joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417da1
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x487f90]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x417de4
cmp word [esi], dx
jne 0x417de4
or byte [edi + eax + 0x28], 4
jmp 0x417de9
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x417f3c
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x417f1c
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x417e2b
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x417e61
cmp eax, edx
jae 0x417e6d
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x417e03
jmp 0x417f3c
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x417f18
cmp dword [ebp - 0x14], 0
je 0x417f18
mov eax, dword [ebx*4 + 0x487f90]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x417ef0
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x417eb9
mov word [esi], cx
jmp 0x417eec
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x487f90]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x487f90]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x487f90]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x417f3c
pop ebx
cmp word [ebp - 4], bx
jne 0x417f01
cmp esi, dword [ebp + 0xc]
jne 0x417f01
mov word [esi], bx
jmp 0x417f39
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.004187d5
add esp, 0x10
cmp word [ebp - 4], bx
je 0x417f3c
push 0xd
jmp 0x417f35
mov ecx, dword [ebx*4 + 0x487f90]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x417f33
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x417f3c
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10002d60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002216a
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x1002d1d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x18], esi
call fcn.1000c641
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x10002e06
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], str.bad_locale_name
push eax
lea ecx, [ebp - 0x24]
call fcn.1000e760
push 0x1002b0d0
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], vtable.std::runtime_error.0
push eax
call fcn.1000d853
push edi
push esi
call fcn.1000cc85
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000d844
mov esp, ebp
pop ebp
ret 4
Function at 0x100039f0
Capabilities:
Check if file exists
Create directory
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10022230
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x1002d1d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x14], 0
call fcn.10001300
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x10003a40
push 0x80004005
call fcn.100039d0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [esi]
or edi, 0xffffffff
mov dword [ebp - 4], 0
cmp dword [eax - 0xc], 0
je 0x10003ae9
push eax
push eax
call fcn.1000e674
add esp, 8
test eax, eax
jns 0x10003ae9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x10003a81
cmp eax, 3
jne 0x10003ae9
push 0x5c
push dword [esi]
call fcn.1000e5ce
add esp, 8
test eax, eax
jne 0x10003a96
or eax, 0xffffffff
jmp 0x10003a9a
sub eax, dword [esi]
sar eax, 1
push eax
lea eax, [ebp - 0x18]
mov ecx, esi
push eax
call fcn.10003e90
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.100034c0
mov edx, dword [ebp - 0x18]
mov ecx, edi
add edx, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10003ad3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x14]
push eax
call fcn.100039f0
add esp, 4
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x10003b0a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000d844
mov esp, ebp
pop ebp
ret

Function at 0x10004040
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1002d1d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push edx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100040cb
mov eax, dword [ebp - 8]
cmp eax, 1
je 0x1000408d
cmp eax, 2
jne 0x100040a9
mov ecx, dword [ebp - 0xc]
test esi, esi
je 0x100040c5
test ecx, ecx
je 0x100040c0
test cl, 1
jne 0x100040a9
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x100040c5
pop edi
mov eax, 0xd
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000d844
mov esp, ebp
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1000d844
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10004f90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x1002d1d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x80
push edi
mov edi, 0x10031008
push 0x104
push 0
push edi
call fcn.1000e300
add esp, 0xc
add edi, 0x208
dec ebx
jne 0x10004fb0
mov edi, dword [ebp + 0xc]
cmp edi, 0x80
jae 0x100050d4
test edi, edi
jne 0x100050ae
xor eax, eax
mov dword [ebp - 0x1c], 0x680063
mov word [ebp - 8], ax
mov word [ebp - 0x38], ax
lea eax, [ebp - 0x1c]
push eax
push 0x104
push 0x10031008
mov dword [ebp - 0x18], 0x6f0072
mov dword [ebp - 0x14], 0x65006d
mov dword [ebp - 0x10], 0x65002e
mov dword [ebp - 0xc], 0x650078
mov dword [ebp - 0x34], 0x690066
mov dword [ebp - 0x30], 0x650072
mov dword [ebp - 0x2c], 0x6f0066
mov dword [ebp - 0x28], 0x2e0078
mov dword [ebp - 0x24], 0x780065
mov dword [ebp - 0x20], 0x65
mov dword [ebp - 0x50], 0x650069
mov dword [ebp - 0x4c], 0x700078
mov dword [ebp - 0x48], 0x6f006c
mov dword [ebp - 0x44], 0x650072
mov dword [ebp - 0x40], 0x65002e
mov dword [ebp - 0x3c], 0x650078
call fcn.1000e572
lea eax, [ebp - 0x34]
push eax
push 0x104
push 0x10031210
call fcn.1000e572
lea eax, [ebp - 0x50]
push eax
push 0x104
push 0x10031418
call fcn.1000e572
add esp, 0x24
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000d844
mov esp, ebp
pop ebp
ret
mov ebx, 0x10031008
sub ebx, esi
test esi, esi
je 0x100050cb
push esi
lea eax, [ebx + esi]
push 0x104
push eax
call fcn.1000e572
add esp, 0xc
add esi, 0x208
dec edi
jne 0x100050b5
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000d844
mov esp, ebp
pop ebp
ret

Function at 0x10005300
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10005315
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10005354
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x10005350
lea ebx, [ebx]
cmp esi, edx
jae 0x10005354
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x10005340
cmp esi, edx
jb 0x10005359
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
Function at 0x4012f0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x45a004]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ebp + 8], 0
je 0x401341
push 8
lea eax, [ebp - 0x14]
push eax
push 3
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea eax, [ebp - 0x14]
push eax
call fcn.00401000
push eax
push str.__s_.dll
lea eax, [ebp - 0x424]
push 0x104
push eax
call fcn.00401460
add esp, 0x14
jmp 0x40135a
push str._enu_.dll
lea eax, [ebp - 0x424]
push 0x104
push eax
call fcn.0040f7fb
add esp, 0xc
push 0x104
lea eax, [ebp - 0x21c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x21c]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401380
lea eax, [ebp - 0x424]
sub ecx, edx
push eax
sar ecx, 1
mov eax, pe_nt_image_headers32
sub eax, ecx
push eax
lea eax, [ebp + ecx*2 - 0x224]
push eax
call fcn.0040f7fb
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov dword [0x45ab04], eax
call fcn.00403e99
mov esp, ebp
pop ebp
ret
Function at 0x40861f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.004076c7
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040767c
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.004076b7
and dword [ebp + 0x4683dc7], edx
add dword [eax], eax
add byte [ebp - 0x12b7b], cl
call dword [eax - 1]
xchg ebp, eax
sub al, 0xfc
invalid

Function at 0x408a91
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp - 0x378]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax - 0x1d]
push eax
lea eax, [ebp - 0x394]
push eax
call fcn.00407628
add esp, 0xc
and dword [ebp - 0x700], 0
jmp 0x408ac4
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x408b0d
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x408ab7
invalid
movsd dword es:[edi], dword [esi]

Function at 0x409099
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 1
pop eax
test eax, eax
je 0x40975d
lea eax, [ebp - 0x230]
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x6fc], 0
jne 0x409232
and byte [ebp - 0x77c], 0
and byte [ebp - 0x77b], 0
mov byte [ebp - 0x77a], 4
and byte [ebp - 0x779], 0
mov byte [ebp - 0x778], 0xb8
mov byte [ebp - 0x777], 0xc1
mov byte [ebp - 0x776], 0xa7
mov byte [ebp - 0x775], 0xab
mov byte [ebp - 0x774], 0x89
invalid
invalid
invalid
clc

Function at 0x433c18
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004335e0

Function at 0x435a40
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00435914

Function at 0x442da9
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004429a1

Function at 0x442db4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00442b2b
Function at 0x4015e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov eax, edx
push esi
dec edx
test eax, eax
mov eax, dword [esp + 0xc]
je 0x401618
xor ebx, ebx
inc ecx
movzx esi, ax
shr eax, 8
mov bl, byte [ecx - 1]
xor ebx, esi
and ebx, 0xff
mov esi, dword [ebx*4 + 0x407080]
xor esi, eax
mov eax, esi
mov esi, edx
dec edx
test esi, esi
jne 0x4015ed
pop esi
pop ebx
ret 4
pop esi
pop ebx
ret 4
Function at 0x40c440
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x28
mov ebx, dword [sym.imp.msvcrt.dll__iob]
lea eax, [esp + 0x34]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
add ebx, 0x40
mov dword [esp + 0xc], ebx
mov dword [esp], str.Mingw_runtime_failure:_n
mov dword [esp + 0x1c], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x1c]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]

Function at 0x40c4a0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x5c
mov dword [esp + 0x4c], ebx
mov ebx, eax
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [esp + 0x50], esi
mov esi, edx
mov dword [esp + 0x54], edi
mov edi, ecx
mov dword [esp + 0x58], ebp
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x40c596
mov eax, dword [esp + 0x38]
cmp eax, 4
jne 0x40c510
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
mov ebx, dword [esp + 0x4c]
mov esi, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
mov ebp, dword [esp + 0x58]
add esp, 0x5c
ret
cmp eax, 0x40
je 0x40c4e5
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov eax, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
cmp eax, 0x40
setne byte [esp + 0x1e]
cmp eax, 4
setne byte [esp + 0x1f]
call sub.msvcrt.dll_memcpy
cmp byte [esp + 0x1f], 0
je 0x40c4f5
cmp byte [esp + 0x1e], 0
je 0x40c4f5
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
jmp 0x40c4f5
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.0040c440
nop

Function at 0x40c830
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x41ea94
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [0x41eaac]
sub esp, 4
test ebx, ebx
je 0x40c87b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov esi, eax
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x40c874
test esi, esi
je 0x40c874
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x40c850
mov dword [esp], 0x41ea94
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret
Function at 0x40dce0
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov esi, eax
lea eax, [eax + 0x41]
and eax, 0xfffffff0
call fcn.0040dae0
mov edx, 0x326d
sub esp, eax
lea eax, [esp + 0x1b]
mov dword [esp + 8], esi
lea edi, [esp + 0xc]
mov dword [esp + 4], ebx
mov dword [esp], eax
mov word [esp + 0x18], dx
mov dword [esp + 0xc], 0x2d636367
mov dword [esp + 0x10], 0x656d6873
mov dword [esp + 0x14], 0x64742d6d
mov byte [esp + 0x1a], 0x2d
call sub.msvcrt.dll_memcpy
lea eax, [esi + 0x10]
mov dword [ebp - 0x1c], eax
add eax, edi
mov dword [eax], 0x61616161
mov dword [eax + 4], 0x61616161
mov dword [eax + 8], 0x61616161
mov dword [eax + 0xc], 0x61616161
mov dword [eax + 0x10], 0x61616161
mov dword [eax + 0x14], 0x61616161
mov dword [eax + 0x18], 0x61616161
mov dword [eax + 0x1c], 0x61616161
mov byte [esp + esi + 0x3c], 0
mov byte [esp + esi + 0x1b], 0
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateMutexA
mov byte [edi + esi + 0xf], 0x2d
sub esp, 0xc
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov dword [ebp - 0x20], eax
call sub.KERNEL32.dll_WaitForSingleObject
sub esp, 8
test eax, eax
je 0x40ddc6
int3
mov dword [esp], edi
call sub.KERNEL32.dll_FindAtomA
sub esp, 4
test ax, ax
jne 0x40de60
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov ebx, eax
mov eax, dword [ebp - 0x1c]
lea edx, [edi + eax]
mov eax, 0x20
bt ebx, eax
jae 0x40ddfa
mov byte [edx], 0x41
add edx, 1
sub eax, 1
jne 0x40ddf2
mov dword [esp], edi
call sub.KERNEL32.dll_AddAtomA
sub esp, 4
test ax, ax
je 0x40de56
lea ecx, [esi + 0x31]
mov esi, dword [ebp - 0x1c]
movzx eax, ax
mov edx, edi
mov dword [esp], esi
call fcn.0040dc70
cmp eax, ebx
mov esi, eax
je 0x40de77
mov dword [esp], ebx
call fcn.0040df50
mov edi, dword [ebp - 0x20]
mov dword [esp], edi
call sub.KERNEL32.dll_ReleaseMutex
sub esp, 4
mov dword [esp], edi
call sub.KERNEL32.dll_CloseHandle
mov eax, esi
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
int3
lea ecx, [esi + 0x31]
mov esi, dword [ebp - 0x1c]
movzx eax, ax
mov edx, edi
mov dword [esp], esi
call fcn.0040dc70
mov esi, eax
jmp 0x40de33
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [esp + 8], eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x40de33
mov dword [esp], ebx
call dword [ebp + 0x10]
jmp 0x40de33

Function at 0x40e09c
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
sub esp, 8
mov ebx, dword [0x41eaf8]
test ebx, ebx
je 0x40e0c4
call sub.KERNEL32.dll_TlsAlloc
mov dword [ebx], eax
mov eax, dword [0x41eaf8]
test eax, eax
je 0x40e0d4
cmp dword [eax], 0xffffffff
je 0x40e0e0
add esp, 8
pop ebx
ret
call fcn.0040e078
mov ebx, eax
mov dword [0x41eaf8], eax
jmp 0x40e0aa
call fcn.0040e078
mov dword [0x41eaf8], eax
jmp 0x40e0ba
call sub.msvcrt.dll_abort
lea esi, [esi]
Function at 0x40efb0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
lea ebx, [esp + 0x20]
mov esi, 0x41544c
mov ecx, 4
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x41eafc]
test eax, eax
je 0x40f108
cmp dword [eax], 1
je 0x40efe0
call fcn.0040ef40
mov eax, dword [0x41eaf8]
test eax, eax
je 0x40f118
mov eax, dword [eax]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
push esi
mov esi, eax
test eax, eax
je 0x40f008
mov eax, esi
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0040eab8
mov ebp, eax
mov ecx, dword [entry3]
test ecx, ecx
je 0x40effe
test eax, eax
je 0x40effe
mov dword [eax + 0x24], 1
call sub.KERNEL32.dll_GetCurrentThreadId
mov dword [ebp + 0x44], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call sub.KERNEL32.dll_CreateEventA
sub esp, 0x10
mov dword [ebp + 0x18], eax
mov dword [ebp + 0x1c], 0xffffffff
lea edi, [ebp + 0x34]
mov ecx, 4
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov dword [ebp + 0x6c], 0
mov dword [ebp + 0x14], 0
call sub.KERNEL32.dll_GetCurrentProcess
mov esi, eax
call sub.KERNEL32.dll_GetCurrentThread
mov ebx, eax
call sub.KERNEL32.dll_GetCurrentProcess
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
lea edx, [ebp + 0x14]
mov dword [esp + 0xc], edx
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.KERNEL32.dll_DuplicateHandle
sub esp, 0x1c
test eax, eax
je 0x40f133
mov eax, dword [ebp + 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_GetThreadPriority
push edx
mov dword [ebp + 0x74], eax
mov dword [ebp + 0x70], 0
mov al, byte [ebp + 0x20]
and eax, 0xffffffcf
or eax, 0x10
mov byte [ebp + 0x20], al
mov eax, dword [0x41eaf8]
test eax, eax
je 0x40f127
mov dword [esp + 4], ebp
mov eax, dword [eax]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsSetValue
sub esp, 8
test eax, eax
je 0x40f133
mov esi, ebp
jmp 0x40effe
call fcn.0040e054
mov dword [0x41eafc], eax
jmp 0x40efd6
call fcn.0040e078
mov dword [0x41eaf8], eax
jmp 0x40efed
call fcn.0040e078
mov dword [0x41eaf8], eax
jmp 0x40f0eb
call sub.msvcrt.dll_abort
xor eax, eax
ret
Function at 0x40fae0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [esp + 0x44]
lea ebx, [esp + 0x10]
mov esi, 0x41544c
mov ecx, 4
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
test eax, eax
je 0x40fb06
cmp eax, 3
je 0x40fb18
mov eax, 1
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
mov eax, dword [0x41eaf8]
test eax, eax
je 0x40fc84
cmp dword [eax], 0xffffffff
je 0x40fb06
mov eax, dword [0x41eaf8]
test eax, eax
je 0x40fca4
mov eax, dword [eax]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
push edx
mov ebp, eax
test eax, eax
je 0x40fb06
test byte [eax + 0x20], 0x30
jne 0x40fc3c
mov eax, dword [eax + 0x70]
test eax, eax
mov eax, dword [ebp + 0x18]
jne 0x40fc00
test eax, eax
je 0x40fb6d
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
push edi
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x70], 1
mov eax, dword [ebp + 0xbc]
mov dword [esp], eax
call fcn.0040f96c
test byte [ebp + 0x24], 4
je 0x40fc14
mov dword [ebp], 0xdeadbeef
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x40fbaa
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
push esi
mov dword [ebp + 0x14], 0
lea eax, [ebp + 0x1c]
mov dword [esp], eax
call fcn.00411b84
lea edi, [ebp + 0x34]
mov ecx, 4
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov eax, ebp
call fcn.0040e37c
mov eax, dword [0x41eaf8]
test eax, eax
je 0x40fc94
mov dword [esp + 4], 0
mov eax, dword [eax]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsSetValue
sub esp, 8
mov eax, 1
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
test eax, eax
je 0x40fc0d
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
push ecx
mov dword [ebp + 0x18], 0
lea eax, [ebp + 0x1c]
mov dword [esp], eax
call fcn.00411b84
lea edi, [ebp + 0x34]
mov ecx, 4
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov eax, 1
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
mov eax, dword [eax + 0xbc]
mov dword [esp], eax
call fcn.0040f96c
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x40fbb1
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
push eax
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x40fc6e
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
push eax
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x14], 0
jmp 0x40fbb1
call fcn.0040e078
mov dword [0x41eaf8], eax
jmp 0x40fb25
call fcn.0040e078
mov dword [0x41eaf8], eax
jmp 0x40fbdc
call fcn.0040e078
mov dword [0x41eaf8], eax
jmp 0x40fb37