joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6620971f
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x6622d5b2
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x66274018]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [sym.imp.GrooveUtil.DLL_public:_static_bool___stdcall_raw_GCStr::Equals_wchar_t_const___wchar_t_const__]
mov esi, 0x662406f4
push esi
push ebx
call edi
test al, al
je 0x662097f9
call dword [sym.imp.GrooveUtil.DLL_public:_static_class_GCUnenforcedReentrantSemaphore____stdcall_GWS::Object::GetMetadataLock_void_]
push eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebx, ebx
mov dword [esp + 0x28], ebx
mov eax, dword [0x6628061c]
cmp eax, ebx
jne 0x662097e1
mov edi, dword [sym.imp.GrooveUtil.DLL_public:_static_struct_GWS::AttrArg_const____cdecl_GWS::Util::CreateAttrArgs_wchar_t_const__]
push ebx
push ebx
mov eax, str.http:__webservices.groove.net_wsdl_2.0_GrooveMembers.wsdl
cdq
push edx
push eax
mov eax, str.GrooveMembersBinding
cdq
push str.Namespace
push edx
push eax
push str.Name
call edi
add esp, 0x1c
push eax
push str.WebServiceBindingAttribute
push ebx
mov eax, str.0.0.0.0
cdq
push edx
push eax
mov eax, str.ImpWsdl
cdq
push esi
push edx
push eax
push esi
call edi
add esp, 0x1c
push eax
push str.GeneratedCodeAttribute
call dword [sym.imp.GrooveUtil.DLL_public:_static_struct_GWS::Attr_const____cdecl_GWS::Util::CreateAttrs_wchar_t_const__]
add esp, 0x14
mov dword [0x6628061c], eax
mov esi, eax
or dword [esp + 0x28], 0xffffffff
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
jmp 0x66209e37
push str.Create
push ebx
call edi
test al, al
je 0x662098b7
call dword [sym.imp.GrooveUtil.DLL_public:_static_class_GCUnenforcedReentrantSemaphore____stdcall_GWS::Object::GetMetadataLock_void_]
push eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
invalid
invalid
in al, dx
Function at 0x6620a135
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [ebp + 0x55fffffc], edi
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.662098ba
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.6620986f
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
add byte [eax - 0x3c25b], al
inc dword [eax]
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.662098ba
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.6620986f
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.662098ba
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.6620986f
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.662098aa
push ecx
sbb bh, 0x3f
and byte [ebp - 0x534], 0
and byte [ebp - 0x533], 0
mov byte [ebp - 0x532], 0x68
and byte [ebp - 0x531], 0
invalid
test eax, edx
Function at 0x401747
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push esi
lea eax, [esp + 8]
xor esi, esi
push eax
push esi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
je 0x4017e2
push edi
push 0x44c140
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x44c138]
test edi, edi
je 0x4017b5
push ebp
push esi
lea ebp, [edi + 8]
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4017ae
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [edi]
push ebp
push 0x44c138
call fcn.004111fa
pop ecx
pop ecx
jmp 0x4017b0
mov edi, dword [edi]
test edi, edi
jne 0x401783
pop ebp
mov esi, dword [0x4497e0]
push 0x10
push 0x44c138
lea eax, [esi + 1]
mov dword [0x4497e0], eax
call fcn.004111cb
pop ecx
pop ecx
push 0x44c140
mov dword [eax], ebx
mov dword [eax + 4], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebx
pop ecx
ret 8
Function at 0x402eed
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
push 0x402e40
push 0x10
push 0x2c
call fcn.0040d42c
push 0
push 0
push 8
mov dword [0x44c208], eax
call fcn.0040a3d6
cmp word [0x44c200], 0
mov dword [0x44c210], eax
jne 0x402fc6
lea eax, [esp]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
neg eax
push str.ws2_32.dll
sbb eax, eax
inc eax
mov word [0x44c200], ax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x44c20c], eax
test eax, eax
je 0x402fc6
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.getaddrinfo
push eax
call esi
push str.freeaddrinfo
push dword [0x44c20c]
mov dword [0x44c1f0], eax
call esi
push str.getnameinfo
push dword [0x44c20c]
mov dword [0x44c1f4], eax
call esi
push str.WSAStringToAddressA
push dword [0x44c20c]
mov dword [0x44c1f8], eax
call esi
cmp dword [0x44c1f0], 0
mov dword [0x44c1fc], eax
pop esi
je 0x402fc6
cmp dword [0x44c1f4], 0
je 0x402fc6
cmp dword [0x44c1f8], 0
je 0x402fc6
test eax, eax
je 0x402fc6
mov dword [0x44c204], 1
add esp, 0x190
ret
Function at 0x404a78
Capabilities:
Get graphical window text

Disassembly:
push ebx
push dword [esp + 8]
push dword [0x44c430]
call fcn.0040d39e
mov ebx, eax
test ebx, ebx
je 0x404adc
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x404aa1
push dword [esp + 0xc]
push ebx
call eax
jmp 0x404adc
push esi
push edi
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push dword [esp + 0x14]
mov edi, eax
push edi
call fcn.004113b0
mov esi, eax
lea ecx, [edi + 1]
push ecx
xor eax, eax
push esi
mov word [esi], ax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push esi
call fcn.00411bd7
pop ecx
sub edi, eax
push edi
call fcn.00411a00
pop edi
pop esi
pop ebx
ret 8

Function at 0x4054f7
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
push dword [0x44c884]
call fcn.0040d39e
mov esi, eax
test esi, esi
je 0x4055d1
cmp dword [ebp + 0xc], 0
je 0x405543
push 4
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x405534
cmp dword [esi + 0x1c], 0
jne 0x405534
push eax
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4055d1
test byte [ebp + 0x10], 3
je 0x40555e
push 4
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindow]
push eax
push dword [ebp + 0x10]
push dword [esi]
call fcn.004186c4
cmp dword [esi + 0x3c], 0xffffffff
push ebx
je 0x405583
xor ebx, ebx
cmp dword [esi + 0x3c], 0x1000000
sete bl
xor ecx, ecx
cmp dword [esi + 0x3c], 0x20000000
sete cl
or dword [esi + 0x3c], 0xffffffff
jmp 0x405597
push dword [esi]
call dword [sym.imp.USER32.dll_IsZoomed]
push dword [esi]
mov ebx, eax
call dword [sym.imp.USER32.dll_IsIconic]
mov ecx, eax
test dword [ebp + 0x10], 0x2000000
je 0x4055b4
test ebx, ebx
je 0x4055a8
push 8
jmp 0x4055ba
neg ecx
sbb ecx, ecx
and ecx, 3
add ecx, 4
jmp 0x4055c7
test ebx, ebx
je 0x4055bd
push 3
pop ecx
jmp 0x4055c7
xor eax, eax
test ecx, ecx
setne al
lea ecx, [eax + 1]
push ecx
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebx
pop esi
pop ebp
ret 0xc
Function at 0x409b66
Capabilities:
Get disk information
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x45c
push esi
or esi, 0xffffffff
push edi
mov edi, esi
test eax, eax
je 0x409cae
xor ecx, ecx
cmp word [eax], cx
je 0x409cae
push 0x104
push eax
lea eax, [esp + 0x10]
push eax
call fcn.0041c420
xor eax, eax
mov word [esp + 0x21c], ax
lea eax, [esp + 0x14]
push eax
call fcn.00411bd7
add esp, 0x10
lea ecx, [esp + eax*2 + 6]
cmp eax, 2
je 0x409bbf
cmp eax, 3
jne 0x409bf9
cmp word [esp + 0xa], 0x3a
jne 0x409bf9
cmp eax, 2
jne 0x409bdd
lea eax, [esp + 8]
push 0x441be0
push eax
call fcn.00411b84
pop ecx
pop ecx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x409cae
push 0xfffffffffffffffe
pop edi
jmp 0x409cae
push ebx
push ebp
push 0x5c
pop ebp
push 0x2f
pop ebx
movzx eax, word [ecx]
cmp ax, bp
je 0x409c0e
cmp ax, bx
jne 0x409c18
xor eax, eax
mov word [ecx], ax
sub ecx, 2
jmp 0x409c01
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, esi
je 0x409c57
test byte [esp + 0x21c], 0x10
je 0x409c3e
push 0xfffffffffffffffe
pop edi
jmp 0x409c4e
mov esi, dword [esp + 0x238]
xor edi, edi
or edi, dword [esp + 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x409cac
cmp word [esp + 0x10], bp
jne 0x409c65
cmp word [esp + 0x12], bp
je 0x409c84
cmp word [esp + 0x10], bx
jne 0x409c73
cmp word [esp + 0x12], bx
je 0x409c84
push 0x2e
pop eax
cmp word [esp + 0x10], ax
jne 0x409cac
cmp word [esp + 0x12], ax
jne 0x409cac
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, esi
je 0x409c99
test al, 0x10
je 0x409cac
jmp 0x409ca9
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x409cac
push 0xfffffffffffffffe
pop edi
pop ebp
pop ebx
mov eax, edi
mov edx, esi
pop edi
pop esi
add esp, 0x45c
ret 4

Function at 0x409e60
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 0x14], 0
jne 0x409e9c
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4
Function at 0x409eb0
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp edi, 0xffffffff
jne 0x409ec9
push dword [0x44c754]
call fcn.00414370
pop edi
ret 4
push esi
push edi
push dword [0x44c754]
call fcn.0040d39e
mov esi, eax
test esi, esi
je 0x409f33
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x409f1f
cmp dword [esi + 0x14], 0
mov dword [esp + 0xc], 0
jne 0x409f0e
push 0
lea eax, [esp + 0x10]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push ecx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
push dword [esi + 4]
push 0
push dword [0x44bf74]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push dword [0x44c754]
call fcn.0040d3dd
pop esi
pop edi
ret 4

Function at 0x40a36b
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push dword [0x44c774]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x40a3cc
push esi
push dword [0x44c770]
push 8
push dword [0x44bf74]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
push edi
push dword [0x44c774]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esi, dword [0x44c76c]
jmp 0x40a3bc
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x40a3ba
mov eax, dword [esi + 8]
add eax, edi
push eax
call ecx
pop ecx
mov esi, dword [esi]
test esi, esi
jne 0x40a3aa
push edi
push 0x40a48e
call fcn.0041c879
pop esi
mov eax, dword [esp + 8]
add eax, edi
pop edi
ret 4

Function at 0x40a3d6
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ecx, edi
and ecx, 3
je 0x40a3ec
push 4
pop eax
sub eax, ecx
add edi, eax
mov esi, dword [0x44c770]
mov ebx, dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
jne 0x40a425
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push edi
push 8
push dword [0x44bf74]
mov dword [0x44c774], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
push dword [0x44c774]
call ebx
mov esi, dword [0x44c770]
lea eax, [edi + esi]
push eax
push dword [0x44c774]
mov dword [0x44c770], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
push 8
push dword [0x44bf74]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ebp, eax
push ebp
push dword [0x44c774]
call ebx
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
test edi, edi
jne 0x40a464
test ebx, ebx
je 0x40a485
push 0x14
push 0x44c76c
call fcn.004111cb
pop ecx
pop ecx
mov dword [eax], esi
mov dword [eax + 4], edi
mov dword [eax + 8], ebx
test edi, edi
je 0x40a485
lea ecx, [esi + ebp]
push ecx
call edi
pop ecx
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x40a7b0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [0x449814]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, dword [esp + 0x18]
mov edi, eax
mov ebp, dword [esp + 0x14]
mov esi, dword [edi + 8]
mov ecx, dword [ebp]
sub esi, ebx
lea eax, [esi + 0xa]
push eax
test ecx, ecx
jne 0x40a7e9
push ecx
push dword [0x44c778]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
jmp 0x40a7f8
push ecx
push 0
push dword [0x44c778]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, eax
shr esi, 1
mov dword [ebp], ecx
mov eax, dword [edi]
push esi
add eax, ebx
push eax
push ecx
call fcn.0041c320
mov dword [edi + 8], ebx
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x40a9b0
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x449814]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
add dword [eax + 8], 2
ret
Function at 0x40e607
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x434fd1
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x40e631
mov eax, dword [edi]
lea ecx, [ebp - 0x1c]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
xor eax, eax
test ebx, ebx
jne 0x40e662
mov ecx, dword [ebp + 8]
mov edi, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
and dword [ecx + 0x10], ebx
xor eax, eax
mov dword [ecx + 0x14], 7
mov word [ecx], ax
mov eax, ecx
jmp 0x40e766
push ebx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
call fcn.0040df0c
cmp dword [edi + 0x14], 8
jb 0x40e67c
mov edi, dword [edi]
push esi
mov esi, dword [ebp - 0x28]
push esi
push ebx
xor ebx, ebx
push ebx
push edi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x40e6db
mov ebx, dword [ebp + 8]
mov edi, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
and dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 7
mov word [ebx], ax
test esi, esi
je 0x40e763
mov eax, dword [ebp - 0x20]
sub eax, esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], eax
cmp eax, 0x1000
jb 0x40e75a
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0040d94f
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
jmp 0x40e758
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], ebx
push eax
lea eax, [ebp - 0x10]
mov dword [ebp + 0xc], ebx
push eax
push str.StringFileInfo040904B0ProductVersion
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40e714
cmp dword [ebp - 0x10], ebx
je 0x40e714
cmp dword [ebp + 0xc], ebx
je 0x40e714
push dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov ecx, ebx
push dword [ebp - 0x10]
call fcn.0040dbe3
jmp 0x40e72f
mov ebx, dword [ebp + 8]
xor eax, eax
mov edi, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
and dword [ebx + 0x10], 0
xor eax, eax
mov dword [ebx + 0x14], 7
mov word [ebx], ax
test esi, esi
je 0x40e763
mov eax, dword [ebp - 0x20]
sub eax, esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], eax
cmp eax, 0x1000
jb 0x40e75a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0040d94f
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
pop ecx
pop ecx
push eax
push esi
call fcn.0041c312
pop ecx
pop ecx
mov eax, ebx
pop esi
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40e935
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebp
push esi
push edi
xor ebp, ebp
lea eax, [esp + 0xc]
push eax
push ebp
push ebp
push ebp
push dword [esp + 0x24]
mov edi, ecx
mov dword [esp + 0x20], ebp
push dword [edi + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, dword [esp + 0x18]
test eax, eax
je 0x40e965
cmp eax, 0xea
jne 0x40e997
mov eax, dword [esp + 0xc]
mov ecx, esi
push ebp
shr eax, 1
push eax
call fcn.0040ddf8
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x40e97e
mov eax, dword [esi]
lea ecx, [esp + 0xc]
push ecx
push eax
push ebp
push ebp
push dword [esp + 0x24]
push dword [edi + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40e9a0
push ebp
push ebp
mov ecx, esi
call fcn.0040ddf8
pop edi
pop esi
pop ebp
pop ecx
ret 8

Function at 0x40e9a7
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ecx
push ebp
push edi
xor ebp, ebp
lea eax, [esp + 0xc]
push eax
push ebp
push ebp
push ebp
push dword [esp + 0x24]
mov edi, ecx
mov dword [esp + 0x20], ebp
push dword [edi + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40e9e4
cmp eax, 0xea
je 0x40e9e4
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x14]
push eax
push ebp
call fcn.004108ab
jmp 0x40ea21
push esi
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0xf]
push eax
push dword [esp + 0x14]
mov ecx, esi
call fcn.004108ab
lea eax, [esp + 0x10]
push eax
push dword [esi]
push ebp
push ebp
push dword [esp + 0x28]
push dword [edi + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40ea20
lea eax, [esp + 0x1c]
mov ecx, esi
push eax
push ebp
call fcn.004108ab
pop esi
pop edi
pop ebp
pop ecx
pop ecx
ret 8
Function at 0x41126e
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x4112c3
push dword [esp + 0x10]
push 0x411322
call dword [sym.imp.USER32.dll_EnumWindows]
mov edi, dword [0x44c79c]
test edi, edi
je 0x41131c
xor esi, esi
mov ebx, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi + 8], eax
jne 0x4112bb
cmp byte [edi + 0x10], 0
je 0x4112bb
push 3
push esi
push esi
push esi
push esi
push 0xfffffffffffffffe
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edi, ebx
test ebx, ebx
jne 0x411297
jmp 0x41131c
mov edi, dword [0x44c79c]
test edi, edi
je 0x41131c
xor esi, esi
push ebp
mov ebp, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi + 8], eax
jne 0x411315
cmp byte [edi + 0x11], 0
je 0x4112ee
push 1
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp byte [edi + 0x10], 0
je 0x411305
push 3
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
lea eax, [edi + 8]
push eax
push 0x44c79c
call fcn.004111fa
pop ecx
pop ecx
mov edi, ebp
test ebp, ebp
jne 0x4112d0
pop ebp
pop edi
pop esi
pop ebx
ret 4

Function at 0x4113b0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [0x449814]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, dword [esp + 0x18]
mov esi, eax
cmp ebx, 0xffffffff
jne 0x4113ce
mov ebx, dword [esi + 8]
mov eax, dword [esp + 0x14]
mov edx, dword [esi + 4]
mov ecx, dword [esi + 8]
lea ebp, [eax + eax]
add ecx, ebp
lea eax, [edx - 4]
cmp ecx, eax
jl 0x4113f2
lea eax, [ecx + 0x4000]
mov dword [esi + 4], eax
add eax, 0xa
jmp 0x41140d
cmp edx, 0x100000
jle 0x411420
cmp ecx, 0x100000
jge 0x411407
mov ecx, 0x100000
mov dword [esi + 4], ecx
lea eax, [ecx + 0xa]
push eax
push dword [esi]
push 0
push dword [0x44c778]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov dword [esi], eax
lea eax, [ebx + ebp]
mov dword [esi + 8], eax
mov eax, dword [esi]
pop edi
pop esi
pop ebp
add eax, ebx
pop ebx
ret 8

Function at 0x411a00
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x449814]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [esp + 4]
neg ecx
add ecx, ecx
add dword [eax + 8], ecx
ret 4
Function at 0x411a1a
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, 0x1000
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebp, ebp
cmp dword [esp + 0x24], 0x18
mov ebx, eax
je 0x411ad9
cmp dword [esp + 0x24], 2
je 0x411ad9
push 0x2000
push ebp
push dword [0x44bf74]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
jmp 0x411aa8
cmp dword [esp + 0x18], 2
jne 0x411ac4
cmp dword [esp + 0x28], 0xffffffff
je 0x411a6c
cmp ebp, dword [esp + 0x28]
jae 0x411ac4
add ebp, 2
test ebx, ebx
jne 0x411a91
lea eax, [edi*2 + 0x2000]
push eax
push esi
push 8
push dword [0x44bf74]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
mov ebx, 0x1000
mov ax, word [esp + 0x14]
cmp ax, 0xa
je 0x411ac4
cmp ax, 0xd
je 0x411aa8
mov word [esi + edi*2], ax
inc edi
dec ebx
push 0
lea eax, [esp + 0x1c]
push eax
push 2
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x411a58
push dword [esp + 0x2c]
xor eax, eax
push esi
mov word [esi + edi*2], ax
call fcn.00413ab0
jmp 0x411b6b
push eax
push 0
push dword [0x44bf74]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp dword [esp + 0x28], 0xffffffff
je 0x411af7
cmp ebp, dword [esp + 0x28]
jae 0x411b4f
push 0
lea eax, [esp + 0x1c]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x411b4f
cmp dword [esp + 0x18], 1
jne 0x411b4f
inc ebp
test ebx, ebx
jne 0x411b3c
lea eax, [edi + 0x1000]
push eax
push esi
push 8
push dword [0x44bf74]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
mov ebx, 0x1000
mov al, byte [esp + 0x13]
cmp al, 0xa
je 0x411b4f
cmp al, 0xd
je 0x411aea
mov byte [esi + edi], al
inc edi
dec ebx
jmp 0x411aea
cmp dword [esp + 0x24], 0x18
push dword [esp + 0x2c]
mov byte [esi + edi], 0
push esi
jne 0x411b66
call fcn.004139c0
jmp 0x411b6b
call fcn.0040d2b0
push esi
push 0
push dword [0x44bf74]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10