joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402080
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2c
push ebx
mov al, 0x65
mov ebx, dword [0x406050]
push ebp
push esi
mov byte [esp + 0x29], al
mov byte [esp + 0x33], al
push edi
mov edi, dword [esp + 0x40]
mov al, 0x73
mov byte [esp + 0x38], al
mov byte [esp + 0x39], al
mov eax, dword [0x41658c]
mov ebp, dword [edi + 4]
push str.IsBadReadPtr
push eax
mov dword [esp + 0x18], ebp
mov byte [esp + 0x34], 0x47
mov byte [esp + 0x36], 0x74
mov byte [esp + 0x37], 0x50
mov byte [esp + 0x38], 0x72
mov byte [esp + 0x39], 0x6f
mov byte [esp + 0x3a], 0x63
mov byte [esp + 0x3b], 0x41
mov byte [esp + 0x3c], 0x64
mov byte [esp + 0x3d], 0x64
mov byte [esp + 0x3e], 0x72
mov byte [esp + 0x42], 0
call ebx
mov esi, dword [0x406068]
push 0xa
mov dword [esp + 0x1c], eax
call esi
mov edx, dword [0x41658c]
lea ecx, [esp + 0x2c]
push ecx
push edx
call ebx
push 0xa
mov dword [esp + 0x44], eax
call esi
mov cl, 0x4c
mov al, 0x61
push 0xa
mov byte [esp + 0x20], cl
mov byte [esp + 0x21], 0x6f
mov byte [esp + 0x22], al
mov byte [esp + 0x23], 0x64
mov byte [esp + 0x24], cl
mov byte [esp + 0x25], 0x69
mov byte [esp + 0x26], 0x62
mov byte [esp + 0x27], 0x72
mov byte [esp + 0x28], al
mov byte [esp + 0x29], 0x72
mov byte [esp + 0x2a], 0x79
mov byte [esp + 0x2b], 0x41
mov byte [esp + 0x2c], 0
call esi
mov eax, dword [edi]
add eax, 0x80
mov ecx, dword [eax + 4]
test ecx, ecx
jbe 0x402258
mov esi, dword [eax]
push 0x14
add esi, ebp
push esi
mov dword [esp + 0x1c], esi
call dword [esp + 0x20]
test eax, eax
jne 0x402258
mov eax, dword [esi + 0xc]
test eax, eax
je 0x402258
mov ecx, dword [0x41658c]
lea eax, [esp + 0x1c]
push eax
push ecx
call dword [esp + 0x48]
mov edx, dword [esi + 0xc]
add edx, ebp
push edx
call eax
mov edx, dword [edi + 8]
mov ebx, eax
mov eax, dword [edi + 0xc]
lea ecx, [eax*4 + 4]
push ecx
push edx
call dword [0x4062ec]
add esp, 8
mov dword [edi + 8], eax
test eax, eax
je 0x40224e
cmp ebx, 0xffffffff
je 0x40224e
mov ecx, dword [edi + 0xc]
mov dword [eax + ecx*4], ebx
mov edx, dword [edi + 0xc]
inc edx
mov dword [edi + 0xc], edx
mov eax, dword [esi]
test eax, eax
je 0x4021ed
mov esi, dword [esi + 0x10]
add ebp, eax
add esi, dword [esp + 0x10]
jmp 0x4021f4
mov edx, dword [esi + 0x10]
add ebp, edx
mov esi, ebp
mov eax, dword [ebp]
test eax, eax
je 0x40222b
test eax, 0x80000000
je 0x40220a
and eax, 0xffff
push eax
jmp 0x402213
mov ecx, dword [esp + 0x10]
lea edx, [eax + ecx + 2]
push edx
push ebx
call dword [esp + 0x48]
test eax, eax
mov dword [esi], eax
je 0x40224e
mov eax, dword [ebp + 4]
add ebp, 4
add esi, 4
test eax, eax
jne 0x4021fb
mov eax, dword [esp + 0x14]
push 0x14
add eax, 0x14
push eax
mov dword [esp + 0x1c], eax
call dword [esp + 0x20]
test eax, eax
jne 0x402258
mov ebp, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
jmp 0x402182
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2c
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2c
ret
Function at 0x402320
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x3c
mov ecx, dword [0x41658c]
push ebx
push ebp
push esi
lea eax, [esp + 0x20]
push edi
mov edi, dword [0x406050]
mov bl, 0x65
push eax
push ecx
mov byte [esp + 0x2c], 0x56
mov byte [esp + 0x2d], 0x69
mov byte [esp + 0x2e], 0x72
mov byte [esp + 0x2f], 0x74
mov byte [esp + 0x30], 0x75
mov byte [esp + 0x31], 0x61
mov byte [esp + 0x32], 0x6c
mov byte [esp + 0x33], 0x46
mov byte [esp + 0x34], 0x72
mov byte [esp + 0x35], bl
mov byte [esp + 0x36], bl
mov byte [esp + 0x37], 0
call edi
mov dword [esp + 0x10], eax
mov al, 0x73
mov byte [esp + 0x44], al
mov byte [esp + 0x45], al
mov eax, dword [0x41658c]
lea edx, [esp + 0x3c]
push edx
push eax
mov byte [esp + 0x44], 0x47
mov byte [esp + 0x45], bl
mov byte [esp + 0x46], 0x74
mov byte [esp + 0x47], 0x50
mov byte [esp + 0x48], 0x72
mov byte [esp + 0x49], 0x6f
mov byte [esp + 0x4a], 0x63
mov byte [esp + 0x4b], bl
mov byte [esp + 0x4e], 0x48
mov byte [esp + 0x4f], bl
mov byte [esp + 0x50], 0x61
mov byte [esp + 0x51], 0x70
mov byte [esp + 0x52], 0
call edi
mov esi, dword [esp + 0x50]
xor ebp, ebp
cmp esi, ebp
mov dword [esp + 0x14], eax
je 0x4024cf
cmp dword [esi + 0x10], ebp
je 0x4023f9
mov ecx, dword [esi]
mov eax, dword [esi + 4]
push ebp
push ebp
mov edx, dword [ecx + 0x28]
push eax
add edx, eax
call edx
mov dword [esi + 0x10], ebp
mov ecx, dword [0x41658c]
lea eax, [esp + 0x30]
push eax
push ecx
mov byte [esp + 0x38], 0x46
mov byte [esp + 0x39], 0x72
mov byte [esp + 0x3a], bl
mov byte [esp + 0x3b], bl
mov byte [esp + 0x3c], 0x4c
mov byte [esp + 0x3d], 0x69
mov byte [esp + 0x3e], 0x62
mov byte [esp + 0x3f], 0x72
mov byte [esp + 0x40], 0x61
mov byte [esp + 0x41], 0x72
mov byte [esp + 0x42], 0x79
mov byte [esp + 0x43], 0
call edi
mov dword [esp + 0x50], eax
mov eax, dword [esi + 8]
cmp eax, ebp
je 0x402478
mov eax, dword [esi + 0xc]
test eax, eax
jle 0x40246b
mov edx, dword [esi + 8]
mov eax, dword [edx + ebp*4]
cmp eax, 0xffffffff
je 0x402463
push eax
call dword [esp + 0x54]
mov eax, dword [esi + 0xc]
inc ebp
cmp ebp, eax
jl 0x402453
mov eax, dword [esi + 8]
push eax
call dword [0x4062f4]
add esp, 4
mov edx, dword [0x41658c]
lea ecx, [esp + 0x18]
push ecx
push edx
mov byte [esp + 0x20], 0x48
mov byte [esp + 0x21], bl
mov byte [esp + 0x22], 0x61
mov byte [esp + 0x23], 0x70
mov byte [esp + 0x24], 0x46
mov byte [esp + 0x25], 0x72
mov byte [esp + 0x26], bl
mov byte [esp + 0x27], bl
mov byte [esp + 0x28], 0
call edi
mov edi, eax
mov eax, dword [esi + 4]
test eax, eax
je 0x4024c5
push 0x8000
push 0
push eax
call dword [esp + 0x1c]
push esi
push 0
call dword [esp + 0x1c]
push eax
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
Function at 0x406010
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x42710b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x4042e4
call fcn.00406c71
push 4
mov dword [esp + 0x18], 0
call fcn.004079a7
mov edi, eax
add esp, 4
test edi, edi
je 0x406084
push ebx
call fcn.00406b49
mov dword [edi], eax
call fcn.00406908
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00406c32
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x406078
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.00406c5a
pop ebx
jmp 0x406086
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x408421
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42a510]
jne 0x40842b
repz ret
jmp fcn.0040c62c
Function at 0x410743
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42a510]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040a7e6
and dword [ebp - 0x14], 0
cmp dword [0x42f650], 0
mov dword [ebp - 0x18], eax
jne 0x4107f6
push 0x4037ac
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41089e
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4037a0
push ebx
call edi
test eax, eax
je 0x41089e
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403790
push ebx
mov dword [0x42f650], eax
call edi
push eax
call esi
push 0x40377c
push ebx
mov dword [0x42f654], eax
call edi
push eax
call esi
push 0x403760
push ebx
mov dword [0x42f658], eax
call edi
push eax
call esi
mov dword [0x42f660], eax
test eax, eax
je 0x4107f6
push 0x403748
push ebx
call edi
push eax
call esi
mov dword [0x42f65c], eax
mov eax, dword [0x42f65c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41084f
cmp dword [0x42f660], ecx
je 0x41084f
push eax
call esi
push dword [0x42f660]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41084f
test ebx, ebx
je 0x41084f
call edi
test eax, eax
je 0x410846
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x410846
test byte [ebp - 8], 1
jne 0x41084f
or dword [ebp + 0x10], 0x200000
jmp 0x410882
mov eax, dword [0x42f654]
cmp eax, dword [ebp - 0x18]
je 0x410882
push eax
call esi
test eax, eax
je 0x410882
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x410882
mov eax, dword [0x42f658]
cmp eax, dword [ebp - 0x18]
je 0x410882
push eax
call esi
test eax, eax
je 0x410882
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42f650]
call esi
test eax, eax
je 0x41089e
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4108a0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408421
leave
ret
Function at 0x4251c0
Capabilities:
Delete directory
Get common file path
Manipulate console buffer

Disassembly:
mov eax, 0x100c
call fcn.004112b0
cmp dword [0x7b33ec], 0x37
jne 0x42525a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemPowerState]
push 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
lea edx, [esp + 4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
lea eax, [esp + 0x810]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
mov ecx, dword [0x7b43e0]
mov dword [esp], ecx
mov eax, 0x5d1
add dword [esp], eax
mov edx, dword [esp]
mov al, byte [edx + esi]
mov ecx, dword [0x43443c]
mov byte [ecx + esi], al
add esp, 0x100c
ret
Function at 0x4254f0
Capabilities:
Accept command line arguments
Enumerate files on windows
Manipulate console buffer
Move file

Disassembly:
mov eax, dword [0x7b33ec]
sub esp, 0x97c
push ebx
push ebp
push esi
mov esi, dword [0x43443c]
push edi
shr eax, 3
xor edi, edi
cmp eax, edi
jbe 0x425706
mov dword [esp + 0x30], 0x9e3779b9
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], eax
jmp 0x425536
mov esi, dword [esp + 0x24]
xor edi, edi
cmp dword [0x7b33ec], 0x1c
jne 0x42554d
lea eax, [esp + 0x40]
push eax
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov edx, dword [0x42b2c0]
mov ebx, dword [0x42b2c8]
mov ebp, dword [0x42b2cc]
mov dword [esp + 0x14], ecx
mov ecx, dword [0x42b2c4]
mov dword [esp + 0x1c], eax
mov esi, 0xc6ef3720
mov dword [esp + 0x38], edx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x2c], 0x20
jmp 0x425596
mov eax, dword [esp + 0x1c]
xor edi, edi
mov edx, eax
shr edx, 5
add edx, ebp
mov ecx, eax
shl ecx, 4
mov dword [esp + 0x20], edx
add ecx, ebx
lea edx, [esi + eax]
xor ecx, edx
mov dword [esp + 0x10], ecx
mov dword [0x7b335c], edi
mov eax, dword [esp + 0x20]
add dword [0x7b335c], eax
mov eax, dword [0x7b335c]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x20], edi
mov eax, dword [esp + 0x3c]
add dword [esp + 0x20], eax
mov eax, dword [esp + 0x10]
xor eax, dword [esp + 0x20]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x20]
sub dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
shl edx, 4
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x38]
add dword [esp + 0x10], eax
cmp dword [0x7b33ec], 0x1be
mov eax, dword [esp + 0x14]
lea edi, [esi + eax]
jne 0x42562d
lea eax, [esp + 0x44]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov eax, dword [esp + 0x14]
shr eax, 5
add eax, dword [esp + 0x34]
cmp dword [0x7b33ec], 0x979
mov dword [0x7b3360], 0xff6b3619
mov dword [0x7b3364], 0xffffffff
mov dword [esp + 0x20], eax
jne 0x425677
push 0
lea ecx, [esp + 0x18c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameW]
lea edx, [esp + 0x48]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
xor dword [esp + 0x10], edi
mov eax, dword [esp + 0x20]
xor dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
sub dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x30]
add dword [esp + 0x18], eax
sub esi, dword [esp + 0x18]
dec dword [esp + 0x2c]
jne 0x425590
cmp dword [0x7b33ec], 0x8d4
jne 0x4256bb
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov dword [esi], eax
mov dword [esi + 4], ecx
cmp dword [0x7b33ec], 0x17
jne 0x4256f5
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
lea edx, [esp + 0x48]
push edx
push 0x403f50
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
add esi, 8
dec dword [esp + 0x28]
mov dword [esp + 0x24], esi
jne 0x425530
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x97c
ret
Function at 0x403b2c
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
test esi, esi
je 0x403b5b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x403b5b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x403b66
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x403b64
mov dword [eax], esi
mov al, 1
pop esi
pop ebp

Function at 0x404829
Capabilities:
Create process on windows

Disassembly:
push 0x60
mov eax, 0x4696bc
call fcn.00440d89
push 0x10
xor ebx, ebx
lea eax, [ebp - 0x28]
push ebx
push eax
call fcn.00444100
push 0x44
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.00444100
mov edi, dword [ebp + 0x14]
add esp, 0x18
test edi, edi
je 0x40485b
mov dword [edi], ebx
push dword [ebp + 8]
lea ecx, [ebp - 0x18]
call fcn.00417f0d
push dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.00417f0d
mov esi, dword [ebp + 0x10]
lea ecx, [ebp - 0x10]
test esi, esi
mov byte [ebp - 4], 1
mov eax, 0x46f5a3
cmovne eax, esi
push eax
call fcn.00417f0d
xor eax, eax
mov dword [ebp - 0x6c], 0x44
lea ecx, [ebp - 0x28]
test esi, esi
push ecx
cmovne eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x6c]
push ecx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4048d8
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x4048cc
mov eax, dword [ebp - 0x28]
mov dword [edi], eax
jmp 0x4048d1
push dword [ebp - 0x28]
call esi
push dword [ebp - 0x24]
call esi
mov bl, 1
lea ecx, [ebp - 0x10]
call fcn.00417f70
lea ecx, [ebp - 0x14]
call fcn.00417f70
lea ecx, [ebp - 0x18]
call fcn.00417f70
invalid
Function at 0x44067f
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
call fcn.0044e8fe
push 2
lea ecx, [ebp - 4]
push ecx
mov eax, dword [eax + 0x14]
push 0x22
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx eax, word [ebp - 4]
sub eax, 0x30
je 0x4406be
sub eax, 1
je 0x4406b9
sub eax, 1
je 0x4406b5
xor eax, eax
leave
ret
push 3
jmp 0x4406c0
xor eax, eax
inc eax
leave
ret
push 2
pop eax
leave
ret

Function at 0x44210a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x442149
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x442149
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x442149
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x442149
cmp dword [ecx + 0x74], 0xe
jbe 0x442149
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x44e8b4
Capabilities:
Read file via mapping

Disassembly:
mov dword [0x4ec8a8], ecx
sub ebx, dword [0x4ecce2]
mov dword [0x4ec662], edx
dec esi
xor edi, dword [0x4ecc0a]
neg edx
add ebx, edi
ror esi, 6
xor edx, eax
invalid
invalid
invalid

Function at 0x454b05
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x4ebf44]
cmp eax, dword [0x4e51d4]
jne fcn.0044ee06
push dword [ebp + 8]
call fcn.00454858
pop ecx
mov dword [0x4ebf44], eax
pop ebp
ret

Function at 0x459ab3
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4d2fc8
push 0x4d2fc0
push str.FlsAlloc
push 0x1f
call fcn.0045991e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x459ae7
push dword [ebp + 8]
mov ecx, esi
call dword [0x46f300]
call esi
jmp 0x459aed
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x459b31
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4d2fd8
push 0x4d2fd0
push str.FlsGetValue
push 0x21
call fcn.0045991e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x459b68
push dword [ebp + 8]
mov ecx, esi
call dword [0x46f300]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x459b70
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4d2fe0
push 0x4d2fd8
push str.FlsSetValue
push 0x22
call fcn.0045991e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x459baa
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x46f300]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x51e1ec
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
nop
push esi
call fcn.00527f14
pop esi
pop eax
lea ebx, [ebp - 0xc8]
mov edx, dword [ebp + 0xc]
cmp dword [ebx], edx
jne 0x51d7a2
mov edx, dword [ebp + 0x10]
cmp dword [ebx + 4], edx
jne 0x51d7a2
mov edx, dword [ebp + 0x14]
cmp dword [ebx + 8], edx
jmp 0x51d790
jmp 0x5214e3
pop ebx
shl ebx, 1
add edx, ebx
sub ecx, ecx
mov eax, eax
push edi
pop edi
mov cx, word [edx]
pop ebx
push eax
jmp 0x51bac8
push ebx
pop esi
jmp 0x525a62
pop ebx
jmp 0x51a05f
pop edi
jmp 0x522edd
add esi, 0x78
push ecx
pop ecx
mov esi, dword [esi]
add esi, ebx
mov dword [ebp - 0x10], esi
add esi, 0x18
lodsd eax, dword [esi]
push eax
xchg edi, edi
jmp 0x51a29e
pop edi
jmp 0x51f63d
sub ecx, ecx
dec ecx
push esi
jmp 0x516155
xor eax, eax
jmp 0x518b02
pop ecx
mov esi, dword [ebp - 0x10]
jmp 0x52576a
push ecx
pop ecx
add edx, 0x24
push esi
pop esi
mov edx, dword [edx]
add edx, ebx
jmp 0x528176
pop edx
add edx, 0x1c
jmp 0x521b82
pop ebp
sub esp, 0x100
push edx
push ebx
push ecx
push esi
jmp 0x52b471
jne 0x51d7a2
mov edx, dword [ebp + 0x18]
cmp dword [ebx + 0xc], edx
je 0x5285df
dec ecx
je 0x51e720
jmp 0x50d094
push ebp
push esp
jmp 0x51d4ed
pop edi
pop esi
jmp 0x522775
sub edi, esi
dec edi
jmp 0x50cfc8
cld
repne scasb al, byte es:[edi]
pop ecx
xchg ecx, ecx
jmp 0x51f247
mov eax, dword [ebp - 0x10]
push eax
pop edx
jmp 0x51b2c7
lea edx, [ebp - 0xc8]
mov ebp, ebp
push edx
push ecx
push ebx
jmp 0x51032e
pop ecx
add esi, 0x20
lodsd eax, dword [esi]
add eax, ebx
push ecx
pop ebx
dec ebx
mov ebx, ebx
shl ebx, 2
mov esi, eax
add esi, ebx
mov esi, dword [esi]
mov edi, edi
add esi, dword [ebp + 8]
push eax
mov eax, eax
pop eax
push eax
jmp 0x524cf4
mov edx, dword [edx]
add edx, ebx
shl ecx, 2
add edx, ecx
mov edx, dword [edx]
add edx, ebx
jmp 0x52b3bf
pop ecx
pop ebx
pop edx
mov eax, 0
push ebp
pop esp
jmp 0x5285dc
pop esi
pop ecx
pop ebx
pop edx
xchg esi, esi
jmp 0x523898
push ebp
pop esp
pop ebp
ret
push esi
jmp 0x520c23
push ecx
jmp 0x5214dc
add esi, dword [esi + 0x3c]
push esi
pop esi
jmp 0x5150c7
push ebx
dec ecx
push ecx
jmp 0x50d75f
pop ebp
nop
ret
mov ebx, dword [ebp + 8]
jmp 0x52083a
push edx
pop eax
jmp 0x51279c
push edi
mov ebx, dword [ebp + 8]
jmp 0x50e51c
Function at 0x522f39
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jne 0x513399
xor eax, eax
mov ebx, ebx
jmp 0x518149
cmp dword [ebp - 0x28], 0
je 0x513390
jmp 0x52844d
cmp edx, dword [eax + 0x18]
jmp 0x520323
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp + 8]
xchg edx, edx
jmp 0x5156c7
add edx, dword [ebp - 0x14]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
jmp 0x52bad5
add eax, dword [edx]
xchg ecx, ecx
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
push ecx
mov edx, dword [ebp + 0xc]
push edx
jmp 0x51ea63
sub esp, 0x3c
cmp dword [ebp + 8], 0
jne 0x524390
sub eax, eax
jmp 0x518147
push ebx
pop ebx
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp + 8]
jmp 0x51630c
movzx ecx, word [ebp + 0x10]
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 0x20]
lea ecx, [eax + ecx*4]
add ecx, dword [ebp + 8]
push edx
mov edi, edi
jmp 0x52ca69
push ebx
jb 0x51a67d
push ebp
push esp
pop ebp
jmp 0x5167dc
cmp dword [ebp + 0xc], 0
je 0x5167e9
mov eax, dword [ebp + 8]
mov esi, esi
mov ecx, dword [eax + 0x3c]
jmp 0x514149
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x10]
mov dword [ebp - 0x2c], ecx
xchg esp, esp
movzx edx, word [ebp + 0x10]
push ebp
xchg eax, eax
pop ebp
mov eax, dword [ebp - 0x2c]
jmp 0x513839
mov ecx, dword [eax + 0x78]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 4]
mov eax, eax
mov eax, dword [edx + 0x7c]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x10], 0
jmp 0x51338a
pop edx
jmp 0x51903c

Function at 0x5263bb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x20b], 0xa8
mov byte [ebp - 0x20a], 0xa3
mov byte [ebp - 0x209], 0xa8
mov byte [ebp - 0x208], 0xa3
jmp 0x51e837
sub esp, 0x234
mov byte [ebp - 0x210], 0xa3
mov byte [ebp - 0x20f], 0xa8
push ebp
jmp 0x528574
pop ebp
xchg esi, esi
jmp 0x513fdc
mov byte [ebp - 0x20c], 0xa3
jmp 0x52a07a
push ebp
push esp
jmp 0x51c646
pop ebp
mov esp, esp
mov byte [ebp - 0x20e], 0xa3
mov byte [ebp - 0x20d], 0xa8
xchg edx, edx
jmp 0x5203d2
push esi
pop esi
jmp 0x50b098