joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Allocate thread local storage

Disassembly:
push 0x94
push 0
push 0x4418fc
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x441900], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x4418fc], eax
mov eax, str.DownloadFile
mov dword [0x441914], eax
call fcn.00411ef0
call fcn.00411481
call fcn.00410812
call fcn.004100c1
call fcn.0040ecf8
call fcn.0040ebea
call fcn.0040d970
call fcn.0040d0f9
call fcn.0040cfc1
call fcn.0040b9b2
call fcn.0040923f
call fcn.00408dbd
call fcn.00408aa6
call fcn.004087e0
call fcn.0040819b
call fcn.00407fad
call fcn.004072b3
push dword [0x441988]
call fcn.00408ac5
push 7
push 0x42bef8
lea eax, [0x441988]
push eax
push 0xc
call fcn.00408a14
push 0x441978
push 0x42bee8
push 8
push 3
push 4
call fcn.0040eb59
push 0x441978
push 0x42bee8
push 8
push 3
push 4
call fcn.0040eb59
push 0x441980
push 0x42bee8
push 8
push 0x1f
push 4
call fcn.0040eb59
call fcn.00411f40
push eax
call fcn.00401620
push 0x44194c
call fcn.00411f60
call fcn.00402280
call fcn.004028f4
call fcn.00402837
push 0
call fcn.00401161
call fcn.00411f20
push dword [0x4418fc]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess

Function at 0x404f62
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov edx, 0x4d
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x404f68
call fcn.00411ff0
mov edx, dword [esp + 0x13c]
lea ecx, [esp]
call fcn.00407000
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
je 0x40505b
lea ebp, [esp + 8]
mov dword [ebp], 0x128
lea eax, [esp + 8]
push eax
push dword [esp + 8]
call sub.KERNEL32.dll_Process32First
and eax, eax
je 0x405052
call fcn.00411f40
push eax
push eax
push dword [esp + 8]
call fcn.004076d0
call fcn.004120f0
call fcn.00411f40
push eax
push eax
call fcn.00411f40
push eax
push eax
push 0x104
lea ebp, [esp + 0x20]
lea eax, [ebp + 0x24]
push eax
call fcn.00408850
call fcn.00412132
add dword [esp], edx
call fcn.004076d0
call fcn.00412210
mov edx, eax
call fcn.00412210
mov ecx, eax
call fcn.004121b0
je 0x40502f
lea ebp, [esp + 8]
mov eax, dword [ebp + 8]
mov dword [esp + 0x130], eax
jmp 0x405052
lea eax, [esp + 8]
push eax
push dword [esp + 8]
call sub.KERNEL32.dll_Process32Next
and eax, eax
je 0x405045
xor eax, eax
jmp 0x40504a
mov eax, 1
and eax, eax
je 0x404fc8
push dword [esp + 4]
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [esp + 0x130]
jmp 0x405066
push dword [esp]
call fcn.00412180
add esp, 0x134
pop ebp
ret 4

Function at 0x407301
Capabilities:
Suspend thread

Disassembly:
push dword [esp + 4]
call fcn.00407269
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
ret 4

Function at 0x407314
Capabilities:
Resume thread

Disassembly:
push dword [esp + 4]
call fcn.00407269
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
ret 4
Function at 0x407327
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
xor esi, esi
push esi
push dword [esp + 0x14]
push dword [esp + 0x14]
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esp + 0xc], eax
je 0x4073bf
push ebx
push ebp
mov ebp, 0x441e94
push ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x4419bc]
test esi, esi
mov ebx, 0x4419bc
je 0x407397
push edi
push 0
lea edi, [esi + 8]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x407390
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esi]
push edi
push ebx
call fcn.00411e80
pop ecx
pop ecx
jmp 0x407392
mov esi, dword [esi]
test esi, esi
jne 0x40736a
pop edi
mov esi, dword [0x43fcb8]
inc dword [0x43fcb8]
push 0x10
push ebx
call fcn.00411ec0
pop ecx
pop ecx
mov ecx, dword [esp + 0x14]
push ebp
mov dword [eax], ecx
mov dword [eax + 4], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebp
pop ebx
mov eax, esi
pop esi
ret 8

Function at 0x408097
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
xor ebx, ebx
cmp dword [esp + 8], ebx
push esi
push edi
je 0x4080e6
push dword [esp + 0x10]
push 0x408013
call dword [sym.imp.USER32.DLL_EnumWindows]
mov esi, dword [0x4419c0]
cmp esi, ebx
je 0x40813a
mov edi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x4080de
cmp byte [esi + 0x10], bl
je 0x4080de
push 3
push ebx
push ebx
push ebx
push ebx
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
cmp edi, ebx
mov esi, edi
jne 0x4080bb
jmp 0x40813a
mov esi, dword [0x4419c0]
cmp esi, ebx
je 0x40813a
push ebp
mov ebp, dword [esi]
lea edi, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi], eax
jne 0x408133
cmp byte [esi + 0x11], bl
je 0x408110
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_EnableWindow]
cmp byte [esi + 0x10], bl
je 0x408126
push 3
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
push edi
push 0x4419c0
call fcn.00411e80
pop ecx
pop ecx
cmp ebp, ebx
mov esi, ebp
jne 0x4080f1
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x40c7f0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
call dword [sym.imp.USER32.DLL_GetFocus]
mov esi, dword [sym.imp.USER32.DLL_GetKeyState]
mov edi, eax
test edi, edi
mov bl, pe_nt_image_headers32
je 0x40c86b
push 9
call esi
test bl, al
je 0x40c86b
push 0x11
call esi
test bl, al
jne 0x40c86b
push 0x10
call esi
test bl, al
jne 0x40c86b
push 0x12
call esi
test bl, al
jne 0x40c86b
push 5
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.USER32.DLL_GetClassNameA]
push 4
lea eax, [esp + 0x14]
push str.Rich
push eax
call sub.MSVCRT.dll_strncmp
add esp, 0xc
test eax, eax
jne 0x40c86b
push eax
push eax
push 0x44e
push edi
call dword [sym.imp.USER32.DLL_SendMessageA]
test ax, 0x800
jne 0x40c86b
xor eax, eax
jmp 0x40c8ed
push ebp
mov ebp, dword [esp + 0x20]
test ebp, ebp
je 0x40c894
push 0x11
call esi
test bl, al
jne 0x40c88c
push 0x10
call esi
test bl, al
jne 0x40c88c
push 0x12
call esi
test bl, al
je 0x40c894
push 1
push ebp
call fcn.0040c79e
test edi, edi
mov esi, dword [sym.imp.USER32.DLL_GetPropA]
je 0x40c8aa
push str.PB_Hotkey
push edi
call esi
test eax, eax
jne 0x40c8ea
push str.PB_WindowID
push ebp
call esi
mov esi, eax
test esi, esi
je 0x40c8ea
lea eax, [esp + 0x10]
push eax
push ebp
call dword [sym.imp.USER32.DLL_GetWindowThreadProcessId]
test eax, eax
je 0x40c8ea
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x10], eax
jne 0x40c8ea
dec esi
push esi
push dword [0x441efc]
call fcn.0041164f
test eax, eax
je 0x40c8ea
mov eax, dword [eax + 8]
jmp 0x40c8ec
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x40d662
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x248
push esi
or esi, 0xffffffff
test eax, eax
push edi
mov edi, esi
je 0x40d79c
cmp byte [eax], 0
je 0x40d79c
push 0x104
push eax
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strncpy
lea eax, [ebp - 0x108]
push eax
mov byte [ebp - 4], 0
call sub.MSVCRT.dll_strlen
add esp, 0x10
cmp eax, 2
lea ecx, [ebp + eax - 0x109]
je 0x40d6bc
cmp eax, 3
jne 0x40d6fc
cmp byte [ebp - 0x107], 0x3a
jne 0x40d6fc
cmp eax, 2
jne 0x40d6dd
lea eax, [ebp - 0x108]
push 0x42523c
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 1
jbe 0x40d79c
jmp 0x40d799
mov byte [ecx], 0
dec ecx
cmp byte [ecx], 0x5c
je 0x40d6f8
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x40d748
test byte [ebp - 0x248], 0x10
je 0x40d72b
push 0xfffffffffffffffe
pop edi
or esi, 0xffffffff
jmp 0x40d73f
mov ecx, dword [ebp - 0x228]
mov esi, dword [ebp - 0x22c]
xor edi, edi
xor edx, edx
or edi, ecx
or esi, edx
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x40d79c
cmp byte [ebp - 0x108], 0x5c
jne 0x40d75a
cmp byte [ebp - 0x107], 0x5c
je 0x40d76c
cmp byte [ebp - 0x108], 0x2e
jne 0x40d79c
cmp byte [ebp - 0x107], 0x2e
jne 0x40d79c
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40d784
test al, 0x10
je 0x40d79c
jmp 0x40d796
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 1
jbe 0x40d79c
or esi, 0xffffffff
push 0xfffffffffffffffe
pop edi
mov eax, edi
pop edi
mov edx, esi
pop esi
leave
ret 4

Function at 0x40d817
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
cmp dword [ebp + 8], 0
je 0x40d88a
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strncpy
lea eax, [ebp - 0x108]
push eax
mov byte [ebp - 4], 0
call sub.MSVCRT.dll_strlen
add esp, 0x10
lea eax, [ebp + eax - 0x108]
jmp 0x40d86c
lea ecx, [eax - 1]
mov dl, byte [ecx]
cmp dl, 0x20
je 0x40d86a
cmp dl, 0x5c
je 0x40d86a
cmp dl, 0x2f
jne 0x40d876
mov eax, ecx
lea ecx, [ebp - 0x108]
cmp eax, ecx
ja 0x40d856
mov byte [eax], 0
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x40d88c
xor eax, eax
leave
ret 4

Function at 0x40d8c0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
cmp dword [esi + 0x14], eax
mov dword [esp + 4], eax
jne 0x40d8f5
mov ecx, dword [esi + 8]
sub ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push eax
lea eax, [esp + 8]
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esi + 8]
mov eax, dword [esp + 4]
mov dword [esi + 0xc], ecx
pop esi
pop ecx
ret 4
Function at 0x40db10
Capabilities:
Write file on windows

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0x10]
xor eax, eax
test edi, edi
mov dword [esp + 4], eax
je 0x40db69
push esi
mov esi, dword [esp + 0x18]
test esi, esi
je 0x40db68
mov eax, dword [esp + 0x10]
mov ecx, dword [0x441f14]
push eax
push ecx
call fcn.0041164f
test eax, eax
je 0x40db64
cmp dword [eax + 4], 0
je 0x40db52
push esi
push edi
push eax
call fcn.0040e1f0
pop esi
pop edi
pop ecx
ret 0xc
mov eax, dword [eax]
push 0
lea edx, [esp + 0xc]
push edx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop esi
pop edi
pop ecx
ret 0xc

Function at 0x40dbc0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x14]
push ebx
push ebp
push edi
push eax
push 0x1000
mov dword [esp + 0x1c], 0x1000
call fcn.004124b0
mov ecx, dword [esp + 0x1c]
mov edx, dword [0x441f14]
push ecx
mov edi, eax
push edx
mov ebp, edi
call fcn.0041164f
mov ebx, eax
test ebx, ebx
je 0x40dcde
push esi
lea ecx, [ecx]
mov byte [esp + 0x13], 0
cmp dword [ebx + 4], 0
je 0x40dc1e
push 1
lea eax, [esp + 0x17]
push eax
push ebx
call fcn.0040e2f0
mov dword [esp + 0x14], eax
jmp 0x40dc35
mov eax, dword [ebx]
push 0
lea ecx, [esp + 0x18]
push ecx
push 1
lea edx, [esp + 0x1f]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov al, byte [esp + 0x13]
test al, al
je 0x40dc47
mov byte [ebp], al
mov al, byte [esp + 0x13]
add ebp, 1
mov ecx, dword [esp + 0x18]
mov esi, ebp
sub esi, edi
cmp esi, ecx
jl 0x40dc71
mov edx, dword [esp + 0x24]
add ecx, 0x1000
push edx
push ecx
mov dword [esp + 0x20], ecx
call fcn.004124b0
mov edi, eax
mov al, byte [esp + 0x13]
lea ebp, [esi + edi]
test al, al
je 0x40dcdd
cmp dword [esp + 0x14], 0
je 0x40dc88
cmp al, 0xd
je 0x40dc88
cmp al, 0xa
jne 0x40dc00
sub ebp, 1
cmp al, 0xd
jne 0x40dcdd
cmp dword [ebx + 4], 0
je 0x40dca4
push 1
lea eax, [esp + 0x17]
push eax
push ebx
call fcn.0040e2f0
jmp 0x40dcbb
mov eax, dword [ebx]
push 0
lea ecx, [esp + 0x18]
push ecx
push 1
lea edx, [esp + 0x1f]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [esp + 0x13], 0xa
je 0x40dcdd
cmp dword [ebx + 4], 0
je 0x40dcce
add dword [ebx + 0xc], 1
jmp 0x40dcdd
mov ecx, dword [ebx]
push 1
push 0
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
pop esi
sub edi, ebp
add edi, dword [esp + 0x14]
mov byte [ebp], 0
push edi
call fcn.00412620
pop edi
pop ebp
pop ebx
add esp, 0xc
ret 8

Function at 0x40dd00
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov ecx, dword [0x441f14]
push eax
push ecx
mov dword [esp + 8], 0
call fcn.0041164f
test eax, eax
je 0x40dd4a
cmp dword [eax + 4], 0
lea edx, [esp]
je 0x40dd37
push 4
push edx
push eax
call fcn.0040e2f0
mov eax, dword [esp]
pop ecx
ret 4
mov eax, dword [eax]
push 0
lea ecx, [esp + 0xc]
push ecx
push 4
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp]
pop ecx
ret 4
Function at 0x40dd60
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov ecx, dword [0x441f14]
push eax
push ecx
mov byte [esp + 0xb], 0
call fcn.0041164f
test eax, eax
je 0x40ddaa
cmp dword [eax + 4], 0
lea edx, [esp + 3]
je 0x40dd97
push 1
push edx
push eax
call fcn.0040e2f0
movsx eax, byte [esp + 3]
pop ecx
ret 4
mov eax, dword [eax]
push 0
lea ecx, [esp + 0xc]
push ecx
push 1
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
movsx eax, byte [esp + 3]
pop ecx
ret 4

Function at 0x40dfb0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov ecx, dword [0x441f14]
push eax
push ecx
mov dword [esp + 8], 0
call fcn.0041164f
test eax, eax
je 0x40e002
cmp dword [eax + 4], 0
je 0x40dfe8
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push edx
push ecx
push eax
call fcn.0040e2f0
pop ecx
ret 0xc
mov ecx, dword [esp + 0x10]
mov eax, dword [eax]
push 0
lea edx, [esp + 4]
push edx
mov edx, dword [esp + 0x14]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp]
pop ecx
ret 0xc

Function at 0x40e070
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
mov ecx, dword [0x441f14]
push esi
push eax
push ecx
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.0041164f
mov esi, eax
test esi, esi
je 0x40e142
mov ecx, dword [esp + 0x14]
test ecx, ecx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
je 0x40e0fa
cmp byte [ecx], 0
je 0x40e0fa
cmp dword [esi + 4], 0
mov eax, ecx
push edi
lea edi, [eax + 1]
je 0x40e0e0
nop
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x40e0c0
sub eax, edi
push eax
push ecx
push esi
call fcn.0040e1f0
mov dword [esp + 0xc], eax
jmp 0x40e0f9
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x40e0e0
push 0
lea edx, [esp + 0x10]
push edx
sub eax, edi
push eax
mov eax, dword [esi]
push ecx
push eax
call ebp
pop edi
cmp dword [esi + 4], 0
je 0x40e11d
push 2
push 0x425264
push esi
call fcn.0040e1f0
mov ecx, eax
mov eax, dword [esp + 8]
pop ebp
add eax, ecx
pop esi
add esp, 8
ret 8
mov edx, dword [esi]
push 0
lea ecx, [esp + 0x10]
push ecx
push 2
push 0x425264
push edx
call ebp
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
pop ebp
add eax, ecx
pop esi
add esp, 8
ret 8
mov eax, dword [esp + 4]
pop esi
add esp, 8
ret 8

Function at 0x40e150
Capabilities:
Write file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov ecx, dword [0x441f14]
push eax
push ecx
mov dword [esp + 8], 0
call fcn.0041164f
test eax, eax
je 0x40e198
cmp dword [eax + 4], 0
lea edx, [esp + 0xc]
je 0x40e185
push 4
push edx
push eax
call fcn.0040e1f0
pop ecx
ret 8
mov eax, dword [eax]
push 0
lea ecx, [esp + 4]
push ecx
push 4
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp]
pop ecx
ret 8
Function at 0x40e1a0
Capabilities:
Write file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov ecx, dword [0x441f14]
push eax
push ecx
mov dword [esp + 8], 0
call fcn.0041164f
test eax, eax
je 0x40e1e8
cmp dword [eax + 4], 0
lea edx, [esp + 0xc]
je 0x40e1d5
push 1
push edx
push eax
call fcn.0040e1f0
pop ecx
ret 8
mov eax, dword [eax]
push 0
lea ecx, [esp + 4]
push ecx
push 1
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp]
pop ecx
ret 8

Function at 0x40e1f0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
cmp dword [esi + 0x14], 1
push edi
mov dword [esp + 8], 0
jne 0x40e225
mov eax, dword [esi + 0xc]
mov ecx, dword [esi]
push 1
push 0
neg eax
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], edx
mov ecx, dword [esi + 0xc]
mov edi, dword [esp + 0x18]
cmp ecx, edi
jle 0x40e29e
mov eax, dword [esi + 8]
add eax, dword [esi + 4]
sub eax, ecx
mov ecx, edi
sub ecx, 1
je 0x40e28b
sub ecx, 1
je 0x40e276
sub ecx, 2
je 0x40e263
mov ecx, dword [esp + 0x14]
push edi
push ecx
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov ecx, dword [edx]
mov dword [eax], ecx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov cx, word [edx]
mov word [eax], cx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov cl, byte [edx]
mov byte [eax], cl
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
push esi
call fcn.0040d8c0
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x40e2cb
mov eax, dword [esp + 0x14]
mov ecx, dword [esi]
push 0
lea edx, [esp + 0xc]
push edx
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
mov ecx, dword [esi + 4]
sub ecx, dword [esi + 0xc]
mov edx, dword [esp + 0x14]
push edi
push edx
add ecx, eax
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
Function at 0x40e2f0
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
cmp dword [esi + 0x14], 0
push edi
jne 0x40e311
push esi
call fcn.0040d8c0
mov dword [esi + 0x14], 1
mov dword [esi + 0xc], 0
mov ebx, dword [esi + 0xc]
mov edi, dword [esp + 0x18]
cmp ebx, edi
jl 0x40e38a
mov eax, dword [esi + 0x10]
add eax, dword [esi + 4]
mov ecx, edi
sub eax, ebx
sub ecx, 1
je 0x40e377
sub ecx, 1
je 0x40e362
sub ecx, 2
je 0x40e34f
push edi
push eax
mov eax, dword [esp + 0x1c]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [eax]
mov edx, dword [esp + 0x14]
mov dword [edx], ecx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ebx
ret 0xc
mov ax, word [eax]
mov ecx, dword [esp + 0x14]
mov word [ecx], ax
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ebx
ret 0xc
mov dl, byte [eax]
mov eax, dword [esp + 0x14]
mov byte [eax], dl
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [esi + 0x10]
push ebp
mov ebp, dword [esp + 0x18]
sub ecx, ebx
add ecx, dword [esi + 4]
push ebx
push ecx
push ebp
call sub.MSVCRT.dll_memcpy
mov eax, dword [esi + 8]
add esp, 0xc
sub edi, ebx
add ebp, ebx
cmp edi, eax
push 0
jl 0x40e3d3
mov eax, dword [esi]
lea edx, [esp + 0x18]
push edx
push edi
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
pop ebp
pop edi
mov dword [esi + 0xc], 0
pop esi
add eax, ebx
pop ebx
ret 0xc
mov edx, dword [esi + 4]
lea ecx, [esp + 0x18]
push ecx
push eax
mov eax, dword [esi]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
cmp edi, eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
jle 0x40e3f6
mov edi, eax
mov ecx, dword [esi + 4]
push edi
push ecx
push ebp
call sub.MSVCRT.dll_memcpy
sub dword [esi + 0xc], edi
add esp, 0xc
pop ebp
lea eax, [ebx + edi]
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x40fe0c
Capabilities:
Set thread local storage value

Disassembly:
push esi
push 0xe8
push 8
push dword [0x4418fc]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
push esi
push dword [0x441f6c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [0x441f70], esi
and dword [esi + 0x88], 0
or dword [esi + 0x8c], 0xffffffff
or dword [esi + 0x90], 0xffffffff
mov dword [esi + 0x84], 0xffffff
mov dword [esi + 0x6c], 1
mov dword [esi + 0x70], 7
mov dword [esi], 0x40ef17
mov dword [esi + 4], 0x40efce
mov dword [esi + 8], 0x40f061
mov dword [esi + 0xc], 0x40f0db
mov dword [esi + 0x10], 0x40f133
mov dword [esi + 0x14], 0x40f18b
mov dword [esi + 0x18], 0x40f1c9
mov dword [esi + 0x1c], 0x40f1e1
mov dword [esi + 0x20], fcn.0040f1f9
mov dword [esi + 0x24], 0x40f4d1
mov dword [esi + 0x28], fcn.0040f348
mov dword [esi + 0x2c], 0x40f4ed
mov dword [esi + 0x30], 0x40f5cf
mov dword [esi + 0x34], 0x40f6fa
mov dword [esi + 0x38], 0x40f09e
mov dword [esi + 0x3c], 0x40f79b
mov dword [esi + 0x40], 0x40ef35
mov dword [esi + 0x44], 0x40f83c
mov dword [esi + 0x48], 0x40f920
mov dword [esi + 0x4c], 0x40f96f
mov dword [esi + 0x50], 0x40fa2f
mov dword [esi + 0x54], 0x40fbb7
mov dword [esi + 0x58], 0x40fcf9
mov dword [esi + 0x5c], 0x40fda2
mov dword [esi + 0x60], 0x40fcb8
mov dword [esi + 0x64], 0x40fc71
mov eax, esi
pop esi
ret

Function at 0x410812
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x94
push edi
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor edi, edi
cmp eax, edi
mov dword [0x441e24], eax
je 0x410845
push str.AlphaBlend
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x441e28], eax
lea eax, [ebp - 0x1c]
push eax
mov dword [0x441e20], 1
mov dword [ebp - 0x1c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x410883
cmp dword [ebp - 0xc], 1
je 0x410894
cmp dword [ebp - 0xc], 2
jne 0x410883
cmp dword [ebp - 0x18], 5
jb 0x410894
jne 0x410883
cmp dword [ebp - 0x14], edi
jne 0x410883
mov dword [0x441e20], edi
cmp dword [0x441e20], edi
je 0x41089a
call fcn.00410759
test eax, eax
jne 0x41089a
mov dword [0x441e20], edi
pop edi
add ebp, 0x78
leave
ret

Function at 0x41176d
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push dword [0x441e2c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x4117ce
push esi
push dword [0x441e34]
push 8
push dword [0x4418fc]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
push edi
push dword [0x441e2c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esi, dword [0x441e30]
jmp 0x4117be
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4117bc
mov ecx, dword [esi + 8]
add ecx, edi
push ecx
call eax
pop ecx
mov esi, dword [esi]
test esi, esi
jne 0x4117ac
push edi
push 0x411732
call fcn.00421159
pop esi
mov eax, dword [esp + 8]
add eax, edi
pop edi
ret 4