joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e470
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push ecx
push esi
push edi
mov esi, edx
mov edi, ecx
call fcn.0040ceb0
test al, al
jne 0x40e4dc
mov ecx, esi
call fcn.0040ceb0
test al, al
jne 0x40e4dc
cmp dword [edi + 0x10], 0x104
jae 0x40e4dc
cmp dword [esi + 0x10], 0x104
jae 0x40e4dc
cmp dword [esi + 0x14], 8
jb 0x40e4a5
mov esi, dword [esi]
cmp dword [edi + 0x14], 8
jb 0x40e4ad
mov edi, dword [edi]
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x40e4dc
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40e4dc
test al, 1
je 0x40e4d6
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov al, 1
pop edi
pop esi
pop ecx
ret
pop edi
xor al, al
pop esi
pop ecx
ret

Function at 0x40e900
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
call fcn.0040ceb0
test al, al
jne 0x40e927
mov ecx, dword [ebp + 0xc]
call fcn.0040ceb0
test al, al
jne 0x40e927
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.0040e4f0
xor al, al
pop ebp
ret

Function at 0x40e930
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, edx
push esi
mov esi, ecx
test ebx, ebx
je 0x40e956
cmp dword [ebx + 0x14], 0x10
mov dword [ebx + 0x10], 0
jb 0x40e951
mov eax, dword [ebx]
jmp 0x40e953
mov eax, ebx
mov byte [eax], 0
call fcn.0040ceb0
test al, al
je 0x40e967
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push edi
mov ecx, esi
call fcn.0040e1d0
mov edi, eax
mov dword [ebp - 0xc], edi
test edi, edi
jne 0x40e981
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10000
call fcn.004a8039
push edi
push 0x10000
mov esi, eax
mov dword [ebp - 8], 0
push 1
push esi
call fcn.004b5cfc
mov edi, eax
add esp, 0x14
test edi, edi
je 0x40e9f6
mov eax, dword [ebp + 8]
nop
test ebx, ebx
je 0x40e9cc
mov ecx, eax
mov eax, edi
sub ecx, dword [ebp - 8]
cmp ecx, edi
cmovb eax, ecx
mov ecx, ebx
push eax
push esi
call fcn.00401fc0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
sub eax, ecx
cmp eax, edi
jb 0x40ea0c
push dword [ebp - 0xc]
add ecx, edi
push 0x10000
push 1
push esi
mov dword [ebp - 8], ecx
call fcn.004b5cfc
mov edi, eax
add esp, 0x10
mov eax, dword [ebp + 8]
test edi, edi
jne 0x40e9b0
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.004b5350
add esp, 4
test eax, eax
jne 0x40ea0f
mov byte [ebp - 1], 1
jmp 0x40ea13
mov ebx, dword [ebp - 0xc]
mov byte [ebp - 1], 0
push ebx
call fcn.004b53f1
add esp, 4
test esi, esi
je 0x40ea29
push esi
call fcn.004a7ad0
add esp, 4
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40ea60
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.0040e090
Function at 0x40f400
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x7aca10]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x40f54d
cmp byte [ebx + 0x3d], 0
je 0x40f54d
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x40f44d
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004a7ad5
mov esp, ebp
pop ebp
ret
mov ecx, 0xf
mov byte [esp + 0x14], 0
xorps xmm0, xmm0
mov dword [esp + 0x28], ecx
cmp ecx, 0x10
movq qword [esp + 0x14], xmm0
lea eax, [esp + 0x14]
mov dword [esp + 0x24], 8
cmovae eax, dword [esp + 0x14]
mov byte [eax + 8], 0
mov ecx, dword [esp + 0x28]
cmp ecx, 0x10
lea eax, [esp + 0x10]
mov ecx, dword [ebx + 0x38]
lea edi, [esp + 0x14]
cmovae edi, dword [esp + 0x14]
lea esi, [esp + 0x14]
cmovae esi, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x28]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x40f4c5
sub eax, 1
je 0x40f4c9
mov ecx, dword [esp + 0x28]
sub eax, 2
je 0x40f523
xor bl, bl
jmp 0x40f525
mov byte [ebx + 0x3d], 0
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x14]
mov edx, dword [esp + 0x14]
cmp ecx, 0x10
mov esi, dword [esp + 0x10]
cmovae eax, edx
sub esi, eax
je 0x40f504
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [esp + 0x18]
push esi
cmovae eax, edx
push 1
push eax
call fcn.004b3fe5
mov ecx, dword [esp + 0x38]
add esp, 0x10
cmp esi, eax
jne 0x40f4c1
cmp byte [ebx + 0x3d], 0
je 0x40f523
test esi, esi
jne 0x40f480
push esi
push 8
lea ecx, [esp + 0x1c]
call fcn.00406820
jmp 0x40f47c
mov bl, 1
cmp ecx, 0x10
jb 0x40f539
inc ecx
push ecx
push dword [esp + 0x18]
lea ecx, [esp + 0x1c]
call fcn.004022b0
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004a7ad5
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x2c]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004a7ad5
mov esp, ebp
pop ebp
ret
Function at 0x410f20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x8c
mov eax, dword [0x7aca10]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov eax, dword [ebx]
sub esp, 8
mov edi, dword [ebp + 8]
mov edx, esp
mov dword [esp + 0x14], 0
cmp dword [eax + 0x14], 8
jb 0x410f5f
mov ecx, dword [eax]
jmp 0x410f61
mov ecx, eax
mov dword [edx], ecx
lea ecx, [esp + 0x84]
mov eax, dword [eax + 0x10]
mov dword [edx + 4], eax
call fcn.0040c2b0
xor eax, eax
mov dword [esp + 0x78], 7
push 0xffffffffffffffff
push eax
mov word [esp + 0x6c], ax
lea ecx, [esp + 0x6c]
lea eax, [esp + 0x84]
mov dword [esp + 0x7c], 0
push eax
call fcn.00405600
mov eax, dword [esp + 0x90]
cmp eax, 8
jb 0x410fbe
inc eax
lea ecx, [esp + 0x7c]
push eax
push dword [esp + 0x80]
call fcn.00406d90
push 0
lea eax, [esp + 0x50]
mov dword [esp + 0x94], 7
push eax
mov ecx, ebx
mov dword [esp + 0x94], 0
call fcn.00409980
push 0x3c
lea eax, [esp + 0x14]
push 0
push eax
call fcn.004ab350
add esp, 0xc
mov dword [esp + 0x10], 0x3c
mov dword [esp + 0x14], 0x40
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp dword [esp + 0x78], 8
mov dword [esp + 0x18], eax
lea eax, [esp + 0x64]
cmovae eax, dword [esp + 0x64]
cmp dword [esp + 0x60], 8
mov dword [esp + 0x20], eax
lea eax, [esp + 0x4c]
cmovae eax, dword [esp + 0x4c]
xor ecx, ecx
cmp byte [esi + 1], cl
mov dword [esp + 0x24], eax
mov eax, 5
cmovne eax, ecx
mov dword [esp + 0x1c], str.runas
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x34], ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x4110c9
lea ecx, [edi + 4]
mov byte [edi], al
push eax
mov dword [ecx], eax
call fcn.0040e630
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test eax, eax
jne 0x411089
cmp byte [0x7c4190], al
jne 0x411162
int3
mov eax, dword [esp + 0x60]
cmp eax, 8
jb 0x4110a1
inc eax
lea ecx, [esp + 0x4c]
push eax
push dword [esp + 0x50]
call fcn.00406d90
mov ecx, dword [esp + 0x78]
xor eax, eax
mov dword [esp + 0x60], 7
mov dword [esp + 0x5c], 0
mov word [esp + 0x4c], ax
cmp ecx, 8
jb 0x41114b
inc ecx
push ecx
jmp 0x41113e
cmp byte [esi], 0
je 0x4110da
push 0xffffffffffffffff
push dword [esp + 0x4c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, dword [esp + 0x48]
lea ecx, [edi + 4]
mov byte [edi], 0
push esi
mov dword [ecx], 0
call fcn.0040e630
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp esi, eax
jne 0x411104
cmp byte [0x7c4190], 0
jne 0x411169
int3
mov eax, dword [esp + 0x60]
cmp eax, 8
jb 0x41111c
inc eax
lea ecx, [esp + 0x4c]
push eax
push dword [esp + 0x50]
call fcn.00406d90
xor eax, eax
mov dword [esp + 0x60], 7
mov word [esp + 0x4c], ax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x5c], 0
cmp eax, 8
jb 0x41114b
inc eax
push eax
push dword [esp + 0x68]
lea ecx, [esp + 0x6c]
call fcn.00406d90
mov ecx, dword [esp + 0x94]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004a7ad5
mov esp, ebp
pop ebp
ret
push 1
call fcn.004b2d10
push 1
call fcn.004b2d10
int3
Function at 0x414490
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1010
call fcn.004a8050
mov eax, dword [0x7aca10]
xor eax, esp
mov dword [esp + 0x100c], eax
mov eax, dword [ebp + 8]
lea edx, [esp]
push esi
push edi
mov edi, dword [ebp + 0xc]
push edx
lea edx, [esp + 0x14]
mov dword [esp + 0xc], 0
push edx
lea edx, [esp + 0x14]
mov dword [esp + 0x14], 1
push edx
push 0
push eax
push dword [ecx]
mov dword [esp + 0x20], 0x800
call fcn.00452104
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x4145d8
mov ecx, dword [esp + 0xc]
cmp ecx, 1
jne 0x414565
cmp word [esp + 0x10], ax
jne 0x41452a
xor ecx, ecx
lea eax, [esp + 0x10]
push ecx
push eax
mov ecx, edi
call fcn.00405500
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x100c]
xor ecx, esp
call fcn.004a7ad5
mov esp, ebp
pop ebp
ret 8
lea ecx, [esp + 0x10]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x414531
sub ecx, edx
lea eax, [esp + 0x10]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.00405500
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x100c]
xor ecx, esp
call fcn.004a7ad5
mov esp, ebp
pop ebp
ret 8
cmp ecx, 2
jne 0x4145d3
push 0x400
lea eax, [esp + 0x814]
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [esp + 8], eax
test eax, eax
je 0x4145b8
cmp eax, 0x400
ja 0x4145b8
lea eax, [esp + 0x810]
mov ecx, edi
push eax
call fcn.00403c10
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x100c]
xor ecx, esp
call fcn.004a7ad5
mov esp, ebp
pop ebp
ret 8
mov eax, 0xea
pop edi
pop esi
mov ecx, dword [esp + 0x100c]
xor ecx, esp
call fcn.004a7ad5
mov esp, ebp
pop ebp
ret 8
mov eax, 0x3f4
mov ecx, dword [esp + 0x1014]
pop edi
pop esi
xor ecx, esp
call fcn.004a7ad5
mov esp, ebp
pop ebp
ret 8
Function at 0x414a90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi], 0
je 0x414b99
cmp dword [edi + 4], 0
jl 0x414b99
mov eax, dword [edi + 0x24]
lea ecx, [edi + 0x2c]
sub eax, dword [edi + 0x20]
mov edx, dword [edi + 0x1c]
mov esi, dword [edi + 0x20]
sar eax, 1
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], edx
lea eax, [eax*2 - 2]
mov dword [ecx], eax
lea ecx, [edi + 8]
call fcn.004125b0
lea ecx, [edi + 0x2c]
push ecx
push esi
lea edx, [edi + 0x30]
push edx
push 0
lea ecx, [esp + 0x20]
push ecx
push eax
push dword [edi + 4]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0xea
jne 0x414b7a
mov ecx, dword [edi + 0x2c]
mov eax, dword [edi + 0x24]
inc ecx
sub eax, dword [edi + 0x20]
shr ecx, 1
inc ecx
sar eax, 1
cmp ecx, eax
jbe 0x414b2b
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
push ecx
lea ecx, [edi + 0x20]
call fcn.00414bc0
mov eax, dword [edi + 0x24]
mov ecx, 0x4000
sub eax, dword [edi + 0x20]
mov esi, dword [edi + 0x20]
sar eax, 1
lea eax, [eax*2 - 2]
mov dword [edi + 0x2c], eax
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x10], eax
cmove eax, ecx
lea ecx, [edi + 8]
mov edx, eax
mov dword [esp + 0x10], eax
call fcn.004125b0
lea ecx, [edi + 0x2c]
push ecx
push esi
lea ecx, [edi + 0x30]
push ecx
push 0
lea ecx, [esp + 0x20]
push ecx
push eax
push dword [edi + 4]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x414b99
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov eax, dword [edi + 0x20]
inc ecx
shr ecx, 1
xor edx, edx
mov word [eax + ecx*2], dx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [edi + 0x1c], 8
lea eax, [edi + 8]
jb 0x414ba4
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
mov eax, dword [edi + 0x20]
mov word [eax], cx
xor al, al
mov dword [edi + 0x2c], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x415400
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 8]
sub esp, 0x18
cmp dword [eax + 0x14], 8
jb 0x415414
mov eax, dword [eax]
lea ecx, [esp + 8]
push ecx
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x415437
or eax, 0xffffffff
or edx, eax
mov esp, ebp
pop ebp
ret
mov edx, dword [esp + 4]
mov eax, dword [esp]
test edx, edx
jg 0x415450
jl 0x415448
test eax, eax
jae 0x415450
or eax, 0xffffffff
mov edx, SysReAllocString
mov esp, ebp
pop ebp
ret
Function at 0x415c70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 4], 0
push edi
mov edi, edx
test ebx, ebx
je 0x415cd2
cmp dword [0x7c4380], 0
jne 0x415cbf
push 0x4c
call fcn.004a7835
add esp, 4
mov ecx, eax
call fcn.00418f90
mov edx, eax
mov esi, 0x7c4380
mov ecx, edx
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
je 0x415cbf
test edx, edx
je 0x415cbf
push ecx
mov ecx, edx
call fcn.00418f40
mov eax, dword [0x7c4380]
cmp dword [eax], 1
jl 0x415cd2
mov dword [ebp - 4], 0x10000
jmp 0x415cd4
xor ebx, ebx
push 0xc
call fcn.004a7835
add esp, 4
mov esi, eax
push 0
push dword [ebp - 4]
mov dword [esi], edi
mov edi, dword [ebp + 8]
test edi, edi
push esi
push 0x415bb0
setne cl
push ebx
mov byte [esi + 4], cl
mov ecx, dword [ebp + 0xc]
push 0
mov dword [esi + 8], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x415d1d
push esi
call fcn.004a780d
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x415d2c
mov dword [edi], eax
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4175a0
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movsd xmm0, qword [0x7c3250]
xorps xmm1, xmm1
ucomisd xmm0, xmm1
push ebx
push esi
push edi
mov dword [ebp - 4], 0
lahf
test ah, 0x44
jp 0x4176df
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 2
mov dword [ebp - 4], eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [0x7c4368]
test cl, 1
jne 0x417607
rdtsc
or ecx, 1
mov dword [0x7c4360], eax
mov dword [0x7c4368], ecx
mov dword [0x7c4364], edx
test cl, 2
jne 0x417637
lea eax, [ebp - 0x10]
or ecx, 2
xorps xmm0, xmm0
mov dword [0x7c4368], ecx
push eax
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x10]
mov dword [0x7c4370], eax
mov eax, dword [ebp - 0xc]
mov dword [0x7c4374], eax
rdtsc
mov edi, eax
xorps xmm0, xmm0
lea eax, [ebp - 0x10]
movq qword [ebp - 0x10], xmm0
push eax
mov ebx, edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push dword [ebp - 4]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
lea eax, [ebp - 0x18]
xorps xmm0, xmm0
push eax
movq qword [ebp - 0x18], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov ecx, dword [ebp - 0x10]
sub ecx, dword [0x7c4370]
mov edx, dword [ebp - 0xc]
sbb edx, dword [0x7c4374]
call fcn.004a8970
mov edx, dword [ebp - 0x14]
movaps xmm1, xmm0
mov ecx, dword [ebp - 0x18]
movsd qword [ebp - 0x10], xmm1
call fcn.004a89b0
movsd xmm2, qword [ebp - 0x10]
divsd xmm2, xmm0
movsd xmm1, qword [0x501b58]
comisd xmm1, xmm2
movsd qword [ebp - 0x10], xmm2
jbe 0x4176bd
xorps xmm0, xmm0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
sub edi, dword [0x7c4360]
mov ecx, edi
sbb ebx, dword [0x7c4364]
mov edx, ebx
call fcn.004a8970
divsd xmm0, qword [ebp - 0x10]
movsd qword [0x7c3250], xmm0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x418ae0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x7aca10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessId]
push 0
push 2
mov esi, eax
mov dword [ebp - 0x230], 0x22c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [ebp - 0x234], 0
test edi, edi
je 0x418bdb
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x234]
mov ebx, eax
call fcn.0040e5c0
cmp edi, 0xffffffff
je 0x418b8a
mov dword [ebp - 0x234], edi
call fcn.00418c30
mov dword [ebp - 0x238], eax
mov eax, dword [ebp + 4]
mov ecx, dword [0x7c3258]
mov dword [ebp - 0x23c], eax
test ecx, ecx
jne 0x418b71
call fcn.004183c0
mov ecx, dword [0x7c3258]
push dword [ebp - 0x238]
mov eax, dword [ecx]
lea edx, [ebp - 0x234]
push dword [ebp - 0x23c]
push edx
push edi
call dword [eax + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x234]
pop ebx
test eax, eax
je 0x418bdb
cmp eax, 0xffffffff
je 0x418bdb
lea ecx, [ebp - 0x230]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x418bdb
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
nop dword [eax]
cmp dword [ebp - 0x228], esi
je 0x418bfa
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 0x234]
call edi
test eax, eax
jne 0x418bc0
xor esi, esi
lea ecx, [ebp - 0x234]
call fcn.0040e5c0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.004a7ad5
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x218]
jmp 0x418bdd
Function at 0x41c580
Capabilities:
Get thread local storage value

Disassembly:
push edi
mov edi, ecx
call fcn.0041c930
mov eax, dword [0x7ad398]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, eax
test edx, edx
jne 0x41c5a1
call fcn.00423af0
mov edx, eax
mov eax, dword [0x7c41dc]
cmp dword [edx + eax*4], 0
jne 0x41c5e2
push 0x70
call fcn.004a7835
add esp, 4
mov ecx, eax
push edi
call fcn.0041c320
mov ecx, dword [0x7ad398]
mov edi, eax
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
test ecx, ecx
jne 0x41c5da
call fcn.00423af0
mov ecx, eax
mov eax, dword [0x7c41dc]
mov dword [ecx + eax*4], edi
pop edi
ret

Function at 0x41c5f0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x7c41d8]
push ebx
push esi
push edi
test eax, eax
jne 0x41c600
pop edi
pop esi
pop ebx
ret
mov eax, dword [0x7ad398]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
test ecx, ecx
jne 0x41c619
call fcn.00423af0
mov ecx, eax
mov eax, dword [0x7c41dc]
mov eax, dword [ecx + eax*4]
test eax, eax
jne 0x41c6da
mov eax, dword [0x7c419c]
xor edi, edi
xor ebx, ebx
test eax, 0xfffffffe
jne 0x41c664
push 0x7c419c
call fcn.00418c90
add esp, 4
test al, al
je 0x41c664
push 0x7d0
push 0x7c41a0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov dword [0x7c419c], 0x7c41a0
mov esi, dword [0x7c419c]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x7c41c0]
test ecx, ecx
je 0x41c68a
mov eax, dword [ecx + 4]
mov edi, ecx
mov dword [0x7c41c0], eax
mov dword [ecx + 4], ebx
jmp 0x41c697
mov ebx, dword [0x7c41e0]
inc ebx
mov dword [0x7c41e0], ebx
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
jne 0x41c6b6
push 0x70
call fcn.004a7835
add esp, 4
mov ecx, eax
push ebx
call fcn.0041c3e0
mov edi, eax
mov ecx, dword [0x7ad398]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
test ecx, ecx
jne 0x41c6d0
call fcn.00423af0
mov ecx, eax
mov eax, dword [0x7c41dc]
mov dword [ecx + eax*4], edi
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x420840
Capabilities:
Enumerate processes

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Process32FirstW]
push esi
mov esi, ecx
push edi
lea edi, [esi + 0xc]
nop
push 0x22c
push 0
push edi
call fcn.004ab350
add esp, 0xc
mov dword [edi], 0x22c
cmp byte [esi + 8], 0
push edi
push dword [esi + 4]
jne 0x420878
mov byte [esi + 8], 1
call ebx
jmp 0x42087e
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
setne al
test al, al
je 0x42089a
mov edx, dword [esi]
mov ecx, esi
mov edx, dword [edx + 4]
call edx
test al, al
je 0x420850
mov eax, edi
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x423af0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x7aca10]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x7ad398]
mov dword [ebp - 0x40c], 0
mov dword [ebp - 0x40c], ebx
push esi
push edi
cmp ebx, 0xffffffff
jne 0x423b90
mov edi, dword [sym.imp.KERNEL32.dll_TlsAlloc]
call edi
mov esi, dword [sym.imp.KERNEL32.dll_TlsFree]
cmp eax, ebx
je 0x423b3d
mov ebx, eax
mov dword [ebp - 0x40c], ebx
jmp 0x423b6e
cmp byte [0x7c4190], 0
jne 0x423c07
int3
mov ecx, ebx
mov edx, 0x7ad398
or eax, 0xffffffff
lock cmpxchg dword [edx], ecx
cmp eax, 0xffffffff
je 0x423b90
push ebx
call esi
mov ebx, dword [0x7ad398]
mov dword [ebp - 0x40c], ebx
push ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x423ba5
cmp byte [0x7c4190], 0
jne 0x423c15
int3
push 0x400
lea eax, [ebp - 0x408]
push 0
push eax
call fcn.004ab350
add esp, 0xc
lea eax, [ebp - 0x408]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0x400
call fcn.004a8039
add esp, 4
lea esi, [ebp - 0x408]
mov ebx, eax
mov ecx, 0x100
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
push ebx
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a7ad5
mov esp, ebp
pop ebp
ret
push 1
call fcn.004b2d10
push 1
call fcn.004b2d10
push 1
call fcn.004b2d10
int3

Function at 0x423c20
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x40c
mov eax, dword [0x7aca10]
xor eax, esp
mov dword [esp + 0x408], eax
mov eax, dword [0x7ad398]
push ebx
push esi
mov ebx, ecx
mov dword [esp + 8], 0
push edi
mov ecx, 0x100
mov dword [esp + 0xc], eax
mov esi, ebx
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ebx
call fcn.004a7ad0
add esp, 4
mov edi, 0x100
nop word [eax + eax]
mov esi, dword [0x7c4200]
xor dl, dl
test esi, esi
jle 0x423cb8
nop dword [eax]
mov ecx, dword [esp + esi*4 + 0x10]
test ecx, ecx
je 0x423cb3
mov eax, dword [esi*4 + 0x7c3b80]
test eax, eax
je 0x423cb3
push ecx
mov dword [esp + esi*4 + 0x14], 0
call eax
add esp, 4
mov dl, 1
dec esi
test esi, esi
jg 0x423c90
dec edi
test edi, edi
jle 0x423cc1
test dl, dl
jne 0x423c80
push 0
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esp + 0x414]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004a7ad5
mov esp, ebp
pop ebp
ret