joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43aee0
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43b08b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28], 0
jne 0x43b06c
mov dl, 1
mov eax, dword [0x40c014]
call fcn.00402d28
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 4]
add eax, 0x2c
call fcn.004039c8
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x43b05b
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0042992c
test al, al
je 0x43b04e
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x43b09c
lea eax, [ebp - 0x254]
call fcn.00408628
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x43b04e
xor eax, eax
push ebp
push 0x43b047
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x43b0d4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x43b030
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00403bf8
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x30]
jne 0x43b030
mov eax, dword [ebp - 4]
add eax, 0x2c
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00403bf8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43b04e
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x43af51
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov byte [eax + 0x19], 0
mov dl, 1
call fcn.0040ec98
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x28]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43b092
lea eax, [ebp - 0x260]
call fcn.004039c8
ret

Function at 0x43b8d8
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4477c4]
cmp byte [eax + 0x95], 0
jne 0x43b949
cmp dword [0x4477e0], 0
jne 0x43b90a
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x43b894
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x4477e0], eax
cmp dword [0x4477dc], 0
jne 0x43b925
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x4477dc], eax
cmp dword [0x4477e4], 0
jne 0x43b949
push esp
push 0
push 0
push 0x43b838
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x4477e4], eax
pop edx
ret
Function at 0x43ba40
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x43ba57
add esp, 0xfffffff0
call fcn.00403040
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00411c04
mov byte [ebx + 0x28], 0
mov dl, 1
mov eax, dword [0x40bd14]
call fcn.00402d28
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x40bd14]
call fcn.00402d28
mov dword [ebx + 0x98], eax
xor eax, eax
mov dword [ebx + 0x50], eax
xor eax, eax
mov dword [ebx + 0x74], eax
mov dword [ebx + 0x4c], 0x80000018
mov dword [ebx + 0x68], 0x1f4
mov byte [ebx + 0x6c], 1
xor eax, eax
mov dword [ebx + 0x70], eax
mov dword [ebx + 0x64], 0x9c4
mov byte [ebx + 0x78], 0
mov byte [ebx + 0x8d], 1
mov dl, 1
mov eax, dword [0x413800]
call fcn.004191ec
mov esi, eax
mov dword [ebx + 0x88], esi
push 0x43bbcc
mov eax, dword [0x445e4c]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.004195bc
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x43d418
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x445e4c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_2
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.00409924
test eax, eax
je 0x43bb4a
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00407fdc
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040994c
test eax, eax
je 0x43bb5e
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x7c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00403bf8
mov eax, dword [0x445d64]
cmp byte [eax], 0
jne 0x43bb8f
mov eax, ebx
call fcn.0043bcb8
mov byte [ebx + 0x49], 1
mov byte [ebx + 0x4a], 1
mov byte [ebx + 0x4b], 1
mov byte [ebx + 0x8e], 1
xor eax, eax
mov dword [ebx + 0x90], eax
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x43bbc1
call fcn.00403098
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43bf28
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4477c4]
cmp dword [eax + 0x24], 0
je 0x43bfcb
cmp dword [ebx + 0x84], 0
jne 0x43bfc5
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x43beb8
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x80]
cmp dword [eax + 8], 0
je 0x43bfc5
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x43bf8e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x80]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x43bfc5
push 0x13
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x80]
call fcn.0040d3d8
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x43bf9d
inc dword [ebx + 0x84]
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x43c9d8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x94], 0
je 0x43ca0d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403ab0
jmp 0x43ca17
mov eax, esi
mov edx, dword [ebx + 0x7c]
call fcn.00403a1c
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x43d78c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x74]
test esi, esi
je 0x43d7c4
mov eax, esi
call fcn.0042582c
test al, al
je 0x43d7c4
mov eax, dword [ebx + 0x74]
call fcn.00425530
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x43d7c4
push 0
mov eax, dword [ebx + 0x74]
call fcn.00425530
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x441ca8
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, ebx
and ax, 0xffff
cmp ax, 0xffff
jne 0x441cd7
mov eax, esi
call fcn.00404110
mov edi, eax
push edi
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x441cd7
push 0x20
push edi
call sub.kernel32.dll_SetFileAttributesW
push ebx
mov ecx, esi
mov dl, 1
mov eax, dword [0x44179c]
call fcn.004418a4
cmp dword [eax + 8], 0xffffffff
jne 0x441cf3
call fcn.00402d58
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x468aa3
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
dec dword [str.lresult]
jne 0x468ab5
call fcn.00468b45
mov eax, dword [0x4c7ef0]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4c7ef0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0x5fffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
mov dword [ebp - 4], eax
fild dword [ebp - 4]
jns 0x468af8
fadd qword [0x4bbac8]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fmul qword [0x4bbaa0]
mov esp, ebp
pop ebp
ret

Function at 0x468b45
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [0x4c7518], 0
push esi
push edi
mov esi, 0x4c7530
jne 0x468b64
push 0
call fcn.0042546c
pop ecx
mov ecx, eax
call 0xffd28b08
mov dword [str.lresult], 0x8b560270
mov edi, 0x8b56e3
mov dword [0x4c7ef0], esi
lea edx, [esi + 4]
mov al, byte [edx]
and al, 1
movzx ecx, al
mov eax, dword [esi]
neg ecx
sbb ecx, ecx
xor eax, dword [edx]
and eax, 0x7f01fffe
and ecx, 0x9908b0df
xor eax, dword [esi]
shr eax, 1
xor eax, dword [esi + 0xf000634]
xor eax, ecx
mov dword [esi], eax
mov esi, edx
dec edi
jne 0x468b79
mov edi, 0x1018c
lea edx, [esi + 4]
mov al, byte [edx]
and al, 1
movzx ecx, al
mov eax, dword [esi]
neg ecx
sbb ecx, ecx
xor eax, dword [edx]
and eax, 0x7f01fffe
and ecx, 0x9908b0df
xor eax, dword [esi]
shr eax, 1
xor eax, dword [esi + 0x1fffc74]
xor eax, ecx
mov dword [esi], eax
lea esi, [edx]
dec edi
jne 0x468bae
mov ecx, dword [0x4c7530]
mov al, cl
and al, 1
movzx edx, al
mov eax, dword [esi]
neg edx
pop edi
sbb edx, edx
xor eax, ecx
and eax, 0x7f01fffe
and edx, 0x9908b0df
xor eax, dword [esi]
shr eax, 1
xor eax, dword [esi + 0x1fffc74]
xor eax, edx
mov dword [esi], eax
pop esi
ret
Function at 0x40c3c2
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
push ebx
mov edx, 0xa
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x40c3c9
call fcn.004388d0
mov edx, dword [esp + 0x34]
lea ecx, [esp]
call fcn.00417060
mov edx, dword [esp + 0x38]
lea ecx, [esp + 4]
call fcn.00417060
mov edx, dword [esp + 0x3c]
lea ecx, [esp + 8]
call fcn.00417060
mov edx, dword [esp + 0x40]
lea ecx, [esp + 0xc]
call fcn.00417060
mov edx, dword [esp + 0x44]
lea ecx, [esp + 0x10]
call fcn.00417060
mov edx, dword [esp + 0x48]
lea ecx, [esp + 0x14]
call fcn.00417060
push 0
call sub.ole32.dll_CoInitialize
lea eax, [esp + 0x24]
push eax
mov ebp, 0x7adc20
push ebp
push 1
push 0
mov ebp, 0x7adc10
push ebp
call sub.ole32.dll_CoCreateInstance
mov dword [esp + 0x18], eax
mov ebx, dword [esp + 0x18]
and ebx, ebx
jne 0x40c51b
sub esp, 4
push dword [esp + 4]
mov eax, dword [esp + 0x2c]
push eax
mov eax, dword [eax]
call dword [eax + 0x50]
add esp, 4
sub esp, 4
push dword [esp + 0xc]
mov eax, dword [esp + 0x2c]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
add esp, 4
sub esp, 4
push dword [esp + 0x10]
mov eax, dword [esp + 0x2c]
push eax
mov eax, dword [eax]
call dword [eax + 0x1c]
add esp, 4
sub esp, 4
push dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
add esp, 4
sub esp, 4
push dword [esp + 0x50]
push dword [esp + 0x1c]
mov eax, dword [esp + 0x30]
push eax
mov eax, dword [eax]
call dword [eax + 0x44]
add esp, 4
lea eax, [esp + 0x20]
push eax
mov ebp, 0x7adc30
push ebp
mov eax, dword [esp + 0x2c]
push eax
mov eax, dword [eax]
call dword [eax]
mov dword [esp + 0x18], eax
mov ebx, dword [esp + 0x18]
and ebx, ebx
jne 0x40c511
sub esp, 4
push 1
push dword [esp + 0xc]
mov eax, dword [esp + 0x2c]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
add esp, 4
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x20]
push eax
mov eax, dword [eax]
call dword [eax + 8]
mov eax, dword [esp + 0x24]
push eax
mov eax, dword [eax]
call dword [eax + 8]
call sub.ole32.dll_CoUninitialize
mov eax, dword [esp + 0x18]
jmp 0x40c528
push dword [esp]
call fcn.00438930
push dword [esp + 4]
call fcn.00438930
push dword [esp + 0x14]
call fcn.00438930
push dword [esp + 0xc]
call fcn.00438930
push dword [esp + 0x1c]
call fcn.00438930
push dword [esp + 8]
call fcn.00438930
push dword [esp + 0x10]
call fcn.00438930
add esp, 0x28
pop ebx
pop ebp
ret 0x1c
Function at 0x413f71
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.004388d0
push 0xa0
call sub.USER32.dll_GetAsyncKeyState
mov dword [esp], eax
push 0x24
call sub.USER32.dll_GetAsyncKeyState
mov dword [esp + 4], eax
push 0x23
call sub.USER32.dll_GetAsyncKeyState
mov dword [esp + 8], eax
push 0x21
call sub.USER32.dll_GetAsyncKeyState
mov dword [esp + 0xc], eax
push 0x22
call sub.USER32.dll_GetAsyncKeyState
mov dword [esp + 0x10], eax
mov ebx, dword [esp]
and ebx, ebx
je 0x413fd9
mov ebx, dword [esp + 4]
and ebx, ebx
je 0x413fd9
mov eax, 1
jmp 0x413fdb
xor eax, eax
and eax, eax
je 0x413fee
call fcn.0040ca7e
mov dword [0x7b0ac8], 0
mov ebx, dword [esp]
and ebx, ebx
je 0x414004
mov ebx, dword [esp + 8]
and ebx, ebx
je 0x414004
mov eax, 1
jmp 0x414006
xor eax, eax
and eax, eax
je 0x414019
call fcn.0040c243
mov dword [0x7b0ac8], 0
mov ebx, dword [esp]
and ebx, ebx
je 0x41402f
mov ebx, dword [esp + 0xc]
and ebx, ebx
je 0x41402f
mov eax, 1
jmp 0x414031
xor eax, eax
and eax, eax
je 0x41403a
call fcn.0040eca9
mov ebx, dword [esp]
and ebx, ebx
je 0x414050
mov ebx, dword [esp + 0x10]
and ebx, ebx
je 0x414050
mov eax, 1
jmp 0x414052
xor eax, eax
and eax, eax
je 0x41405b
call fcn.00412487
xor eax, eax
add esp, 0x14
pop ebx
ret

Function at 0x41783d
Capabilities:
Create thread

Disassembly:
push ecx
push ebp
push esi
lea eax, [esp + 8]
xor esi, esi
push eax
push esi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebp, eax
test ebp, ebp
je 0x4178d5
push edi
push 0x7b36a4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x7b0cbc]
test edi, edi
je 0x4178a9
push ebx
push esi
lea ebx, [edi + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4178a2
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [edi]
push ebx
push 0x7b0cbc
call fcn.00438622
pop ecx
pop ecx
jmp 0x4178a4
mov edi, dword [edi]
test edi, edi
jne 0x417879
pop ebx
mov eax, dword [0x7adc40]
mov esi, eax
inc eax
push 0x10
push 0x7b0cbc
mov dword [0x7adc40], eax
call fcn.00438662
pop ecx
pop ecx
push 0x7b36a4
mov dword [eax], ebp
mov dword [eax + 4], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebp
pop ecx
ret 8
Function at 0x41c753
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x41c7a8
push dword [esp + 0x10]
push 0x41c6d2
call dword [sym.imp.USER32.dll_EnumWindows]
mov esi, dword [0x7b0f90]
test esi, esi
je 0x41c801
xor edi, edi
mov ebx, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x41c7a0
cmp byte [esi + 0x10], 0
je 0x41c7a0
push 3
push edi
push edi
push edi
push edi
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov esi, ebx
test ebx, ebx
jne 0x41c77c
jmp 0x41c801
mov esi, dword [0x7b0f90]
test esi, esi
je 0x41c801
xor edi, edi
push ebp
mov ebx, dword [esi]
lea ebp, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp], eax
jne 0x41c7fa
cmp byte [esi + 0x11], 0
je 0x41c7d6
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp byte [esi + 0x10], 0
je 0x41c7ed
push 3
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
push ebp
push 0x7b0f90
call fcn.00438622
pop ecx
pop ecx
mov esi, ebx
test ebx, ebx
jne 0x41c7b5
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x41db2e
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [0x7b3a18]
call fcn.00437cde
mov edi, dword [eax + 0x24]
test edi, edi
je 0x41dbec
cmp dword [edi + 8], 1
je 0x41dbec
mov edi, dword [edi + 0xc]
test edi, edi
je 0x41dbec
mov al, byte [edi]
cmp al, 0x20
je 0x41db67
cmp al, 9
jne 0x41db6a
inc edi
jmp 0x41db5d
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor eax, eax
push eax
push eax
push 0xffffffffffffffff
push edi
push eax
push 0xfde9
call esi
push dword [esp + 0x14]
mov ebx, eax
lea ecx, [ebx - 1]
push ecx
call fcn.00438a90
push ebx
mov ebp, eax
push ebp
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call esi
test ebx, ebx
jle 0x41dbbb
push 9
pop edx
lea eax, [ebp - 2]
lea eax, [eax + ebx*2]
movzx ecx, word [eax]
push 0x20
pop esi
cmp cx, si
je 0x41dbd7
cmp cx, dx
je 0x41dbd7
pop edi
pop esi
pop ebp
pop ebx
ret 4
movzx ecx, word [eax]
cmp cx, si
je 0x41dbcf
cmp cx, dx
jne 0x41dbdb
xor ecx, ecx
mov word [eax], cx
sub eax, 2
cmp eax, ebp
jae 0x41dbc2
push ebp
call sub.MSVCRT.dll_wcslen
pop ecx
sub ebx, eax
push ebx
call fcn.00438b70
jmp 0x41dbbb
pop edi
pop esi
pop ebp
pop ebx
jmp fcn.00438ba0
Function at 0x41f8f0
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x7b0fa4], 0
jne 0x41f8fe
call fcn.0041f870
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [0x7b0fa8]
call esi
test eax, eax
jne 0x41f921
call fcn.0041f870
push dword [0x7b0fa8]
call esi
mov edx, dword [esp + 0x14]
lea esi, [eax + 8]
mov edi, 0x11
lea ecx, [ecx]
imul ecx, edx, 0x53a9b4fb
lea esi, [esi + 4]
mov edx, 1
sub edx, ecx
imul ecx, edx, 0x53a9b4fb
mov dword [esi + 0x40], edx
mov edx, 1
sub edx, ecx
mov dword [esi - 4], edx
dec edi
jne 0x41f930
mov dword [eax], edi
lea ebp, [edi + 0x1f]
mov dword [eax + 4], 0xa
mov ebx, dword [eax]
mov edi, dword [eax + 4]
mov edx, dword [eax + ebx*4 + 8]
mov ecx, dword [eax + ebx*4 + 0x4c]
mov esi, dword [eax + edi*4 + 8]
ror ecx, 0xd
add ecx, dword [eax + edi*4 + 0x4c]
dec edi
ror edx, 5
add edx, esi
mov dword [eax + ebx*4 + 8], ecx
mov dword [eax + ebx*4 + 0x4c], edx
dec ebx
jns 0x41f990
mov ebx, 0x10
test edi, edi
jns 0x41f999
mov edi, 0x10
mov dword [eax], ebx
mov dword [eax + 4], edi
dec ebp
jne 0x41f962
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x41f9b0
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x7b0fa4], 0
jne 0x41f9be
call fcn.0041f870
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [0x7b0fa8]
call esi
mov edx, eax
test edx, edx
jne 0x41f9e5
call fcn.0041f870
push dword [0x7b0fa8]
call esi
mov edx, eax
mov ebx, dword [edx]
mov esi, dword [edx + 4]
mov ebp, dword [esp + 0x14]
inc ebp
mov edi, dword [edx + ebx*4 + 0x4c]
mov eax, dword [edx + ebx*4 + 8]
mov ecx, dword [edx + esi*4 + 8]
ror edi, 0xd
add edi, dword [edx + esi*4 + 0x4c]
dec esi
ror eax, 5
add eax, ecx
mov dword [edx + ebx*4 + 8], edi
mov dword [edx + ebx*4 + 0x4c], eax
dec ebx
jns 0x41fa18
mov ebx, 0x10
test esi, esi
jns 0x41fa21
mov esi, 0x10
mov dword [edx], ebx
mov eax, edi
mov dword [edx + 4], esi
test ebp, ebp
je 0x41fa30
mul ebp
mov eax, edx
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x4221e5
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
push esi
push 0x422134
push 0x10
push 0x2c
call fcn.00437f22
xor esi, esi
mov dword [0x7b1148], eax
push esi
push esi
push 8
call fcn.00437d49
mov dword [0x7b3a34], eax
cmp word [0x7b1140], si
jne 0x4222ce
push edi
lea eax, [esp + 8]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
xor edi, edi
inc edi
test eax, eax
jne 0x42223d
mov word [0x7b1140], di
jmp 0x422245
xor eax, eax
mov word [0x7b1140], ax
push 0x800
push esi
push str.ws2_32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x7b115c], eax
test eax, eax
je 0x4222cd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.getaddrinfo
push eax
call esi
push str.freeaddrinfo
push dword [0x7b115c]
mov dword [0x7b114c], eax
call esi
push str.getnameinfo
push dword [0x7b115c]
mov dword [0x7b1150], eax
call esi
push str.WSAStringToAddressA
push dword [0x7b115c]
mov dword [0x7b1154], eax
call esi
cmp dword [0x7b114c], 0
mov dword [0x7b1158], eax
je 0x4222cd
cmp dword [0x7b1150], 0
je 0x4222cd
cmp dword [0x7b1154], 0
je 0x4222cd
test eax, eax
je 0x4222cd
mov dword [0x7b1144], edi
pop edi
pop esi
add esp, 0x190
ret

Function at 0x422350
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 0x14], 0
jne 0x42238c
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4
Function at 0x422820
Capabilities:
Write file on windows

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
mov dword [esp], 0
test edx, edx
je 0x422928
cmp word [edx], 0
je 0x422928
mov ecx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
test ecx, ecx
jne 0x42284e
mov ecx, dword [esi + 0x18]
push edi
cmp ecx, 0x19
jne 0x4228ad
cmp dword [esi + 4], 0
mov ecx, edx
lea edi, [ecx + 2]
je 0x422880
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x422860
sub ecx, edi
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push edx
push esi
call fcn.00422c90
pop edi
pop esi
pop ecx
ret 0xc
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x422880
sub ecx, edi
lea eax, [esp + 8]
push 0
sar ecx, 1
push eax
lea eax, [ecx + ecx]
push eax
push edx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor eax, eax
cmp ecx, 2
lea ecx, [esp + 0x14]
setne al
push ecx
dec eax
and eax, 0xfde9
push edx
push eax
call fcn.00422da0
mov edi, eax
test edi, edi
je 0x4228a3
cmp dword [esi + 4], 0
je 0x4228fb
push dword [esp + 0x14]
push edi
push esi
call fcn.00422c90
push edi
push 0
push dword [0x7b07fc]
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x1c]
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
push 0
push dword [0x7b07fc]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor eax, eax
pop ecx
ret 0xc

Function at 0x4229a0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
mov dword [esp + 4], 0
test esi, esi
je 0x422a05
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x4229fd
push dword [esp + 0x10]
push dword [0x7b3a38]
call fcn.00437e4f
test eax, eax
je 0x4229f3
cmp dword [eax + 4], 0
je 0x4229e2
push edi
push esi
push eax
call fcn.00422c90
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea ecx, [esp + 0xc]
push ecx
push edi
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
pop edi
xor eax, eax
pop esi
pop ecx
ret 0xc
xor eax, eax
pop esi
pop ecx
ret 0xc

Function at 0x422b20
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push esi
push dword [esp + 0x10]
mov dword [esp + 8], 0
push dword [0x7b3a38]
call fcn.00437e4f
mov esi, eax
test esi, esi
je 0x422b9f
cmp dword [esi + 4], 0
je 0x422b70
push 1
lea eax, [esp + 8]
push eax
push esi
call fcn.004232c0
test eax, eax
je 0x422b64
inc dword [esi + 0xc]
xor eax, eax
pop esi
add esp, 8
ret 4
mov eax, 1
pop esi
add esp, 8
ret 4
push 0
lea eax, [esp + 0xc]
push eax
push 1
lea eax, [esp + 0x1c]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x422baa
cmp dword [esp + 8], 0
je 0x422baa
push 1
push 0
push 0xffffffffffffffff
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 4]
pop esi
add esp, 8
ret 4
or eax, 0xffffffff
pop esi
add esp, 8
ret 4