joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403eb0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, ecx
mov edx, 0x1505
mov dword [ebp - 8], eax
push esi
mov esi, eax
test eax, eax
jne 0x403ecc
pop esi
mov esp, ebp
pop ebp
ret
movsx ecx, byte [eax]
test ecx, ecx
je 0x403ee6
mov eax, edx
lea esi, [esi + 1]
shl edx, 5
add edx, ecx
movsx ecx, byte [esi]
add edx, eax
test ecx, ecx
jne 0x403ed3
push ebx
test edx, edx
mov ebx, 1
mov ecx, ebx
mov eax, 0xc0906d
cmovne ecx, edx
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 9
imul eax, eax, 0x3fd
push edi
push 0x46ed78
sub ecx, eax
cmovne ebx, ecx
mov dword [ebp - 4], ebx
mov esi, ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x46ed5c]
lea edi, [esi*8]
add ecx, edi
mov dword [ebp - 0xc], ecx
mov eax, dword [ecx]
test eax, eax
je 0x404037
cmp eax, ebx
jne 0x403f77
mov ecx, dword [ecx + 4]
mov eax, dword [ebp - 8]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x403f67
test dl, dl
je 0x403f63
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x403f67
add eax, 2
add ecx, 2
test dl, dl
jne 0x403f47
xor eax, eax
jmp 0x403f6c
sbb eax, eax
or eax, 1
test eax, eax
je 0x4040c4
mov ecx, dword [ebp - 0xc]
push dword [ecx + 4]
push dword [ebp - 8]
push str.hash_collision___s_vs__s_
push str.htab_hash
push 4
push 0
call fcn.00402920
mov ecx, dword [ebp - 4]
mov eax, 0x14191f7
mul ecx
mov eax, ecx
mov ebx, ecx
sub eax, edx
add esp, 0x18
shr eax, 1
add eax, edx
shr eax, 9
imul eax, eax, 0x3fb
sub ebx, eax
inc ebx
lea eax, [ebx*8]
nop word [eax + eax]
cmp esi, ebx
ja 0x403fd7
sub edi, eax
mov eax, 0x3fd
sub eax, ebx
add esi, eax
add edi, 0x1fe8
jmp 0x403fdb
sub esi, ebx
sub edi, eax
cmp esi, ecx
je 0x404034
mov edx, dword [0x46ed5c]
mov eax, dword [edi + edx]
mov dword [ebp - 0xc], eax
cmp eax, ecx
jne 0x404029
mov eax, dword [edi + edx + 4]
mov ecx, dword [ebp - 8]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x404016
test dl, dl
je 0x404012
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x404016
add ecx, 2
add eax, 2
test dl, dl
jne 0x403ff6
xor eax, eax
jmp 0x40401b
sbb eax, eax
or eax, 1
test eax, eax
je 0x4040c4
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
test eax, eax
lea eax, [ebx*8]
jne 0x403fc0
mov ebx, dword [ebp - 4]
cmp dword [0x46ed58], 0x3fd
jb 0x404074
push 0x3fd
push str.hash_table_is_full___lu_entries_
push str.htab_hash
push 1
push 0
call fcn.00402920
add esp, 0x14
xor esi, esi
push 0x46ed78
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop ebx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push dword [ebp - 8]
call fcn.0042e9ec
mov ecx, eax
add esp, 4
mov eax, dword [0x46ed5c]
mov dword [eax + esi*8 + 4], ecx
lea eax, [eax + esi*8]
test ecx, ecx
jne 0x4040bc
push str.could_not_duplicate_string_for_hash_table
push str.htab_hash
push 1
push ecx
call fcn.00402920
add esp, 0x10
xor esi, esi
push 0x46ed78
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop ebx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
inc dword [0x46ed58]
mov dword [eax], ebx
push 0x46ed78
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop ebx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4048a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x46ed6c]
push ebx
inc eax
xor bl, bl
mov dword [0x46ed6c], eax
push esi
mov esi, dword [ebp + 8]
push edi
cmp eax, 1
jne 0x40495e
call fcn.00404220
mov dword [0x46ec18], eax
test eax, eax
jne 0x4048ec
push str.failed_to_detect_Windows_version
push str.windows_init
push 1
push esi
call fcn.00402920
add esp, 0x10
mov edi, 0xfffffff4
jmp 0x4049e9
cmp eax, 4
jge 0x4048f8
push str.Windows_version_is_too_old
jmp 0x4048d2
mov ecx, esi
call fcn.00403dd0
test al, al
jne 0x40490d
mov edi, 0xfffffff5
jmp 0x4049e9
push esi
call fcn.00409000
mov edi, eax
add esp, 4
test edi, edi
jne 0x4049e9
push esi
mov bl, 1
call fcn.00410670
add esp, 4
test eax, eax
jne 0x404949
push str.UsbDk_backend_is_available
push str.windows_init
push 4
push esi
call fcn.00402920
mov byte [0x46ec44], bl
jmp 0x40495b
push str.UsbDk_backend_is_not_available
push str.windows_init
push 3
push esi
call fcn.00402920
add esp, 0x10
push 1
push 0
push 0
push 0xffffffffffffffff
mov dword [esi + fcn.00409000], 0x4644d8
mov edi, 0xfffffff5
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov dword [esi + 0x12c], eax
test eax, eax
jne 0x4049a4
xor ecx, ecx
call fcn.00403c20
push eax
push str.failed_to_create_I_O_completion_port:__s
push str.windows_init
push 1
push esi
call fcn.00402920
add esp, 0x14
jmp 0x4049e9
push 0
push 0
push esi
push 0x404660
push 0
push 0
call fcn.0042e951
add esp, 0x18
mov dword [esi + 0x130], eax
test eax, eax
jne 0x4049e7
push str.failed_to_create_I_O_completion_port_thread
push str.windows_init
push 1
push esi
call fcn.00402920
add esp, 0x10
push dword [esi + 0x12c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4049e9
xor edi, edi
cmp dword [0x46ed6c], 1
jne 0x404a38
test edi, edi
je 0x404a38
cmp byte [0x46ec44], 0
je 0x404a20
mov eax, dword [0x46eeec]
test eax, eax
je 0x404a19
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x46eeec], 0
mov byte [0x46ec44], 0
test bl, bl
je 0x404a2d
push esi
call fcn.00409080
add esp, 4
call fcn.00403e60
dec dword [0x46ed6c]
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x405820
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push edi
mov edi, ecx
lea eax, [edi + 0x84]
push eax
call esi
lea eax, [edi + 0x9c]
push eax
call esi
lea eax, [edi + 0xbc]
push eax
call esi
lea eax, [edi + 0xd4]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeConditionVariable]
lea eax, [edi + 0xd8]
push eax
call esi
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [edi + 0xb8], eax
lea eax, [edi + 0x7c]
mov dword [eax + 4], eax
mov dword [eax], eax
lea eax, [edi + 0xf8]
mov dword [eax + 4], eax
mov dword [eax], eax
lea eax, [edi + 0x100]
mov dword [eax + 4], eax
mov dword [eax], eax
lea eax, [edi + 0x110]
push 0
push 0
mov dword [eax + 4], eax
mov dword [eax], eax
lea eax, [edi + 0x118]
push 1
push 0
mov dword [eax + 4], eax
mov dword [eax], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0xc], eax
test eax, eax
jne 0x4058d6
xor ecx, ecx
call fcn.00403c20
push eax
push str.CreateEvent_failed:__s
push str.usbi_create_event
push 1
push 0
call fcn.00402920
mov ebx, 0xffffff9d
jmp 0x405998
push ecx
mov edx, eax
mov ecx, edi
call fcn.00407340
mov ebx, eax
add esp, 4
test ebx, ebx
js 0x405970
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerW]
mov dword [edi + 0x10], eax
test eax, eax
jne 0x405936
xor ecx, ecx
call fcn.00403c20
push eax
push str.CreateWaitableTimer_failed:__s
push str.usbi_create_timer
push 2
push 0
call fcn.00402920
push str.timer_not_available_for_timeouts
push str.usbi_io_init
push 4
push edi
call fcn.00402920
add esp, 0x24
pop edi
pop esi
xor eax, eax
pop ebx
ret
push str.using_timer_for_timeouts
push str.usbi_io_init
push 4
push edi
call fcn.00402920
mov edx, dword [edi + 0x10]
add esp, 0xc
mov ecx, edi
call fcn.00407340
mov ebx, eax
add esp, 4
test ebx, ebx
jns 0x405930
lea ecx, [edi + 0x10]
call fcn.00403720
mov edx, dword [edi + 0xc]
mov ecx, edi
call fcn.004073f0
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x40599b
xor ecx, ecx
call fcn.00403c20
push eax
push str.CloseHandle_failed:__s
push str.usbi_destroy_event
push 2
push 0
call fcn.00402920
add esp, 0x14
mov esi, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea eax, [edi + 0x84]
push eax
call esi
lea eax, [edi + 0x9c]
push eax
call esi
lea eax, [edi + 0xbc]
push eax
call esi
lea eax, [edi + 0xd8]
push eax
call esi
push dword [edi + 0xb8]
call dword [sym.imp.KERNEL32.dll_TlsFree]
pop edi
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x406ac0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 4], edx
push edi
push dword [ebx + 0xb8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x406aea
mov eax, 0xfffffffa
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea esi, [ebx + 0xd8]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test byte [ebx + 0xf0], 1
je 0x406b6d
push str.event_sources_modified__reallocating_event_data
push str.handle_events
push 4
push ebx
call fcn.00402920
add esp, 0x10
mov ecx, ebx
call fcn.004059e0
mov ecx, ebx
call fcn.004038b0
mov edi, eax
test edi, edi
je 0x406b39
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
and dword [ebx + 0xf0], 0xfffffffe
jne 0x406b6d
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
test eax, eax
jne 0x406b6d
xor ecx, ecx
call fcn.00403c20
push eax
push str.ResetEvent_failed:__s
push str.usbi_clear_event
push 2
push 0
call fcn.00402920
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
mov esi, 0x3e8
push ebx
push dword [ebx + 0xb8]
mov dword [ebp - 0x14], 0
mov eax, dword [ecx + 4]
cdq
idiv esi
imul esi, dword [ecx], 0x3e8
mov edi, edx
add esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, edi
lea eax, [esi + 1]
lea edx, [ebp - 0x14]
mov ecx, ebx
cmove eax, esi
push eax
call fcn.004039a0
mov edi, eax
add esp, 4
test edi, edi
je 0x406be6
cmp edi, 0xfffffff9
jne 0x406c5d
mov eax, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea esi, [ebx + 0x84]
push esi
call eax
mov ecx, ebx
call fcn.004066c0
mov eax, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
call eax
xor edi, edi
jmp 0x406c5d
mov eax, dword [ebp - 0x14]
test al, 1
je 0x406bfd
mov ecx, ebx
call fcn.00406810
mov edi, eax
test edi, edi
jne 0x406c5d
mov eax, dword [ebp - 0x14]
test al, 2
je 0x406c2b
mov eax, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea esi, [ebx + 0x84]
push esi
call eax
mov ecx, ebx
call fcn.004066c0
mov ecx, ebx
call fcn.00405c20
mov edi, eax
mov eax, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
call eax
test edi, edi
jne 0x406c5d
mov eax, dword [ebp - 8]
test eax, eax
je 0x406c5d
push eax
push dword [ebp - 0xc]
xor eax, eax
push dword [ebp - 0x10]
push ebx
call eax
mov edi, eax
add esp, 0x10
test edi, edi
je 0x406c5d
push edi
push str.backend_handle_events_failed_with_error__d
push str.handle_events
push 1
push ebx
call fcn.00402920
add esp, 0x14
push 0
push dword [ebx + 0xb8]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4076b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 4], 0
test esi, esi
je 0x4076ca
mov eax, dword [esi + 0x24]
mov eax, dword [eax + 4]
jmp 0x4076cc
xor eax, eax
push dword [eax + 0xb8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4076e8
mov eax, 0xfffffffa
pop esi
mov esp, ebp
pop ebp
ret 0x18
push edi
push 0xf0
push 1
call fcn.0042c0a1
mov edi, eax
add esp, 8
test edi, edi
je 0x407737
lea ecx, [edi + 0xac]
mov dword [edi + 0x70], 0
push ecx
mov dword [edi + 0xc4], edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
add edi, 0xc8
je 0x407737
push 8
call fcn.0042e5df
mov edx, eax
add esp, 4
test edx, edx
jne 0x407744
mov ecx, edi
call fcn.00405bb0
pop edi
mov eax, 0xfffffff5
pop esi
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [ebp + 0xc]
mov eax, ecx
shr eax, 8
mov byte [ebp + 0xd], al
mov byte [ebp + 0xc], cl
movzx eax, word [ebp + 0xc]
mov word [edx + 2], ax
mov word [ebp + 0xc], 0
movzx eax, word [ebp + 0xc]
mov word [edx + 4], ax
push ebx
mov word [ebp + 0xc], 0
movzx eax, word [ebp + 0xc]
push ecx
mov word [edx + 6], ax
lea eax, [ebp - 4]
push eax
push ecx
mov word [edx], 0x900
mov ecx, edi
push edx
mov edx, esi
call fcn.00407550
add esp, 0x10
mov byte [edi + 4], 2
mov ecx, edi
call fcn.00405f60
mov ebx, eax
mov ecx, edi
test ebx, ebx
jns 0x4077b2
call fcn.00405bb0
mov eax, ebx
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
call fcn.00407610
mov ecx, dword [edi + 0xc]
cmp ecx, 6
ja case.default.0x4077c3
jmp dword [ecx*4 + 0x40788c]
mov esi, dword [edi + 0x14]
mov ecx, edi
call fcn.00405bb0
pop ebx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x18
mov ecx, edi
mov esi, 0xfffffff9
call fcn.00405bb0
pop ebx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x18
mov ecx, edi
mov esi, 0xfffffff7
call fcn.00405bb0
pop ebx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x18
mov ecx, edi
mov esi, 0xfffffffc
call fcn.00405bb0
pop ebx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x18
mov ecx, edi
mov esi, 0xfffffff8
call fcn.00405bb0
pop ebx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x18
mov ecx, edi
or esi, 0xffffffff
call fcn.00405bb0
pop ebx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x18
test esi, esi
je 0x40785c
mov eax, dword [esi + 0x24]
mov eax, dword [eax + 4]
jmp 0x40785e
xor eax, eax
push ecx
push str.unrecognised_status_code__d
push str.libusb_control_transfer
push 2
push eax
call fcn.00402920
add esp, 0x14
mov ecx, edi
mov esi, 0xffffff9d
call fcn.00405bb0
pop ebx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4479a5
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044772c

Function at 0x449b51
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00449335

Function at 0x449b5c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00449570

Function at 0x453128
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00452d2d

Function at 0x453133
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00452eae
Function at 0x4011d0
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 8]
push esi
cmp eax, 0x111
ja 0x40124f
je 0x4011b7
cmp eax, 0x10
je 0x401174
cmp eax, 0x110
jne case.0x4011c9.3
mov esi, dword [esp + 8]
push ebx
push ebp
push edi
call fcn.0041c090
push 0
call dword [0x4391b0]
mov edi, dword [0x43932c]
push 0x67
push esi
mov ebx, eax
call edi
push 0
push 0x80
push 0x80
push 1
push 0x65
push ebx
mov ebp, eax
call dword [0x439338]
mov ebx, dword [0x43931c]
push eax
push 1
push 0x172
push ebp
mov dword [0x443b04], eax
call ebx
push 0x68
push esi
call edi
push 0x6d
push esi
mov ebp, eax
call edi
push 0x6e
push esi
mov dword [esp + 0x1c], eax
call edi
push 0
mov edi, eax
call dword [0x439320]
push str.Tahoma
push 0
push 5
push 0
push 4
push 1
push 0
push 0
push 0
push 0x2bc
push 0
push 0
push 0
push 0x48
mov esi, eax
push 0x5a
push esi
call dword [0x439044]
push eax
push 0x12
call dword [0x4391bc]
neg eax
push eax
call dword [0x439040]
push str.Tahoma
push 0
push 5
push 0
push 4
push 1
push 0
push 1
push 0
push 0x190
push 0
push 0
push 0
push 0x48
mov dword [0x443b00], eax
push 0x5a
push esi
call dword [0x439044]
push eax
push 8
call dword [0x4391bc]
neg eax
push eax
call dword [0x439040]
push esi
push 0
mov dword [0x443afc], eax
call dword [0x439328]
mov eax, dword [0x443b00]
push 0
push eax
push 0x30
push ebp
call ebx
mov ecx, dword [0x443afc]
mov edx, dword [esp + 0x14]
push 0
push ecx
push 0x30
push edx
call ebx
mov eax, dword [0x443afc]
push 0
push eax
push 0x30
push edi
call ebx
push 0xf
call dword [0x439334]
push eax
call dword [0x439050]
pop edi
pop ebp
pop ebx
mov dword [0x443af8], eax
mov eax, 1
pop esi
ret 0x10
mov ecx, dword [0x443b04]
push ecx
call dword [0x43933c]
mov edx, dword [0x443b00]
mov esi, dword [0x43904c]
push edx
call esi
mov eax, dword [0x443afc]
push eax
call esi
mov ecx, dword [0x443af8]
push ecx
call esi
mov edx, dword [esp + 8]
push 1
push edx
call dword [0x439330]
mov eax, 1
pop esi
ret 0x10
movzx eax, word [esp + 0x10]
dec eax
cmp eax, 0x6d
ja case.0x4011c9.3
movzx eax, byte [eax + 0x4012a4]
jmp dword [eax*4 + 0x401294]
push 1
push 0
push 0
push str.http:__www.customxp.net_TrueTransparency_
push str.open
push 0
call dword [0x4391e8]
xor eax, eax
pop esi
ret 0x10
push 1
push 0
push 0
push str.http:__www.customxp.net_
push str.open
push 0
call dword [0x4391e8]
xor eax, eax
pop esi
ret 0x10
mov ecx, dword [0x443b04]
push ecx
call dword [0x43933c]
mov edx, dword [0x443b00]
mov esi, dword [0x43904c]
push edx
call esi
mov eax, dword [0x443afc]
push eax
call esi
mov ecx, dword [0x443af8]
push ecx
call esi
mov edx, dword [esp + 8]
push 2
push edx
call dword [0x439330]
mov eax, 1
pop esi
ret 0x10
cmp eax, 0x138
jne case.0x4011c9.3
mov eax, dword [esp + 0x14]
push 0xfffffffffffffff4
push eax
call dword [0x439324]
cmp eax, 0x6d
je 0x401271
cmp eax, 0x6e
jne case.0x4011c9.3
mov esi, dword [esp + 0x10]
push 1
push esi
call dword [0x439048]
push 0xff3232
push esi
call dword [0x43905c]
mov eax, dword [0x443af8]
pop esi
ret 0x10
Function at 0x4011ee
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 8]
push esi
cmp eax, 0x111
ja 0x40124f
je 0x4011b7
cmp eax, 0x10
je 0x401174
cmp eax, 0x110
jne case.0x4011c9.3
mov esi, dword [esp + 8]
push ebx
push ebp
push edi
call fcn.0041c090
push 0
call dword [0x4391b0]
mov edi, dword [0x43932c]
push 0x67
push esi
mov ebx, eax
call edi
push 0
push 0x80
push 0x80
push 1
push 0x65
push ebx
mov ebp, eax
call dword [0x439338]
mov ebx, dword [0x43931c]
push eax
push 1
push 0x172
push ebp
mov dword [0x443b04], eax
call ebx
push 0x68
push esi
call edi
push 0x6d
push esi
mov ebp, eax
call edi
push 0x6e
push esi
mov dword [esp + 0x1c], eax
call edi
push 0
mov edi, eax
call dword [0x439320]
push str.Tahoma
push 0
push 5
push 0
push 4
push 1
push 0
push 0
push 0
push 0x2bc
push 0
push 0
push 0
push 0x48
mov esi, eax
push 0x5a
push esi
call dword [0x439044]
push eax
push 0x12
call dword [0x4391bc]
neg eax
push eax
call dword [0x439040]
push str.Tahoma
push 0
push 5
push 0
push 4
push 1
push 0
push 1
push 0
push 0x190
push 0
push 0
push 0
push 0x48
mov dword [0x443b00], eax
push 0x5a
push esi
call dword [0x439044]
push eax
push 8
call dword [0x4391bc]
neg eax
push eax
call dword [0x439040]
push esi
push 0
mov dword [0x443afc], eax
call dword [0x439328]
mov eax, dword [0x443b00]
push 0
push eax
push 0x30
push ebp
call ebx
mov ecx, dword [0x443afc]
mov edx, dword [esp + 0x14]
push 0
push ecx
push 0x30
push edx
call ebx
mov eax, dword [0x443afc]
push 0
push eax
push 0x30
push edi
call ebx
push 0xf
call dword [0x439334]
push eax
call dword [0x439050]
pop edi
pop ebp
pop ebx
mov dword [0x443af8], eax
mov eax, 1
pop esi
ret 0x10
mov ecx, dword [0x443b04]
push ecx
call dword [0x43933c]
mov edx, dword [0x443b00]
mov esi, dword [0x43904c]
push edx
call esi
mov eax, dword [0x443afc]
push eax
call esi
mov ecx, dword [0x443af8]
push ecx
call esi
mov edx, dword [esp + 8]
push 1
push edx
call dword [0x439330]
mov eax, 1
pop esi
ret 0x10
movzx eax, word [esp + 0x10]
dec eax
cmp eax, 0x6d
ja case.0x4011c9.3
movzx eax, byte [eax + 0x4012a4]
jmp dword [eax*4 + 0x401294]
push 1
push 0
push 0
push str.http:__www.customxp.net_TrueTransparency_
push str.open
push 0
call dword [0x4391e8]
xor eax, eax
pop esi
ret 0x10
push 1
push 0
push 0
push str.http:__www.customxp.net_
push str.open
push 0
call dword [0x4391e8]
xor eax, eax
pop esi
ret 0x10
mov ecx, dword [0x443b04]
push ecx
call dword [0x43933c]
mov edx, dword [0x443b00]
mov esi, dword [0x43904c]
push edx
call esi
mov eax, dword [0x443afc]
push eax
call esi
mov ecx, dword [0x443af8]
push ecx
call esi
mov edx, dword [esp + 8]
push 2
push edx
call dword [0x439330]
mov eax, 1
pop esi
ret 0x10
cmp eax, 0x138
jne case.0x4011c9.3
mov eax, dword [esp + 0x14]
push 0xfffffffffffffff4
push eax
call dword [0x439324]
cmp eax, 0x6d
je 0x401271
cmp eax, 0x6e
jne case.0x4011c9.3
mov esi, dword [esp + 0x10]
push 1
push esi
call dword [0x439048]
push 0xff3232
push esi
call dword [0x43905c]
mov eax, dword [0x443af8]
pop esi
ret 0x10
Function at 0x401510
Capabilities:
Delete registry value
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x1c]
push eax
push 3
xor ebx, ebx
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
mov dword [esp + 0x2c], ebx
call dword [section..rdata]
test eax, eax
jne 0x4015cc
mov edx, dword [esp + 0x1c]
mov ebp, dword [0x439004]
lea ecx, [esp + 0x18]
push ecx
push ebx
push ebx
push ebx
push 0x43b8e8
push edx
call ebp
mov edi, dword [esp + 0x18]
cmp edi, ebx
je 0x4015c1
lea eax, [esp + 0x17]
push eax
lea esi, [esp + 0x24]
mov byte [esp + 0x1b], bl
call fcn.004019d0
mov esi, dword [esp + 0x24]
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push esi
push ebx
push ebx
push 0x43b8e8
push edx
call ebp
mov eax, dword [esp + 0x18]
lea ecx, [esi + 1]
push ecx
mov byte [esi + eax - 2], bl
call dword [0x439180]
cmp eax, 0xffffffff
jne 0x4015b4
mov edx, dword [esp + 0x1c]
push 0x43b8e8
push edx
call dword [0x439010]
mov dword [esp + 0x18], ebx
cmp esi, ebx
je 0x4015c1
push esi
call fcn.00423279
add esp, 4
mov eax, dword [esp + 0x1c]
push eax
call dword [0x43900c]
pop edi
xor eax, eax
cmp dword [esp + 0x14], ebx
pop esi
pop ebp
setne al
pop ebx
add esp, 0x24
ret
Function at 0x4015e0
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
sub esp, 0x194
push ebx
lea eax, [esp + 4]
push eax
push 2
xor ebx, ebx
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [section..rdata]
test eax, eax
jne 0x401783
call dword [0x4391ac]
push 0x103
lea ecx, [esp + 0x98]
push ecx
push ebx
push eax
call sub.PSAPI.DLL_GetModuleFileNameExA
mov cl, 0x5c
cmp byte [esp + eax + 0x94], cl
je 0x40163a
mov edi, edi
dec eax
cmp byte [esp + eax + 0x94], cl
jne 0x401630
push ebp
mov byte [esp + eax + 0x98], bl
mov ebp, 0xf
lea eax, [esp + 0x98]
push esi
mov dword [esp + 0x44], ebp
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x401660
push edi
sub eax, edx
push eax
lea edx, [esp + 0xa4]
push edx
lea ecx, [esp + 0x38]
call fcn.00401a30
lea eax, [esp + 0x30]
push eax
mov eax, 0x43b9bc
lea edi, [esp + 0x88]
call fcn.00401c50
add esp, 4
mov edi, 0x43b9b8
lea esi, [esp + 0x68]
call fcn.00401cd0
mov edi, 0x43b8e8
lea esi, [esp + 0x4c]
call fcn.00401cd0
mov edi, str..exe_
lea esi, [esp + 0x14]
call fcn.00401cd0
mov esi, 0x10
pop edi
cmp dword [esp + 0x60], esi
jb 0x4016d8
mov ecx, dword [esp + 0x4c]
push ecx
call fcn.00423279
add esp, 4
mov dword [esp + 0x60], ebp
mov dword [esp + 0x5c], ebx
mov byte [esp + 0x4c], bl
cmp dword [esp + 0x7c], esi
jb 0x4016f7
mov edx, dword [esp + 0x68]
push edx
call fcn.00423279
add esp, 4
mov dword [esp + 0x7c], ebp
mov dword [esp + 0x78], ebx
mov byte [esp + 0x68], bl
cmp dword [esp + 0x98], esi
jb 0x40171c
mov eax, dword [esp + 0x84]
push eax
call fcn.00423279
add esp, 4
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x28], esi
jae 0x40172a
lea eax, [esp + 0x14]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0xc]
inc ecx
push ecx
push eax
push 1
push ebx
push 0x43b8e8
push edx
call dword [0x439008]
mov eax, dword [esp + 0xc]
push eax
call dword [0x43900c]
cmp dword [esp + 0x28], esi
jb 0x401762
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00423279
add esp, 4
cmp dword [esp + 0x44], esi
pop esi
mov dword [esp + 0x24], ebp
mov dword [esp + 0x20], ebx
mov byte [esp + 0x10], bl
pop ebp
jb 0x401783
mov edx, dword [esp + 0x28]
push edx
call fcn.00423279
add esp, 4
pop ebx
add esp, 0x194
ret

Function at 0x401790
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ecx
lea eax, [esp]
push eax
push 2
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [section..rdata]
test eax, eax
jne 0x4017c6
mov ecx, dword [esp]
push 0x43b8e8
push ecx
call dword [0x439010]
mov edx, dword [esp]
push edx
call dword [0x43900c]
pop ecx
ret