joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41bfc0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [0x492e54]
test eax, eax
je 0x41c114
call sym.__pthread_once_raw.constprop.5
mov eax, dword [0x492e50]
test eax, eax
je 0x41c140
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x41c000
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
call sym._pop_pthread_mem
test eax, eax
mov ebx, eax
je 0x41c18c
mov eax, dword [entry3]
test eax, eax
je 0x41c18c
mov dword [ebx + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 0x38], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
sub esp, 0x10
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], 0xffffffff
mov dword [ebx + 0x34], 0xffffffff
mov dword [ebx + 0x60], 0
mov dword [ebx + 0x14], 0
call esi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, eax
call esi
mov edx, eax
lea eax, [ebx + 0x14]
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebp
mov dword [esp + 4], edi
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
sub esp, 0x1c
test eax, eax
je 0x41c193
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [ebx + 0x68], eax
movzx eax, byte [ebx + 0x20]
sub esp, 4
mov dword [ebx + 0x64], 0
and eax, 0xffffffcf
or eax, 0x10
mov byte [ebx + 0x20], al
mov eax, dword [0x492e50]
test eax, eax
je 0x41c166
mov dword [esp + 4], ebx
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x41c193
mov eax, ebx
jmp 0x41bff8
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_once_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x492e54], eax
jmp 0x41bfd4
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x492e50], eax
jmp 0x41bfe6
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x492e50], eax
jmp 0x41c0f3
xor eax, eax
jmp 0x41bff8
call sym._abort
nop
lea esi, [esi]
Function at 0x41c700
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
cmp dword [esp + 0x24], 3
je 0x41c720
add esp, 0x14
mov eax, 1
pop ebx
pop esi
ret 0xc
mov eax, dword [0x492e50]
test eax, eax
je 0x41c890
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x41c70c
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
mov ebx, eax
je 0x41c70c
test byte [eax + 0x20], 0x30
je 0x41c7e0
mov eax, dword [eax + 0xb0]
test eax, eax
jne 0x41c880
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x41c790
mov dword [esp], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x41c782
mov dword [esp], eax
call esi
sub esp, 4
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x14], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call sym._pthread_mutex_destroy
mov edx, dword [ebx + 0xac]
mov dword [ebx + 0x34], 0xffffffff
test edx, edx
je 0x41c8e6
mov eax, dword [0x492e50]
test eax, eax
je 0x41c8c0
mov dword [esp + 4], 0
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
mov eax, 1
add esp, 0x14
pop ebx
pop esi
ret 0xc
mov eax, dword [eax + 0x64]
test eax, eax
mov eax, dword [ebx + 0x18]
jne 0x41c840
test eax, eax
je 0x41c7fa
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebx + 0xb0]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x64], 1
test eax, eax
jne 0x41c870
test byte [ebx + 0x24], 4
je 0x41c857
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x41c789
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
jmp 0x41c789
test eax, eax
je 0x41c850
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebx + 0x18], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call sym._pthread_mutex_destroy
mov dword [ebx + 0x34], 0xffffffff
jmp 0x41c70c
call sym.__pthread_cleanup_dest.part.3
jmp 0x41c812
call sym.__pthread_cleanup_dest.part.3
jmp 0x41c75e
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x492e50], eax
jmp 0x41c72d
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x492e50], eax
jmp 0x41c7bd
mov eax, ebx
call sym._push_pthread_mem.part.0
jmp 0x41c7b0
Function at 0x41da80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call sym.___pthread_self_lite
mov ebx, eax
mov dword [eax + 4], esi
mov eax, dword [eax + 0xb0]
test eax, eax
jne 0x41dafb
test byte [ebx + 0x20], 0x30
je 0x41db02
mov eax, dword [0x492e50]
test eax, eax
je 0x41db8b
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
mov ebx, eax
je 0x41daf2
cmp dword [eax + 0x14], 0
je 0x41db15
mov esi, dword [eax + 4]
mov dword [eax + 0x64], 1
mov eax, dword [eax + 0x18]
test eax, eax
je 0x41dae5
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
test byte [ebx + 0x24], 4
mov dword [ebx + 0x18], 0
jne 0x41db5f
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
call sym.__pthread_cleanup_dest.part.3
jmp 0x41da9d
add ebx, 0x6c
mov dword [esp + 4], 1
mov dword [esp], ebx
call sym._longjmp
mov dword [eax], 0xdeadbeef
mov eax, dword [eax + 0x18]
test eax, eax
je 0x41db2c
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
cmp dword [ebx + 0xac], 0
mov dword [ebx + 0x18], 0
mov esi, dword [ebx + 4]
je 0x41db82
mov eax, dword [0x492e50]
test eax, eax
je 0x41dbb1
mov dword [esp + 4], 0
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edx
push edx
jmp 0x41daf2
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
cmp dword [ebx + 0xac], 0
mov dword [ebx + 0x14], 0
jne 0x41db3f
mov eax, ebx
call sym._push_pthread_mem.part.0
jmp 0x41db3f
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x492e50], eax
jmp 0x41dab0
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x492e50], eax
jmp 0x41db48
Function at 0x420430
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [ebp + 8]
mov dword [esp], edi
call sym._strlen
mov ebx, eax
lea eax, [eax + 0x40]
and eax, 0xfffffff0
call fcn.0040df70
mov edx, 0x326d
sub esp, eax
lea eax, [esp + 0x1b]
mov dword [esp + 4], edi
mov dword [esp + 8], ebx
lea esi, [esp + 0xc]
mov word [esp + 0x18], dx
mov dword [esp + 0xc], 0x2d636367
mov dword [esp], eax
mov dword [esp + 0x10], 0x656d6873
mov dword [esp + 0x14], 0x64742d6d
mov byte [esp + 0x1a], 0x2d
call sym._memcpy
lea eax, [ebx + 0x10]
lea edi, [esi + eax]
mov dword [ebp - 0x24], eax
lea eax, [ebx + 0x30]
mov dword [edi], 0x61616161
mov dword [edi + 4], 0x61616161
mov dword [edi + 8], 0x61616161
mov dword [edi + 0xc], 0x61616161
mov dword [edi + 0x10], 0x61616161
mov dword [edi + 0x14], 0x61616161
mov dword [edi + 0x18], 0x61616161
mov dword [edi + 0x1c], 0x61616161
mov dword [ebp - 0x1c], eax
mov byte [esp + ebx + 0x3c], 0
mov byte [esp + ebx + 0x1b], 0
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
sub esp, 0xc
mov byte [esi + ebx + 0xf], 0x2d
mov dword [ebp - 0x20], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
je 0x42051f
int3
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_FindAtomA]
sub esp, 4
test ax, ax
jne 0x4205c3
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._malloc
mov edx, edi
mov ebx, eax
mov eax, 0x20
nop
lea esi, [esi]
bt ebx, eax
jae 0x420558
mov byte [edx], 0x41
add edx, 1
sub eax, 1
jne 0x420550
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_AddAtomA]
sub esp, 4
test ax, ax
je 0x4205c0
mov ecx, dword [ebp - 0x24]
mov edx, esi
movzx eax, ax
mov dword [esp], ecx
mov ecx, dword [ebp - 0x1c]
call sym._get_ptr_from_atom_1
cmp eax, ebx
mov esi, eax
je 0x4205da
mov dword [esp], ebx
call sym._free
mov edi, dword [ebp - 0x20]
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
int3
mov ecx, dword [ebp - 0x24]
mov edx, esi
movzx eax, ax
mov dword [esp], ecx
mov ecx, dword [ebp - 0x1c]
call sym._get_ptr_from_atom_1
mov esi, eax
jmp 0x420592
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [esp + 8], eax
call sym._memset
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x420592
mov dword [esp], ebx
call dword [ebp + 0x10]
jmp 0x420592
Function at 0x47c7f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x6c
lea eax, [esp + 0x60]
mov dword [esp + 0x34], sym.___gxx_personality_sj0
mov dword [esp + 0x38], 0x47ff68
mov dword [esp + 0x40], 0x47c8f5
mov dword [esp + 0x44], esp
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x1c]
mov dword [esp], eax
mov dword [esp + 0x18], eax
call dbg._Unwind_SjLj_Register
mov eax, dword [esp + 0x80]
lea ecx, [esp + 0x5f]
mov dword [esp + 4], 0
mov dword [esp + 0x20], 0xffffffff
mov dword [esp], eax
call sym.std::istream::sentry::sentry_std::istream__bool_
sub esp, 8
cmp byte [esp + 0x5f], 0
jne 0x47c873
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call sym.__Unwind_SjLj_Unregister
mov eax, dword [esp + 0x80]
add esp, 0x6c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x80]
mov ebx, dword [esp + 0x80]
mov eax, dword [eax]
mov eax, dword [eax - 0xc]
mov ecx, dword [ebx + eax + 0x78]
mov edx, dword [ecx + 8]
cmp edx, dword [ecx + 0xc]
jae 0x47c8b0
movzx eax, byte [edx]
add edx, 1
mov dword [ecx + 8], edx
mov edx, dword [esp + 0x84]
mov byte [edx], al
jmp 0x47c858
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
mov dword [esp + 0x20], 1
call eax
cmp eax, 0xffffffff
jne 0x47c89b
mov eax, dword [esp + 0x80]
mov ecx, dword [esp + 0x80]
mov eax, dword [eax]
add ecx, dword [eax - 0xc]
mov eax, dword [ecx + 0x14]
mov dword [esp + 0x20], 0xffffffff
or eax, 6
mov dword [esp], eax
call method.std::basic_ios_char__std::char_traits_char___.clear_std::_Ios_Iostate_
sub esp, 4
jmp 0x47c858
Function at 0x42c5b4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a797c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x50], 0x4ca5a0
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 4], 0
mov byte [ebp - 0x18], 1
lea eax, [ebp - 0x50]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x17], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x2c]
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
push eax
push ecx
push edx
push 0x428748
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
movzx eax, byte [ebp - 0x17]
test eax, eax
jne 0x42c632
mov esi, 0x893
mov ebx, 0x893
jmp 0x42c636
xor esi, esi
xor ebx, ebx
lea eax, [ebp - 0x48]
push ebx
push esi
push 0
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jle 0x42c6b1
mov eax, dword [ebp - 0x44]
cmp eax, 0x893
je 0x42c6b1
movzx eax, byte [ebp - 0x18]
test eax, eax
jne 0x42c682
mov eax, dword [ebp - 0x44]
cmp eax, 0xb
je 0x42c67b
cmp eax, 0xf
je 0x42c67b
cmp eax, 0x14
je 0x42c67b
xor ecx, ecx
mov edx, 1
cmp eax, 0x18
cmove ecx, edx
jmp 0x42c687
mov ecx, 1
jmp 0x42c687
mov ecx, 1
test ecx, ecx
je 0x42c69f
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x48]
push ebx
push esi
push 0
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jg 0x42c648
mov edi, dword [ebp - 0x28]
mov esi, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x20]
mov dword [ebp - 0x50], 0x4ca594
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x42efb4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a7a2a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], 0
call fcn.0042f078
mov ebx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov edx, dword [eax + 0x2c]
lea ecx, [ebx + 0x14]
cmp edx, 0x10
jb 0x42f000
mov ebx, dword [ecx + 4]
jmp 0x42f003
add ebx, 0x18
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x42f04b
mov dword [ebp - 4], 0xffffffff
mov ebx, dword [ebp - 0x20]
mov eax, dword [ebx + 0x2c]
cmp eax, 0x10
jae 0x42f040
mov dword [ebx + 0x2c], 0xf
xor eax, eax
mov dword [ebx + 0x28], eax
mov byte [ebx + 0x18], al
mov ebx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push dword [ebx + 0x18]
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
pop ecx
jmp 0x42f020
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov edx, dword [eax + 0x2c]
lea ecx, [ebx + 0x14]
cmp edx, 0x10
jb 0x42f069
mov ebx, dword [ecx + 4]
jmp 0x42f06c
add ebx, 0x18
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x42f00e

Function at 0x42f0fc
Capabilities:
Clear file content

Disassembly:
push edi
sub esp, 0x10
mov edi, ecx
mov eax, dword [edi + 0xc]
cmp eax, 0xffffffff
je 0x42f13f
mov eax, dword [edi + 4]
test eax, eax
je 0x42f1cf
mov ecx, edi
call fcn.0042f1e4
cmp eax, dword [edi + 8]
je 0x42f135
mov ecx, edi
call fcn.0042f1e4
push eax
mov ecx, edi
call fcn.0042f1fc
add esp, 0x10
pop edi
ret
mov eax, 1
add esp, 0x10
pop edi
ret
mov ecx, edi
call fcn.0042f268
mov eax, dword [edi + 0xc]
cmp eax, 0xffffffff
je 0x42f1c8
mov eax, dword [edi + 8]
test eax, eax
jne 0x42f1a8
mov ecx, edi
call fcn.0042f0b0
mov eax, dword [edi + 8]
cmp eax, 1
jae 0x42f19e
mov eax, 1
mov dword [esp + 8], eax
mov dword [edi + 8], eax
xor edx, edx
mov dword [esp + 0xc], edx
lea eax, [esp]
push edx
push eax
push 0
push 1
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x42f199
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x42f19e
mov eax, dword [edi + 8]
jmp 0x42f1a8
mov ecx, edi
call fcn.0042f2c0
mov eax, dword [edi + 8]
test eax, eax
jbe 0x42f1b3
mov ecx, edi
call fcn.0042f2c0
mov edx, dword [edi + 4]
xor eax, eax
mov ecx, 1
cmp edx, 0
cmovne eax, ecx
add esp, 0x10
pop edi
ret
xor eax, eax
add esp, 0x10
pop edi
ret
mov ecx, edi
call fcn.0042f1e4
push eax
mov ecx, edi
call fcn.0042f1fc
add esp, 0x10
pop edi
ret

Function at 0x42f1e4
Capabilities:
Get file size

Disassembly:
sub esp, 8
lea eax, [esp]
push eax
push dword [ecx + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [esp]
add esp, 8
ret
Function at 0x42f1fc
Capabilities:
Clear file content

Disassembly:
push esi
push ebx
sub esp, 0x10
mov esi, ecx
mov ebx, dword [esp + 0x1c]
mov ecx, esi
call fcn.0042f0b0
test ebx, ebx
jne 0x42f21b
mov ecx, esi
call fcn.0042f1e4
mov ebx, eax
cmp ebx, dword [esi + 8]
jbe 0x42f259
mov dword [esp + 8], ebx
lea eax, [esp]
mov dword [esi + 8], ebx
xor edx, edx
mov dword [esp + 0xc], edx
push edx
push eax
push 0
push ebx
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x42f24f
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x42f259
xor eax, eax
add esp, 0x10
pop ebx
pop esi
ret 4
mov ecx, esi
call fcn.0042f2c0
add esp, 0x10
pop ebx
pop esi
ret 4

Function at 0x430924
Capabilities:
Get process image filename

Disassembly:
push ebp
push ebx
push edx
push eax
mov eax, 0x2008
call fcn.0049e080
mov edx, dword [esp + 0x200c]
mov eax, dword [esp + 0x2008]
mov ebp, edx
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
lea ecx, [esp + 0x200c]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x430a27
mov ecx, dword [esp + 0x200c]
cmp ecx, 0x103
je 0x43097f
xor ebp, ebp
jmp 0x430a29
lea ecx, [esp + 0x1000]
push 0x1000
push ecx
push ebx
call sub.PSAPI.DLL_GetProcessImageFileNameA
test eax, eax
jne 0x43099d
xor ebp, ebp
jmp 0x430a29
movsx ecx, byte [esp + 0x1000]
lea edx, [esp]
lea eax, [esp + 0x1000]
test ecx, ecx
je 0x430a04
mov dword [esp + 0x2000], ebp
mov ebp, eax
mov dword [esp + 0x2008], esi
mov dword [esp + 0x2004], edi
mov esi, ebx
mov ebx, edx
mov ecx, ebp
movsx edi, byte [ecx]
push edi
add ebp, 1
call dword [sym.imp.MSVCR80.dll_toupper]
pop ecx
movsx ecx, byte [ebp]
mov byte [ebx], al
add ebx, 1
test ecx, ecx
jne 0x4309ce
mov ebp, dword [esp + 0x2000]
mov edi, dword [esp + 0x2004]
mov edx, ebx
mov ebx, esi
mov esi, dword [esp + 0x2008]
mov byte [edx], 0
lea ecx, [esp]
push ebp
push ecx
call dword [sym.imp.MSVCR80.dll_strstr]
add esp, 8
mov edx, 1
cmp eax, 0
mov ebp, 0
cmovne ebp, edx
jmp 0x430a29
xor ebp, ebp
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebp
add esp, 0x2010
pop ebx
pop ebp
ret

Function at 0x430a3c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a7a90
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 0
push 4
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x24], eax
test eax, eax
je 0x430a8e
mov edx, dword [ebp + 8]
mov dword [ebp - 0x28], 0
mov dword [eax], edx
jmp 0x430a90
xor eax, eax
mov dword [ebp - 4], 0xffffffff
lea edx, [ebp - 0x20]
push edx
xor ecx, ecx
mov dword [ebp - 0x20], ecx
push ecx
push eax
push 0x4308a0
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x460c88
Capabilities:
Delete file

Disassembly:
sub esp, 0x800
lea edx, [esp]
push 0x400
push edx
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [esp]
push eax
call dword [sym.imp.MSVCR80.dll__wremove]
pop ecx
test eax, eax
je 0x460cbf
xor eax, eax
add esp, 0x800
ret
mov eax, 1
add esp, 0x800
ret

Function at 0x460ccc
Capabilities:
Delete file
Move file

Disassembly:
push ebp
push edx
push eax
mov eax, 0xff8
call fcn.0049e080
mov edx, dword [esp + 0xffc]
mov eax, dword [esp + 0xff8]
mov ebp, edx
lea ecx, [esp]
push 0x400
push ecx
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [esp + 0x800]
push 0x400
push eax
push 0xffffffffffffffff
push ebp
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [esp + 0x800]
push eax
call dword [sym.imp.MSVCR80.dll__wremove]
lea edx, [esp + 4]
lea eax, [esp + 0x804]
push eax
push edx
call dword [sym.imp.MSVCR80.dll__wrename]
add esp, 0xc
test eax, eax
je 0x460d51
xor eax, eax
add esp, 0x1000
pop ebp
ret
mov eax, 1
add esp, 0x1000
pop ebp
ret
Function at 0x4a3bf0
Capabilities:
Get file version info

Disassembly:
sub esp, 0xc
test ebx, ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
je 0x4a3c03
mov dword [ebx], 0
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4a3c11
mov dword [eax], 0
lea eax, [esp + 0xc]
push eax
push ebp
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x4a3c77
push edi
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
push esi
push 0
push ebp
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4a3c6f
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x10]
push edx
push 0x4b1a30
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4a3c6f
test ebx, ebx
mov ecx, dword [esp + 0xc]
je 0x4a3c62
mov eax, dword [ecx + 8]
mov dword [ebx], eax
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4a3c6f
mov ecx, dword [ecx + 0xc]
mov dword [eax], ecx
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
pop ebp
add esp, 0xc
ret

Function at 0x4a3dd0
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x100
push esi
push edi
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [esp + 0xc]
push str.QTMLInitTermMutex_lx
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 8]
push ecx
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
test edi, edi
je 0x4a3e10
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x4b6ebc]
test eax, eax
jle 0x4a3e21
inc eax
mov dword [0x4b6ebc], eax
jmp 0x4a3e7a
push str.QuickTime.qts
call fcn.004a4a20
add esp, 4
test eax, eax
mov dword [0x4b6ec0], eax
jne 0x4a3e98
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0xfffff7d3
mov eax, dword [0x4b6ec0]
test eax, eax
je 0x4a3e5c
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x4b6ec0], 0
mov eax, 0x4a3be0
mov dword [0x4b5d98], 0x4a3d70
mov dword [0x4b5da8], eax
mov dword [0x4b5dac], eax
mov dword [0x4b5da4], eax
test edi, edi
je 0x4a3e8c
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov ax, si
pop esi
add esp, 0x100
ret
call fcn.004a3d70
mov esi, eax
test si, si
jne 0x4a3e42
mov edx, dword [esp + 0x10c]
push edx
call fcn.004a3bc0
add esp, 4
mov esi, eax
test si, si
jne 0x4a3e42
inc dword [0x4b6ebc]
jmp 0x4a3e7a
Function at 0x4a4690
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
mov eax, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x14]
lea ecx, [esp + 4]
push ecx
push 1
push 0
push edx
push 0x80000002
mov dword [esp + 0x18], 0
mov dword [esp + 0x2c], eax
mov byte [esi], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4a472d
mov eax, dword [esp + 4]
test eax, eax
je 0x4a473c
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a472d
cmp byte [esi], 0
je 0x4a472d
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4a46f2
sub eax, edx
cmp byte [eax + esi - 1], 0x5c
je 0x4a472d
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4a4707
sub eax, edx
cmp byte [eax + esi - 1], 0x2f
je 0x4a472d
dec esi
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x4a4718
mov ax, word [0x4b1a30]
push edi
mov edi, esi
mov word [edi], ax
pop edi
mov eax, dword [esp + 4]
test eax, eax
je 0x4a473c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ecx
ret