joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e7b30
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x5e7b68
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x5e7b70
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x5e7ba4
mov eax, dword [esp + 0x14]
test eax, eax
je 0x5e7ba4
push eax
push esi
call fcn.005ea83b
add esp, 8
pop esi
ret 0x10

Function at 0x5e7bb0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x5e7c32
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x5e7c25
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x5ff2fc
push ecx
mov dword [esp + 0x1c], 4
call fcn.005ea42f
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x5e7bea
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x5e7c40
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x5e7cd2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x5e7cc5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x5ff2fc
push ecx
mov dword [esp + 0x1c], 4
call fcn.005ea42f
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x5e7cbb
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x5e7c7a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x5e7e50
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x5e7f81
push esi
call fcn.005eb465
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.005da150
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x5e7f81
push 0
push ebp
call fcn.005da470
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.005da330
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x5e7edb
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.005da3c0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x5e7f71
push 0x5ff8f4
push edi
call fcn.005e9280
push eax
push ebx
push esi
call fcn.005e7db0
push 0x5ff8d4
push edi
call fcn.005e9280
push eax
push ebx
push esi
call fcn.005e7db0
push 0x5ff8b4
push edi
call fcn.005e9280
push eax
push ebx
push esi
call fcn.005e7db0
push 0x5ff89c
push edi
call fcn.005e9280
add esp, 0x44
push eax
push ebx
push esi
call fcn.005e7db0
push 0x5ff87c
push edi
call fcn.005e9280
push eax
push ebx
push esi
call fcn.005e7db0
push 0x5ff864
push edi
call fcn.005e9280
push eax
push ebx
push esi
call fcn.005e7db0
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x5e9040
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.005e8fd0
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.005e8fd0
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.005e8fd0
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.005e8fd0
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret
Function at 0x5ea230
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5ea286
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x5fa88c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5ea279
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x5ea288
xor eax, eax
pop esi
leave
ret 4

Function at 0x5f13f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x61a7d0
cmp edx, dword [eax]
je 0x5f1412
add eax, 8
inc ecx
cmp eax, 0x61a860
jl 0x5f1403
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x61a7d0]
jne 0x5f1540
mov eax, dword [0x61f918]
cmp eax, 1
je 0x5f151a
test eax, eax
jne 0x5f1443
cmp dword [0x61a024], 1
je 0x5f151a
cmp edx, 0xfc
je 0x5f1540
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x5f147a
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.005f27e0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.005f16c0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x5f14bd
lea eax, [ebp - 0x1a4]
push eax
call fcn.005f16c0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x5fad40
push edi
call fcn.005f2660
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.005f27e0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.005f27f0
lea eax, [ebp - 0xa0]
push 0x5fad20
push eax
call fcn.005f27f0
push dword [esi + 0x61a7d4]
lea eax, [ebp - 0xa0]
push eax
call fcn.005f27f0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.005f4a03
add esp, 0x2c
pop edi
jmp 0x5f1540
lea eax, [ebp + 8]
lea esi, [esi + 0x61a7d4]
push 0
push eax
push dword [esi]
call fcn.005f16c0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x42b006
Capabilities:
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ae60
push 0x42d700
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push ebx
mov eax, 0x564d5868
mov ebx, 0x8685d465
mov ecx, 0xa
mov dx, 0x5658
in eax, dx
mov dword [ebp - 0x1c], ebx
pop ebx
mov dword [ebp - 4], 0xffffffff
jmp 0x42b06e
xor eax, eax
cmp dword [ebp - 0x1c], 0x564d5868
sete al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42b08b
Capabilities:
Check for vm using instruction vpcext

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ae70
push 0x42d700
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
mov eax, 1
invalid

Function at 0x42bebe
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push 0x1400
push 0x4291a8
call fcn.0042b36b
pop ecx
pop ecx
push 0x42a94c
push 0x41a5d7
call dword [sym.imp.MSVCRT.dll_fopen]
pop ecx
pop ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42bf11
push dword [ebp - 4]
push 1
push 0x1400
push 0x4291a8
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
push dword [ebp - 4]
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
push 0x42a950
push 0x41a6d6
call dword [sym.imp.MSVCRT.dll_fopen]
pop ecx
pop ecx
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x42bf4e
push dword [ebp - 8]
push 1
push 0x1400
push 0x4291a8
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
push dword [ebp - 8]
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
push dword [0x425320]
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
test eax, eax
jne 0x42bf78
push 0x41a6d6
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
test eax, eax
jne 0x42bf78
push 0x41a5d7
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xor eax, eax
leave
ret

Function at 0x42c0f7
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push 0x44
push 0
lea eax, [ebp - 0x54]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
leave
ret
Function at 0x42c1d8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x834
push 0
push 0
push 0
push 0
push 0x42a964
call dword [0x419cdc]
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x82c], 0
je 0x42c2b6
push 0
push 0
push 0
push 0
push dword [ebp + 8]
push dword [ebp - 0x82c]
call dword [0x4198a0]
mov dword [ebp - 0x830], eax
cmp dword [ebp - 0x830], 0
je 0x42c2b6
push 0x42a968
push dword [ebp + 0xc]
call dword [sym.imp.MSVCRT.dll_fopen]
pop ecx
pop ecx
mov dword [ebp - 0x834], eax
cmp dword [ebp - 0x834], 0
je 0x42c2b6
lea eax, [ebp - 0x824]
push eax
push 0x800
lea eax, [ebp - 0x800]
push eax
push dword [ebp - 0x830]
call dword [0x4198ac]
test eax, eax
jne 0x42c275
jmp 0x42c2a4
push dword [ebp - 0x834]
push 1
push dword [ebp - 0x824]
lea eax, [ebp - 0x800]
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
push 0x64
call dword [sym.imp.KERNEL32.DLL_Sleep]
cmp dword [ebp - 0x824], 0
ja 0x42c250
push dword [ebp - 0x834]
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
push 1
pop eax
jmp 0x42c2b8
xor eax, eax
leave
ret

Function at 0x42c394
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library
Resolve dns
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x51fc
call fcn.0042d710
push 0x42a974
jmp loc.0042e034
Function at 0x42d290
Capabilities:
Create thread
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
call fcn.0042b08b
movzx eax, al
test eax, eax
jne 0x42d2b1
call fcn.0042b006
movzx eax, al
test eax, eax
je 0x42d2b8
xor eax, eax
jmp 0x42d3e9
push 2
call dword [sym.imp.KERNEL32.DLL_SetErrorMode]
push 0
call dword [sym.imp.KERNEL32.DLL_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [sym.imp.MSVCRT.dll___argc]
cmp dword [eax], 1
jle 0x42d356
push 0x428f10
lea eax, [ebp - 0x104]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
mov dword [ebp - 0x108], 1
jmp 0x42d305
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
mov eax, dword [sym.imp.MSVCRT.dll___argc]
mov ecx, dword [ebp - 0x108]
cmp ecx, dword [eax]
jge 0x42d347
mov eax, dword [sym.imp.MSVCRT.dll___argv]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x108]
push dword [eax + ecx*4]
lea eax, [ebp - 0x104]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
push 0x42adf4
lea eax, [ebp - 0x104]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
jmp 0x42d2f8
push 0xa
lea eax, [ebp - 0x104]
push eax
call dword [0x419cd8]
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push eax
call dword [sym.imp.MSVCRT.dll_srand]
pop ecx
call fcn.0042bc68
call dword [sym.imp.MSVCRT.dll_rand]
cdq
mov ecx, 0x3e8
idiv ecx
push edx
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x42adf8
push 0x7f
push 0
push 4
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateFileMappingA]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x42d3a4
xor eax, eax
jmp 0x42d3e9
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x42cee9
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x7d0
call dword [sym.imp.KERNEL32.DLL_Sleep]
call fcn.0042bebe
push 1
pop eax
test eax, eax
je 0x42d3e7
push 0x64
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x42d3d6
xor eax, eax
leave
ret 0x10
Function at 0x40610d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x40611c
pop dword [ebp - 0x4c]
mov eax, 0x7c9d7a2
add eax, 0xf876897a
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xe8dae251
add dword [ebp - 0x5c], 0x657762fa
mov dword [ebp - 0x58], 0x75dcd324
add dword [ebp - 0x58], 0xbc567921
mov dword [ebp - 0x54], 0x8a5d4012
sub dword [ebp - 0x54], 0x3e10fbe4
mov dword [ebp - 0x50], 0x5ea088e0
sub dword [ebp - 0x50], 0x5ea088e0
lea eax, [ebp - 0x5c]
push eax
mov eax, 0xa94829cb
add eax, 0x56f84695
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x963f77b6
sub dword [ebp - 0x5c], 0x21cd0e60
mov dword [ebp - 0x58], 0xea55f9ba
add dword [ebp - 0x58], 0x571667bb
mov dword [ebp - 0x54], 0xe979f692
add dword [ebp - 0x54], 0x79f575da
mov dword [ebp - 0x50], 0x63ab8405
sub dword [ebp - 0x50], 0x63ab8405
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x699b5bea
add eax, 0x96a51516
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x38b3b
push 0
call eax
mov ecx, 0xfbb700e3
sub ecx, 0xfbb6b083
xor esi, esi
add esi, eax
mov edx, 0x410000
add edx, dword [ebp - 0x4c]
mov edi, 0x7033d94
sub edi, 0xbfa03ec8
add dword [ebp - 0x34], 0x5253fe06
mov ebx, dword [edx]
sub dword [ebp - 0xc], 0x76dfdc74
xor ebx, edi
add dword [ebp - 0x28], ecx
mov dword [esi], ebx
mov dword [ebp - 0x18], 0x82ad52e7
add esi, 4
add edx, 0xb3a548c
add edx, 0xf4c5ab78
loop 0x40623a
add eax, 0x83f4f3ea
add eax, 0x7c0c4069
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xc982e1a7
sub ecx, 0xc942e1a7
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x4099fc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x409a8c
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x409a8c
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x409a3f
test edx, 3
jne 0x409a2e
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x409a39
jmp 0x409a3f
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x409a3f
cmp dword [ecx - 8], 1
je 0x409a49
mov edx, ebx
or edx, 3
call 0xac879a81
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x5b5b5b5b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x409a5b
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp 0x60809acc
Function at 0x40af70
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00419eb0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00419eb0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x40afd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x502078]
test esi, esi
jle 0x40b0f0
mov eax, dword [0x50207c]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x40b004
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x40b087
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x40aff0
mov dword [esp], ebx
call fcn.0040b9c0
mov edi, eax
test eax, eax
je 0x40b117
mov eax, dword [0x50207c]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.0040bb00
mov edx, dword [0x50207c]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x40b0f7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x40b080
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x40b090
add dword [0x502078], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x50207c]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x40b080
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.0040af70
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x40b00e
mov eax, dword [0x50207c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.0040af70
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.0040af70
lea esi, [esi]
nop
Function at 0x40b630
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x502094
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x50208c]
sub esp, 4
test ebx, ebx
je 0x40b685
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40b67e
test esi, esi
je 0x40b67e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x40b660
mov dword [esp], 0x502094
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40b9c0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x40b9e5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x40b9f0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x40b9e5
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x40ba38
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x40ba2e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40ba3a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x40ba20
xor eax, eax
pop ebx
pop esi
ret

Function at 0x410d60
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0x1c
mov dword [0x5020f0], 0xffffffff
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0xffff
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
sub esp, 0x10
mov dword [0x5020f4], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x410dd0
mov dword [esp + 4], 0x410c70
mov dword [esp], eax
mov dword [0x5020ec], eax
call fcn.0041a690
test eax, eax
jne 0x4b09c1
add esp, 0x1c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x410dba
Function at 0x410de0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov edx, dword [0x4b7018]
mov eax, dword [esp + 0x40]
test edx, edx
jne 0x410e08
mov eax, dword [eax + 8]
test eax, eax
je 0x410e68
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, dword [eax + 8]
test edi, edi
je 0x410e80
mov ebx, dword [0x5020ec]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
mov esi, eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
test ebx, ebx
je 0x410f00
mov edx, dword [ebx]
cmp edx, edi
jb 0x410f50
sub edi, 1
mov eax, dword [ebx + edi*4 + 4]
test eax, eax
jne 0x410dfc
mov eax, dword [esp + 0x40]
call fcn.00410cc0
mov dword [ebx + edi*4 + 4], eax
jmp 0x410dfc
mov eax, dword [esp + 0x40]
call fcn.00410cc0
mov ecx, dword [esp + 0x40]
mov dword [ecx + 8], eax
jmp 0x410dfc
mov ebp, dword [0x4b7018]
test ebp, ebp
je 0x410fc6
mov edi, dword [0x4b702c]
test edi, edi
je 0x410ff0
lock add dword [0x5020f0], 1
jne 0x411028
mov eax, dword [esp + 0x40]
mov edi, dword [eax + 8]
test edi, edi
je 0x410fd5
mov eax, dword [0x4b7018]
test eax, eax
je 0x410e0f
lock sub dword [0x5020f0], 1
js 0x410e0f
mov eax, dword [0x5020f4]
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
sub esp, 0xc
jmp 0x410e0f
lea eax, [edi + 0x21]
mov dword [esp + 4], 4
lea edx, [edi + 0x20]
mov dword [esp], eax
mov dword [esp + 0x18], edx
call sub.msvcrt.dll_calloc
mov ebx, eax
test eax, eax
je 0x4b09c6
mov edx, dword [esp + 0x18]
mov dword [eax], edx
mov eax, dword [0x5020ec]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x410e4b
call ebp
jmp 0x410e4b
lea ecx, [edx + edx]
lea eax, [edi + 0x20]
mov dword [esp], ebx
cmp ecx, edi
mov dword [esp + 0x1c], edx
cmovb ecx, eax
lea eax, [ecx*4 + 4]
mov dword [esp + 0x18], ecx
mov dword [esp + 4], eax
call sub.msvcrt.dll_realloc
mov ebx, eax
test eax, eax
je 0x4b09c6
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [eax], ecx
sub ecx, edx
lea eax, [eax + edx*4 + 4]
shl ecx, 2
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov dword [esp], eax
call sub.msvcrt.dll_memset
jmp 0x410f2a
call fcn.00410d60
mov dword [0x4b702c], 1
mov edx, dword [0x4b7018]
test edx, edx
jne 0x410e9c
mov eax, dword [esp + 0x40]
mov edi, dword [eax + 8]
test edi, edi
jne 0x410e0f
mov eax, dword [0x5020e8]
lea edi, [eax + 1]
mov dword [0x5020e8], edi
mov eax, dword [esp + 0x40]
mov dword [eax + 8], edi
jmp 0x410eb9
lock add dword [0x4b7030], 1
je 0x410fa9
mov esi, dword [0x4b702c]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
jne 0x410fb8
lea esi, [esi]
mov dword [esp], 0
call ebx
mov ecx, dword [0x4b702c]
sub esp, 4
test ecx, ecx
je 0x411010
jmp 0x410fb8
mov eax, dword [0x5020f4]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
je 0x410eaa
lock sub dword [0x5020f0], 1
jmp 0x410eaa