joyce8/EMBER2024-capa huggingface dataset:
Function at 0x458b10
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x458cbb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x458c9c
mov dl, 1
mov eax, dword [0x418514]
call fcn.00403228
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00403fa8
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x458c8b
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00446b00
test al, al
je 0x458c7e
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x458ccc
lea eax, [ebp - 0x254]
call fcn.00409594
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x458c7e
xor eax, eax
push ebp
push 0x458c77
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x458d04
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x458c60
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404218
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x458c60
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404218
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458c7e
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x458b81
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041c01c
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458cc2
lea eax, [ebp - 0x260]
call fcn.00403fa8
ret

Function at 0x4595f0
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x479be0]
cmp byte [eax + 0xa5], 0
jne 0x459661
cmp dword [0x479bf8], 0
jne 0x459622
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x4595ac
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x479bf8], eax
cmp dword [0x479bf4], 0
jne 0x45963d
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x479bf4], eax
cmp dword [0x479bfc], 0
jne 0x459661
push esp
push 0
push 0
push 0x459550
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x479bfc], eax
pop edx
ret
Function at 0x459758
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x45976f
add esp, 0xfffffff0
call fcn.0040357c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041fe2c
mov eax, dword [0x47832c]
cmp word [eax + 2], 0
jne 0x459797
mov eax, dword [0x47832c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045aed8
mov eax, dword [0x4783e4]
cmp word [eax + 2], 0
jne 0x4597b1
mov eax, dword [0x4783e4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045b0d0
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x4180f8]
call fcn.00403228
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4180f8]
call fcn.00403228
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x422378]
call fcn.004296f0
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x459938
mov eax, dword [0x478230]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00429ac0
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x45b670
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x478230]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040ce34
test eax, eax
je 0x4598a6
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408f4c
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040ce5c
test eax, eax
je 0x4598ba
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404218
mov eax, dword [0x4780f4]
cmp byte [eax], 0
jne 0x4598ee
mov eax, ebx
call fcn.00459a60
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0045b84c
mov eax, ebx
call fcn.0045c210
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45992e
call fcn.004035d4
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x459ce0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x479be0]
cmp dword [eax + 0x30], 0
je 0x459d8a
cmp dword [ebx + 0x94], 0
jne 0x459d84
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x459c70
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x459d84
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x459d4a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x459d84
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041a460
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x459d59
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45a8ec
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45a921
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404098
jmp 0x45a92e
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00403ffc
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45ba28
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45ba69
mov eax, esi
call fcn.0044212c
test al, al
je 0x45ba69
mov eax, dword [ebx + 0x84]
call fcn.00441e28
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45ba69
push 0
mov eax, dword [ebx + 0x84]
call fcn.00441e28
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x46ae14
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.00402c6c
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret
Function at 0x47610c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x108], ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404458
xor eax, eax
push ebp
push 0x4761f2
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
lea eax, [ebp - 0x103]
push eax
push 0xfb
call sub.kernel32.dll_GetLogicalDriveStringsA
mov esi, eax
lea eax, [ebp - 8]
call fcn.00403fa8
test esi, esi
jl 0x4761c7
inc esi
lea edi, [ebp - 0x103]
lea eax, [ebp - 8]
mov dl, byte [edi]
call fcn.00404190
lea eax, [ebp - 0x10c]
mov ecx, 0x47620c
mov edx, dword [ebp - 8]
call fcn.004042b4
mov eax, dword [ebp - 0x10c]
lea edx, [ebp - 0x108]
call fcn.00408128
mov eax, dword [ebp - 0x108]
push eax
lea edx, [ebp - 0x110]
mov eax, dword [ebp - 4]
call fcn.00408128
mov edx, dword [ebp - 0x110]
pop eax
call fcn.004043b4
jne 0x4761c3
xor ebx, ebx
inc edi
dec esi
jne 0x476170
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4761f9
lea eax, [ebp - 0x110]
mov edx, 3
call fcn.00403fcc
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403fcc
ret
Function at 0x407442
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x4128e8
call fcn.00407900
push 1
call fcn.00406ff5
pop ecx
test al, al
je 0x40742c
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.00406fc1
mov byte [ebp - 0x24], al
mov eax, dword [0x4147bc]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x40742c
test eax, eax
jne 0x407350
mov dword [0x4147bc], ecx
push 0x401028
push 0x401010
call fcn.0040b653
pop ecx
pop ecx
test eax, eax
je 0x407333
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x40741c
push 0x40100c
push section..text
call fcn.0040b5f7
pop ecx
pop ecx
mov dword [0x4147bc], 2
jmp 0x407355
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.0040715e
pop ecx
call fcn.00407a5e
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x407386
push esi
call fcn.004070ca
pop ecx
test al, al
je 0x407386
mov esi, dword [esi]
push edi
push 2
push edi
mov ecx, esi
call dword [0x4a0148]
call esi
call fcn.00407a64
mov esi, eax
cmp dword [esi], edi
je 0x4073a4
push esi
call fcn.004070ca
pop ecx
test al, al
je 0x4073a4
push dword [esi]
call fcn.0040aa56
pop ecx
call fcn.0040782f
movzx esi, ax
call fcn.0040b5b1
push esi
push eax
push edi
push 0x400000
call main
mov esi, eax
call fcn.00407868
test al, al
je 0x407433
test bl, bl
jne 0x4073d2
call fcn.0040aa31
push edi
push 1
call fcn.0040717b
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x40741c
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
push 7
call fcn.00407715
push esi
call fcn.0040aa8e
push dword [ebp - 0x20]
call fcn.0040aa40
int3
call fcn.00412c54
jmp 0x4072c6

Function at 0x412dc9
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebp - 8], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call 0x412e07
mov esp, ebp
pop ebp
ret
Function at 0x4012c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x4012cf
pop dword [ebp - 0x2c]
mov eax, 0x657d21c2
sub eax, 0x653d0ef3
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x853ac0d4
sub dword [ebp - 0x3c], 0x36e87b89
mov dword [ebp - 0x38], 0xbc40b723
sub dword [ebp - 0x38], 0x8a0d6ade
mov dword [ebp - 0x34], 0xf349b3dd
sub dword [ebp - 0x34], 0xa6fd6faf
mov dword [ebp - 0x30], 0x5461344e
sub dword [ebp - 0x30], 0x5461344e
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x95461f38
add eax, 0x6afb1168
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x71cd68c9
sub dword [ebp - 0x3c], 0xfd5aff73
mov dword [ebp - 0x38], 0xfde97d3d
sub dword [ebp - 0x38], 0xbc7d1bc8
mov dword [ebp - 0x34], 0x574a06d0
sub dword [ebp - 0x34], 0xf3da9a64
mov dword [ebp - 0x30], 0x136132c
add dword [ebp - 0x30], 0xfec9ecd4
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0xa0b13237
add eax, 0x5f8ffe05
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3ab34
push 0
call eax
mov ecx, 0xb486af65
add ecx, 0x4b7998a7
mov edx, eax
mov ebx, 0x9febee9b
add ebx, 0x6055c165
add ebx, dword [ebp - 0x2c]
mov edi, 0x102202db
add edi, 0x5a7e69d9
mov esi, dword [ebx]
sub dword [ebp - 0x28], esi
xor esi, edi
sub dword [ebp - 0x20], 0xa0180e5
mov dword [edx], esi
add dword [ebp - 4], edx
add edx, 4
add ebx, 4
loop 0x4013f1
add eax, 0xf896a088
sub eax, 0xf8958d85
mov ebx, eax
add eax, 5
mov ecx, 0x865c51fd
sub ecx, 0x861c51fd
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x409ca0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi]
cmp dword [eax + 4], 2
jne 0x409ccc
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x409cbd
pop edi
xor eax, eax
pop esi
pop ebp
ret
push dword [eax + 8]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call ecx
jmp 0x409d00
cmp dword [esi + 8], 0
jne 0x409cf0
push 0x475ec8
push dword [eax + 8]
call fcn.0044e940
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x409cf0
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret
push dword [esi + 8]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call fcn.0044eb23
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x409d22
mov eax, dword [esi + 8]
test eax, eax
je 0x409d1c
push eax
call fcn.0044e7ff
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [esi], eax
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x40c450
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x190]
test eax, eax
je 0x40c479
push dword [esi + 0x11c]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call eax
add esp, 0x14
pop esi
pop ebp
ret
mov eax, dword [ebp + 0xc]
cmp eax, 2
ja 0x40c4af
push dword [esi + 0x118]
lea eax, [eax + eax*2]
push 1
add eax, 0x464890
push 2
push eax
call fcn.004510d8
push dword [esi + 0x118]
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.004510d8
add esp, 0x20
xor eax, eax
pop esi
pop ebp
ret

Function at 0x40efa0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x10]
call fcn.0040a820
add esp, 4
mov dword [ebp + 0x10], eax
pop ebp
jmp fcn.00459fd0

Function at 0x413f70
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov cl, byte [ebp + 8]
movsx eax, cl
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x413f81
jmp dword [eax*4 + 0x413ff4]
mov al, 0x41
pop ebp
ret
mov al, 0x42
pop ebp
ret
mov al, 0x43
pop ebp
ret
mov al, 0x44
pop ebp
ret
mov al, 0x45
pop ebp
ret
mov al, 0x46
pop ebp
ret
mov al, 0x47
pop ebp
ret
mov al, 0x48
pop ebp
ret
mov al, 0x49
pop ebp
ret
mov al, 0x4a
pop ebp
ret
mov al, 0x4b
pop ebp
ret
mov al, 0x4c
pop ebp
ret
mov al, 0x4d
pop ebp
ret
mov al, 0x4e
pop ebp
ret
mov al, 0x4f
pop ebp
ret
mov al, 0x50
pop ebp
ret
mov al, 0x51
pop ebp
ret
mov al, 0x52
pop ebp
ret
mov al, 0x53
pop ebp
ret
mov al, 0x54
pop ebp
ret
mov al, 0x55
pop ebp
ret
mov al, 0x56
pop ebp
ret
mov al, 0x57
pop ebp
ret
mov al, 0x58
pop ebp
ret
mov al, 0x59
pop ebp
ret
mov al, 0x5a
pop ebp
ret
mov al, cl
pop ebp
ret

Function at 0x414d40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call fcn.0044befc
add esp, 0x18
test eax, eax
je 0x414d62
cmp eax, 0xffffffff
jne 0x414d64
xor eax, eax
pop ebp
ret
Function at 0x422630
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
lea eax, [ecx - 0xc8]
mov edx, dword [edi]
cmp eax, 0x64
jb 0x42265f
push str.Couldnt_set_desired_mode
push edx
call fcn.0040bf70
add esp, 8
lea eax, [esi + 0x11]
pop edi
pop esi
pop ebp
ret
cmp ecx, 0xc8
je 0x422676
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push edx
call fcn.0040c010
add esp, 0xc
mov eax, dword [ebp + 0x10]
cmp eax, 0x13
jne 0x42268d
push edi
call fcn.004223d0
add esp, 4
mov esi, eax
pop edi
pop esi
pop ebp
ret
cmp eax, 0x14
jne 0x4226a1
push edi
call fcn.00421540
add esp, 4
mov esi, eax
pop edi
pop esi
pop ebp
ret
cmp eax, 0x15
jne 0x4226b5
push edi
call fcn.004223b0
add esp, 4
mov esi, eax
pop edi
pop esi
pop ebp
ret
cmp eax, 0x16
jne 0x4226c5
push edi
call fcn.00422510
mov esi, eax
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
ret
Function at 0x42acc0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x47c0b0]
mov edi, eax
add esp, 4
test edi, edi
jne 0x42aced
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x42ad34
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call eax
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
mov eax, dword [esi + 8]
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], ebx
jmp 0x42ad3a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [edi + 4]
mov eax, dword [esi]
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [ebp + 0x10]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x42ad9b
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], eax
nop word [eax + eax]
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub dword [ebp + 0x10], 1
jne 0x42ad60
mov ebx, dword [ebp - 8]
cmp ebx, dword [esi + 0x10]
jae 0x42adc7
mov eax, dword [esi + 4]
push 1
push 0x46a98e
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x46a98f
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x42ada0
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x45a619
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045a498
Function at 0x21101090
Capabilities:
Check mutex on windows

Disassembly:
cmp dword [0x21165710], 0
je 0x211010cb
mov eax, dword [0x2118b20c]
test eax, eax
jne 0x211010c2
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
lea esp, [esp]
push 0
push 0
push 0
call esi
test eax, eax
mov dword [0x2118b20c], eax
je 0x211010b0
pop esi
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
ret

Function at 0x21101430
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ecx
push esi
mov esi, dword [0x211656a8]
test esi, esi
mov dword [esp + 4], esi
je 0x21101455
mov eax, dword [0x21165654]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x21101587
lock inc dword [0x2118b214]
cmp dword [0x2118b204], 0
je 0x2110156f
cmp dword [0x2118b208], 0
jg 0x2110156f
cmp dword [0x2118b214], 1
jne 0x2110156f
push ebx
push ebp
push edi
lock inc dword [0x2118b1f8]
call sym.mss32.dll__AIL_us_count_0
mov ebp, eax
mov eax, dword [0x2118b210]
test eax, eax
jne 0x2110149f
mov eax, ebp
mov edi, ebp
sub edi, eax
cmp edi, dword [0x2118b218]
jle 0x211014b1
mov dword [0x2118b218], edi
cmp edi, 0x186a0
jle 0x211014be
mov edi, 0x186a0
xor ebx, ebx
cmp dword [0x21165658], ebx
mov dword [0x2118b210], ebp
jle 0x2110152a
mov eax, dword [0x2118b204]
xor esi, esi
cmp dword [esi + eax], 2
jne 0x21101518
add dword [esi + eax + 0xc], edi
mov ecx, dword [esi + eax + 0xc]
cmp ecx, dword [esi + eax + 0x10]
jl 0x21101518
lea esp, [esp]
mov ecx, dword [esi + eax + 0x10]
mov edx, dword [esi + eax + 8]
sub dword [esi + eax + 0xc], ecx
mov eax, dword [esi + eax + 4]
push edx
call eax
mov eax, dword [0x2118b204]
cmp dword [esi + eax], 2
jne 0x21101518
mov ecx, dword [esi + eax + 0xc]
cmp ecx, dword [esi + eax + 0x10]
jge 0x211014f0
add ebx, 1
add esi, 0x1c
cmp ebx, dword [0x21165658]
jl 0x211014d5
mov esi, dword [esp + 0x10]
call sym.mss32.dll__AIL_us_count_0
mov ecx, dword [0x2116572c]
sub eax, ebp
pop edi
add ecx, eax
cmp ecx, 0x989680
pop ebp
mov dword [0x2116572c], ecx
pop ebx
jbe 0x21101568
mov eax, 0x10624dd3
mul ecx
shr edx, 6
add dword [0x21165734], edx
imul edx, edx, 0xfffffc18
add ecx, edx
mov dword [0x2116572c], ecx
lock dec dword [0x2118b1f8]
lock dec dword [0x2118b214]
test esi, esi
je 0x21101587
mov edx, dword [0x21165654]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
pop ecx
ret
Function at 0x211018f0
Capabilities:
Create thread

Disassembly:
push ecx
mov ecx, dword [0x2118b204]
test ecx, ecx
push esi
jne 0x211019b6
mov eax, dword [0x21165694]
lea ecx, [eax*8]
sub ecx, eax
add ecx, ecx
add ecx, ecx
push ecx
mov dword [0x21165658], eax
call sym.mss32.dll__AIL_mem_alloc_lock_4
test eax, eax
mov dword [0x2118b204], eax
jne 0x2110192e
or eax, 0xffffffff
pop esi
pop ecx
ret 4
mov edx, dword [0x21165658]
xor ecx, ecx
test edx, edx
mov dword [esp + 4], ecx
jle 0x2110195f
mov edi, edi
lea esi, [ecx*8]
sub esi, ecx
mov dword [eax + esi*4], 0
mov ecx, dword [esp + 4]
add ecx, 1
cmp ecx, edx
mov dword [esp + 4], ecx
jl 0x21101940
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
lea edx, [esp + 4]
push edx
push 0
push 0
push 0x21101590
push 0x10000
push 0
mov dword [0x2116554c], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x2118b21c], eax
mov eax, dword [esp + 4]
push str.Miles_Timer
push eax
call section..text
mov ecx, dword [0x2118b21c]
push 0xf
push ecx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [0x2118b204]
mov edx, dword [0x21165658]
xor eax, eax
test edx, edx
mov dword [esp + 4], eax
jle 0x211019ea
jmp 0x211019d0
lea esi, [eax*8]
sub esi, eax
cmp dword [ecx + esi*4], 0
je 0x211019ea
add eax, 1
cmp eax, edx
mov dword [esp + 4], eax
jl 0x211019d0
cmp eax, edx
je 0x21101926
lea edx, [eax*8]
sub edx, eax
mov dword [ecx + edx*4], 1
mov eax, dword [esp + 4]
lea edx, [eax*8]
sub edx, eax
mov eax, dword [esp + 0xc]
mov dword [ecx + edx*4 + 4], eax
mov eax, dword [esp + 4]
lea edx, [eax*8]
sub edx, eax
mov dword [ecx + edx*4 + 0x10], 0x2710
mov eax, dword [esp + 4]
lea edx, [eax*8]
sub edx, eax
mov dword [ecx + edx*4 + 0xc], 0
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4