0xe8231a2b
sub eax, 0xe8231a26
mov ecx, 0x400000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x4088f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, edx
mov edx, dword [esp + 0x20]
mov dword [esp + 4], ecx
xor ecx, ecx
mov esi, edi
and esi, 3
je 0x4089da
mov eax, 4
sub eax, esi
je 0x4089da
cmp eax, edx
mov ebp, edi
cmova eax, edx
xor esi, esi
mov dword [esp + 8], ebp
lea ecx, [edi + eax]
mov edx, eax
mov edi, eax
mov dword [esp], ecx
mov ecx, dword [esp + 4]
nop word cs:[eax + eax]
mov ebx, dword [esp]
sub ebx, ebp
cmp ebx, 3
jbe 0x4089a5
movzx ebx, byte [ebp]
xor eax, eax
cmp bl, cl
setne al
add esi, eax
cmp bl, cl
je 0x408ae0
movzx eax, byte [ebp + 1]
xor ebx, ebx
cmp al, cl
setne bl
add esi, ebx
cmp al, cl
je 0x408ae0
movzx eax, byte [ebp + 2]
xor ebx, ebx
cmp al, cl
setne bl
add esi, ebx
cmp al, cl
je 0x408ae0
movzx eax, byte [ebp + 3]
add ebp, 4
xor ebx, ebx
cmp al, cl
setne bl
add edi, 0xfffffffc
add esi, ebx
cmp al, cl
jne 0x408940
jmp 0x408ae0
mov ebx, 1
sub ebx, esi
nop dword [eax]
test edi, edi
je 0x4089d0
dec edi
dec ebx
cmp byte [ebp], cl
lea ebp, [ebp + 1]
jne 0x4089b0
sete al
inc al
movzx esi, al
and esi, 1
sub esi, ebx
jmp 0x408ae0
mov ecx, edx
mov edx, dword [esp + 0x20]
mov edi, dword [esp + 8]
cmp edx, 8
jb 0x408a49
lea esi, [edx - 8]
cmp ecx, esi
ja 0x408a49
movzx eax, byte [esp + 4]
movdqa xmm1, xmmword [0x42f1e0]
movaps xmm2, xmmword [0x42f1f0]
imul eax, eax, 0x1010101
movd xmm0, eax
pshufd xmm0, xmm0, 0x44
nop dword [eax]
movsd xmm3, qword [edi + ecx]
shufps xmm3, xmm3, 0xd4
xorps xmm3, xmm0
movaps xmm4, xmm3
paddq xmm4, xmm1
andnps xmm3, xmm4
andps xmm3, xmm2
movd eax, xmm3
pshufd xmm3, xmm3, 0x4e
movd ebx, xmm3
or ebx, eax
jne 0x408a41
add ecx, 8
cmp ecx, esi
jbe 0x408a10
cmp ecx, edx
ja 0x408af8
mov ebx, dword [esp + 4]
lea ebp, [edi + ecx]
add edi, edx
sub edx, ecx
xor esi, esi
mov dword [esp], ecx
nop dword [eax]
mov eax, edi
sub eax, ebp
cmp eax, 3
jbe 0x408ab5
movzx ecx, byte [ebp]
xor eax, eax
cmp cl, bl
setne al
add esi, eax
cmp cl, bl
je 0x408add
movzx eax, byte [ebp + 1]
xor ecx, ecx
cmp al, bl
setne cl
add esi, ecx
cmp al, bl
je 0x408add
movzx eax, byte [ebp + 2]
xor ecx, ecx
cmp al, bl
setne cl
add esi, ecx
cmp al, bl
je 0x408add
movzx eax, byte [ebp + 3]
add ebp, 4
xor ecx, ecx
cmp al, bl
setne cl
add edx, 0xfffffffc
add esi, ecx
cmp al, bl
jne 0x408a60
jmp 0x408add
mov eax, dword [esp + 4]
neg esi
nop dword [eax + eax]
test edx, edx
je 0x408aef
dec edx
dec esi
cmp byte [ebp], al
lea ebp, [ebp + 1]
jne 0x408ac0
sete al
not esi
inc al
movzx eax, al
and eax, 1
add esi, eax
add esi, dword [esp]
mov eax, 1
mov edx, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
neg esi
xor eax, eax
add esi, dword [esp]
jmp 0x408ae5
call fcn.00407390
ud2
Function at 0x411ad0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
cmp eax, 3
je 0x411ae4
test eax, eax
jne 0x411c76
mov edi, dword [0x43a9b4]
test edi, edi
je 0x411c76
xor ebx, ebx
push dword [edi + 4]
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
jne 0x411b13
mov edi, dword [edi + 8]
test edi, edi
je 0x411b2e
push dword [edi + 4]
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x411b00
mov esi, eax
push 0
push dword [edi + 4]
call sub.KERNEL32.dll_TlsSetValue
push esi
call dword [edi]
add esp, 4
mov bl, 1
mov edi, dword [edi + 8]
test edi, edi
jne 0x411b07
test bl, 1
je 0x411c76
mov edi, dword [0x43a9b4]
test edi, edi
je 0x411c76
xor ebx, ebx
push dword [edi + 4]
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
jne 0x411b73
nop word cs:[eax + eax]
nop dword [eax]
mov edi, dword [edi + 8]
test edi, edi
je 0x411b8e
push dword [edi + 4]
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x411b60
mov esi, eax
push 0
push dword [edi + 4]
call sub.KERNEL32.dll_TlsSetValue
push esi
call dword [edi]
add esp, 4
mov bl, 1
mov edi, dword [edi + 8]
test edi, edi
jne 0x411b67
test bl, 1
je 0x411c76
mov edi, dword [0x43a9b4]
test edi, edi
je 0x411c76
xor ebx, ebx
push dword [edi + 4]
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
jne 0x411bd3
nop word cs:[eax + eax]
nop dword [eax]
mov edi, dword [edi + 8]
test edi, edi
je 0x411bee
push dword [edi + 4]
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x411bc0
mov esi, eax
push 0
push dword [edi + 4]
call sub.KERNEL32.dll_TlsSetValue
push esi
call dword [edi]
add esp, 4
mov bl, 1
mov edi, dword [edi + 8]
test edi, edi
jne 0x411bc7
test bl, 1
je 0x411c76
mov edi, dword [0x43a9b4]
test edi, edi
je 0x411c76
xor ebx, ebx
push dword [edi + 4]
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
jne 0x411c23
nop
mov edi, dword [edi + 8]
test edi, edi
je 0x411c3e
push dword [edi + 4]
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x411c10
mov esi, eax
push 0
push dword [edi + 4]
call sub.KERNEL32.dll_TlsSetValue
push esi
call dword [edi]
add esp, 4
mov bl, 1
mov edi, dword [edi + 8]
test edi, edi
jne 0x411c17
test bl, 1
je 0x411c76
mov edi, dword [0x43a9b4]
test edi, edi
jne 0x411c56
jmp 0x411c76
mov edi, dword [edi + 8]
test edi, edi
je 0x411c76
push dword [edi + 4]
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x411c4f
mov esi, eax
push 0
push dword [edi + 4]
call sub.KERNEL32.dll_TlsSetValue
push esi
call dword [edi]
add esp, 4
jmp 0x411c4f
mov al, byte [0x43703c]
pop esi
pop edi
pop ebx
ret 0xc
Function at 0x411cb0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x41fb90
mov esi, ecx
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov ecx, 0x43a9e4
mov dword fs:[0], eax
call fcn.00412f90
mov dword [ebp - 0x20], 0x43a9e4
mov edi, dword [esi]
test edi, edi
jne 0x411d55
mov ebx, dword [esi + 4]
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x411d77
mov edi, eax
test ebx, ebx
je 0x411d4d
call sub.KERNEL32.dll_GetProcessHeap
push 0xc
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x411dcb
mov dword [eax], ebx
mov dword [eax + 4], edi
mov dword [eax + 8], 0
mov ecx, eax
mov eax, dword [0x43a9b4]
nop word cs:[eax + eax]
nop dword [eax]
mov dword [ecx + 8], eax
lock cmpxchg dword [0x43a9b4], ecx
jne 0x411d40
mov eax, edi
test edi, edi
xchg dword [esi], eax
je 0x411d97
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x10], 0xffffffff
call fcn.004130b0
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, edi
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
mov ecx, str.assertion_failed:_key___c::TLS_OUT_OF_INDEXES
mov edx, 0x2e
push 0x431e9c
call fcn.00413080
add esp, 4
jmp 0x411dc9
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x38], 0x431eac
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x28], 4
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x10], 0
call fcn.004139c0
ud2
mov ecx, 0xc
mov edx, 4
call fcn.00404cd0
ud2

Function at 0x411e00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
sub esp, 0xc
mov eax, dword [0x43a064]
test eax, eax
je 0x411e27
push eax
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x411e3b
xor edi, edi
mov esi, eax
cmp eax, 1
je 0x411eb7
jmp 0x411e77
mov ecx, 0x43a064
call fcn.00411cb0
push eax
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
jne 0x411e18
call sub.KERNEL32.dll_GetProcessHeap
push 0x10
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x411ebf
mov dword [eax], 0
mov dword [eax + 0xc], 0x43a064
mov esi, eax
mov eax, dword [0x43a064]
test eax, eax
jne 0x411e70
mov ecx, 0x43a064
call fcn.00411cb0
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov eax, dword [esi + 8]
lea edi, [esi + 4]
mov dword [esi], 1
mov dword [esi + 4], 0
mov dword [esi + 8], 0
test ecx, ecx
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], eax
je 0x411eb7
test eax, eax
je 0x411eb7
lock dec dword [eax]
jne 0x411eb7
lea ecx, [esp + 8]
call fcn.00412270
mov eax, edi
add esp, 0xc
pop esi
pop edi
ret
mov ecx, 0x10
mov edx, 4
call fcn.00404cd0
ud2
Function at 0x413760
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x43a084]
test eax, eax
je 0x41377e
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x413793
cmp dword [eax], 1
mov esi, eax
jne 0x413793
jmp 0x4137f6
mov ecx, 0x43a084
call fcn.00411cb0
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jae 0x413775
mov eax, dword [0x43a084]
test eax, eax
je 0x4137fd
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x413812
mov esi, eax
test eax, eax
jne 0x4137e9
call sub.KERNEL32.dll_GetProcessHeap
push 0xc
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x413818
mov dword [eax], 0
mov dword [eax + 8], 0x43a084
mov esi, eax
mov eax, dword [0x43a084]
test eax, eax
jne 0x4137e2
mov ecx, 0x43a084
call fcn.00411cb0
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov dword [esi + 4], 0
mov dword [esi], 1
add esi, 4
mov eax, esi
pop esi
ret
mov ecx, 0x43a084
call fcn.00411cb0
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jne 0x4137a7
xor esi, esi
mov eax, esi
pop esi
ret
mov ecx, 0xc
mov edx, 4
call fcn.00404cd0
ud2
Function at 0x42fb71
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x43757a
call fcn.004339e0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x43c770
mov dword [esi + 4], 0x43c758
mov dword [esi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.004028e9
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x24], 1
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov byte [esi + 0x4c], bl
mov byte [esi + 0x4d], bl
mov dword [esi], 0x43c73c
mov dword [esi + 4], 0x43c724
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x430a10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x430a1f
pop dword [ebp - 0x28]
mov eax, 0x6c42722f
sub eax, 0x6bff6810
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x3c007
push 0
mov eax, 0x3eaf570
sub eax, 0x3a77540
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x29114218
sub ecx, 0x2910f4e0
mov edi, eax
mov esi, 0x96efb9fd
sub esi, 0x96aaf3fd
add esi, dword [ebp - 0x28]
mov ebx, 0x39884fef
mov edx, dword [esi]
add edx, ebx
mov dword [ebp - 4], 0x2f117bc3
mov dword [edi], edx
xor dword [ebp - 0x24], 0xb98e0705
add edi, 0x1a46f4d2
sub edi, 0x1a46f4ce
add esi, 0x71e23680
sub esi, 0x71e2367c
loop 0x430a78
add eax, 0xa4c15ec8
add eax, 0x5b3fc8eb
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x433770
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x433799
xor eax, eax
ret 4
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x4337a8
mov eax, 1
ret 4