joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412270
Capabilities:
Enumerate process modules
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x1014
call fcn.0040c22c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push 0x1000
push edx
push eax
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x4123ae
mov ecx, dword [esp + 0x10]
xor edx, edx
mov eax, 0
cmp ecx, 4
jb 0x41241b
shr ecx, 2
mov dword [esp + 8], ecx
jmp 0x4122d3
mov edx, dword [esp + 0xc]
inc edx
xor eax, eax
mov ecx, dword [esp + 8]
cmp edx, ecx
je 0x41241b
mov dword [esp + 0xc], edx
mov esi, dword [esp + edx*4 + 0x14]
mov eax, dword [esi + 0x3c]
movzx ecx, word [esi + eax + 0x14]
mov edx, dword [esp + 0x102c]
mov dword [edx], esi
mov dword [esp + 4], esi
movzx ebx, word [esi + eax + 6]
test ebx, ebx
je 0x4122c0
add eax, dword [esp + 4]
lea ebp, [eax + ecx]
add ebp, 0x18
mov dword [esp], 0
xor ecx, ecx
jmp 0x41234e
mov eax, dword [ebp + 8]
add eax, edi
mov ecx, dword [esp + 0x1028]
cmp eax, ecx
mov eax, esi
movzx esi, al
mov eax, esi
mov edx, 1
cmova eax, edx
cmp edi, ecx
mov ecx, eax
cmova ecx, esi
test cl, 1
je 0x412344
mov eax, dword [esp]
and al, 1
jne 0x4123ca
add ebp, 0x28
dec ebx
je 0x4122c0
mov esi, ecx
mov edi, dword [ebp + 0xc]
add edi, dword [esp + 4]
push 8
push str..text
push ebp
call sub.api_ms_win_crt_string_l1_1_0.dll_strncmp
add esp, 0xc
test eax, eax
je 0x412310
push 8
push str..eh_frame
push ebp
call sub.api_ms_win_crt_string_l1_1_0.dll_strncmp
add esp, 0xc
test eax, eax
je 0x412390
mov ecx, esi
test cl, 1
jne 0x412339
jmp 0x412344
mov ecx, dword [esp + 0x102c]
mov dword [ecx + 4], edi
mov eax, dword [ebp + 8]
mov dword [ecx + 8], eax
mov al, 1
mov dword [esp], eax
mov ecx, esi
test cl, 1
jne 0x412339
jmp 0x412344
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp byte [0x441211], 1
jne 0x4123ce
cmp byte [0x441210], 0
jne 0x4123ed
jmp 0x412419
mov al, 1
jmp 0x41241b
push str.LIBUNWIND_PRINT_UNWINDING
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
mov byte [0x441211], 1
test eax, eax
setne byte [0x441210]
je 0x412419
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push 2
call edi
add esp, 4
push esi
push str.libunwind:_findUnwindSections:_EnumProcessModules_failed__returned_error__d_n
push eax
call fcn.0040e1f0
add esp, 0xc
push 2
call edi
add esp, 4
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
add esp, 4
xor eax, eax
add esp, 0x1014
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x4128d0
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push eax
mov edi, dword [esp + 0x10]
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push 2
call esi
add esp, 4
push eax
push 1
push 0xb
push str.libcabi:
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
lea eax, [esp + 0x14]
mov dword [esp], eax
push 2
call esi
add esp, 4
push dword [esp]
push edi
push eax
call fcn.0040e5c0
add esp, 0xc
push 2
call esi
add esp, 4
push eax
push 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add esp, 8
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
int3
Function at 0x40c6a4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x40c6b3
pop dword [ebp - 0x50]
mov eax, 0xb947592f
add eax, 0x46f96d84
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x3e492
push 0
mov eax, 0xf859d98b
sub eax, 0xf8178773
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0x6431adc5
add ecx, 0x9bce9c2d
mov esi, eax
mov edx, 0x1bfe3060
add edx, 0xe44523a0
add edx, dword [ebp - 0x50]
mov ebx, 0xd2215a14
sub ebx, 0xe1e2ab14
sub dword [ebp - 0x14], eax
mov edi, dword [edx]
xor dword [ebp - 0x34], 0xc5f51fa6
sub edi, ebx
sub dword [ebp - 0x14], 0x458159f
mov dword [esi], edi
mov dword [ebp - 0x4c], 0xb3f3374e
add esi, 4
add edx, 0x7e295b2e
sub edx, 0x7e295b2a
loop 0x40c712
add eax, 0xab38c606
add eax, 0x54c85495
mov ebx, eax
add eax, 0x70774f70
sub eax, 0x70774f6b
mov ecx, 0x400000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x40158a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x10000000
mov dword [esp], str..PhysicalDrive0
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileW]
call eax
sub esp, 0x1c
mov dword [ebp - 0xc], eax
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x200
mov dword [esp + 4], 0x41b000
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteFile]
call eax
sub esp, 0x14
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
nop
leave
ret
Function at 0x40d460
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.0040f3e0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.0040f3e0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x40d4c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x41e39c]
test esi, esi
jle 0x40d5c0
mov eax, dword [0x41e3a0]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x40d4f0
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x40d56f
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x40d4e0
mov dword [esp], ebx
call fcn.0040de30
mov edi, eax
test eax, eax
je 0x40d5e7
mov eax, dword [0x41e3a0]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.0040df40
mov edx, dword [0x41e3a0]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x40d5c7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x40d568
sub eax, 4
and eax, 0xfffffffb
jne 0x40d576
add dword [0x41e39c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
add ebx, dword [0x41e3a0]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x40d568
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.0040d460
xor esi, esi
jmp 0x40d4fa
mov eax, dword [0x41e3a0]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.0040d460
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.0040d460
lea esi, [esi]
nop
Function at 0x40daa0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x41e3b8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x41e3b0]
sub esp, 4
test ebx, ebx
je 0x40daf5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40daee
test esi, esi
je 0x40daee
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x40dad0
mov dword [esp], 0x41e3b8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40f190
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [ebp + 8]
mov dword [esp], esi
call sub.MSVCR120.dll_strlen
mov ebx, eax
add eax, 0x10
mov dword [ebp - 0x1c], eax
lea eax, [ebx + 0x41]
lea ecx, [ebx + 0x31]
shr eax, 4
mov dword [ebp - 0x20], ecx
shl eax, 4
call fcn.0040e0b0
mov edx, 0x326d
sub esp, eax
lea eax, [esp + 0x1b]
mov dword [esp + 8], ebx
lea edi, [esp + 0xc]
mov dword [esp + 4], esi
mov dword [esp], eax
mov word [esp + 0x18], dx
mov dword [esp + 0xc], 0x2d636367
mov dword [esp + 0x10], 0x656d6873
mov dword [esp + 0x14], 0x64742d6d
mov byte [esp + 0x1a], 0x2d
call sub.MSVCR120.dll_memcpy
lea eax, [ebx + 0x10]
add eax, edi
mov dword [eax], 0x61616161
mov dword [eax + 4], 0x61616161
mov dword [eax + 8], 0x61616161
mov dword [eax + 0xc], 0x61616161
mov dword [eax + 0x10], 0x61616161
mov dword [eax + 0x14], 0x61616161
mov dword [eax + 0x18], 0x61616161
mov dword [eax + 0x1c], 0x61616161
mov byte [esp + ebx + 0x3c], 0
mov byte [esp + ebx + 0x1b], 0
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov byte [edi + ebx + 0xf], 0x2d
sub esp, 0xc
mov dword [ebp - 0x24], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
je 0x40f284
int3
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_FindAtomA]
sub esp, 4
test ax, ax
je 0x40f2d0
mov ecx, dword [ebp - 0x1c]
movzx eax, ax
mov edx, edi
mov dword [esp], ecx
mov ecx, dword [ebp - 0x20]
call fcn.0040f120
mov ebx, eax
mov edi, dword [ebp - 0x24]
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0xc]
add ebx, edi
mov dword [esp], eax
call sub.MSVCR120.dll_malloc
mov edx, 0x20
mov esi, eax
lea esi, [esi]
bt esi, edx
jae 0x40f2f6
mov eax, edx
neg eax
mov byte [ebx + eax + 0x30], 0x41
sub edx, 1
jne 0x40f2e8
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_AddAtomA]
sub esp, 4
test ax, ax
jne 0x40f30d
int3
mov ecx, dword [ebp - 0x1c]
movzx eax, ax
mov edx, edi
mov dword [esp], ecx
mov ecx, dword [ebp - 0x20]
call fcn.0040f120
mov ebx, eax
cmp esi, eax
je 0x40f333
mov dword [esp], esi
call sub.msvcrt.dll_free
jmp 0x40f2aa
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [esp + 8], eax
call sub.MSVCR120.dll_memset
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x40f2aa
mov dword [esp], ebx
call dword [ebp + 0x10]
jmp 0x40f2aa
Function at 0x4106a0
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [0x41e418]
test ebx, ebx
je 0x4106d0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [ebx], eax
mov eax, dword [0x41e418]
test eax, eax
je 0x4106f8
cmp dword [eax], 0xffffffff
je 0x419614
add esp, 0x18
pop ebx
ret
mov dword [esp + 8], 0x40faf0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.00413fe0
mov dword [0x41e418], eax
mov ebx, eax
jmp 0x4106ae
mov dword [esp + 8], 0x40faf0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.00413fe0
mov dword [0x41e418], eax
jmp 0x4106bf
call sub.msvcrt.dll_abort

Function at 0x410ba0
Capabilities:
Print debug messages

Disassembly:
test eax, eax
je 0x410bd0
push edi
push esi
push ebx
mov ebx, eax
add esp, 0xffffff80
mov dword [esp], eax
call fcn.00415570
cmp eax, 1
je 0x410bd1
mov dword [ebx], 0xffffffff
sub esp, 0xffffff80
pop ebx
pop esi
pop edi
ret
ret
lea ebx, [esp + 0x15]
xor eax, eax
mov esi, str.Error_cleaning_up_spin_keys_for_thread
mov ecx, 0xa
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x3d]
mov ecx, 0x43
rep stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea edx, [esp + 0x3c]
mov dword [esp + 8], 0xa
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__ultoa]
cmp byte [esp + 0x3c], 0
mov eax, 0x27
jne 0x410c25
jmp 0x410c33
cmp eax, 0x6a
je 0x410c3d
add eax, 1
cmp byte [ebx + eax], 0
jne 0x410c20
cmp eax, 0x6a
je 0x410c3d
mov byte [esp + eax + 0x15], 0xa
mov byte [esp + eax + 0x16], 0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push eax
call sub.msvcrt.dll_abort
lea esi, [esi]
Function at 0x410c50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [0x41e41c]
test eax, eax
je 0x410db8
cmp dword [eax], 1
je 0x410c6e
call fcn.00410b20
mov eax, dword [0x41e418]
test eax, eax
je 0x410de0
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x410ca0
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.004104c0
mov esi, eax
mov eax, dword [entry3]
test eax, eax
je 0x410c8f
test esi, esi
je 0x410c8f
mov dword [esi + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x1c], 0xffffffff
mov dword [esi + 0x18], eax
sub esp, 0x10
lea eax, [esi + 0x38]
call fcn.00410ba0
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esi + 0x64], 0
mov dword [esi + 0x14], 0
call ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ebx, eax
call ebp
lea edx, [esi + 0x14]
mov dword [esp + 8], edi
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
sub esp, 0x1c
test eax, eax
je 0x419619
mov eax, dword [esi + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], eax
movzx eax, byte [esi + 0x20]
sub esp, 4
and eax, 0xffffffcf
or eax, 0x10
mov byte [esi + 0x20], al
mov eax, dword [0x41e418]
test eax, eax
je 0x410e10
mov dword [esp + 4], esi
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x419619
add esp, 0x2c
mov ebx, esi
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_once_shmem
call fcn.00413fe0
mov dword [0x41e41c], eax
jmp 0x410c64
mov dword [esp + 8], 0x40faf0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.00413fe0
mov dword [0x41e418], eax
jmp 0x410c7b
mov dword [esp + 8], 0x40faf0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.00413fe0
mov dword [0x41e418], eax
jmp 0x410d8e
call sub.msvcrt.dll_abort
Function at 0x4113d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x411400
mov edi, dword [esp + 0x28]
test edi, edi
je 0x4114b0
add esp, 0x10
mov eax, 1
pop ebx
pop esi
pop edi
ret 0xc
cmp eax, 1
je 0x4114e0
cmp eax, 3
jne 0x4113ea
mov eax, dword [0x41e418]
test eax, eax
je 0x4115f0
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x4113ea
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x4113ea
test byte [eax + 0x20], 0x30
je 0x411510
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x41144d
call fcn.004111c0
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x41147f
mov dword [esp], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x411471
mov dword [esp], eax
call esi
sub esp, 4
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x14], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call fcn.0040f940
lea eax, [ebx + 0x38]
call fcn.00410ba0
mov esi, dword [ebx + 0xb0]
test esi, esi
jne 0x411598
mov eax, ebx
call fcn.00410720
jmp 0x411598
mov eax, dword [0x41e430]
test eax, eax
je 0x4113ea
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
mov dword [0x41e430], 0
sub esp, 4
jmp 0x4113ea
mov dword [esp + 4], 0x40fb20
mov dword [esp], 1
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
sub esp, 8
mov dword [0x41e430], eax
mov eax, 1
add esp, 0x10
pop ebx
pop esi
pop edi
ret 0xc
mov edx, dword [ebx + 0x68]
mov eax, dword [eax + 0x18]
test edx, edx
jne 0x4115c0
test eax, eax
je 0x41152e
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebx + 0xb4]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x68], 1
test eax, eax
je 0x41154b
call fcn.004111c0
lea edi, [ebx + 0x1c]
lea esi, [ebx + 0x38]
test byte [ebx + 0x24], 4
je 0x411620
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x411574
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebx + 0x14], 0
mov dword [esp], edi
call fcn.0040f940
mov eax, esi
call fcn.00410ba0
mov ecx, dword [ebx + 0xb0]
test ecx, ecx
je 0x4114a0
mov eax, dword [0x41e418]
test eax, eax
je 0x411634
mov dword [esp + 4], 0
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
jmp 0x4113ea
test eax, eax
je 0x4115d0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
lea eax, [ebx + 0x1c]
mov dword [ebx + 0x18], 0
mov dword [esp], eax
call fcn.0040f940
lea eax, [ebx + 0x38]
call fcn.00410ba0
jmp 0x4113ea
mov dword [esp + 8], 0x40faf0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.00413fe0
mov dword [0x41e418], eax
jmp 0x41141b
mov dword [esp], edi
call fcn.0040f940
mov eax, esi
call fcn.00410ba0
jmp 0x4113ea
mov dword [esp + 8], 0x40faf0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.00413fe0
mov dword [0x41e418], eax
jmp 0x4115a5
Function at 0x4128b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call fcn.00410c50
mov dword [eax + 4], esi
mov ebx, eax
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x4128d2
call fcn.004111c0
test byte [ebx + 0x20], 0x30
je 0x412934
mov eax, dword [0x41e418]
test eax, eax
je 0x4129bb
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x41292b
cmp dword [ebx + 0x14], 0
mov eax, dword [eax + 0x18]
je 0x41298b
mov dword [ebx + 0x68], 1
mov esi, dword [ebx + 4]
test eax, eax
je 0x41291e
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
mov dword [ebx + 0x18], 0
test byte [ebx + 0x24], 4
jne 0x412948
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
add ebx, 0x70
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_longjmp]
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
cmp dword [ebx + 0xb0], 0
mov dword [ebx + 0x14], 0
je 0x4129b2
mov eax, dword [0x41e418]
test eax, eax
je 0x4129e1
mov dword [esp + 4], 0
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push eax
push eax
jmp 0x41292b
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x41299f
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
cmp dword [ebx + 0xb0], 0
mov esi, dword [ebx + 4]
mov dword [ebx + 0x18], 0
jne 0x41296b
mov eax, ebx
call fcn.00410720
jmp 0x41296b
mov dword [esp + 8], 0x40faf0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.00413fe0
mov dword [0x41e418], eax
jmp 0x4128e5
mov dword [esp + 8], 0x40faf0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.00413fe0
mov dword [0x41e418], eax
jmp 0x412974
Function at 0x413fe0
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [ebp + 8]
mov dword [esp], esi
call sub.MSVCR120.dll_strlen
mov ebx, eax
add eax, 0x10
mov dword [ebp - 0x1c], eax
lea eax, [ebx + 0x40]
lea ecx, [ebx + 0x30]
shr eax, 4
mov dword [ebp - 0x20], ecx
shl eax, 4
call fcn.0040e0b0
mov edx, 0x326d
sub esp, eax
lea eax, [esp + 0x1b]
mov dword [esp + 8], ebx
lea edi, [esp + 0xc]
mov dword [esp + 4], esi
mov dword [esp], eax
mov word [esp + 0x18], dx
mov dword [esp + 0xc], 0x2d636367
mov dword [esp + 0x10], 0x656d6873
mov dword [esp + 0x14], 0x64742d6d
mov byte [esp + 0x1a], 0x2d
call sub.MSVCR120.dll_memcpy
lea eax, [ebx + 0x10]
add eax, edi
mov dword [eax], 0x61616161
mov dword [eax + 4], 0x61616161
mov dword [eax + 8], 0x61616161
mov dword [eax + 0xc], 0x61616161
mov dword [eax + 0x10], 0x61616161
mov dword [eax + 0x14], 0x61616161
mov dword [eax + 0x18], 0x61616161
mov dword [eax + 0x1c], 0x61616161
mov byte [esp + ebx + 0x3c], 0
mov byte [esp + ebx + 0x1b], 0
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov byte [edi + ebx + 0xf], 0x2d
sub esp, 0xc
mov dword [ebp - 0x24], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
je 0x4140d4
int3
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_FindAtomA]
sub esp, 4
test ax, ax
je 0x414120
mov ecx, dword [ebp - 0x1c]
movzx eax, ax
mov edx, edi
mov dword [esp], ecx
mov ecx, dword [ebp - 0x20]
call fcn.00413f70
mov ebx, eax
mov edi, dword [ebp - 0x24]
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0xc]
add ebx, edi
mov dword [esp], eax
call sub.MSVCR120.dll_malloc
mov edx, 0x20
mov esi, eax
lea esi, [esi]
bt esi, edx
jae 0x414146
mov eax, edx
neg eax
mov byte [ebx + eax + 0x30], 0x41
sub edx, 1
jne 0x414138
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_AddAtomA]
sub esp, 4
test ax, ax
jne 0x41415d
int3
mov ecx, dword [ebp - 0x1c]
movzx eax, ax
mov edx, edi
mov dword [esp], ecx
mov ecx, dword [ebp - 0x20]
call fcn.00413f70
mov ebx, eax
cmp esi, eax
je 0x414183
mov dword [esp], esi
call sub.msvcrt.dll_free
jmp 0x4140fa
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [esp + 8], eax
call sub.MSVCR120.dll_memset
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4140fa
mov dword [esp], ebx
call dword [ebp + 0x10]
jmp 0x4140fa
Function at 0x401990
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x410008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x424
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x434], edx
push 0
push eax
mov ebx, ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x430], 0x428
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessId]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x401a23
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0x18
jne 0x401a10
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessId]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x401a23
call edi
cmp eax, 0x18
je 0x4019f2
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a480
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x401a10
lea eax, [ebp - 0x430]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
mov ebx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov edi, eax
nop dword [eax]
push dword [ebp - 0x434]
lea eax, [ebp - 0x410]
push eax
call ebx
add esp, 8
test eax, eax
je 0x401a6a
lea eax, [ebp - 0x430]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32NextW]
mov edi, eax
test edi, edi
jne 0x401a40
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x401a10
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x414]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0040a480
mov esp, ebp
pop ebp
ret