joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a270
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x41b220
mov esi, ecx
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [0x49f04c]
test eax, eax
je 0x41a2c4
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x41a2dd
cmp dword [eax], 0
mov ebx, eax
je 0x41a2dd
add ebx, 4
jmp 0x41a3cc
push 0x49f04c
call fcn.00451f20
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
ja 0x41a2b5
mov eax, dword [0x49f04c]
test eax, eax
je 0x41a3ad
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x41a3ca
mov edi, eax
test eax, eax
jne 0x41a34e
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x20], 0x49f04c
push 4
push 0x10
call fcn.004429f0
add esp, 8
test eax, eax
je 0x41a3f1
movsd xmm0, qword [ebp - 0x2c]
movsd xmm1, qword [ebp - 0x24]
mov edi, eax
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
mov eax, dword [0x49f04c]
test eax, eax
je 0x41a3df
dec eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
je 0x41a382
mov edx, dword [esi]
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
mov dword [esi], 0
test edx, edx
je 0x41a382
cmp edx, 1
jne 0x41a36d
mov edx, ecx
jmp 0x41a386
test ecx, ecx
je 0x41a382
xor eax, eax
lock dec dword [ecx]
mov edx, 0
jne 0x41a386
call fcn.00411330
xor eax, eax
xor edx, edx
mov ecx, dword [edi + 8]
cmp dword [edi], 0
lea ebx, [edi + 4]
mov dword [edi], 1
mov dword [edi + 4], eax
mov dword [edi + 8], edx
je 0x41a3cc
test ecx, ecx
je 0x41a3cc
lock dec dword [ecx]
jne 0x41a3cc
call fcn.00411330
jmp 0x41a3cc
push 0x49f04c
call fcn.00451f20
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x41a2fb
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ebx
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x49f04c
call fcn.00451f20
add esp, 4
jmp 0x41a346
mov dword [ebp - 0x10], 0
push 4
push 0x10
call fcn.00451b50
add esp, 8
ud2
Function at 0x41a480
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x49f05c]
mov esi, ecx
test eax, eax
je 0x41a4a5
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x41a4be
cmp dword [eax], 0
je 0x41a4be
add eax, 4
pop esi
pop edi
ret
push 0x49f05c
call fcn.00451f20
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
ja 0x41a49a
mov eax, dword [0x49f05c]
test eax, eax
je 0x41a534
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x41a54d
mov edi, eax
test eax, eax
jne 0x41a50b
push 4
push 0xc
call fcn.004429f0
add esp, 8
test eax, eax
je 0x41a561
mov dword [eax], 0
mov dword [eax + 8], 0x49f05c
mov edi, eax
mov eax, dword [0x49f05c]
test eax, eax
je 0x41a552
dec eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
je 0x41a523
mov eax, dword [esi]
xor ecx, ecx
mov dword [esi], 0
cmp eax, 1
jne 0x41a525
mov ecx, dword [esi + 4]
jmp 0x41a525
xor ecx, ecx
mov dword [edi], 1
lea eax, [edi + 4]
mov dword [edi + 4], ecx
pop esi
pop edi
ret
push 0x49f05c
call fcn.00451f20
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x41a4d4
xor eax, eax
pop esi
pop edi
ret
push 0x49f05c
call fcn.00451f20
add esp, 4
jmp 0x41a503
push 4
push 0xc
call fcn.00451b50
add esp, 8
ud2
Function at 0x428620
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov esi, edx
mov edi, dword [ebp + 8]
mov eax, dword [0x49f070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0x104
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x42878e
push str.MicrosoftWindowsStart_MenuPrograms_
push 0x104
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
test eax, eax
jne 0x42878e
mov ecx, dword [esi + 0x10]
lea eax, [ecx - 0x7ffffffb]
cmp eax, 3
jbe 0x4287a0
mov eax, dword [esi]
mov dword [ebp - 0x38], eax
mov edx, dword [esi + 0x14]
lea edi, [ebp - 0x28]
mov dword [edi], 0
lea eax, [ecx + 4]
mov ebx, 7
cmp eax, 8
jb 0x428704
mov dword [ebp - 0x30], edx
mov edx, eax
or edx, 7
cmp edx, 0xb
mov ebx, 0xa
cmovae ebx, edx
mov edx, SysReAllocString
cmp ebx, edx
cmovae ebx, edx
lea edi, [ebx + ebx]
cmp ebx, 0x7ff
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x2c], eax
jb 0x4286ea
cmp ebx, 0x7fffffee
jae 0x4287a5
add edi, 0x25
push edi
call fcn.0044fb05
add esp, 4
lea edi, [eax + 0x23]
and edi, 0xffffffe0
mov dword [edi - 4], eax
jmp 0x4286f8
add edi, 2
push edi
call fcn.0044fb05
add esp, 4
mov edi, eax
mov dword [ebp - 0x28], edi
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
cmp edx, 8
cmovae esi, dword [ebp - 0x38]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ebx
lea eax, [ecx + ecx]
push eax
push esi
push edi
mov esi, ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [edi + esi*2 + 4], 0x6b006e
mov dword [edi + esi*2], 0x6c002e
mov word [edi + esi*2 + 8], 0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
jb 0x428743
mov eax, dword [ebp - 0x28]
push eax
push 0x104
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x42878e
mov ecx, dword [ebp - 0x28]
lea esi, [eax + eax]
add esi, 2
cmp esi, 0x1000
jb 0x428784
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x4287aa
add eax, eax
add eax, 0x25
mov esi, eax
mov ecx, edx
push esi
push ecx
call fcn.0044fb35
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004501b0
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.00453410
call fcn.00453420
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4287fb
mov eax, dword [ebp + 0xc]
movdqu xmm0, xmmword [eax]
pcmpeqb xmm0, xmmword [0x461b70]
pmovmskb edx, xmm0
cmp edx, 0xffff
je 0x4287f2
movdqu xmm0, xmmword [eax]
pcmpeqb xmm0, xmmword [0x461b80]
pmovmskb edx, xmm0
mov eax, 0x80004002
cmp edx, 0xffff
jne 0x428800
mov eax, dword [ebp + 8]
mov dword [ecx], eax
xor eax, eax
jmp 0x428800
mov eax, 0x80004003
pop ebp
ret 0xc
Function at 0x42a500
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x49f070]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov esi, eax
call fcn.00401160
mov ecx, dword [eax]
or ecx, 2
xor edx, edx
push esi
push edx
push dword [ebp + 0xc]
push edx
push edx
push dword [eax + 4]
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vswprintf]
add esp, 0x1c
xor ecx, ecx
dec ecx
test eax, eax
cmovs eax, ecx
lea edi, [eax + 1]
lea ebx, [eax + eax]
add ebx, 2
push ebx
call fcn.0044faf7
add esp, 4
mov esi, eax
push ebx
xor eax, eax
push eax
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ebx, [ebp + 0x18]
mov dword [ebp - 0x18], ebx
call fcn.00401160
push ebx
xor ecx, ecx
push ecx
push dword [ebp + 0xc]
push edi
push esi
push dword [eax + 4]
push dword [eax]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vswprintf]
add esp, 0x1c
mov eax, str.Error:__s___S:_d_
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push eax
call fcn.004525f0
add esp, 0x10
lea ecx, [eax + 1]
mov dword [ebp - 0x1c], ecx
lea ebx, [eax + eax]
add ebx, 2
cmp eax, 0xffffffff
mov eax, 0xffffffff
cmovl ebx, eax
push ebx
call fcn.0044faf7
add esp, 4
mov edi, eax
push ebx
xor ebx, ebx
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
mov eax, str.Error:__s___S:_d_
push eax
push 0xffffffffffffffff
push dword [ebp - 0x1c]
push edi
call fcn.00452650
add esp, 0x1c
push dword [ebp + 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test eax, eax
je 0x42a62f
mov ebx, eax
lea eax, [ebp - 0x14]
mov dword [eax], edi
sub esp, 0x24
xor ecx, ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
movaps xmm0, xmmword [0x45f470]
movups xmmword [esp + 4], xmm0
mov dword [esp], ebx
mov dword [esp + 0x14], 1
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push ebx
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
push edi
call fcn.0044fb00
add esp, 4
push esi
call fcn.0044fb00
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004501b0
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42b6f0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x3c
mov dword [ebp - 0x48], edx
mov ebx, ecx
mov eax, dword [0x49f070]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
lea edi, [ebp - 0x28]
mov dword [edi], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 7
mov word [edi], 0
sub esp, 0xc
mov al, byte [ebp - 0x40]
mov byte [esp + 4], al
mov dword [esp + 8], str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov dword [esp], 0x2e
mov ecx, edi
call fcn.004534f0
mov eax, dword [edi + 0x10]
mov ecx, dword [edi + 0x14]
cmp eax, ecx
jae 0x42b881
lea edx, [eax + 1]
mov dword [ebp - 0x18], edx
cmp ecx, 8
jb 0x42b75c
mov ecx, dword [ebp - 0x28]
jmp 0x42b75f
lea ecx, [ebp - 0x28]
mov word [ecx + eax*2], 0x5c
mov word [ecx + eax*2 + 2], 0
lea esi, [ebp - 0x40]
mov ecx, ebx
mov edx, esi
push dword [ebp + 8]
call fcn.0042aef0
add esp, 4
mov eax, dword [esi + 0x10]
cmp dword [esi + 0x14], 8
jb 0x42b78a
mov esi, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov ebx, edx
sub ebx, ecx
cmp ebx, eax
jb 0x42b88e
lea ebx, [ecx + eax]
mov dword [ebp - 0x18], ebx
cmp edx, 8
jb 0x42b7aa
mov edi, dword [ebp - 0x28]
lea ecx, [edi + ecx*2]
add eax, eax
push eax
push esi
push ecx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov word [edi + ebx*2], 0
mov eax, dword [ebp - 0x2c]
cmp eax, 8
mov edi, dword [ebp - 0x48]
jb 0x42b800
mov ecx, dword [ebp - 0x40]
lea esi, [eax + eax]
add esi, 2
cmp esi, 0x1000
jb 0x42b7f6
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x42b8b0
add eax, eax
add eax, 0x25
mov esi, eax
mov ecx, edx
push esi
push ecx
call fcn.0044fb35
add esp, 8
cmp dword [ebp - 0x14], 8
jb 0x42b80b
mov eax, dword [ebp - 0x28]
jmp 0x42b80e
lea eax, [ebp - 0x28]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov ecx, eax
and ecx, 0xfffffffd
movzx edx, ax
or edx, 0x80070000
test eax, eax
cmovle edx, eax
test ecx, ecx
cmove edx, ecx
mov dword [edi], edx
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x42b86d
mov ecx, dword [ebp - 0x28]
lea esi, [eax + eax]
add esi, 2
cmp esi, 0x1000
jb 0x42b863
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x42b8b0
add eax, eax
add eax, 0x25
mov esi, eax
mov ecx, edx
push esi
push ecx
call fcn.0044fb35
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004501b0
mov eax, edi
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [ebp - 0x28]
call fcn.00455b70
jmp 0x42b76c
sub esp, 0x10
mov cl, byte [ebp - 0x44]
mov byte [esp + 4], cl
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp], eax
lea ecx, [ebp - 0x28]
call fcn.00453600
jmp 0x42b7c0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x439590
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, edx
mov eax, dword [0x49f070]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor edi, edi
lea ebx, [ebp - 0x14]
mov dword [ebx], edi
push ebx
push 0x20019
push edi
push str.SOFTWAREPoliciesMozillaFirefox
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [ebx]
test ebx, ebx
je 0x43964b
lea eax, [ebp - 0x18]
mov dword [eax], edi
lea ecx, [ebp - 0x1c]
mov dword [ecx], edi
sub esp, 0x30
xorps xmm0, xmm0
movups xmmword [esp + 0x20], xmm0
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, 2
test eax, eax
jne 0x439642
lea ecx, [ebp - 0x20]
mov dword [ecx], 0xffffffff
lea eax, [ebp - 0x24]
mov dword [eax], 4
xor edi, edi
push eax
push ecx
push edi
push 0x10
push esi
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
xor ecx, ecx
lea edx, [ebp - 0x20]
cmp dword [edx], edi
sete cl
test eax, eax
mov edi, 2
cmove edi, ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x439650
mov edi, 2
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004501b0
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x44f340
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x1c
mov eax, dword [0x49f148]
test eax, eax
je 0x44f44e
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x44f36e
cmp dword [eax + 4], 0
mov esi, eax
jne 0x44f445
mov eax, dword [0x49f148]
test eax, eax
je 0x44f460
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x44f443
mov esi, eax
test eax, eax
jne 0x44f3cc
push 4
push 0x20
call fcn.004162d0
add esp, 8
test eax, eax
je 0x44f484
mov dword [eax + 4], 0
mov dword [eax + 0x1c], 0x49f148
mov esi, eax
mov eax, dword [0x49f148]
test eax, eax
je 0x44f472
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp + 8]
test eax, eax
je 0x44f405
mov edx, dword [eax + 4]
mov ecx, dword [eax]
mov dword [eax + 4], 0
test edx, edx
je 0x44f405
mov edi, dword [eax + 0x18]
movsd xmm0, qword [eax + 8]
movsd xmm1, qword [eax + 0x10]
mov dword [ebp - 0xc], edi
movsd qword [ebp - 0x14], xmm1
movsd qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], edx
jmp 0x44f411
lea eax, [ebp - 0x24]
push eax
call fcn.0044f110
add esp, 4
movsd xmm1, qword [ebp - 0x1c]
movsd xmm0, qword [ebp - 0x24]
movsd qword [esi + 8], xmm1
movsd xmm1, qword [ebp - 0x14]
movsd qword [esi + 0x10], xmm1
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x18], eax
cmp dword [esi + 4], 0
movsd qword [esi], xmm0
je 0x44f445
lock dec dword [0x49f700]
jmp 0x44f445
xor esi, esi
mov eax, esi
add esp, 0x1c
pop esi
pop edi
pop ebp
ret
push 0x49f148
call fcn.00451f20
add esp, 4
jmp 0x44f356
push 0x49f148
call fcn.00451f20
add esp, 4
jmp 0x44f37c
push 0x49f148
call fcn.00451f20
add esp, 4
jmp 0x44f3c4
push 4
push 0x20
call fcn.00451b50
int3
Function at 0x44f490
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [0x49f708]
test edi, edi
jne 0x44f59b
push 0x4740f1
call sub.KERNEL32.dll_GetModuleHandleA
test eax, eax
je 0x44f4df
mov esi, eax
push str.WaitOnAddress
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x44f4df
mov ebx, eax
push str.WakeByAddressSingle
push esi
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x44f4df
xor esi, esi
mov dword [ebp - 0x10], eax
inc esi
jmp 0x44f54e
push 0x4740ac
call sub.KERNEL32.dll_GetModuleHandleA
test eax, eax
je 0x44f5a5
mov ebx, eax
push str.NtCreateKeyedEvent
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x44f5a5
mov edi, eax
push str.NtReleaseKeyedEvent
push ebx
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
mov dword [ebp - 0x10], eax
je 0x44f5a5
push str.NtWaitForKeyedEvent
push ebx
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x44f5a5
mov ecx, edi
mov dword [ebp - 0x14], eax
call dword [section..00cfg]
xor esi, esi
lea eax, [ebp - 0x18]
push esi
push esi
push 0xc0000000
push eax
call edi
test eax, eax
jne 0x44f5a5
mov ebx, dword [ebp - 0x18]
push 4
push 0x10
call fcn.004162d0
add esp, 8
test eax, eax
je 0x44f5aa
mov dword [eax], esi
mov edi, eax
mov dword [eax + 4], ebx
mov eax, dword [ebp - 0x10]
mov dword [edi + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [edi + 0xc], eax
xor eax, eax
lock cmpxchg dword [0x49f708], edi
je 0x44f59b
cmp dword [edi], 0
mov esi, eax
jne 0x44f58c
push dword [edi + 4]
call sub.KERNEL32.dll_CloseHandle
push 4
push 0x10
push edi
call fcn.00416340
add esp, 0xc
mov edi, esi
mov eax, edi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.0045ca40
push 4
push 0x10
call fcn.00451b50
int3
Function at 0x451f20
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x30]
cmp dword [edi + 4], 0
je 0x451f9a
lea ebx, [edi + 0xc]
mov dword [esp + 4], 0
lea eax, [esp + 4]
push 0
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_InitOnceBeginInitialize]
cmp eax, 1
mov dword [esp], eax
jne 0x451fd5
cmp dword [esp + 4], 0
je 0x451fbc
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x451ff8
mov esi, eax
inc eax
mov dword [edi], eax
mov eax, dword [0x49f264]
nop word [eax + eax]
mov dword [edi + 8], eax
lock cmpxchg dword [0x49f264], edi
jne 0x451f80
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_InitOnceComplete]
jmp 0x451fcc
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esp], eax
je 0x45203f
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [edi], ecx
jne 0x451fc0
mov esi, dword [esp]
jmp 0x451fcc
mov esi, dword [edi]
jmp 0x451fcb
mov esi, eax
push dword [esp]
call dword [sym.imp.KERNEL32.dll_TlsFree]
dec esi
mov eax, esi
add esp, 0x20
pop esi
pop edi
pop ebx
ret
mov dword [esp + 0x10], 0
lea eax, [esp + 8]
mov ecx, esp
mov edx, 0x460aec
push 0x460b20
push eax
call fcn.00451b70
add esp, 8
ud2
push 0
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_InitOnceComplete]
mov dword [esp + 0x10], 0x460b44
mov dword [esp + 0x14], 1
mov dword [esp + 8], 0
mov dword [esp + 0x18], 0x45f570
mov dword [esp + 0x1c], 0
lea eax, [esp + 8]
push 0x460b4c
push eax
call fcn.004515b0
add esp, 8
ud2
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0
mov dword [esp + 0x10], 0x460b44
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 0x45f570
mov dword [esp + 0x1c], 0
call fcn.00451c30
ud2
Function at 0x4526b0
Capabilities:
Create process on windows
Create process suspended
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x270
mov eax, dword [0x49f070]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0x21a]
push 0x20a
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x452702
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
add eax, 0xffffff07
cmp eax, 0xfffffefc
jae 0x45271b
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004501b0
mov eax, ebx
add esp, 0x270
pop esi
pop edi
pop ebx
pop ebp
ret
push str.control.exe
push edi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
xor ebx, ebx
test eax, eax
je 0x452704
lea esi, [ebp - 0x220]
mov dword [esi], ebx
mov ecx, esi
call fcn.00452500
mov eax, dword [esi]
mov dword [ebp - 0x278], eax
mov ecx, str.control.exe__name_Microsoft.DefaultPrograms__page_pageDefaultProgrampageAdvancedSettings_pszAppName_s
push eax
push ecx
call fcn.004525f0
add esp, 8
lea ecx, [eax + 1]
mov dword [ebp - 0x27c], ecx
lea ecx, [eax + eax]
add ecx, 2
xor esi, esi
dec esi
cmp eax, 0xffffffff
cmovge esi, ecx
push esi
call fcn.0044faf7
add esp, 4
push esi
push ebx
mov esi, eax
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push dword [ebp - 0x278]
mov eax, str.control.exe__name_Microsoft.DefaultPrograms__page_pageDefaultProgrampageAdvancedSettings_pszAppName_s
push eax
push 0xffffffffffffffff
push dword [ebp - 0x27c]
push esi
call fcn.00452650
add esp, 0x14
xorps xmm0, xmm0
lea eax, [ebp - 0x264]
movups xmmword [eax + 0x24], xmm0
movups xmmword [eax + 0x34], xmm0
movups xmmword [eax + 0x14], xmm0
movups xmmword [eax + 4], xmm0
mov dword [eax], 0x44
mov dword [eax + 0x2c], 1
mov word [eax + 0x30], 0xa
lea ecx, [ebp - 0x274]
movups xmmword [ecx], xmm0
sub esp, 0x28
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], esi
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
setne bl
je 0x452815
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x274]
call edi
push dword [ebp - 0x270]
call edi
push esi
call fcn.0044fb00
add esp, 4
mov eax, dword [ebp - 0x278]
test eax, eax
je 0x452704
push eax
call fcn.0044fb00
add esp, 4
jmp 0x452704
Function at 0x455110
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [0x49f070]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov bl, 1
cmp dword [ecx + 0x38], 0
je 0x4551b2
mov esi, ecx
cmp byte [ecx + 0x3d], 0
je 0x4551b2
mov eax, dword [esi]
mov edi, dword [eax + 0xc]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push 0xffffffffffffffff
call edi
cmp eax, 0xffffffff
je 0x4551b0
mov ebx, dword [esi + 0x38]
lea eax, [esi + 0x40]
mov dword [ebp - 0x38], eax
mov eax, dword [ebx]
mov edi, dword [eax + 0x20]
mov ecx, edi
call dword [section..00cfg]
lea eax, [ebp - 0x34]
lea edx, [ebp - 0x30]
mov ecx, ebx
mov ebx, edx
push eax
lea eax, [ebp - 0x10]
push eax
push edx
push dword [ebp - 0x38]
call edi
cmp eax, 3
je 0x4551c6
cmp eax, 1
je 0x45518c
test eax, eax
jne 0x4551b0
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x34]
sub edi, ebx
je 0x4551a7
push dword [esi + 0x4c]
push edi
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x4551b0
cmp byte [esi + 0x3d], 0
sete bl
jmp 0x4551b2
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004501b0
mov eax, ebx
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
mov byte [esi + 0x3d], 0
mov bl, 1
jmp 0x4551b2
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219