joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414a57
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x414a92
push 6
call fcn.004660af
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.00467c40
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x414af5
push 0x80000301
push 0
push 1
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.00469810
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x414b19
push 6
call fcn.004660af
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.00467c40
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x414b7c
push 0x80000301
push 0
push 2
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.00469810
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x414ba0
push 6
call fcn.004660af
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.00467c40
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x414c03
push 0x80000301
push 0
push 4
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.00469810
add esp, 0x1c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x414c0b
mov esp, ebp
pop ebp
ret
Function at 0x419340
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp - 0xc]
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x419386
push 6
call fcn.004660af
add esp, 4
mov dword [ebp - 0x1c], eax
fild dword [ebp - 0x1c]
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
fadd qword [0x4b149c]
fstp qword [ebp - 0x24]
fld qword [ebp - 0x24]
call fcn.00403b18
mov dword [ebp - 4], eax
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x184
call fcn.00467710
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4193d9
push ebx
call fcn.004660bb
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
push dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x419412
push 6
call fcn.004660af
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x41942e
push eax
mov ebx, eax
call fcn.0040201b
inc eax
push eax
call fcn.004660a9
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x419433
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x419444
push ebx
call fcn.004660bb
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x466d10
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x466d79
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.00466a80
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret

Function at 0x467ae0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x467afe
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x467af3
pop esi
ret
Function at 0x469990
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x144
push ebx
mov ebx, dword [esp + 0x14c]
push ebp
mov ebp, dword [esp + 0x15c]
push esi
push edi
mov esi, dword [ebp]
mov dword [esp + 0x10], 0
test ebx, ebx
je 0x469a1b
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x469a1b
test esi, esi
je 0x4699d5
cmp esi, 0xffffffff
je 0x4699d5
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x14]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebp], esi
je 0x469a61
mov eax, dword [esp + 0x160]
test eax, eax
je 0x469a04
mov ecx, dword [esp + 0x14]
and ecx, 0x10
cmp cl, 0x10
je 0x469a1b
jmp 0x469a13
mov edx, dword [esp + 0x15c]
mov eax, dword [esp + 0x14]
test edx, eax
je 0x469a1b
mov dword [esp + 0x10], 1
test esi, esi
je 0x469a61
cmp esi, 0xffffffff
je 0x469a61
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x469a98
mov eax, dword [esp + 0x160]
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
lea eax, [esp + 0x14]
push eax
push esi
je 0x469a6e
call edi
test eax, eax
je 0x469a61
mov ecx, dword [esp + 0x14]
and ecx, 0x10
cmp cl, 0x10
jne 0x469a98
lea edx, [esp + 0x14]
push edx
push esi
call edi
test eax, eax
jne 0x469a49
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x144
ret
call edi
test eax, eax
je 0x469a61
mov ebx, dword [esp + 0x15c]
test dword [esp + 0x14], ebx
jne 0x469a98
lea ecx, [esp + 0x14]
push ecx
push esi
call edi
test eax, eax
jne 0x469a7b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x144
ret
lea edi, [esp + 0x40]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.00466a80
mov edx, eax
lea edi, [esp + 0x44]
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x144
ret
Function at 0x469c30
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x14]
test esi, esi
jne 0x469c43
xor eax, eax
pop esi
add esp, 8
ret
push esi
call fcn.0046d7a0
add esp, 4
test eax, eax
jne 0x469c55
pop esi
add esp, 8
ret
mov eax, dword [esi]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push edi
mov dword [esp + 0x10], 0
jne 0x469ccc
mov eax, dword [esp + 0x1c]
mov edi, dword [esi + 4]
cmp eax, ebx
mov dword [esp + 0x10], ebx
jle 0x469cfe
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x469cb8
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x469c88
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 8
ret
pop edi
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
pop ebp
pop ebx
pop esi
add esp, 8
ret
cmp eax, 2
jne 0x469cfe
mov eax, dword [esp + 0x1c]
mov esi, dword [esi + 4]
cmp eax, ebx
mov dword [esp + 0x10], ebx
jle 0x469cfe
lea edi, [esp + 0x2c]
lea ebx, [eax - 1]
mov eax, dword [edi]
mov edx, dword [esi]
mov ecx, dword [eax + 4]
add eax, 8
push ecx
push eax
mov ecx, esi
call dword [edx + 0x24]
add edi, 0xc
dec ebx
jne 0x469ce7
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 8
ret
Function at 0x469d70
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x1010
call fcn.0046f220
mov eax, dword [esp + 0x1014]
push ebx
push ebp
mov ebp, dword [esp + 0x1020]
push esi
push edi
xor edi, edi
push 1
push edi
push edi
push eax
mov dword [ebp], edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
je 0x469e72
jmp 0x469daf
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x1024]
xor esi, esi
lea ecx, [esp + 0x18]
push esi
push ecx
lea edx, [esp + 0x28]
push 0x1000
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x469e8f
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], esi
cmp eax, esi
jbe 0x469dfb
mov cl, byte [esp + esi + 0x20]
test cl, cl
je 0x469df2
inc esi
cmp esi, eax
jb 0x469de3
jmp 0x469dfb
inc esi
mov dword [esp + 0x14], 1
mov eax, dword [ebp]
mov ebx, edi
add edi, esi
test eax, eax
mov dword [esp + 0x1c], edi
je 0x469e17
inc edi
push edi
push eax
call fcn.00466ad0
add esp, 8
jmp 0x469e21
inc edi
push edi
call fcn.00466a80
add esp, 4
mov edi, eax
lea ecx, [esp + 0x20]
add edi, ebx
push esi
push ecx
push edi
mov dword [ebp], eax
call fcn.0046f120
mov eax, dword [esp + 0x20]
add esp, 0xc
test eax, eax
mov byte [edi + esi], 0
jne 0x469ea8
cmp dword [esp + 0x18], 0x1000
jb 0x469edb
mov edx, dword [esp + 0x1024]
push 1
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x469dab
mov eax, dword [esp + 0x102c]
pop edi
pop esi
pop ebp
mov dword [eax], 0
mov eax, 1
pop ebx
add esp, 0x1010
ret
mov ecx, dword [esp + 0x102c]
pop edi
mov eax, 1
mov dword [ecx], esi
pop esi
pop ebp
pop ebx
add esp, 0x1010
ret
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x1024]
push 0
add esi, edx
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esp + 0x102c]
pop edi
pop esi
pop ebp
mov dword [ecx], 1
xor eax, eax
pop ebx
add esp, 0x1010
ret
mov edx, dword [esp + 0x102c]
pop edi
pop esi
pop ebp
mov dword [edx], 1
mov eax, 1
pop ebx
add esp, 0x1010
ret

Function at 0x469f00
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esp + 0x18]
push 4
push ecx
push edi
mov dword [esi], 0
call ebx
test eax, eax
je 0x469f8c
cmp dword [esp + 0x14], 4
jb 0x469f8c
mov edx, dword [esp + 0x10]
add edx, 8
push edx
call fcn.00466a80
mov edx, dword [esp + 0x14]
add esp, 4
lea ecx, [esp + 0x14]
mov dword [esi], eax
push 0
push ecx
add eax, 8
push edx
push eax
push edi
call ebx
test eax, eax
je 0x469f7b
mov esi, dword [esi]
mov dword [esi], 1
mov eax, dword [esp + 0x14]
mov dword [esi + 4], eax
mov ecx, dword [esp + 0x14]
cmp ecx, dword [esp + 0x10]
jne 0x469f8c
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov edx, dword [esi]
push edx
call fcn.00466b10
add esp, 4
mov dword [esi], 0
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x46a710
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
test ebx, ebx
push edi
jne 0x46a723
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push ebx
call fcn.0046d7a0
add esp, 4
test eax, eax
jne 0x46a735
pop edi
pop esi
pop ebp
pop ebx
ret
mov edi, dword [esp + 0x24]
test edi, edi
jg 0x46a744
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, dword [ebx]
xor esi, esi
cmp eax, 1
jne 0x46a79b
mov ebx, dword [ebx + 4]
push edi
call fcn.0047a5ab
add esp, 4
mov ebp, eax
lea eax, [esp + 0x18]
push esi
push eax
push edi
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x46a77e
push ebp
call fcn.0047a5d4
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0x18]
push ecx
push ebp
call fcn.0046d090
push ebp
mov esi, eax
call fcn.0047a5d4
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
cmp eax, 2
jne 0x46a7dd
mov ebx, dword [ebx + 4]
lea edx, [edi + 8]
push edx
call fcn.00466a80
mov esi, eax
add esp, 4
lea ecx, [esi + 8]
mov dword [esi], 1
mov dword [esi + 4], edi
mov eax, dword [ebx]
push edi
push ecx
mov ecx, ebx
call dword [eax + 0x20]
test eax, eax
jne 0x46a7da
push esi
call fcn.00466b10
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov dword [esi + 4], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x47cf78
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x47cfba
call fcn.004802d2
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x47cfba
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x47cfb1
xor eax, eax
jmp 0x47cfc2
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0047cfc8
pop edi
pop esi
pop ebx
ret 4

Function at 0x47df58
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x481b98
call fcn.0046ff0c
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
mov eax, dword [esi + 0x48]
mov edi, dword [esi + 0x44]
mov dword [ebp - 0x18], eax
call fcn.004802d2
cmp dword [esi + 0x40], 0
mov ebx, dword [eax + 0xc]
je 0x47df97
call fcn.004802d2
mov ebx, dword [eax + 0xc]
push 5
push dword [esi + 0x40]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x47dfa5
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x47dfb3
or eax, 0xffffffff
jmp 0x47e09b
mov ecx, esi
call fcn.0047dece
mov dword [ebp - 0x14], eax
call fcn.0047b5c0
xor edi, edi
cmp dword [ebp - 0x14], edi
mov dword [ebp - 0x20], edi
je 0x47dfea
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x47dfea
push edi
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x20], 1
push esi
mov dword [ebp - 4], edi
call fcn.0047b574
push dword [ebp - 0x14]
call fcn.0047b0a6
push ebx
push eax
push dword [ebp - 0x18]
mov ecx, esi
call fcn.0047dc66
cmp eax, edi
je 0x47e05d
test byte [esi + 0x24], 0x10
je 0x47e02b
push 4
mov ecx, esi
pop ebx
call fcn.0047aaa6
test ah, 1
je 0x47e023
push 5
pop ebx
push ebx
mov ecx, esi
call fcn.0047d0ca
cmp dword [esi + 0x1c], edi
je 0x47e05d
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.0047aada
jmp 0x47e05d
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], edi
je 0x47e071
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x47e08a
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x1c]
jne 0x47e08a
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
mov ecx, esi
call fcn.0047df08
mov eax, dword [esi + 0x2c]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x47fe3f
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x47fe6d
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x47fe8b
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0047fda5
jmp 0x47fe8b
mov eax, dword [esi + 0x14]
test eax, eax
je 0x47fe8b
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0047fda5
test edi, edi
mov eax, edi
jne 0x47fe75
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x402050
Capabilities:
Check if file exists

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x4020b1
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4020b1
cmp dword [esp + 0xc], 0
jne 0x402095
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.00401700
add esp, 4
test eax, eax
je 0x402095
mov eax, 0x5358e8
call fcn.00402ac0
test eax, eax
je 0x402095
mov eax, 1
pop ebx
ret 8
lea eax, [esp + 8]
push eax
push ebx
mov ecx, 0x536e28
mov dword [esp + 0x10], 0
call fcn.00401a10
pop ebx
ret 8
xor eax, eax
pop ebx
ret 8

Function at 0x402990
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
sub esp, 0x214
mov eax, dword [0x533a94]
xor eax, esp
mov dword [esp + 0x210], eax
push 0x208
lea eax, [esp + 0xc]
push 0
push eax
call fcn.004c1bc0
add esp, 0xc
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 8]
push eax
push 0x517de4
push 0x517df0
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1c], 0x208
mov dword [esp + 0x18], 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x402a07
xor eax, eax
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.004c1753
add esp, 0x214
ret
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4029f0
lea eax, [esp + 8]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402a20
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0xc]
push edx
lea ecx, [esi + 0x24]
call fcn.00402dc0
mov ecx, dword [esp + 0x210]
xor ecx, esp
mov eax, 1
call fcn.004c1753
add esp, 0x214
ret
Function at 0x40afb0
Capabilities:
Encode data using xor

Disassembly:
push esi
popal
cmp esp, dword [eax + 0x546003a3]
popal
inc ebx
mov al, byte [0x9162609d]
popal
add esp, eax
push esp
loope 0x40b009
sbb byte [ebx - 0x20], 7
inc esp
add eax, dword [eax]
add ecx, edx
in al, 0x90
pop esp
bound eax, qword [ecx]
or al, 0x89
loopne 0x40afdb
inc esp
nop
loope 0x40b043
add byte [eax], al
add dword [eax + 0xf], esp
pop edi
adc cl, 0x60
arpl word [eax], ax
sbb al, byte [eax + 0x36]
loope 0x40b040
add al, ah
push es
add byte [ebx], bl
loopne 0x40affa
inc eax
sub al, byte [eax]
loope 0x40b046
jecxz 0x40affa
add eax, dword [eax]
push ebp
fsub qword [eax + 0x4007e013]
add byte [ebp - 0x24], dl
mov al, byte [0x4007e013]
add al, ah
pop es
push ebp
pushal
sbb dword [eax], eax
xchg edi, eax
aam 0
or byte [eax + 1], ah
stosb byte es:[edi], al
loope 0x40b013
add dword [ebp + 0x59df80e0], 0xa0aae280
add ecx, esp
add ch, byte [bp + si + 0xa60]
stosb byte es:[edi], al
jnp 0x40afe6
test eax, esp
sbb bh, 0x59
and dl, 0xaa
mov al, byte [0x267e101]
stosb byte es:[edi], al
pushal
or ch, byte [edx - 0x1cb83f85]
push es
inc edi
jecxz 0x40b02f
add eax, 0xe80206e2
pushal
add cl, 0x4c
add bh, ch
jo 0x40b078
push dword [ecx + 0x34]
ret 0xb17a
add byte [edx + 0xa72ef3d], dh
out dx, eax
jb 0x40b050
invalid
ja 0x40b0c2
feni8087_nop
invalid
add cl, byte [eax + esi*4]
add ebx, dword [edx - 0x56]
lock add dword [eax + esi*4 + 9], eax
mov cl, 0xe
add eax, 0xf40004b2
add dh, dh
clc
add ah, ah
jno 0x40b0a2
ret
int1
add eax, 0x49710171
mov ebx, 0x1bb300b5
cli
mov dl, 3
add dword [ebp + 0x260171], ecx
sbb dword [0xb3f03cf0], edx
add cl, byte [eax]
jo 0x40b0c6
inc dword [eax + 0x3002c2d]
sub eax, 0xc003002c
xchg ecx, eax
ror dword [ebx + 0x1030ff], 4
pop ss
rcl byte [ecx + 0x30ff8bc1], 0x10
add byte [edi + edx], al
invalid
Function at 0x40df20
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fcac0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x533a94]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, dword [0x537ab8]
xor edi, edi
cmp ecx, edi
jne 0x40df6b
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
jne 0x40df78
mov dword [ebp - 0x14], edi
jmp 0x40df90
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x14], eax
cmp eax, edi
jne 0x40e026
mov ecx, dword [0x537ab8]
mov eax, dword [ecx]
cmp eax, edi
je 0x40df57
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40df57
mov ebx, 0x537ab8
mov dword [ebp - 4], edi
call fcn.0040e040
mov esi, eax
mov dword [ebp - 0x14], esi
cmp esi, edi
jne 0x40dfce
push 0x51fe48
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], 1
call fcn.004c2448
mov ecx, dword [0x537ab8]
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
je 0x40dfe8
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp eax, edi
jne 0x40e012
push 0x51fe48
lea edx, [ebp - 0x1c]
push edx
mov dword [ebp - 0x1c], 4
call fcn.004c2448
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x40e009
call fcn.0040e480
mov eax, 0x40e00f
ret
mov eax, dword [0x537ab8]
mov eax, dword [eax]
test eax, eax
je 0x40e024
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40e040
Capabilities:
Print debug messages

Disassembly:
sub esp, 8
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov ecx, dword [eax + 0x5b0]
add eax, 8
mov dword [eax + 0x5b0], ecx
cmp ecx, eax
jne 0x40e06d
xor ecx, ecx
jmp 0x40e079
mov edx, dword [ecx + 0x5a8]
mov dword [eax + 0x5b0], edx
push esi
mov esi, ecx
test ecx, ecx
je 0x40e12d
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenThread]
mov eax, dword [esi]
cmp dword [esp + 0x10], eax
jne 0x40e0a0
mov dword [esp + 0xc], esi
jmp 0x40e100
push eax
push 1
push 0x40
call edi
test eax, eax
jne 0x40e0f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40e0ec
mov eax, dword [esi + 0x5ac]
mov ecx, dword [esi + 0x5a8]
mov dword [eax + 0x5a8], ecx
mov edx, dword [esi + 0x5a8]
mov eax, dword [esi + 0x5ac]
mov dword [edx + 0x5ac], eax
call ebp
test eax, eax
je 0x40e100
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x40e100
push 0x518788
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x40e100
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebx]
mov esi, dword [eax + 0x5b8]
add eax, 8
cmp esi, eax
je 0x40e123
mov ecx, dword [esi + 0x5a8]
mov dword [eax + 0x5b0], ecx
test esi, esi
jne 0x40e092
mov eax, dword [esp + 0xc]
pop edi
pop ebp
test eax, eax
jne 0x40e141
mov ecx, dword [ebx]
add ecx, 8
call fcn.0040e3b0
test eax, eax
je 0x40e141
mov edx, dword [esp + 8]
mov dword [eax], edx
pop esi
add esp, 8
ret

Function at 0x40e150
Capabilities:
Allocate thread local storage

Disassembly:
push 0xffffffffffffffff
push 0x4fcb4b
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x533a94]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1c]
lea esi, [edi + 8]
push 0x5a0
lea eax, [esi + 8]
push 0
mov dword [edi], 0
mov dword [edi + 4], 0xffffffff
push eax
mov dword [esi], 0
call fcn.004c1bc0
add esp, 0xc
mov dword [esi + 0x5ac], esi
mov dword [esi + 0x5a8], esi
mov dword [esi + 0x5b0], esi
mov dword [esp + 0x14], 0
mov dword [edi + 0x5bc], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [edi + 4], eax
cmp eax, 0xffffffff
jne 0x40e1e8
push 0x51fe48
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28], 2
call fcn.004c2448
mov ecx, dword [esp + 0x20]
mov dword [edi], ecx
mov eax, edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 8