joyce8/EMBER2024-capa huggingface dataset:
Function at 0x469550
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4aca38]
push edi
test eax, eax
je 0x4695b4
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0xc]
jge 0x4695b4
mov eax, dword [eax + 0x10]
mov edi, dword [eax + ecx*4]
test edi, edi
je 0x4695b4
push esi
mov esi, dword [ebp + 0xc]
push 4
push dword [ebp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4695a5
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4695a5
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4695a5
push eax
call dword [sym.imp.USER32.dll_LoadMenuIndirectW]
test eax, eax
jne 0x4695ae
push dword [ebp + 0x10]
mov eax, dword [edi + 0x3c]
push esi
call eax
pop esi
pop edi
pop ebp
ret 0xc
xor eax, eax
pop edi
pop ebp
ret 0xc

Function at 0x4695c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4aca38]
push edi
test eax, eax
je 0x469624
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0xc]
jge 0x469624
mov eax, dword [eax + 0x10]
mov edi, dword [eax + ecx*4]
test edi, edi
je 0x469624
push esi
mov esi, dword [ebp + 0xc]
push 4
push dword [ebp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x469615
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x469615
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x469615
push eax
call dword [sym.imp.USER32.dll_LoadMenuIndirectW]
test eax, eax
jne 0x46961e
push dword [ebp + 0x10]
mov eax, dword [edi + 0x40]
push esi
call eax
pop esi
pop edi
pop ebp
ret 0xc
xor eax, eax
pop edi
pop ebp
ret 0xc
Function at 0x479724
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4a7ff8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.00471f8f
mov dword [ebp - 0x14], eax
cmp dword [0x4ad7d8], edi
jne 0x479815
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x4797a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4798f5
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x4798f5
push 0x488d50
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4798f5
push eax
call ebx
push 0x488d5c
push esi
mov dword [0x4ad7d8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x4ad7dc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x4ad7e0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4ad7e8], eax
test eax, eax
je 0x479812
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4ad7e4], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x47983a
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x47982d
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x47984f
push 4
pop eax
jmp 0x4798f7
cmp dword [ebp - 0x14], edi
je 0x47984f
push dword [0x4ad7d8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x479834
mov eax, dword [0x4ad7e4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x4798ad
cmp dword [0x4ad7e8], esi
je 0x4798ad
push eax
call ebx
push dword [0x4ad7e8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4798ad
test eax, eax
je 0x4798ad
call ecx
test eax, eax
je 0x4798a2
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4798a2
test byte [ebp - 8], 1
jne 0x4798ad
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x4798dd
mov eax, dword [0x4ad7dc]
cmp eax, esi
je 0x4798da
push eax
call ebx
test eax, eax
je 0x4798da
call eax
mov edi, eax
test edi, edi
je 0x4798da
mov eax, dword [0x4ad7e0]
cmp eax, esi
je 0x4798da
push eax
call ebx
test eax, eax
je 0x4798da
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x4ad7d8]
call ebx
test eax, eax
je 0x4798f5
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x4798f7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046d049
leave
ret
Function at 0x6210aee0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x62100000], 0x5a4d
jne 0x6210af05
mov ecx, dword [0x6210003c]
cmp dword [ecx + 0x62100000], 0x4550
lea edx, [ecx + 0x62100000]
je 0x6210af10
ret
cmp word [ecx + 0x62100018], 0x10b
jne 0x6210af05
push esi
movzx eax, word [ecx + 0x62100014]
push ebx
movzx esi, word [ecx + 0x62100006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x62100000
test si, si
je 0x6210af58
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x6210af4e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x6210af5a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x6210af40
xor eax, eax
pop ebx
pop esi
ret
Function at 0x401000
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
push esi
push edi
call fcn.004011c0
add esp, 8
lea eax, [esp + 0x10]
push eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x40105b
mov edx, dword [esp + 0x18]
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x18]
push 1
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
ret
pop edi
xor eax, eax
pop esi
ret

Function at 0x401060
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
push esi
push edi
mov dword [esp + 0x10], 0x104
call fcn.004011c0
add esp, 8
lea eax, [esp + 0x14]
push eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4010e6
mov edi, 0x408f04
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x1c]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [esp + 0x18]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 8]
push ecx
push eax
mov eax, dword [esp + 0x1c]
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov edi, 0x408f04
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x1c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ecx
ret

Function at 0x401120
Capabilities:
Delete registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
push esi
push edi
call fcn.004011c0
add esp, 8
lea eax, [esp + 0x10]
push eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
pop edi
pop esi
test eax, eax
jne 0x401162
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
ret

Function at 0x401170
Capabilities:
Set registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
lea eax, [esp + 8]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4011bb
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
lea eax, [esp + 0x10]
push 4
push eax
push 4
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
ret
xor eax, eax
ret
Function at 0x401c50
Capabilities:
Check if file exists
Persist via appinit_dlls registry key

Disassembly:
sub esp, 0x40c
push ebx
mov ebx, dword [esp + 0x414]
push ebp
mov ebp, dword [sym.imp.USER32.dll_MessageBoxA]
push esi
push edi
xor esi, esi
push esi
push ebx
lea eax, [esp + 0x18]
push str._s_d
push eax
call fcn.004021ce
lea ecx, [esp + 0x20]
lea edx, [esp + 0x12c]
push ecx
push str.Checked_in__s
push edx
call fcn.004021ce
lea eax, [esp + 0x138]
push eax
call fcn.00402060
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x30]
push ecx
push edx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionDrivers32
push 0x80000002
call fcn.00401060
lea edi, [esp + 0x4c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x30
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x401cf6
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x10]
push eax
push ecx
lea edx, [esp + 0x124]
push str._s_s
push edx
call fcn.004021ce
lea eax, [esp + 0x12c]
push eax
call fcn.00402060
add esp, 0x14
lea ecx, [esp + 0x1c]
push ecx
call fcn.00406a0c
lea edx, [esp + 0x20]
push str.LOCALS1_
push edx
call fcn.00402220
add esp, 0xc
test eax, eax
jne 0x401d30
lea eax, [esp + 0x1c]
push str.TEMP_
push eax
call fcn.00402220
add esp, 8
test eax, eax
je 0x401e4c
lea ecx, [esp + 0x10]
lea edx, [esp + 0x11c]
push ecx
push str.Found_in__s
push edx
call fcn.004021ce
lea eax, [esp + 0x128]
push eax
call fcn.00402060
lea ecx, [esp + 0x2c]
push 0x20
push ecx
call fcn.004022a0
add esp, 0x18
test eax, eax
je 0x401d6a
mov byte [eax], 0
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x401d86
lea eax, [esp + 0x1c]
push eax
call fcn.00401e70
add esp, 4
lea ecx, [esp + 0x10]
lea edx, [esp + 0x11c]
push ecx
push str.Virus_Found_in__s._nDo_you_want_to_fix_it_
push edx
call fcn.004021ce
add esp, 0xc
lea eax, [esp + 0x11c]
push 0x34
push str.Browlog__Fix_Winmm_
push eax
push 0
call ebp
cmp eax, 7
je 0x401e4c
lea ecx, [esp + 0x10]
push ecx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionDrivers32
push 0x80000002
call fcn.00401120
push 0x408f04
push str.AppInit_DLLs
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
push 0x80000002
call fcn.00401000
add esp, 0x1c
cmp eax, 1
jne 0x401e4c
push 0
push str.LoadAppInit_DLLs
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
push 0x80000002
call fcn.00401170
add esp, 0x10
cmp eax, 1
jne 0x401e4c
lea edx, [esp + 0x21c]
push eax
push edx
call fcn.00401f40
lea eax, [esp + 0x224]
lea ecx, [esp + 0x18]
push eax
push ecx
lea edx, [esp + 0x32c]
push str.Fixed_Value_HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersionDrivers32___s__at_:__s
push edx
call fcn.004021ce
lea eax, [esp + 0x334]
push eax
call fcn.00402060
add esp, 0x1c
inc esi
cmp esi, 0xa
jl 0x401c69
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x40c
ret
Function at 0x401e70
Capabilities:
Create directory
Delete file
Move file
Set file attributes

Disassembly:
sub esp, 0x320
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
push ebx
mov ebx, dword [esp + 0x328]
push esi
push edi
mov edi, ebx
push 0x2e
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x24]
push ecx
call fcn.004022a0
add esp, 8
test eax, eax
je 0x401eba
mov byte [eax + 1], 0x56
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x80
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileA]
lea eax, [esp + 0x20]
push eax
push ebx
call esi
test eax, eax
jne 0x401eeb
lea ecx, [esp + 0x20]
push ecx
push ebx
call esi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push ebx
lea edx, [esp + 0x128]
push str._s_AntiHook_Normal
push edx
call fcn.004021ce
lea eax, [esp + 0x18]
push 1
push eax
call fcn.00401f40
lea ecx, [esp + 0x138]
lea edx, [esp + 0x20]
push ecx
push edx
push str.SoftwareVB_and_VBA_Program_SettingsSPYWAREPROTECTIONQUARANTINE
push 0x80000001
call fcn.00401000
add esp, 0x24
pop edi
pop esi
pop ebx
add esp, 0x320
ret

Function at 0x4020a0
Capabilities:
Delete file
Get file size

Disassembly:
push esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.C:ZVAntiHook.log
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
je 0x4020ed
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 0x186a0
jbe 0x4020e9
push esi
call edi
push str.C:ZVAntiHook.log
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call edi
pop edi
pop esi
ret
Function at 0x403f65
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4085a8
cmp edx, dword [eax]
je 0x403f87
add eax, 8
inc ecx
cmp eax, 0x408638
jl 0x403f78
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4085a8]
jne 0x4040b5
mov eax, dword [0x408f10]
cmp eax, 1
je 0x40408f
test eax, eax
jne 0x403fb8
cmp dword [0x4084e4], 1
je 0x40408f
cmp edx, 0xfc
je 0x4040b5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x403fef
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00405ae0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00402800
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x404032
lea eax, [ebp - 0x1a4]
push eax
call fcn.00402800
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4074cc
push edi
call fcn.00405c60
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00405ae0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00405af0
lea eax, [ebp - 0xa0]
push 0x4074ac
push eax
call fcn.00405af0
push dword [esi + 0x4085ac]
lea eax, [ebp - 0xa0]
push eax
call fcn.00405af0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00405bd0
add esp, 0x2c
pop edi
jmp 0x4040b5
lea eax, [ebp + 8]
lea esi, [esi + 0x4085ac]
push 0
push eax
push dword [esi]
call fcn.00402800
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x80010c0
Capabilities:
Check mutex on windows
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x20
push ebx
push esi
mov esi, ecx
push edi
push str.KERNEL32.DLL
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, dword [ebp + 0xc]
mov dword [esi + 8], eax
test ebx, ebx
je 0x8001187
mov dword [0x8018230], 0
lea eax, [ebp - 0x20]
mov dword [ebp - 0xc], 0xc
push 1
push eax
mov dword [ebp - 4], 1
mov dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov edi, dword [esi + 4]
lea eax, [ebp - 0xc]
push ebx
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi], eax
mov eax, dword [edi]
shr eax, 0x1f
test al, al
jne 0x800117c
push ebx
push 0
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, eax
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [edi]
shr ecx, 0x1f
test cl, cl
jne 0x800116e
mov dword [edi], 0
mov eax, dword [edi]
or eax, 0x80000000
mov dword [edi], eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InitializeSRWLock
push eax
call edi
mov dword [0x8018230], eax
test eax, eax
je 0x80010f4
push str.ReleaseSRWLockExclusive
push dword [esi + 8]
call edi
push str.ReleaseSRWLockShared
push dword [esi + 8]
mov dword [0x801822c], eax
call edi
push str.AcquireSRWLockExclusive
push dword [esi + 8]
mov dword [0x8018228], eax
call edi
push str.AcquireSRWLockShared
push dword [esi + 8]
mov dword [0x8018224], eax
call edi
push dword [esi + 4]
mov dword [0x8018220], eax
call dword [0x8018230]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x80014e0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push dword [ebp + 0xc]
mov esi, ecx
push dword [ebp + 8]
mov dword [ebp - 4], esi
call sym.pshook.dll_public:_void___thiscall_RWLockIPC::constructor_int___wchar_t_const__
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push 8
push 8
mov dword [esi + 0xc], eax
call fcn.08007406
add esp, 8
mov dword [esi + 0x10], eax
push eax
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x8001590
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push edi
mov edi, ecx
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x80015d8
push 4
call fcn.08003c3f
add esp, 4
mov esi, eax
push esi
mov dword [esi], 0
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 8
push 8
call fcn.08007406
add esp, 8
mov dword [eax + 4], esi
push eax
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
mov eax, 1
lock xadd dword [esi], eax
inc eax
cmp eax, 1
jne 0x80015f0
mov ecx, edi
pop edi
pop esi
jmp sym.pshook.dll_public:_void___fastcall_RWLockIPC::StartRead_void_
pop edi
pop esi
ret

Function at 0x8001600
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push edi
mov edi, ecx
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x8001648
push 4
call fcn.08003c3f
add esp, 4
mov esi, eax
push esi
mov dword [esi], 0
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 8
push 8
call fcn.08007406
add esp, 8
mov dword [eax + 4], esi
push eax
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
mov eax, 1
lock xadd dword [esi], eax
inc eax
cmp eax, 1
jne 0x8001660
mov ecx, edi
pop edi
pop esi
jmp sym.pshook.dll_public:_void___fastcall_RWLockIPC::StartWrite_void_
pop edi
pop esi
ret

Function at 0x8001670
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push edi
mov edi, ecx
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x80016b8
push 4
call fcn.08003c3f
add esp, 4
mov esi, eax
push esi
mov dword [esi], 0
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 8
push 0x55
push ebp

Function at 0x8001771
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
push es
Function at 0x7ffe536d
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword fs:[0x30]
stc
add eax, 0
cld
add eax, 0
clc
pushal
inc eax
popal
clc
and bh, 0xff
clc
push edx
cdq
pop edx
stc
add eax, 0
cld
pushal
inc eax
popal
nop
lea esp, [esp]
cld
push edx
cdq
pop edx
stc
add eax, 0
clc
and bh, 0xff
clc
add eax, 0
clc
pushal
inc eax
popal
nop
lea esp, [esp]
nop
add eax, 0
cld
lea esp, [esp]
cld
push edx
cdq
pop edx
clc
and bh, 0xff
cld
add eax, 0
cld
pushal
inc eax
popal
cld
and bh, 0xff
cld
lea esp, [esp]
clc
push edx
cdq
pop edx
cld
lea esp, [esp]
cld
add eax, 0
nop
add eax, 0
cld
add eax, 0
nop
pushal
inc eax
popal
clc
lea esp, [esp]
cld
and bh, 0xff
cld
push edx
cdq
pop edx
nop
lea esp, [esp]
stc
lea esp, [esp]
nop
pushal
inc eax
popal
cld
push edx
cdq
pop edx
stc
lea esp, [esp]
call 0x7ffe5408
pop edx
stc
and bh, 0xff
inc esi
dec esi
nop
xor dx, dx
cld
stc
add edx, 0xd5e0
cld
and bh, 0xff
nop
push edx
cdq
pop edx
cld
xor ecx, ecx
mov cl, 0x1e
push eax
pop eax
nop
xor byte [ecx + edx], 0
loop 0x7ffe542b
cld
cld
push dword fs:[0x24]
cld
pop dword [edx + 0xa]
stc
lea esp, [esp]
nop
and bh, 0xff
mov cl, 0xff
stc
lea esp, [esp]
nop
and bh, 0xff
and al, 0xff
nop
push edx
loop 0x7ffe5453
clc
cld
mov dword [edx + 0x11], 0xffffacbb
stc
mov ecx, dword [eax + 0x2c]
pushal
inc eax
popal
cld
lea esp, [esp]
cld
mov dword [edx + 0x1b], ecx
lea esp, [esp]
mov dword [edx + 0x100], ecx
clc
clc
mov dword [eax + 0x2c], esp
cld
lea esp, [esp]
stc
and bh, 0xff
nop
push 0
pushal
inc eax
popal
stc
push 0
pushal
inc eax
popal
clc
push eax
pop eax
cld
push 0
lea esp, [esp]
and al, 0xff
cld
push 0
nop
lea esp, [esp]
cld
push 0x30
pushal
inc eax
popal
stc
and bh, 0xff
clc
push 0x20
add al, 0
clc
push 0
cld
clc
push 0
push edx
cdq
pop edx
cld
and bh, 0xff
cld
clc
add edx, 0xffff7f29
cld
and bh, 0xff
push edx
cld
stc
clc
push edx
push edx
cdq
pop edx
nop
nop
stc
push 0
add eax, 0
cld
lea esp, [esp]
clc
stc
call dword [edx + 0x821a]
cld
cld
cld
cld
add esp, 0x3f8
clc
lea esp, [esp]
cld
and bh, 0xff
add eax, 0
xor eax, eax
cld
nop
inc eax
cld
ret 0xc
Function at 0x401249
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x406054]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 0x1c]
push edi
mov edi, dword [ebp + 8]
push ecx
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x804]
push 0x400
push eax
mov byte [ebp - 0x805], 0
call fcn.004011f1
add esp, 0x14
test eax, eax
js 0x401320
and dword [ebp - 0x80c], 0
lea eax, [ebp - 0x80c]
push eax
push 1
push 0
lea eax, [ebp - 0x804]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401320
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x810]
push eax
xor edi, edi
push edi
push ebx
push dword [ebp - 0x80c]
mov dword [ebp - 0x810], edi
mov dword [ebp - 0x814], edi
mov dword [ebp - 0x818], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401314
cmp dword [ebp - 0x810], 4
jne 0x401314
cmp dword [ebp - 0x814], edi
mov byte [ebp - 0x805], 1
setne al
mov dword [esi], eax
push dword [ebp - 0x80c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x805]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040279c
leave
ret

Function at 0x401ffc
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x406054]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_HeapSetInformation]
push edi
xor edi, edi
push edi
push edi
push 1
push edi
call esi
mov dword [ebp - 0x12c], eax
cmp eax, edi
je 0x4020bf
push ebx
mov ebx, 0x11c
push ebx
lea eax, [ebp - 0x120]
push edi
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], ebx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4020be
cmp dword [ebp - 0x11c], 5
jne 0x4020be
cmp dword [ebp - 0x118], 1
push 2
pop eax
je 0x402079
cmp dword [ebp - 0x118], eax
jne 0x4020be
mov dword [ebp - 0x128], eax
call dword [sym.imp.MSVCR100.dll__get_heap_handle]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [ebp - 0x124], eax
cmp ebx, edi
je 0x4020a4
push 4
lea eax, [ebp - 0x128]
push eax
push edi
push ebx
call esi
cmp dword [ebp - 0x124], edi
je 0x4020be
push 4
lea eax, [ebp - 0x128]
push eax
push edi
push dword [ebp - 0x124]
call esi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x12c]
pop edi
xor ecx, ebp
pop esi
call fcn.0040279c
leave
ret