joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a180
Capabilities:
Terminate thread

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
mov dword [esi], 0x426fd8
je 0x40a1c4
lea ecx, [esp + 4]
push ecx
push eax
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov edx, dword [esp + 4]
xor eax, eax
cmp edx, 0x103
sete al
test eax, eax
je 0x40a1c4
mov edx, dword [esi + 4]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push edi
lea edi, [esi + 0x2c]
mov ecx, edi
call fcn.00407fc0
mov eax, dword [edi + 4]
push eax
call fcn.00419d46
mov dword [edi + 4], 0
mov eax, dword [esi + 0x28]
add esp, 4
cmp eax, 0xffffffff
pop edi
je 0x40a1f9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x28], 0xffffffff
lea ecx, [esi + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov ecx, esi
call 0x405400
pop esi
pop ecx
ret

Function at 0x40a660
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42496b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
xor ebp, ebp
mov dword [esp + 8], esi
mov dword [esi + 0xc], ebp
mov dword [esi + 8], ebp
mov dword [esp + 0x14], ebp
mov dword [esi + 0x24], ebp
mov dword [esi + 0x20], ebp
mov dword [esi + 0x28], ebp
mov dword [esi + 0x2c], ebp
xor eax, eax
lea ecx, [esi + 0x30]
mov edx, ecx
mov dword [edx], eax
mov dword [edx + 4], eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov byte [esp + 0x14], 2
mov dword [edx + 0x14], eax
call fcn.00401040
cmp eax, ebp
jge 0x40a6c2
push eax
call fcn.00401000
push edi
lea edi, [esi + 0x48]
mov ecx, edi
mov byte [esp + 0x18], 3
call fcn.00403440
mov dword [edi + 4], eax
mov byte [eax + 0x15], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], ebp
lea edi, [esi + 0x54]
mov ecx, edi
mov byte [esp + 0x18], 4
call fcn.00403480
mov dword [edi + 4], eax
mov byte [eax + 0x29], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], ebp
lea ecx, [esi + 0x60]
call fcn.00405700
mov dword [esi + 0x13c], ebp
xor eax, eax
lea ecx, [esi + 0x140]
mov edx, ecx
mov dword [edx], eax
mov dword [edx + 4], eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov byte [esp + 0x18], 7
mov dword [edx + 0x14], eax
call fcn.00401040
cmp eax, ebp
pop edi
jge 0x40a755
push eax
call fcn.00401000
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x130], ebp
mov dword [esi + 0x138], ebp
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x413553
Capabilities:
Get file size

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi + 4]
push str.GetFileSizeEx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov ecx, dword [esi]
jne 0x41357a
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
xor edx, edx
pop esi
add esp, 8
ret
lea edx, [esp + 4]
push edx
push ecx
call eax
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
pop esi
add esp, 8
ret

Function at 0x413e30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x424f2a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x628
mov eax, dword [0x42d5a0]
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x62c], eax
xor edi, edi
mov dword [esi + 8], edi
mov eax, dword [0x42e734]
mov ecx, 0x42e734
mov dword [esp + 0xc], esi
lea ebx, [esi + 0x10]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov dword [esp + 0x63c], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
lea ecx, [esp + 0x420]
push ecx
push 0x104
mov byte [esp + 0x644], 2
mov dword [esi + 0xc], edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov word [esp + 0x10], di
xor eax, eax
mov ecx, 0x103
lea edi, [esp + 0x12]
rep stosd dword es:[edi], eax
push 0x40f
lea edx, [esp + 0x14]
stosw word es:[edi], ax
push edx
lea eax, [esp + 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea ecx, [esp + 0x10]
push ecx
call fcn.00419e1e
add esp, 4
push eax
lea edx, [esp + 0x14]
push edx
mov ecx, ebx
call fcn.00401520
mov ecx, dword [esp + 0x634]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x62c]
mov eax, esi
call fcn.00419c7e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x413f20
Capabilities:
Delete file

Disassembly:
mov eax, dword [ecx + 0xc]
sub esp, 0xc
test eax, eax
je 0x413fd5
mov eax, dword [ecx + 0x18]
test eax, eax
push esi
lea esi, [ecx + 0x18]
je 0x413fd4
mov ecx, dword [esi]
push ebx
mov ebx, dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
push ebp
push edi
lea eax, [esp + 0x14]
push eax
push 1
push ecx
xor edi, edi
call ebx
test eax, eax
jl 0x413fcb
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, edi
mov eax, dword [esi]
lea edx, [esp + 0x18]
push edx
push 1
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
test eax, eax
jl 0x413fcb
mov ecx, dword [esp + 0x18]
sub ecx, dword [esp + 0x14]
inc ecx
cmp edi, ecx
jae 0x413fd1
push edi
mov ecx, esi
call fcn.00413070
mov edx, dword [eax]
push edx
lea ecx, [esp + 0x14]
call fcn.004080a0
mov eax, dword [esp + 0x10]
push eax
call ebp
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x413fba
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esi]
lea eax, [esp + 0x14]
push eax
push 1
push ecx
inc edi
call ebx
test eax, eax
jge 0x413f60
push eax
call fcn.00401000
pop edi
pop ebp
pop ebx
pop esi
add esp, 0xc
ret
Function at 0x414960
Capabilities:
Access the windows event log

Disassembly:
sub esp, 0x208
mov eax, dword [0x42d5a0]
mov ecx, dword [esp + 0x210]
mov dword [esp + 0x204], eax
push esi
lea eax, [esp + 0x218]
push eax
push ecx
lea edx, [esp + 0x10]
push edx
call fcn.00419ca8
mov esi, dword [esp + 0x21c]
lea eax, [esp + 0x14]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x260]
add esp, 0xc
test eax, eax
jne 0x4149b6
lea ecx, [esp + 8]
push ecx
call fcn.0041a779
add esp, 4
add esi, 0x40
push esi
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x4149e9
push 0
lea edx, [esp + 8]
push edx
push 0
push 1
push 0
push 0
push 0
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, dword [esp + 0x208]
pop esi
call fcn.00419c7e
add esp, 0x208
ret

Function at 0x414d30
Capabilities:
Query or enumerate registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi]
shl eax, 1
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x10]
push esi
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push eax
push 0
mov dword [edi], 0
mov eax, dword [ecx]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x414d9d
mov eax, dword [esp + 0x10]
cmp eax, 1
je 0x414d75
cmp eax, 2
jne 0x414d8d
test esi, esi
mov eax, dword [esp + 0x14]
je 0x414d97
test al, 1
jne 0x414d8d
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x414d97
pop edi
mov eax, 0xd
pop esi
ret 0xc
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop edi
pop esi
ret 0xc
Function at 0x4153f0
Capabilities:
Delete service
Stop service

Disassembly:
mov eax, 0x1020
call fcn.00419c10
mov eax, dword [0x42d5a0]
push ebx
push ebp
push esi
push edi
push 0xf003f
xor ebx, ebx
push ebx
push ebx
mov dword [esp + 0x1038], eax
mov edi, ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x415559
mov ebp, dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push 1
add edi, 0x40
push edi
push esi
call ebp
test eax, eax
je 0x415444
push eax
mov ebx, 1
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebx, ebx
je 0x415559
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
jne 0x41548a
push 0x400
lea eax, [esp + 0x30]
push eax
push 0xd80a
call fcn.00414af0
add esp, 0xc
test eax, eax
jne 0x4154cb
push str.Could_not_open_Service_Manager
jmp 0x4154c0
push 0x10020
push edi
push ebx
call ebp
mov esi, eax
test esi, esi
jne 0x4154d8
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x400
lea eax, [esp + 0x30]
push eax
push 0xd80c
call fcn.00414af0
add esp, 0xc
test eax, eax
jne 0x4154cb
push str.Could_not_open_service
lea ecx, [esp + 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0
push edi
lea edx, [esp + 0x34]
push edx
jmp 0x4155b1
lea eax, [esp + 0x10]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x415540
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x426
je 0x415540
cmp eax, 0x425
jne 0x415505
cmp dword [esp + 0x14], 3
je 0x415540
push 0x400
lea ecx, [esp + 0x30]
push ecx
push 0xd80e
call fcn.00414af0
add esp, 0xc
test eax, eax
jne 0x415530
push str.Could_not_stop_service
lea edx, [esp + 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0
push edi
lea eax, [esp + 0x34]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebp, eax
call esi
push ebx
call esi
test ebp, ebp
je 0x415575
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x101c]
call fcn.00419c7e
add esp, 0x1020
ret
push 0x400
lea ecx, [esp + 0x830]
push ecx
push 0xd80d
call fcn.00414af0
add esp, 0xc
test eax, eax
jne 0x4155a6
push str.Could_not_delete_service
lea edx, [esp + 0x830]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0
push edi
lea eax, [esp + 0x834]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [esp + 0x102c]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
call fcn.00419c7e
add esp, 0x1020
ret
Function at 0x4161e0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push edi
push 1
push 4
push 0x42e78c
mov esi, ecx
call fcn.004152a0
mov edi, eax
test edi, edi
jne 0x416234
mov al, byte [esi + 0x3c]
test al, al
je 0x416238
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
test eax, eax
mov dword [esi + 0x30], eax
je 0x416229
lea eax, [esp + 8]
push eax
push edi
push esi
push 0x4155e0
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x416238
pop edi
mov eax, 0x80004005
pop esi
pop ecx
ret 4
mov byte [esi + 0x3c], 0
mov eax, edi
pop edi
pop esi
pop ecx
ret 4
Function at 0x4170e0
Capabilities:
Create service

Disassembly:
sub esp, 0xa18
mov eax, dword [0x42d5a0]
push ebx
push ebp
push esi
push edi
push 0xf003f
xor edi, edi
push edi
push edi
mov dword [esp + 0xa30], eax
mov ebx, ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x417137
push 1
lea eax, [ebx + 0x40]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
je 0x41712c
push eax
mov edi, 1
call ebp
push esi
call ebp
test edi, edi
jne 0x41728e
push 0x104
lea ecx, [esp + 0x1e]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4171c6
cmp eax, 0x104
je 0x4171c6
push 0xf003f
mov ecx, 0x22
push 0
mov word [esp + 0x20], cx
push 0
mov word [esp + eax*2 + 0x26], cx
mov word [esp + eax*2 + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x4171df
push 0x400
lea edx, [esp + 0x228]
push edx
push 0xd80a
call fcn.00414af0
add esp, 0xc
test eax, eax
jne 0x4171b0
push str.Could_not_open_Service_Manager
lea eax, [esp + 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0
add ebx, 0x40
push ebx
lea ecx, [esp + 0x22c]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xa14]
call fcn.00419c7e
add esp, 0xa18
ret
push 0
push 0
push str.RPCSS
push 0
push 0
lea edx, [esp + 0x2c]
push edx
push 1
push 3
push 0x110
push 0xf01ff
add ebx, 0x40
push ebx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov edi, eax
test edi, edi
jne 0x417255
push esi
call ebp
push 0x400
lea eax, [esp + 0x228]
push eax
push 0xd80b
call fcn.00414af0
add esp, 0xc
test eax, eax
jne 0x417245
push str.Could_not_start_service
lea ecx, [esp + 0x228]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0
push ebx
lea edx, [esp + 0x22c]
push edx
jmp 0x4171be
lea ecx, [esp + 0x10]
call fcn.00401460
push 0x66
lea ecx, [esp + 0x14]
call fcn.00405f20
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push 1
push edi
mov dword [esp + 0x20], eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push edi
call ebp
push esi
call ebp
lea ecx, [esp + 0x10]
call fcn.00401480
mov ecx, dword [esp + 0xa24]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
call fcn.00419c7e
add esp, 0xa18
ret
Function at 0x417a00
Capabilities:
Delete registry value

Disassembly:
sub esp, 8
call fcn.004153f0
test eax, eax
jne 0x417a15
mov eax, 0x80004005
add esp, 8
ret
push ebp
lea eax, [esp + 8]
push eax
push 0x20006
xor ebp, ebp
push ebp
push str.AppID
push SysReAllocString
mov dword [esp + 0x1c], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebp
je 0x417a49
push eax
call fcn.00401900
add esp, 4
pop ebp
add esp, 8
ret
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
push 0x20006
push str.215B82AF_10BB_4C82_ADF1_8A69743A0AAC
push edi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], ebp
call fcn.00401ac0
cmp eax, ebp
je 0x417a99
push eax
call fcn.00401900
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
mov eax, dword [esp + 0x14]
add esp, 4
cmp eax, ebp
je 0x417a88
push eax
call ebx
cmp edi, ebp
je 0x417a8f
push edi
call ebx
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
add esp, 8
ret
mov esi, dword [esp + 0x10]
push str.LocalService
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push ebp
call fcn.004179b0
test esi, esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, eax
je 0x417abe
push esi
call ebx
test edi, edi
je 0x417ac5
push edi
call ebx
pop edi
pop esi
pop ebx
mov eax, ebp
pop ebp
add esp, 8
ret
Function at 0x417ad0
Capabilities:
Delete registry value

Disassembly:
sub esp, 0x1c
push edi
mov edi, ecx
call fcn.004153f0
test eax, eax
jne 0x417aeb
mov eax, 0x80004005
pop edi
add esp, 0x1c
ret 4
mov ecx, dword [0x42e420]
push ebx
lea eax, [esp + 0x14]
push eax
push 1
push 0x65
xor ebx, ebx
push ecx
mov dword [esp + 0x24], 0x42801c
mov dword [esp + 0x28], str.215B82AF_10BB_4C82_ADF1_8A69743A0AAC
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call fcn.004177d0
cmp eax, ebx
jl 0x417c23
push esi
push 0x20006
push str.AppID
push SysReAllocString
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], ebx
call fcn.00401ac0
cmp eax, ebx
je 0x417b69
push eax
call fcn.00401900
mov esi, eax
mov eax, dword [esp + 0x10]
add esp, 4
cmp eax, ebx
je 0x417b5e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
pop edi
add esp, 0x1c
ret 4
mov esi, dword [esp + 0xc]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push str.215B82AF_10BB_4C82_ADF1_8A69743A0AAC
push esi
mov dword [esp + 0x34], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x417bed
mov eax, dword [esp + 0x10]
push str.LocalService
push eax
mov dword [esp + 0x18], eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp byte [esp + 0x2c], bl
je 0x417c0e
push 1
lea ecx, [edi + 0x40]
push ecx
push str.LocalService
lea ecx, [esp + 0x1c]
call fcn.00401b30
mov ecx, edi
call fcn.004170e0
test eax, eax
jne 0x417c0e
lea ecx, [esp + 0x10]
call fcn.00402780
lea ecx, [esp + 0xc]
call fcn.00402780
pop esi
pop ebx
mov eax, 0x80004005
pop edi
add esp, 0x1c
ret 4
push eax
call fcn.00401900
add esp, 4
cmp esi, ebx
mov edi, eax
je 0x417c03
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
mov eax, edi
pop edi
add esp, 0x1c
ret 4
lea ecx, [esp + 0x10]
call fcn.00402780
lea ecx, [esp + 0xc]
call fcn.00402780
xor eax, eax
pop esi
pop ebx
pop edi
add esp, 0x1c
ret 4
Function at 0x419b23
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.00419c10
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x419bbe
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x42eae0]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x419bbe
cmp eax, 1
je 0x419bdf
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x419bbe
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x419b8b
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x419bba
xor eax, eax
inc eax
jmp 0x419bfe
cmp edi, eax
jae 0x419bc2
xor eax, eax
jmp 0x419bfe
cmp eax, esi
jae 0x419bc9
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x42eae0]
jmp 0x419be2
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x419fcc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x419fe9
call fcn.0041b775
mov dword [eax], 0x16
xor eax, eax
jmp 0x41a053
push esi
push 0x8c
push 1
call fcn.0041ec65
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x41a03e
push esi
call fcn.0041c9a6
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x41a01c
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x419f37
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x41a052
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.004191e6
test ebx, ebx
pop ecx
je 0x41a050
push ebx
call fcn.0041b787
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41c6f6
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x41c724
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x41c72b
cmp ebx, dword [eax + 4]
jae 0x41c72b
xor eax, eax
jmp 0x41c91b
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x41c73c
xor eax, eax
inc eax
jmp 0x41c91a
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x41c752
cmp ecx, edx
jae 0x41c897
cmp dword [eax + 4], 0
je 0x41c75b
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x41c743
cmp dword [ebp + 8], 0
je 0x41c77d
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x41c897
cmp eax, esi
jae 0x41c897
mov eax, dword [0x42ea80]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x41c7a2
cmp dword [esi*4 + 0x42ea88], edi
je 0x41c89b
inc esi
cmp esi, eax
jl 0x41c790
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x41c917
cmp dword [ebp - 8], 0x1000000
jne 0x41c917
test byte [ebp - 0xc], 0xcc
je 0x41c820
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x41c917
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x41c917
cmp word [eax + 0x18], 0x10b
jne 0x41c917
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x41c917
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x41c820
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x41c820
test byte [ecx + 0x27], 0x80
jne 0x41c897
push 1
push 0x42eac8
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x41c734
mov ecx, dword [0x42ea80]
test ecx, ecx
mov edx, ecx
jle 0x41c854
lea eax, [ecx*4 + 0x42ea84]
cmp dword [eax], edi
je 0x41c854
dec edx
sub eax, 4
test edx, edx
jg 0x41c848
test edx, edx
jne 0x41c885
push 0xf
pop ebx
cmp ecx, ebx
jg 0x41c861
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x41c879
lea eax, [edx*4 + 0x42ea88]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x41c867
cmp ecx, 0x10
jge 0x41c885
inc ecx
mov dword [0x42ea80], ecx
push 0
push 0x42eac8
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x41c734
xor eax, eax
jmp 0x41c91a
test esi, esi
jle 0x41c734
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x42eac8
call ebx
test eax, eax
jne 0x41c734
cmp dword [esi*4 + 0x42ea88], edi
je 0x41c8f1
mov eax, dword [0x42ea80]
lea esi, [eax - 1]
test esi, esi
jl 0x41c8df
cmp dword [esi*4 + 0x42ea88], edi
je 0x41c8db
dec esi
jns 0x41c8cf
test esi, esi
jge 0x41c8ef
cmp eax, 0x10
jge 0x41c8ea
inc eax
mov dword [0x42ea80], eax
lea esi, [eax - 1]
jmp 0x41c8f1
je 0x41c909
xor ecx, ecx
test esi, esi
jl 0x41c909
lea eax, [ecx*4 + 0x42ea88]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x41c8f7
push 0
push 0x42eac8
call ebx
jmp 0x41c734
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret