joyce8/EMBER2024-capa huggingface dataset:
Function at 0x499b1c
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x62de18], 0
push ebx
push esi
mov esi, 0x62de20
jne 0x499b48
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x62de38], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x62de18], 1
push dword [0x62de38]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x499be5
push 0x14
push 8
push dword [0x62c3a4]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x499c0f
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x62de1c]
test eax, eax
je 0x499b8a
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x62de1c], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x499c14
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x62de38]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x62c3a4]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x499c0f
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8
Function at 0x100015d4
Capabilities:
Get common file path
Terminate process

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
mov edx, dword [esp + 0x14]
lea ecx, [esp]
call fcn.10002000
mov edx, dword [esp]
push dword [0x10007408]
push edx
call fcn.10003a60
lea eax, [esp + 8]
push eax
call fcn.10003ac0
mov edx, dword [0x10007408]
push edx
push edx
push dword [esp + 0xc]
call fcn.10002cba
add dword [0x10007408], 2
lea edx, [0x10006028]
pop ecx
mov dword [0x10007408], ecx
add ecx, dword [0x10006ae4]
call fcn.10002090
je 0x10001657
mov edx, dword [esp + 4]
push dword [0x10007408]
push edx
call fcn.10003a60
lea edx, str..dll
push edx
call fcn.10003a60
lea eax, [esp + 8]
push eax
call fcn.10003ac0
cmp dword [esp + 0x18], 0
je 0x100016f8
push dword [0x100070c4]
lea edx, [0x10006028]
pop ecx
call fcn.10002090
je 0x100016c6
mov edx, dword [0x10007408]
push edx
push edx
push 0x104
call fcn.10002220
push 0x100070c4
call fcn.10003ac0
push 0x104
mov eax, dword [0x100070c4]
push eax
call sub.KERNEL32.dll_GetSystemDirectoryW
mov edx, dword [0x10007408]
push edx
push edx
lea eax, [0x1000614e]
push eax
push dword [0x100070c4]
call fcn.10002270
push 0x100070c4
call fcn.10003ac0
mov edx, dword [0x100070c4]
push dword [0x10007408]
push edx
call fcn.10003a60
lea edx, [0x1000614e]
push edx
call fcn.10003a60
mov edx, dword [esp + 8]
push edx
call fcn.10003a60
lea eax, [esp + 8]
push eax
call fcn.10003ac0
push dword [esp + 4]
call sub.KERNEL32.dll_LoadLibraryW
mov dword [esp + 8], eax
mov ebx, dword [esp + 8]
and ebx, ebx
jne 0x1000176c
push dword [0x10007408]
push 0x10
lea eax, str.PurePortable
push eax
push dword [0x10007408]
lea edx, str.Failed_load_original_dll_n
push edx
call fcn.10003a60
mov edx, dword [esp + 0x10]
push edx
call fcn.10003a60
add dword [0x10007408], 2
push 0
mov edx, dword [0x10006ae4]
add dword [esp + 4], edx
call sub.USER32.dll_MessageBoxW
pop dword [0x10007408]
push 0
call sub.KERNEL32.dll_GetCurrentProcess
push eax
call sub.KERNEL32.dll_TerminateProcess
mov eax, dword [esp + 8]
jmp 0x10001774
push dword [esp + 4]
call fcn.10003b40
push dword [esp]
call fcn.10003b40
add esp, 0xc
pop ebx
ret 8

Function at 0x10001930
Capabilities:
Check if file exists

Disassembly:
xor eax, eax
push eax
mov edx, dword [esp + 8]
lea ecx, [esp]
call fcn.10002000
mov eax, dword [esp]
push eax
call sub.SHLWAPI.dll_PathFileExistsW
jmp 0x1000194c
push dword [esp]
call fcn.10003b40
add esp, 4
ret 4
Function at 0x10001a8f
Capabilities:
Terminate process

Disassembly:
xor eax, eax
push eax
push eax
push eax
mov edx, dword [0x10007408]
push edx
push edx
push dword [esp + 0x18]
call fcn.10003520
add dword [0x10007408], 2
lea eax, [esp + 4]
push eax
call fcn.10003ac0
push 1
push dword [esp + 4]
call fcn.100015d4
mov dword [esp + 4], eax
push dword [esp + 0x14]
push dword [esp + 8]
call sub.KERNEL32.dll_GetProcAddress
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x10001ae4
xor eax, eax
jmp 0x10001ae9
mov eax, 1
and eax, eax
je 0x10001b60
push dword [0x10007408]
push 0x10
lea eax, str.PurePortable
push eax
push dword [0x10007408]
lea edx, str.Error_init_proxy_function
push edx
call fcn.10003a60
mov edx, dword [0x10007408]
push edx
push edx
push 0x18
push 0xffffffff
push dword [esp + 0x34]
call fcn.10003570
pop eax
add dword [0x10007408], 2
push 0
mov edx, dword [0x10006ae4]
add dword [esp + 4], edx
call sub.USER32.dll_MessageBoxW
pop dword [0x10007408]
push 0
call sub.KERNEL32.dll_GetCurrentProcess
push eax
call sub.KERNEL32.dll_TerminateProcess
jmp 0x10001b68
mov eax, dword [esp + 8]
jmp 0x10001b68
push dword [esp]
call fcn.10003b40
add esp, 0xc
ret 8
Function at 0x10001d4c
Capabilities:
Get common file path

Disassembly:
xor eax, eax
push eax
mov eax, dword [0x10007084]
mov dword [0x100070f0], eax
mov edx, dword [0x10007408]
push edx
push edx
push 0x7fff
call fcn.10002220
lea eax, [esp + 4]
push eax
call fcn.10003ac0
push 0x7fff
mov eax, dword [esp + 4]
push eax
push 0
call sub.KERNEL32.dll_GetModuleFileNameW
mov edx, dword [0x10007408]
push edx
push edx
mov eax, dword [esp + 8]
push eax
call fcn.10003520
push 0x10007130
call fcn.10003ac0
mov edx, dword [0x10007408]
push edx
push edx
push dword [0x10007130]
call fcn.10002d2d
push 0x1000716c
call fcn.10003ac0
mov edx, dword [0x10007408]
push edx
push edx
lea eax, [0x1000614e]
push eax
push dword [0x1000716c]
call fcn.10002270
push 0x100070cc
call fcn.10003ac0
mov edx, dword [0x10007408]
push edx
push edx
push 1
push dword [0x10007130]
call fcn.10002dac
push 0x10007164
call fcn.10003ac0
push 0x7fff
mov eax, dword [esp + 4]
push eax
push dword [0x100070f0]
call sub.KERNEL32.dll_GetModuleFileNameW
mov edx, dword [0x10007408]
push edx
push edx
mov eax, dword [esp + 8]
push eax
call fcn.10003520
push 0x1000708c
call fcn.10003ac0
mov edx, dword [0x10007408]
push edx
push edx
push dword [0x1000708c]
call fcn.10002d2d
push 0x100070fc
call fcn.10003ac0
mov edx, dword [0x10007408]
push edx
push edx
lea eax, [0x1000614e]
push eax
push dword [0x100070fc]
call fcn.10002270
push 0x10007138
call fcn.10003ac0
mov edx, dword [0x10007408]
push edx
push edx
push 1
push dword [0x1000708c]
call fcn.10002dac
push 0x100070b0
call fcn.10003ac0
push 0x7fff
mov eax, dword [esp + 4]
push eax
call sub.KERNEL32.dll_GetWindowsDirectoryW
mov edx, dword [0x10007408]
push edx
push edx
lea eax, [0x1000614e]
push eax
push dword [esp + 0xc]
call fcn.10002270
push 0x1000710c
call fcn.10003ac0
push 0x7fff
mov eax, dword [esp + 4]
push eax
call sub.KERNEL32.dll_GetSystemDirectoryW
mov edx, dword [0x10007408]
push edx
push edx
lea eax, [0x1000614e]
push eax
push dword [esp + 0xc]
call fcn.10002270
push 0x100070c4
call fcn.10003ac0
mov eax, dword [esp]
push eax
push 0x7fff
call sub.KERNEL32.dll_GetTempPathW
mov edx, dword [0x10007408]
push edx
push edx
lea eax, [0x1000614e]
push eax
push dword [esp + 0xc]
call fcn.10002270
push 0x10007104
call fcn.10003ac0
xor eax, eax
push dword [esp]
call fcn.10003b40
add esp, 4
ret
Function at 0x401170
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41bec0
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x243c
call fcn.0041a310
mov eax, dword [0x42600c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x4278f0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
push str.LogCortexLauncherService.log
push str.C:ProgramDataRazerRazerCortex_
push str._s_s
push 0x104
lea eax, [ebp - 0x21c]
push eax
call fcn.004010e0
push 0
call fcn.004096bd
mov dword [ebp - 0x244c], eax
mov dword [ebp - 0x2448], edx
lea eax, [ebp - 0x244c]
push eax
lea eax, [ebp - 0x2440]
push eax
call fcn.00408e5b
push dword [ebp - 0x2440]
push dword [ebp - 0x243c]
push dword [ebp - 0x2438]
push dword [ebp - 0x2434]
mov eax, dword [ebp - 0x2430]
inc eax
push eax
mov eax, dword [ebp - 0x242c]
add eax, 0x76c
push eax
push str.__d__d__d__d:_d:_d_
push 0x100
lea eax, [ebp - 0x241c]
push eax
call fcn.004010e0
add esp, 0x44
push esi
push 0x1100
lea eax, [ebp - 0x241c]
push eax
call fcn.00409339
push 0x422b64
push 0x1100
lea eax, [ebp - 0x241c]
push eax
call fcn.00409339
add esp, 0x18
mov dword [ebp - 0x2444], 0
lea eax, [ebp - 0x21c]
push eax
call fcn.00401110
test edx, edx
jl 0x4012a2
jg 0x40129b
cmp eax, 0x20000
jbe 0x4012a2
push 0x422b68
jmp 0x4012a7
push str.a_ccsUTF_8
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x2444]
push eax
call fcn.00408f27
add esp, 0xc
mov eax, dword [ebp - 0x2444]
test eax, eax
je 0x401312
push 2
push 0
push eax
call fcn.0040931e
add esp, 0xc
lea eax, [ebp - 0x241c]
lea edx, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4012e0
sub eax, edx
sar eax, 1
push dword [ebp - 0x2444]
push eax
push 2
lea eax, [ebp - 0x241c]
push eax
call fcn.004095e6
push dword [ebp - 0x2444]
call fcn.00408fe4
add esp, 0x14
push 0x4278f0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00404c0b
mov esp, ebp
pop ebp
ret 8

Function at 0x401450
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401469
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4014a6
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x4014a2
nop word [eax + eax]
cmp esi, edx
jae 0x4014a6
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x401490
cmp esi, edx
jb 0x4014ad
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x401d60
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x15
push str.CortexLauncherService
mov ecx, 0x4278ec
xor esi, esi
call fcn.004023f0
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
test ebx, ebx
je 0x401e30
push edi
push 0xf01ff
push dword [0x4278ec]
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
je 0x401e28
lea eax, [ebp - 0x20]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x401e0e
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x401e21
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
nop
mov eax, dword [ebp - 8]
test eax, eax
je 0x401e04
push eax
call ebx
cmp dword [ebp - 0x1c], 1
je 0x401e04
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x401de0
mov ebx, dword [ebp - 0x24]
jmp 0x401e21
mov ebx, dword [ebp - 0x24]
mov esi, 1
jmp 0x401e21
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x426
mov ecx, 1
cmove esi, ecx
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404c0b
mov esp, ebp
pop ebp
ret
Function at 0x403530
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41c2a8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x42600c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00401620
mov ecx, eax
test ecx, ecx
jne 0x403569
push 0x80004005
call fcn.00401360
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x10]
push 9
push 0x422d54
call fcn.00402720
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.00403be0
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [esi - 4], 1
jle 0x4035b7
push dword [esi - 0xc]
lea ecx, [ebp - 0x10]
call fcn.00402890
mov esi, dword [ebp - 0x10]
push esi
push ecx
call fcn.00401170
push dword [esi - 8]
push esi
call fcn.00409a6a
add esp, 8
test eax, eax
js 0x40360b
cmp eax, dword [esi - 8]
jg 0x40360b
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4035fb
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00401360
int3

Function at 0x403ef0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41c2a8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x42600c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00401620
mov ecx, eax
test ecx, ecx
jne 0x403f29
push 0x80004005
call fcn.00401360
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x10]
push 9
push str.RzKL
call fcn.00402720
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.00403be0
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [esi - 4], 1
jle 0x403f77
push dword [esi - 0xc]
lea ecx, [ebp - 0x10]
call fcn.00402890
mov esi, dword [ebp - 0x10]
push esi
push ecx
call fcn.00401170
push dword [esi - 8]
push esi
call fcn.00409a6a
add esp, 8
test eax, eax
js 0x403fcb
cmp eax, dword [esi - 8]
jg 0x403fcb
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x403fbb
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00401360
int3
Function at 0x404740
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41c5cd
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x42600c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
push edi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
push 0xc
mov dword [ebp - 0x244], eax
call fcn.0040510f
mov edx, eax
add esp, 4
mov dword [ebp - 0x248], edx
mov dword [ebp - 4], edi
mov ecx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edx], vtable.Razer_Lib::ResourceFinalizer_void___class_std::_Binder_int__int____stdcall___void____struct_std::_Ph_1__const___.0
mov dword [edx + 4], ecx
mov al, byte [ebp - 0x240]
mov byte [edx + 8], al
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x240], edx
mov dword [ebp - 4], 1
mov esi, dword [ebp - 0x244]
cmp esi, 0xffffffff
je 0x404834
push 0x228
lea eax, [ebp - 0x238]
push edi
push eax
call fcn.00406710
add esp, 0xc
mov dword [ebp - 0x23c], 0x22c
lea eax, [ebp - 0x23c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x404834
mov esi, dword [sym.imp.KERNEL32.dll_Process32NextW]
lea eax, [ebp - 0x218]
push eax
push 0x423354
call fcn.00409e6c
add esp, 8
test eax, eax
je 0x40482e
lea eax, [ebp - 0x23c]
push eax
push dword [ebp - 0x244]
call esi
test eax, eax
jne 0x404801
jmp 0x404834
mov edi, dword [ebp - 0x234]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x244]
call fcn.00403b70
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00404c0b
mov esp, ebp
pop ebp
ret

Function at 0x41236b
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00411cd6

Function at 0x412376
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00411f14
Function at 0x406222
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x406246
xor eax, eax
test eax, eax
je 0x406258
cmp byte [ebp + eax - 0x121], 0x5c
je 0x406258
xor ecx, ecx
jmp 0x40625b
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x409014]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4

Function at 0x406305
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4222c4], 0
push esi
jne 0x40633c
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406316
mov dword [ecx*4 + 0x4222c0], eax
inc ecx
cmp ecx, 0x100
jl 0x406311
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40636d
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4222c0]
xor eax, esi
inc ecx
dec edx
jne 0x40634f
pop edi
not eax
pop esi
ret 0xc

Function at 0x10010dc
Capabilities:
Get hostname
Initialize winsock library
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push ebx
push esi
push edi
push 0x1002040
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, 0xffffffff
jne 0x100110e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x2713
call fcn.01001439
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov esi, 0x10010ac
jmp 0x1001121
cmp al, 0x73
jne 0x1001142
xor ebx, ebx
inc ebx
push esi
push edi
push dword [ebp + 8]
call fcn.01001475
cmp eax, 0xffffffff
jne 0x100111a
mov eax, dword [0x1002004]
cmp dword [edi + eax*4], 0
je 0x1001154
push 0x2714
jmp 0x1001147
push 0x2710
push 2
call fcn.010013ca
pop ecx
pop ecx
push 1
jmp 0x10011d0
push 0x400
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jge 0x100117d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x2712
call fcn.01001439
jmp 0x1001150
test ebx, ebx
je 0x1001199
lea eax, [ebp - 0x400]
push 0x2e
push eax
call dword [sym.imp.msvcrt.dll_strchr]
test eax, eax
pop ecx
pop ecx
je 0x1001199
and byte [eax], 0
lea eax, [ebp - 0x400]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10011a2
sub eax, edx
push eax
lea eax, [ebp - 0x400]
push eax
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.USER32.dll_CharToOemBuffA]
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.msvcrt.dll_puts]
pop ecx
push 0
call dword [sym.imp.msvcrt.dll_exit]
int3
Function at 0x4011b8
Capabilities:
Get common file path
Get startup folder

Disassembly:
jmp 0x4014b7
mov eax, 0x461bb0
call fcn.00410d14
sub esp, 0x148
push ebx
xor ebx, ebx
cmp byte [ebp + 8], bl
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov esi, ecx
je 0x4014e9
push 0xffff0000
push ebx
push 0x1101
push dword [esi + 0x1c]
call edi
push ebx
push ebx
push 0x1109
push dword [esi + 0x1c]
call edi
push eax
call fcn.00432175
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [esi + 0x1c]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
lea eax, [ebp - 0x154]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
lea eax, [ebp - 0x154]
lea ecx, [esi + 0x1f84]
push eax
call fcn.0043b33a
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x32
push 0x32
push 0x18
push 0x32
call edi
push eax
push 0x31
call edi
push eax
lea ecx, [esi + 0x2180]
call fcn.004321a8
mov edi, dword [sym.imp.USER32.dll_GetSysColor]
push 5
call edi
push eax
push dword [esi + 0x2184]
call dword [sym.imp.COMCTL32.dll_ImageList_SetBkColor]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], 0x466168
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], ebx
call fcn.00442bdf
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [ebp - 0x28]
call fcn.00442c96
push ebx
push 0x18
push 1
push 0x20
push 0x20
call dword [sym.imp.GDI32.dll_CreateBitmap]
push eax
lea ecx, [ebp - 0x14]
call fcn.00443f7d
lea eax, [ebp - 0x14]
neg eax
sbb eax, eax
and eax, dword [ebp - 0x10]
push eax
push dword [ebp - 0x24]
call fcn.00442e0f
push 5
mov dword [ebp + 8], eax
call edi
push eax
push 0x1f
push 0x1f
push ebx
push ebx
lea ecx, [ebp - 0x28]
call fcn.0044b70a
mov eax, dword [ebp + 8]
cmp eax, ebx
jne 0x4015d8
xor eax, eax
jmp 0x4015db
mov eax, dword [eax + 4]
push eax
push dword [ebp - 0x24]
call fcn.00442e0f
lea ecx, [ebp - 0x28]
mov edi, eax
call fcn.00442cfe
cmp edi, ebx
jne 0x4015f6
xor eax, eax
jmp 0x4015f9
mov eax, dword [edi + 4]
push ebx
push eax
push dword [esi + 0x2184]
call dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
call fcn.0045072a
mov eax, dword [eax + 4]
mov edi, dword [sym.imp.SHELL32.dll_ExtractIconA]
push 0x22
push str.shell32.dll
push dword [eax + 0x68]
call edi
push eax
push 0xffffffffffffffff
push dword [esi + 0x2184]
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov dword [ebp + 8], eax
call fcn.0045072a
mov eax, dword [eax + 4]
push 0xf
push str.shell32.dll
push dword [eax + 0x68]
call edi
push eax
push 0xffffffffffffffff
push dword [esi + 0x2184]
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
push eax
push eax
mov edi, 0xffff0000
push 1
push edi
push 0x477fe0
mov ecx, esi
call fcn.00401096
push dword [ebp + 8]
mov dword [esi + 0x1f88], eax
mov eax, dword [esi + 0x1f84]
mov ecx, esi
push dword [ebp + 8]
push 1
push edi
push eax
call fcn.00401172
lea ecx, [ebp - 0x28]
mov dword [esi + 0x1f80], eax
mov byte [ebp - 4], bl
call fcn.00442d14
mov dword [ebp - 0x14], vtable.CGdiObject.0
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 2
call fcn.00443fd4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4