joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407d50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
or eax, 0xffffffff
xor ecx, ecx
test edx, edx
jle 0x407d80
push esi
mov esi, dword [esp + 8]
push edi
movzx edi, byte [ecx + esi]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x425288]
inc ecx
cmp ecx, edx
jl 0x407d63
pop edi
pop esi
not eax
ret

Function at 0x407e80
Capabilities:
Check if file exists
Connect pipe
Read pipe
Write pipe

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x408
push edi
mov edi, dword [esp + 0x414]
lea edx, [esp + 0x20c]
mov byte [edi], 0
sub edx, eax
mov edi, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x407ea0
push 0xffffffffffffffff
lea eax, [esp + 0xc]
push eax
push 0x200
lea ecx, [esp + 0x18]
push ecx
push 0x200
lea edx, [esp + 0x220]
push edx
push str..pipeMeliaDriveS
call dword [sym.imp.KERNEL32.dll_CallNamedPipeA]
test eax, eax
jne 0x407f03
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push 0x4219a8
push edi
call fcn.00409ac7
add esp, 0xc
xor eax, eax
cmp esi, 2
setne al
pop esi
pop edi
add eax, 0xfffffffe
add esp, 0x408
ret
cmp byte [esp + 0xc], 0x2d
push edi
jne 0x407f36
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x14]
push str._s_d_60s
push ecx
mov dword [esp + 0x14], 0xfffffffd
call fcn.0040cf48
mov eax, dword [esp + 0x14]
add esp, 0x10
pop edi
add esp, 0x408
ret
lea edx, [esp + 0x10]
push str._s_200s
push edx
call fcn.0040cf48
add esp, 0xc
xor eax, eax
pop edi
add esp, 0x408
ret

Function at 0x407fb0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x108
push eax
lea ecx, [esp + 0xc]
push str.MeliaKey_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp]
push edx
push 1
push 0
lea eax, [esp + 0x14]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x408027
mov edx, dword [esp + 0x110]
push esi
lea ecx, [esp + 8]
push ecx
push edx
push eax
mov eax, dword [esp + 0x10]
push eax
mov dword [esp + 0x18], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 4]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
neg eax
sbb eax, eax
pop esi
add esp, 0x108
ret
or eax, 0xffffffff
add esp, 0x108
ret

Function at 0x408050
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov ebp, eax
call esi
sub eax, ebp
cmp eax, dword [esp + 0xc]
ja 0x408083
push ebx
push edi
call esi
mov edi, eax
call esi
mov ebx, eax
call esi
sub eax, ebx
cmp eax, 1
jb 0x408070
sub edi, ebp
cmp edi, dword [esp + 0x14]
jbe 0x408068
pop edi
pop ebx
pop esi
pop ebp
ret
Function at 0x4086e0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x409630
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x58
mov ecx, dword [esp + 0x60]
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x64]
push eax
push ecx
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00409520
mov ecx, dword [esp + 0x68]
lea eax, [esp + 0xc]
push eax
push ecx
call fcn.004095c0
add esp, 0x6c
ret

Function at 0x40c735
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x425758]
jne 0x40c73f
repz ret
jmp fcn.00413188

Function at 0x41aa43
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00410bd2
and dword [ebp - 4], 0
cmp dword [0x42766c], 0
mov ebx, eax
jne 0x41aaf4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41aba5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x422d84
push edi
call esi
test eax, eax
je 0x41aba5
push eax
call fcn.00410b60
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42766c], eax
call esi
push eax
call fcn.00410b60
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x427670], eax
call esi
push eax
call fcn.00410b60
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x427674], eax
call esi
push eax
call fcn.00410b60
pop ecx
mov dword [0x42767c], eax
test eax, eax
je 0x41aaf4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00410b60
pop ecx
mov dword [0x427678], eax
mov eax, dword [0x427678]
cmp eax, ebx
je 0x41ab4c
cmp dword [0x42767c], ebx
je 0x41ab4c
push eax
call fcn.00410bdb
push dword [0x42767c]
mov esi, eax
call fcn.00410bdb
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41ab4c
test edi, edi
je 0x41ab4c
call esi
test eax, eax
je 0x41ab43
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41ab43
test byte [ebp - 0xc], 1
jne 0x41ab4c
or dword [ebp + 0x10], 0x200000
jmp 0x41ab85
mov eax, dword [0x427670]
cmp eax, ebx
je 0x41ab85
push eax
call fcn.00410bdb
pop ecx
test eax, eax
je 0x41ab85
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41ab85
mov eax, dword [0x427674]
cmp eax, ebx
je 0x41ab85
push eax
call fcn.00410bdb
pop ecx
test eax, eax
je 0x41ab85
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42766c]
call fcn.00410bdb
pop ecx
test eax, eax
je 0x41aba5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41aba7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40e7b4
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret 4

Function at 0x412857
Capabilities:
Get common file path

Disassembly:
push dword [esp + 4]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
neg eax
sbb eax, eax
neg eax
ret 8

Function at 0x5a0463
Capabilities:
Parse pe header

Disassembly:
call 0x5a0463
rol byte [edi - 0x4972dbcc], 1
invalid
jne 0x5a0beb
jmp 0x5a05cd
push ebx
jmp 0x5a08b4
call dword [0x5a0244]
js 0x5a04c4
jns 0x5a04c4
dec esi
pop edi
jb 0x5a0c0d
jmp 0x5a07f8
push esp
jmp 0x5a0998
adc dl, dl
jmp 0x5a0ab1
pushal
jmp 0x5a054f
mov dword [0x5a0240], 1
jmp 0x5a0735
jne 0x5a0ab1
jmp 0x5a0c59
jmp 0x5a04c4
ret
push ebp
jmp 0x5a09b2
add dl, dl
jmp 0x5a066a
push edi
jmp 0x5a045d
jmp 0x5a0a52
sub esp, 0xc
jmp 0x5a0bde
call 0x5a099f
push ecx
mov ecx, 0x8d242c87
lodsd eax, dword [esi]
test dword [eax], eax
add byte [eax], al
xchg dword [esp], ebp
jmp 0x5a0943
push esi
jmp 0x5a08cf
inc esi
jmp 0x5a0567
call 0x5a0a58
xchg dword cs:[esp], eax
lea eax, [eax - 0x4db]
xchg dword [esp], eax
jmp 0x5a057c
ret
push eax
jmp 0x5a04ff
cmp dword [0x5a0240], 0
jmp 0x5a0477
mov eax, dword [esp + 0x10]
jmp 0x5a0b1e
call 0x5a0c14
fcom dword [esi - 0x72dbc379]
mov edi, 0xfffffd5c
xchg dword [esp], edi
jmp 0x5a08bd
mov dl, byte [esi]
jmp 0x5a09ee
Function at 0x41b02a4c
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x18]
push 0
push 2
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegGetValueW]
neg eax
sbb eax, eax
inc eax
pop ebp
ret 0x14
Function at 0x41b02ef2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x41b28b68]
cmp eax, 0x41b28b68
je 0x41b02f2d
test dword [eax + 0x1c], 0x400000
je 0x41b02f2d
cmp byte [eax + 0x19], 4
jb 0x41b02f2d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x41b027ac
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.41b02f38
pop ebp
jmp fcn.41b02ce1

Function at 0x41b02f70
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push edi
push 0x41b28e80
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edi, edi
cmp dword [0x41b282b0], edi
je 0x41b06c23
inc edi
push 0x41b28e80
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
leave
ret
call fcn.41b06d23
test eax, eax
je 0x41b0e499
mov eax, dword [0x41b28b68]
push ebx
push esi
mov esi, 0x41b28b68
mov ebx, 0x400000
cmp eax, esi
je 0x41b06c62
test dword [eax + 0x1c], ebx
je 0x41b06c62
cmp byte [eax + 0x19], 4
jb 0x41b06c62
push 0x41b0493c
push 0x17
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.41b02941
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebp - 4], eax
cmp eax, edi
je 0x41b06d0a
push 0x41b28110
push edi
push eax
push 0x41b027c1
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x41b0e4e3
mov eax, dword [0x41b28b68]
cmp eax, esi
je 0x41b06cc8
test dword [eax + 0x1c], ebx
je 0x41b06cc8
cmp byte [eax + 0x19], 3
jb 0x41b06cc8
push dword [0x41b28110]
push 0x41b0493c
push 0x19
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.41b0298a
push 0xffffffffffffffff
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x41b28b68]
cmp eax, esi
je 0x41b06cff
test dword [eax + 0x1c], ebx
je 0x41b06cff
cmp byte [eax + 0x19], 3
jb 0x41b06cff
push dword [0x41b282b0]
push 0x41b0493c
push 0x1a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.41b0298a
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
xor eax, eax
cmp dword [0x41b282b0], edi
pop esi
setne al
pop ebx
mov edi, eax
jmp 0x41b02f91
mov eax, dword [0x41b28b68]
cmp eax, 0x41b28b68
je 0x41b02f91
test dword [eax + 0x1c], 0x400000
je 0x41b02f91
cmp byte [eax + 0x19], 1
jb 0x41b02f91
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x41b28b68]
push 0x41b0493c
push 0x16
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.41b0298a
jmp 0x41b02f91
mov eax, dword [0x41b28b68]
cmp eax, esi
je 0x41b06cff
test dword [eax + 0x1c], ebx
je 0x41b06cff
cmp byte [eax + 0x19], 1
jb 0x41b06cff
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x41b28b68]
push 0x41b0493c
push 0x18
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.41b0298a
jmp 0x41b06cff
Function at 0x41b02fa6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x41b28d84]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebx]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test eax, 0x10000
je 0x41b0a33c
mov eax, dword [ebp + 0x10]
push ebx
shr eax, 1
push eax
push esi
push edi
call fcn.41b0300f
test eax, eax
je 0x41b0a325
test dword [ebx], 0x200000
je 0x41b0fc18
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.41b028d6
leave
ret 0x10
push edi
push dword [ebp + 0x10]
push esi
call fcn.41b029b6
test eax, eax
je 0x41b02fea
jmp 0x41b0fc0c
test eax, 0x20000
je 0x41b02fd4
jmp 0x41b0a325
xor eax, eax
mov word [esi], ax
xor eax, eax
jmp 0x41b02ff9
push esi
push 0x200
lea eax, [ebp - 0x204]
push eax
call fcn.41b029b6
test eax, eax
jne 0x41b0fc0c
push 0x100
lea eax, [ebp - 0x204]
push eax
call fcn.41b2388f
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, 0x41b0fd7c
test eax, eax
jne 0x41b0fc7c
lea eax, [ebp - 0x204]
push eax
call fcn.41b235e9
test eax, eax
je 0x41b0fc7c
push esi
call ebx
cmp eax, 0xffffffff
jne 0x41b02ff6
push edi
push dword [ebp + 0x10]
push esi
call fcn.41b02b3a
test eax, eax
jge 0x41b02ff6
push esi
call ebx
cmp eax, 0xffffffff
jne 0x41b02ff6
push esi
push 0x200
lea eax, [ebp - 0x204]
push eax
call fcn.41b029b6
test eax, eax
jne 0x41b0fc0c
mov eax, dword [ebp + 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_SearchPathW]
lea ecx, [ebp - 0x414]
push ecx
push esi
shr eax, 1
push eax
mov dword [ebp - 0x410], eax
push edi
lea eax, [ebp - 0x204]
push eax
push 0
call ebx
test eax, eax
jne 0x41b0fd39
lea eax, [ebp - 0x40c]
push eax
push 0x104
push str.MediaPath
push str.SoftwareMicrosoftWindowsCurrentVersion
call fcn.41b11209
test eax, eax
je 0x41b02ff6
lea eax, [ebp - 0x414]
push eax
push esi
push dword [ebp - 0x410]
lea eax, [ebp - 0x204]
push edi
push eax
lea eax, [ebp - 0x40c]
push eax
call ebx
test eax, eax
je 0x41b0fc11
cmp byte [0x41b29ded], 0
je 0x41b02ff6
push 0x41b0fd6c
call sub.ntdll.dll_Ordinal_1
mov byte [0x41b29ded], 0
jmp 0x41b02ff6
cmp byte [0x41b29dec], 0
je 0x41b02ff6
push 0x41b0fd5c
call sub.ntdll.dll_Ordinal_1
mov byte [0x41b29dec], 0
jmp 0x41b02ff6
Function at 0x41b0300f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x46c
mov eax, dword [0x41b28d84]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x464], ecx
mov dword [ebp - 0x468], eax
cmp ecx, ebx
je 0x41b0aa7e
cmp eax, ebx
je 0x41b0aa7e
push str.SystemDefault
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x41b0fb83
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x104]
push eax
push ebx
push 2
push ebx
push str.AppEventsSchemes_
push 0x80000001
mov dword [ebp - 0x46c], 0x100
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegGetValueW]
test eax, eax
jne 0x41b030ab
push str..None
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x41b0fb92
push dword [ebp - 0x464]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x20
jge 0x41b030f5
test byte [edi], 0x80
push esi
mov esi, str..Current
jne 0x41b0fb9a
test dword [edi], 0x400000
jne 0x41b0aa45
push edi
push dword [ebp + 0x10]
push dword [ebp - 0x468]
push dword [ebp - 0x464]
push 0x41b29854
push esi
call fcn.41b0337d
mov ebx, eax
pop esi
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.41b028d6
leave
ret 0x10
push edi
push dword [ebp + 0x10]
push dword [ebp - 0x468]
push dword [ebp - 0x464]
push str.Explorer
push esi
call fcn.41b0337d
mov ebx, eax
test ebx, ebx
jne 0x41b030f4
jmp 0x41b030d7
mov ebx, eax
test ebx, ebx
je 0x41b030cb
jmp 0x41b030f4
xor eax, eax
jmp 0x41b030f7
mov dword [ebp - 0x464], str..Default
jmp 0x41b03061
or dword [edi], 2
jmp 0x41b030ab
xor eax, eax
mov word [ebp - 0x204], ax
push 0x12e
lea eax, [ebp - 0x460]
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x41b030cb
push ebx
lea eax, [ebp - 0x204]
push eax
push ebx
push ebx
lea eax, [ebp - 0x460]
push eax
call fcn.41b23912
cmp word [ebp - 0x204], bx
je 0x41b030cb
push edi
push dword [ebp + 0x10]
lea eax, [ebp - 0x204]
push dword [ebp - 0x468]
push dword [ebp - 0x464]
push eax
push esi
call fcn.41b0337d
jmp 0x41b0aa6f
Function at 0x41b035e6
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 3
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x41b0ab48
mov eax, dword [0x41b28b68]
cmp eax, 0x41b28b68
je 0x41b03651
test dword [eax + 0x1c], 0x400000
je 0x41b03651
cmp byte [eax + 0x19], 3
jb 0x41b03651
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x41b28b68]
push esi
push 0x41b02964
push 0x17
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.41b02acc
xor eax, eax
pop esi
pop ebx
leave
ret 4
mov eax, dword [0x41b28b68]
cmp eax, 0x41b28b68
je 0x41b0ab76
test dword [eax + 0x1c], 0x400000
je 0x41b0ab76
cmp byte [eax + 0x19], 3
jb 0x41b0ab76
push esi
push 0x41b02964
push 0x18
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.41b02a79
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
inc edi
inc edi
push ebx
push dword [ebp - 4]
shr edi, 1
add edi, edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x41b0eecc
lea ecx, [ebp - 8]
push ecx
lea eax, [edi + edi + 0x38]
push ebx
push eax
call fcn.41b0a91e
test eax, eax
jl 0x41b0ef77
push dword [ebp - 8]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x41b0ef08
lea eax, [esi + edi*2 + 0x38]
push ebx
push eax
push dword [ebp - 4]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll__lread]
cmp eax, ebx
jne 0x41b0ef64
xor eax, eax
lea ecx, [esi + 0x30]
push ecx
push eax
push eax
push dword [ebp - 4]
mov dword [esi + 0x2c], ebx
mov dword [esi], 0x66646e53
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push ebx
push dword [ebp - 8]
lea eax, [esi + 4]
push eax
call fcn.41b051fb
test eax, eax
je 0x41b0ef37
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 8]
lea eax, [esi + 0x38]
push edi
push eax
call fcn.41b050d1
test eax, eax
jne 0x41b0ef64
mov eax, esi
pop edi
jmp 0x41b03653
mov eax, dword [0x41b28b68]
cmp eax, 0x41b28b68
je 0x41b0ef77
test dword [eax + 0x1c], 0x400000
je 0x41b0ef77
cmp byte [eax + 0x19], 2
jb 0x41b0ef77
push esi
push 0x41b02964
push 0x19
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.41b02a79
jmp 0x41b0ef77
mov eax, dword [0x41b28b68]
cmp eax, 0x41b28b68
je 0x41b0ef77
test dword [eax + 0x1c], 0x400000
je 0x41b0ef77
cmp byte [eax + 0x19], 3
jb 0x41b0ef77
push 0x41b02964
push 0x1a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.41b02941
jmp 0x41b0ef77
mov eax, dword [0x41b28b68]
cmp eax, 0x41b28b68
je 0x41b0ef64
test dword [eax + 0x1c], 0x400000
je 0x41b0ef64
cmp byte [eax + 0x19], 3
jb 0x41b0ef64
push 0x41b02964
push 0x1b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.41b02941
mov eax, dword [esi + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
test eax, eax
je 0x41b0ef74
push eax
call edi
push esi
call edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x41b0ac36
Function at 0x41b03dda
Capabilities:
Allocate thread local storage
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [0x41b28b30], eax
test eax, eax
je 0x41b03e88
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x41b28db0], eax
cmp eax, 0xffffffff
je 0x41b03e88
push esi
push 0xe
mov esi, 0x41b290a8
push esi
call fcn.41b03b91
test eax, eax
je 0x41b102fa
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x41b28b40], eax
test eax, eax
je 0x41b102eb
call fcn.41b03a5d
call fcn.41b03b60
mov dword [0x41b28b2c], 1
call fcn.41b03e91
test eax, eax
je 0x41b102ad
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x1c]
mov dword [0x41b28b28], eax
mov eax, dword [ebp - 0x18]
mov dword [0x41b28da8], eax
xor eax, eax
inc eax
pop esi
leave
ret 4
xor eax, eax
jmp 0x41b03e84
mov eax, dword [0x41b28b68]
cmp eax, 0x41b28b68
je 0x41b03e66
test dword [eax + 0x1c], 0x400000
je 0x41b03e66
cmp byte [eax + 0x19], 2
jb 0x41b03e66
push 0x41b03980
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.41b02941
jmp 0x41b03e66
and dword [0x41b28b40], 0
push 0xe
push esi
call fcn.41b09b99
push dword [0x41b28db0]
call dword [sym.imp.KERNEL32.dll_TlsFree]
or dword [0x41b28db0], 0xffffffff
xor eax, eax
jmp 0x41b03e83

Function at 0x41b04135
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x41b28d84]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.41b04209
mov eax, 0x41b00000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x98]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x41b041d7
cmp dword [ebp - 0x94], 5
jb 0x41b041aa
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x41b041f4
call fcn.41b040a6
test eax, eax
jl 0x41b10ddf
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.41b028d6
leave
ret
cmp dword [ebp - 0x88], 1
je 0x41b10dc7
jmp 0x41b041aa
cmp dword [ebp - 0x90], 0
jbe 0x41b041aa
jmp 0x41b041a6
cmp dword [ebp - 0x94], 4
ja 0x41b041a6
je 0x41b041e6
jmp 0x41b041aa
mov byte [0x41b2a1a0], 1
jmp 0x41b041c8
Function at 0x41b089f2
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 0x40
xor edi, edi
push edi
push 0x41b29980
call sub.ntdll.dll_memset
add esp, 0xc
push 0x41b08ad0
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push 0x41b29458
push edi
push 0x2001f
xor ebx, ebx
push str.SystemCurrentControlSetControlMediaPropertiesPrivatePropertiesJoystickWinmm
inc ebx
push 0x80000001
mov dword [0x41b29418], eax
mov dword [0x41b29414], edi
mov dword [0x41b2941c], edi
mov dword [0x41b29410], ebx
call fcn.41b08b01
test eax, eax
jl 0x41b08a89
lea eax, [ebp - 4]
push eax
push 0x41b29410
push edi
push edi
mov esi, 0x41b297a8
push esi
push dword [0x41b29458]
mov dword [ebp - 4], 4
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x41b0d58f
push dword [0x41b29458]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
cmp dword [0x41b282c0], edi
jne 0x41b08ab0
mov esi, 0x41b08ab8
push esi
push edi
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [0x41b282c0], eax
cmp eax, edi
je 0x41b09a04
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
push esi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x41b282c0], eax
jmp 0x41b08ab0
push dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push 4
push edi
push esi
push dword [0x41b29458]
mov dword [ebp - 8], ebx
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExW]
jmp 0x41b08a7d

Function at 0x41b0a83e
Capabilities:
Create thread

Disassembly:
call fcn.41b03aff
test eax, eax
je 0x41b0f2c8
push esi
xor esi, esi
push esi
push 1
push esi
push 0x1f0003
push 0x41b28fc0
call dword [sym.imp.ntdll.dll_NtCreateEvent]
test eax, eax
jl 0x41b0f2fb
push esi
push 1
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x41b28fd0], eax
cmp eax, esi
je 0x41b0f2c9
push 0x41b293e0
push 0x20
push esi
push 0x41b0a3e0
push 0x12c
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x41b293e4], eax
cmp eax, esi
je 0x41b0f2d7
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor eax, eax
inc eax
pop esi
ret
ret
push dword [0x41b28fc0]
call dword [sym.imp.ntdll.dll_NtClose]
jmp 0x41b0f2f5
push dword [0x41b28fd0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x41b28fc0]
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [0x41b28fd0], esi
mov dword [0x41b28fc0], esi
xor eax, eax
pop esi
ret