joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002445
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
cmp byte [0x1012d58], bl
jne 0x10024d1
push esi
push 4
pop esi
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push 0x1001290
push 0x80000002
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10024c9
lea eax, [ebp - 0xc]
push eax
push 0x1012034
lea eax, [ebp - 8]
push eax
push ebx
push 0x1001260
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10024b6
cmp dword [ebp - 8], esi
jne 0x10024b6
cmp dword [0x1012034], esi
mov dword [0x1012034], esi
je 0x10024c0
mov dword [0x1012034], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [0x1012d58], 1
pop esi
mov eax, dword [0x1012034]
pop ebx
leave
ret

Function at 0x1002714
Capabilities:
Access the windows event log
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
je 0x1002797
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0xc]
push eax
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 8]
call esi
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x10027a3
cmp dword [ebp - 0xc], 0x10
jne 0x100278e
cmp dword [ebp - 8], 3
jne 0x100278e
xor eax, eax
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 0x10]
mov dword [ebp - 8], ebx
push dword [ebp + 8]
call esi
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x10027a3
mov edi, dword [ebp + 0x18]
lea esi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x100279e
mov dword [ebp - 4], 0xe8
jmp 0x100279e
mov dword [ebp - 4], 0x3f2
cmp dword [ebp - 4], ebx
je 0x10027e1
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
cmp esi, ebx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
je 0x10027e1
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
push 4
push 2
push ebx
push 0x800007d6
push ebx
push 2
push dword [0x1012b30]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
mov edi, dword [ebp + 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x10027f0
Capabilities:
Access the windows event log
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 0x10]
push esi
xor esi, esi
cmp dword [ebp + 8], esi
push edi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
je 0x100286d
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
push esi
push ebx
push dword [ebp + 8]
call edi
cmp eax, esi
mov dword [ebp - 4], eax
jne 0x1002879
cmp dword [ebp - 0xc], 4
jne 0x1002864
cmp dword [ebp - 8], 4
je 0x100283d
cmp dword [ebp - 8], 3
jne 0x1002864
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 8]
push eax
push esi
push ebx
push dword [ebp + 8]
mov dword [ebp - 8], esi
call edi
cmp eax, esi
mov dword [ebp - 4], eax
jne 0x1002879
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
jmp 0x1002874
mov dword [ebp - 4], 0xe8
jmp 0x1002874
mov dword [ebp - 4], 0x3f2
cmp dword [ebp - 4], esi
je 0x10028b4
mov edi, dword [ebp + 0x14]
cmp edi, esi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], eax
je 0x10028b4
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
push 4
push 2
push esi
push 0x800007d6
push esi
push 2
push dword [0x1012b30]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
mov eax, dword [edi]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x10028c3
Capabilities:
Access the windows event log
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x1c]
push ebx
push esi
xor esi, esi
xor ebx, ebx
cmp dword [ebp + 8], esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [eax], esi
je 0x100295b
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
mov dword [ebp - 4], eax
jne 0x100296b
cmp dword [ebp - 8], 2
jbe 0x1002949
push dword [ebp - 8]
push 8
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
cmp ebx, esi
je 0x1002952
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ebx
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x1002962
mov dword [ebp - 4], 0xe8
jmp 0x1002962
mov dword [ebp - 4], 0xe
jmp 0x1002962
mov dword [ebp - 4], 0x3f2
cmp dword [ebp - 4], esi
je 0x1002a09
cmp ebx, esi
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
je 0x100298b
push ebx
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ebx, ebx
mov dword [ebp - 8], esi
cmp dword [ebp + 0x14], esi
je 0x1002a04
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 1
mov dword [ebp - 8], eax
jbe 0x1002a04
add eax, eax
push eax
push 8
mov dword [ebp - 8], eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
cmp ebx, esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
push 4
push 2
push esi
je 0x10029e9
push 0x800007d6
push esi
push 2
push dword [0x1012b30]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push dword [ebp + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [ebp - 4], esi
jmp 0x1002a09
push 0x800007d7
push esi
push 2
push dword [0x1012b30]
mov dword [ebp - 4], 0xe
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
cmp dword [ebp - 4], esi
jne 0x1002a2c
mov eax, dword [ebp + 0x18]
mov eax, dword [eax]
cmp eax, esi
je 0x1002a1d
push eax
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x1c]
mov dword [eax], ebx
mov eax, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x1002a40
cmp ebx, esi
je 0x1002a40
push ebx
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp + 0x1c]
mov dword [eax], esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x18
Function at 0x429474
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.004294f3
jae 0x429480
xor ecx, ecx
call fcn.004294f3
jae 0x4294aa
xor eax, eax
call fcn.004294f3
jae 0x4294bb
mov al, 0x10
call fcn.004294f3
adc al, al
jae 0x42949c
jne 0x4294e8
stosb byte es:[edi], al
jmp 0x429481
call fcn.004294ff
dec ecx
loop 0x4294c7
mov eax, ebp
call fcn.004294fd
jmp 0x4294e9
lodsb al, byte [esi]
shr eax, 1
je 0x42950f
adc ecx, 2
mov ebp, eax
jmp 0x4294e9
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.004294fd
cmp eax, 0x7d00
jae 0x4294e7
cmp eax, 0x500
jae 0x4294e8
cmp eax, 0x7f
ja 0x4294e9
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x429481
pop ebp
ret 8
Function at 0x401390
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x48baac]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 0x14], 0
je 0x4013c4
mov dword [ebp - 0x1c], 0x20119
jmp 0x4013cb
mov dword [ebp - 0x1c], 0x20219
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x20]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x40143f
mov dword [ebp - 0xc], 4
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x24], 0
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x401435
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044e402
mov esp, ebp
pop ebp
ret
Function at 0x401fa0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46e228
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x48baac]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x58]
call fcn.0040c2c0
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
mov dword [ebp - 4], 0
push 0xea60
mov ecx, dword [ebp - 0x48]
call fcn.0040c690
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.0040c4d0
call fcn.0040c2f0
call fcn.00401000
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x44], 0
push 1
lea ecx, [ebp - 0x14]
call fcn.00401820
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x28]
add ecx, 0x44
call fcn.00402aa0
jmp 0x402036
lea ecx, [ebp - 0x14]
call fcn.00402b90
lea edx, [ebp - 0x50]
push edx
mov ecx, dword [ebp - 0x28]
add ecx, 0x44
call fcn.00402930
push eax
lea ecx, [ebp - 0x14]
call fcn.004029c0
movzx eax, al
test eax, eax
je 0x402106
lea ecx, [ebp - 0x14]
call fcn.00402b70
mov ecx, eax
call fcn.00407770
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x40207a
mov dword [ebp - 0x30], 0
jmp 0x4020ea
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x1c]
mov cl, byte [eax]
mov byte [ebp - 0x15], cl
add dword [ebp - 0x1c], 1
cmp byte [ebp - 0x15], 0
jne 0x402089
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x40]
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x4c]
add eax, 1
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x3fffffff
jle 0x4020bf
mov dword [ebp - 0x2c], 0
jmp 0x4020e4
mov eax, dword [ebp - 0x20]
shl eax, 1
call fcn.00460520
mov dword [ebp - 0x3c], esp
mov ecx, dword [ebp - 0x38]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x3c]
push ecx
call fcn.00401010
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x402101
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x44], eax
jmp 0x40202e
lea esp, [ebp - 0x5c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044e402
mov esp, ebp
pop ebp
ret
Function at 0x4090d0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 1
jle 0x4091e1
push str.sysrun
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + eax]
push edx
call fcn.0044f173
add esp, 8
test eax, eax
jne 0x4091e1
push str.GlobalNamLoaderMutex
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4091e1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x409176
cmp dword [ebp + 8], 2
jle 0x40915f
push str.sschanged
mov eax, 4
shl eax, 1
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + eax]
push edx
call fcn.0044f173
add esp, 8
test eax, eax
jne 0x40915f
push 1
push 0x47a788
call fcn.00409020
add esp, 8
push 0x47a7b4
push 1
mov eax, dword [0x490050]
push eax
call fcn.00408be0
add esp, 0xc
jmp 0x4091e1
push 0x47a7d0
push 1
mov ecx, dword [0x490050]
push ecx
call fcn.00408be0
add esp, 0xc
call fcn.0040b540
mov ecx, eax
call fcn.0040b600
mov edx, 1
test edx, edx
je 0x4091c7
push 0xffffffffffffffff
call fcn.0040b540
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4091c5
call fcn.0040b540
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4091c7
jmp 0x409198
push str._Loader_:Loader
push 1
mov edx, dword [0x490050]
push edx
call fcn.00408be0
add esp, 0xc
xor eax, eax
jmp 0x4091e4
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
Function at 0x40b1a0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x48baac]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
mov ecx, dword [ebp - 0x234]
push ecx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x40b1ec
xor eax, eax
jmp 0x40b282
lea edx, [ebp - 0x230]
push edx
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x40b273
lea ecx, [ebp - 0x20c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0044f173
add esp, 8
test eax, eax
jne 0x40b26e
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x23c], eax
mov ecx, dword [ebp - 0x23c]
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x238], eax
push 0
mov edx, dword [ebp - 0x238]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x234]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x40b282
jmp 0x40b1ec
mov edx, dword [ebp - 0x234]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044e402
mov esp, ebp
pop ebp
ret

Function at 0x40bc70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x48baac]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0x1c], 0x20219
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x40bd0e
mov dword [ebp - 0xc], 4
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x40bd04
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044e402
mov esp, ebp
pop ebp
ret 8
Function at 0x40bd50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46e593
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x48baac]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], 0
push 1
lea ecx, [ebp - 0x14]
call fcn.00401370
push 8
call fcn.0044e4b5
add esp, 4
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0
je 0x40bdba
push 0
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x24]
call fcn.0040bec0
mov dword [ebp - 0x20], eax
jmp 0x40bdc1
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x14]
call fcn.00402820
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x18]
push ecx
push 0
lea ecx, [ebp - 0x14]
call fcn.00402b60
push eax
push 0x40bf00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x40be12
lea ecx, [ebp - 0x14]
call fcn.0040be90
jmp 0x40be29
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x28], eax
push 0x484db8
lea edx, [ebp - 0x28]
push edx
call fcn.0044fc3b
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040be60
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044e402
mov esp, ebp
pop ebp
ret
Function at 0x40ddc0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x46eb09
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
push edi
mov edi, ecx
mov dword [esp + 0xc], edi
call fcn.004075c0
sub esp, 8
lea ecx, [edi + 0x18]
mov dword [esp + 0x24], 0
call fcn.0040e790
sub esp, 8
lea ecx, [edi + 0xb0]
mov byte [esp + 0x24], 1
call fcn.0040e790
lea ecx, [edi + 0x148]
mov byte [esp + 0x1c], 2
call fcn.0040f190
mov byte [esp + 0x1c], 3
mov dword [edi + 0x15c], 0
mov dword [edi + 0x160], 0
call fcn.0040fcf0
mov dword [edi + 0x15c], eax
lea ecx, [edi + 0x164]
mov byte [esp + 0x1c], 4
call fcn.004075c0
lea ecx, [edi + 0x17c]
mov byte [esp + 0x1c], 5
call fcn.004075c0
lea esi, [edi + 0x194]
mov byte [esp + 0x1c], 6
mov ecx, esi
mov dword [esp + 0x10], esi
call fcn.004075c0
lea ecx, [esi + 0x18]
mov byte [esp + 0x1c], 7
call fcn.004075c0
lea ecx, [esi + 0x30]
mov byte [esp + 0x1c], 8
call fcn.004075c0
lea ecx, [esi + 0x48]
mov byte [esp + 0x1c], 9
call fcn.004075c0
lea ecx, [esi + 0x60]
mov byte [esp + 0x1c], 0xa
call fcn.004075c0
lea ecx, [esi + 0x78]
mov byte [esp + 0x1c], 0xb
call fcn.004075c0
lea ecx, [esp + 0xb]
call fcn.004030b0
mov dword [esi + 0x90], 0
mov dword [esi + 0x94], 0
mov dword [esi + 0x98], 0
mov word [esi + 0x9c], 0
mov byte [esi + 0x9e], 0
lea esi, [edi + 0x238]
mov byte [esp + 0x1c], 0xc
sub esp, 8
mov ecx, esi
mov dword [esp + 0x18], esi
call fcn.0040e790
lea ecx, [esi + 0x98]
mov byte [esp + 0x1c], 0xd
call fcn.004075c0
lea ecx, [esi + 0xb0]
mov byte [esp + 0x1c], 0xe
call fcn.00407790
lea ecx, [edi + 0x300]
mov byte [esp + 0x1c], 0xf
call fcn.004075c0
lea ecx, [edi + 0x318]
mov byte [esp + 0x1c], 0x10
call fcn.004075c0
lea ecx, [edi + 0x330]
mov byte [esp + 0x1c], 0x11
call fcn.0042fc80
mov byte [esp + 0x1c], 0x12
lea ecx, [esp + 0xb]
mov dword [edi + 0x408], 0
call fcn.004030b0
push 0x200
lea ecx, [edi + 0x40c]
mov dword [edi + 0x40c], 0
mov dword [edi + 0x410], 0
mov dword [edi + 0x414], 0
call fcn.00422200
mov ecx, dword [esp + 0x14]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x40e1a0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x46ebe3
push eax
mov dword fs:[0], esp
sub esp, 0x18
cmp byte [0x49060c], 0
push ebx
push esi
push edi
jne 0x40e30c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push eax
mov dword [0x490044], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x40e221
push 0x418
call fcn.0044e4b5
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x2c], 0
test eax, eax
je 0x40e20a
mov ecx, eax
call fcn.0040ddc0
jmp 0x40e20c
xor eax, eax
push eax
mov dword [esp + 0x30], 0xffffffff
push dword [0x490044]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ebx, dword [0x490374]
test ebx, ebx
jne 0x40e236
call fcn.0040d8c0
mov ebx, dword [0x490374]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov esi, dword [esp + 0x14]
xor edi, edi
or edi, dword [esp + 0x10]
push 0
add edi, 0x2ac18000
push 0x989680
adc esi, 0xfe624e21
push esi
push edi
call fcn.00453d00
push 0
push 0x989680
push edx
push eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], edx
call fcn.00453cc0
push 0
sub edi, eax
push 0xa
sbb esi, edx
push esi
push edi
call fcn.00453d00
movq xmm0, qword [esp + 0x10]
movq qword [ebx + 0x30], xmm0
mov dword [esp + 0x18], eax
movq xmm0, qword [esp + 0x18]
lea ecx, [esp + 0x10]
movq qword [ebx + 0x38], xmm0
call fcn.0040c2c0
mov dword [esp + 0x10], vtable.log4cplus::Logger.0
mov dword [esp + 0x2c], 1
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x40e2f0
mov eax, dword [ecx + 0x14]
lea edx, [ecx + 0x14]
mov eax, dword [eax + 4]
add edx, eax
or ecx, 0xffffffff
lea eax, [edx + 8]
lock xadd dword [eax], ecx
cmp ecx, 1
sete al
test al, al
je 0x40e2f0
test edx, edx
je 0x40e2f0
mov eax, dword [edx]
push 1
mov ecx, edx
call dword [eax]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], vtable.log4cplus::spi::AppenderAttachable.0
call fcn.0042d8c0
mov byte [0x49060c], 1
mov ecx, dword [esp + 0x24]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4103f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46f2d9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
mov dword [esp + 0x14], 0
push esi
mov dword [esp + 0xc], 0
mov ebx, dword [esp + 0x20]
push edi
mov edi, ecx
mov eax, dword [edi + 0x30]
mov ecx, dword [eax]
mov dword [ebx], ecx
mov eax, dword [ecx]
call dword [eax + 4]
mov ebp, dword [esp + 0x28]
mov dword [esp + 0x1c], 0
mov esi, dword [edi + 0x30]
mov dword [esp + 0x10], 1
mov ecx, dword [esi]
cmp ecx, dword [ebp]
je 0x410465
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, eax
test ecx, ecx
je 0x41045b
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [ebp]
mov dword [esi], ecx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [edi + 0x2c]
test esi, esi
je 0x410484
lea esp, [esp]
push dword [esi + 4]
mov ecx, dword [esi + 8]
push edi
push 1
call ecx
mov esi, dword [esi]
add esp, 0xc
test esi, esi
jne 0x410470
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x411c30
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x46ee2b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
cmp dword [esp + 0x2c], 0
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esp + 4], 0
je 0x411c80
lea ecx, [esi + 0x158]
mov dword [esi + 4], 0x47b600
call fcn.004104d0
mov dword [esp + 0x14], 0
mov dword [esp + 4], 1
push ecx
push dword [esp + 0x30]
push dword [esp + 0x30]
push ecx
push dword [esp + 0x2c]
mov ecx, esi
call fcn.00410e80
mov dword [esp + 0x14], 2
mov eax, dword [esi + 4]
mov dword [esi], vtable.log4cplus::FileAppender.0
mov eax, dword [eax + 4]
mov ecx, esi
mov dword [eax + esi + 4], vtable.log4cplus::FileAppender.1.0
call fcn.00411ba0
push dword [esp + 0x24]
mov dword [esp + 0x18], 3
mov eax, dword [esi + 4]
push dword [esp + 0x24]
mov dword [esi], vtable.log4cplus::RollingFileAppender.0
mov eax, dword [eax + 4]
mov ecx, esi
mov dword [eax + esi + 4], vtable.log4cplus::RollingFileAppender.1.0
call fcn.00411f10
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 0x18