joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438564
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 0x10], eax
je 0x4386e8
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov dword [ebp - 8], ebx
je 0x4386e7
push esi
push edi
mov edi, dword [ebx]
add edi, 0x40
push edi
call fcn.00421245
mov esi, eax
test esi, esi
pop ecx
je 0x4386e5
push edi
push ebx
push esi
call fcn.00421530
mov edi, dword [esi]
add esp, 0xc
add edi, esi
and dword [ebp + 0xc], 0
mov ecx, dword [ebp + 0xc]
mov ecx, dword [edi + ecx*4]
xor eax, eax
cmp ecx, dword [eax*8 + 0x448198]
je 0x4385da
inc eax
cmp eax, 4
jb 0x4385c9
jmp 0x43863c
cmp dword [ebp + 0x10], 0
je 0x4385f6
cmp dword [eax*8 + 0x44819c], 0x12
je 0x43863c
mov eax, dword [ebp + 0xc]
mov dword [edi + eax*4], 0xffffff
jmp 0x43863c
lea ebx, [eax*8 + 0x44819c]
push dword [ebx]
mov dword [ebp - 4], ebx
call dword [sym.imp.USER32.dll_GetSysColor]
push dword [ebx]
movzx eax, ah
mov dword [ebp + 8], eax
call dword [sym.imp.USER32.dll_GetSysColor]
mov ecx, dword [ebp + 8]
mov ch, al
mov eax, ebx
push dword [eax]
shl ecx, 8
mov dword [ebp + 8], ecx
call dword [sym.imp.USER32.dll_GetSysColor]
mov ecx, dword [ebp + 8]
shr eax, 0x10
movzx eax, al
or ecx, eax
mov eax, dword [ebp + 0xc]
mov dword [edi + eax*4], ecx
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], 0x10
jl 0x4385c1
mov edi, dword [esi + 4]
mov ebx, dword [esi + 8]
push 0
mov dword [ebp + 8], edi
mov dword [ebp + 0xc], ebx
call dword [sym.imp.USER32.dll_GetDC]
push ebx
push edi
push eax
mov dword [ebp + 0x10], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
test eax, eax
mov dword [ebp - 4], eax
je 0x4386c7
push dword [ebp + 0x10]
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [ebp - 4]
mov ebx, dword [sym.imp.GDI32.dll_SelectObject]
mov edi, eax
push edi
call ebx
mov cl, byte [esi + 0xe]
push 0xcc0020
xor edx, edx
inc edx
shl edx, cl
mov ecx, dword [ebp - 8]
mov dword [ebp - 0xc], eax
xor eax, eax
push eax
push esi
lea ecx, [ecx + edx*4 + 0x28]
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
push eax
push edi
call dword [sym.imp.GDI32.dll_StretchDIBits]
push dword [ebp - 0xc]
push edi
call ebx
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp + 0x10]
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push esi
call fcn.0042112d
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x43a27f
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push esi
push edi
mov edi, dword [ebp + 8]
push edi
mov esi, ecx
call fcn.00430312
test eax, eax
jne 0x43a46f
mov edi, dword [edi + 4]
push ebx
mov ecx, esi
call fcn.00416dd4
test byte [esi + 0x7c], 0x20
mov dword [ebp - 0x10], eax
mov ebx, 0x201
jne 0x43a2c3
cmp edi, ebx
je 0x43a2c3
cmp edi, 0x202
jne 0x43a41c
cmp edi, 0x200
jb 0x43a2d3
cmp edi, 0x209
jbe 0x43a2eb
cmp edi, 0xa0
jb 0x43a41c
cmp edi, 0xa9
ja 0x43a41c
call fcn.0043dc61
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
push dword [esi + 0x1c]
mov dword [ebp - 0x18], ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
push 0x30
lea eax, [ebp - 0x48]
push 0
push eax
call fcn.004214b0
mov eax, dword [esi]
add esp, 0xc
lea ecx, [ebp - 0x48]
push ecx
push dword [ebp - 0x14]
mov ecx, esi
push dword [ebp - 0x18]
mov dword [ebp - 0x48], 0x28
call dword [eax + 0x6c]
cmp dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 4], eax
je 0x43a349
push dword [ebp - 0x24]
call fcn.0042112d
pop ecx
cmp edi, ebx
jne 0x43a35c
test byte [ebp - 0x41], 0x80
je 0x43a35c
mov dword [ebp - 8], 1
jmp 0x43a37a
and dword [ebp - 8], 0
cmp edi, ebx
je 0x43a37a
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x43a37a
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x78]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x43a3e6
cmp dword [ebp - 8], 0
jne 0x43a3e6
cmp edi, 0x202
jne 0x43a3a6
mov eax, dword [esi]
push 0xffffffffffffffff
mov ecx, esi
call dword [eax + 0x160]
push 0xc8
push 0xe001
jmp 0x43a3ce
test byte [esi + 0x78], 8
jne 0x43a3d7
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x43a3d7
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
cmp eax, dword [ecx + 0x78]
je 0x43a413
push 0x12c
push 0xe000
mov ecx, esi
call fcn.00439930
jmp 0x43a413
push dword [ebp - 4]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x160]
jmp 0x43a413
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x43a3f9
cmp dword [ebp - 8], 0
je 0x43a413
mov eax, dword [esi]
push 0xffffffffffffffff
mov ecx, esi
call dword [eax + 0x160]
push 0xe001
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x78], eax
mov ecx, esi
call fcn.0043211a
test eax, eax
pop ebx
je 0x43a42e
cmp dword [eax + 0x64], 0
jne 0x43a474
cmp dword [ebp - 0x10], 0
je 0x43a456
mov edi, dword [ebp - 0x10]
push dword [ebp + 8]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x100]
test eax, eax
jne 0x43a46f
mov ecx, edi
call fcn.004320db
test eax, eax
mov dword [ebp - 0x10], eax
jne 0x43a434
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x43a474
push dword [ebp + 8]
mov ecx, esi
call fcn.00430d34
jmp 0x43a476
xor eax, eax
inc eax
jmp 0x43a476
xor eax, eax
pop edi
pop esi
leave
ret 4
Function at 0x43a875
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x45704c]
push esi
mov esi, ecx
cmp dword [esi + 0x50], 0
mov dword [ebp - 4], eax
je 0x43a8c2
push dword [ebp + 8]
call fcn.0043f8c0
mov esi, eax
test esi, esi
je 0x43a8ea
push edi
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push 0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
sete al
pop edi
jmp 0x43a8ea
push dword [ebp + 0x10]
lea eax, [ebp - 0x24]
push 0x4455b4
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push dword [esi + 0x64]
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 4]
pop esi
call fcn.004214a1
leave
ret 0xc
Function at 0x43cd69
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1058
call fcn.004208a0
mov edx, dword [ebp + 0xc]
mov eax, dword [0x45704c]
push ebx
xor ecx, ecx
cmp edx, ecx
push esi
mov dword [ebp - 4], eax
push edi
je 0x43ce91
cmp dword [ebp + 8], ecx
je 0x43ce91
mov eax, dword [ebp + 0x18]
mov esi, eax
mov edi, eax
and esi, 0x2e000000
and edi, 0x40000000
test eax, 0x90000000
mov dword [ebp - 0x1054], 0x824
mov dword [ebp - 0x1050], ecx
mov dword [ebp + 0x18], ecx
je 0x43cddf
cmp dword [edx + 0x30], ecx
je 0x43cddf
test eax, 0x2000000
je 0x43cdd9
mov dword [ebp + 0x18], 1
jmp 0x43cddf
or edi, 0x80000000
mov ebx, dword [sym.imp.WININET.dll_InternetCanonicalizeUrlW]
push esi
lea eax, [ebp - 0x1054]
push eax
lea eax, [ebp - 0x104c]
push eax
push dword [ebp + 8]
call ebx
test eax, eax
jne 0x43ce49
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x43ce91
mov eax, dword [ebp - 0x1054]
add eax, eax
push eax
call fcn.00434636
test eax, eax
pop ecx
mov dword [ebp - 0x1058], eax
je 0x43ce91
push esi
lea ecx, [ebp - 0x1054]
push ecx
push eax
push dword [ebp + 8]
mov dword [ebp - 0x1050], 1
call ebx
test eax, eax
jne 0x43ce51
push dword [ebp - 0x1058]
jmp 0x43ce8b
lea ebx, [ebp - 0x104c]
jmp 0x43ce57
mov ebx, dword [ebp - 0x1058]
mov esi, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
push edi
push ebx
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
cmp dword [ebp + 0x18], edi
mov dword [ebp + 8], eax
je 0x43ceae
push 0x2100000
push edi
push edi
push dword [esi + 0x2c]
call dword [sym.imp.SHLWAPI.dll_UrlUnescapeW]
test eax, eax
jge 0x43cea2
cmp dword [ebp - 0x1050], edi
je 0x43ce91
push ebx
call fcn.00434666
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.004214a1
leave
ret 0x14
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [esi + 0x30], eax
cmp dword [ebp - 0x1050], edi
je 0x43cebd
push ebx
call fcn.00434666
pop ecx
mov eax, dword [ebp + 8]
cmp eax, edi
jne 0x43cecf
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0x1000
jmp 0x43ce93
mov cx, word [esi + 0x18]
mov edx, dword [ebp + 0x14]
mov word [edx], cx
mov esi, dword [esi + 0xc]
dec esi
mov ecx, dword [ebp + 0x10]
je 0x43cf2d
dec esi
je 0x43cf22
dec esi
je 0x43cf17
dec esi
je 0x43cf0c
dec esi
je 0x43cf04
dec esi
je 0x43cefc
dec esi
jne 0x43cec7
mov dword [ecx], 0x1002
jmp 0x43ce93
mov dword [ecx], 0x1006
jmp 0x43ce93
mov dword [ecx], 0x1001
jmp 0x43ce93
mov dword [ecx], 0x100b
jmp 0x43ce93
mov dword [ecx], 3
jmp 0x43ce93
mov dword [ecx], 2
jmp 0x43ce93
mov dword [ecx], 1
jmp 0x43ce93
Function at 0x43dde9
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
cmp dword [ebp + 0xc], 0x800
mov eax, dword [0x45704c]
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
jne 0x43de47
push 0x4479a0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
mov esi, 0x112
lea eax, [ebp - 0x230]
push esi
push eax
call fcn.00421989
add esp, 0x10
cmp eax, 0xffffffff
je 0x43de5b
cmp eax, esi
jae 0x43de5b
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x43de5d
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x43de12
jmp 0x43de5e
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
call fcn.004214a1
leave
ret
Function at 0x43de7e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x45704c]
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor ebx, ebx
push 0x447a4c
mov dword [ebp - 4], eax
mov dword [ebp - 0x28], ebx
xor esi, esi
call edi
push 0x447a30
push eax
mov dword [ebp - 0x30], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x43df20
call eax
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov ebx, 0x3ff
mov edi, 0xfc00
mov dword [ebp - 0x28], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ecx, cx
and eax, edi
or eax, ecx
push eax
mov dword [ebp - 0x2c], ecx
call esi
push dword [ebp - 0x2c]
mov dword [ebp - 0x48], eax
call esi
push 0x447a14
push dword [ebp - 0x30]
mov dword [ebp - 0x44], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
mov dword [ebp - 0x28], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ebx, cx
and eax, edi
or eax, ebx
push eax
call esi
push ebx
mov dword [ebp - 0x40], eax
call esi
mov dword [ebp - 0x3c], eax
push 4
xor ebx, ebx
jmp 0x43e022
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x43dfd0
lea eax, [ebp - 0x2c]
push eax
push 0x20019
push ebx
push 0x4479c8
push SysReAllocStringLen
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43e023
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
push ebx
push ebx
push dword [ebp - 0x2c]
mov dword [ebp - 0x30], 0x20
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43dfc5
cmp dword [ebp - 0x34], 1
jne 0x43dfc5
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x24]
push 0x4479bc
push eax
call fcn.00421948
add esp, 0xc
cmp eax, 1
jne 0x43dfc5
mov eax, dword [ebp - 0x4c]
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov dword [ebp - 0x28], eax
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x48], eax
call esi
push 2
mov dword [ebp - 0x44], eax
pop esi
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43e023
push 0x4479a8
call edi
cmp eax, ebx
je 0x43e023
lea ecx, [ebp - 0x28]
push ecx
push 0x43de68
push 1
push 0x10
push eax
mov dword [ebp - 0x28], ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesW]
cmp word [ebp - 0x28], bx
je 0x43e023
movzx eax, word [ebp - 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x48], eax
call esi
mov dword [ebp - 0x44], eax
push 2
pop esi
mov dword [ebp + esi*4 - 0x48], 0x800
inc esi
xor edi, edi
cmp esi, ebx
jle 0x43e049
push dword [ebp + edi*4 - 0x48]
push dword [ebp + 8]
call fcn.0043dde9
cmp eax, ebx
pop ecx
pop ecx
jne 0x43e04b
inc edi
cmp edi, esi
jl 0x43e032
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.004214a1
leave
ret 4
Function at 0x43e05a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
xor edi, edi
mov dword [ecx + 0x9c], edi
cmp dword [0x456454], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
mov ebx, 0x456454
je 0x43e116
push esi
lea eax, [ebp - 4]
push eax
push 1
push edi
push dword [ebx]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43e0fe
mov esi, dword [ebx + 4]
jmp 0x43e0f8
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43e0e8
cmp dword [ebp - 0xc], 4
jne 0x43e0e8
cmp dword [ebp - 8], edi
mov eax, dword [ebp - 0x10]
mov ecx, dword [esi + 4]
je 0x43e0e0
or dword [eax + 0x9c], ecx
jmp 0x43e0e8
not ecx
and dword [eax + 0x9c], ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
add esi, 8
mov eax, dword [esi]
cmp eax, edi
jne 0x43e0ac
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebx, 8
cmp dword [ebx], edi
mov dword [ebp - 4], edi
jne 0x43e08f
pop esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
inc eax
pop ebx
leave
ret

Function at 0x43e4d2
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x442e7d
call fcn.00421510
sub esp, 0x220
mov eax, dword [0x45704c]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x228]
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov esi, eax
test esi, esi
jne 0x43e5cb
push 0x104
lea eax, [ebp - 0x220]
push eax
push 0
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov esi, eax
test esi, esi
jne 0x43e59f
and dword [ebp - 4], eax
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x224]
call fcn.00417066
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 0x228]
mov byte [ebp - 4], 1
call fcn.0043e4d2
mov ecx, dword [ebp - 0x224]
mov esi, eax
test esi, esi
setne bl
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.00401230
test bl, bl
jne 0x43e59f
or dword [ebp - 4], 0xffffffff
jmp 0x43e510
cmp esi, 0x103
je 0x43e5af
cmp esi, 0x3f2
jne 0x43e5bf
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
mov eax, esi
call fcn.004214a1
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x43ee86
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov dword [ebp - 4], ecx
call fcn.0043dc3b
mov esi, dword [eax + 0xc]
push 0xf1
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x43eec6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 8], eax
je 0x43eec6
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x43eeca
xor eax, eax
jmp 0x43ef47
movzx eax, word [esi + 6]
push ebx
shl eax, 2
push edi
push eax
call fcn.00434636
mov edi, eax
xor eax, eax
cmp word [esi + 6], ax
pop ecx
jbe 0x43eef8
lea ecx, [esi + 8]
movzx edx, word [ecx]
mov dword [edi + eax*4], edx
movzx edx, word [esi + 6]
inc eax
inc ecx
inc ecx
cmp eax, edx
jl 0x43eee7
movzx eax, word [esi + 6]
mov ecx, dword [ebp - 4]
push eax
push edi
call fcn.0043eaca
push edi
mov ebx, eax
call fcn.00434666
test ebx, ebx
pop ecx
je 0x43ef3a
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
push ecx
lea esi, [ecx + 7]
mov ecx, dword [ebp - 4]
push eax
lea edx, [eax + 7]
push esi
push edx
call fcn.0043ed0c
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.0043ed93
mov ebx, eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, ebx
pop ebx
pop esi
leave
ret 4

Function at 0x43f225
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x43f25a
cmp edi, dword [esi + 0xc]
jge 0x43f25a
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x43f25a
cmp edi, dword [eax + 8]
jge 0x43f25a
mov eax, dword [eax + 0xc]
mov edi, dword [eax + edi*4]
jmp 0x43f25c
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x43f360
Capabilities:
Allocate thread local storage

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x18], 4
mov dword [esi + 4], eax
mov dword [esi + 8], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x43f394
jmp fcn.0042de77
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
ret
Function at 0x43f405
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x1c]
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
jle 0x43f4fe
cmp eax, dword [edi + 0xc]
jge 0x43f4fe
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
je 0x43f456
mov ecx, dword [ebp + 8]
cmp ecx, dword [esi + 8]
jl 0x43f4e7
cmp dword [ebp + 0xc], ebx
je 0x43f4e7
jmp 0x43f480
push 0x10
call fcn.0043f0f1
cmp eax, ebx
je 0x43f46c
mov ecx, eax
call fcn.0043f357
mov esi, eax
jmp 0x43f46e
xor esi, esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [esi + eax], ecx
mov dword [edi + 0x14], esi
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x43f497
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x43f4a7
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
cmp eax, ebx
jne 0x43f4b9
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0042de77
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], eax
mov edx, dword [edi + 0xc]
sub edx, ecx
shl edx, 2
push edx
lea eax, [eax + ecx*4]
push ebx
push eax
call fcn.004214b0
mov eax, dword [edi + 0xc]
add esp, 0xc
push esi
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x43f4f9
cmp ecx, dword [esi + 8]
jge 0x43f4f9
mov edx, dword [ebp + 0xc]
mov dword [eax + ecx*4], edx
push dword [ebp - 4]
jmp 0x43f4ff
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x43f5be
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x43f5ec
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x43f60a
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0043f528
jmp 0x43f60a
mov eax, dword [esi + 0x14]
test eax, eax
je 0x43f60a
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.0043f528
test edi, edi
mov eax, edi
jne 0x43f5f4
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x45a0d4]
test ecx, ecx
je 0x43f6bd
jmp 0x43f5bd
ret 8
Function at 0x405cf0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push edi
xor edi, edi
test ebx, ebx
je 0x405e9e
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseEventLog]
nop dword [eax]
push 0
call esi
add byte [edi + ebp], 5
push 0
call esi
add byte [edi + ebp], 0x61
push 0
call esi
xor byte [edi + ebp], 0x87
push 0
call esi
add byte [edi + ebp], 0x55
push 0
call esi
add byte [edi + ebp], 0xfd
push 0
call esi
add byte [edi + ebp], 0xe9
push 0
call esi
push 0
call esi
xor byte [edi + ebp], 0x3b
push 0
call esi
add byte [edi + ebp], 0x68
push 0
call esi
add byte [edi + ebp], 0x45
push 0
call esi
xor byte [edi + ebp], 0xc1
push 0
call esi
add byte [edi + ebp], 0x2f
push 0
call esi
add byte [edi + ebp], 0x75
push 0
call esi
add byte [edi + ebp], 0xa9
push 0
call esi
add byte [edi + ebp], 0xce
push 0
call esi
add byte [edi + ebp], 0x1e
push 0
call esi
xor byte [edi + ebp], 0x51
push 0
call esi
add byte [edi + ebp], 0xe7
push 0
call esi
add byte [edi + ebp], 0x14
push 0
call esi
add byte [edi + ebp], 0xc8
push 0
call esi
add byte [edi + ebp], 0x4a
push 0
call esi
add byte [edi + ebp], 0xd5
push 0
call esi
add byte [edi + ebp], 0x2d
push 0
call esi
add byte [edi + ebp], 0x65
push 0
call esi
add byte [edi + ebp], 0x3a
push 0
call esi
xor byte [edi + ebp], 0x17
push 0
call esi
add byte [edi + ebp], 0x90
push 0
call esi
add byte [edi + ebp], 0xa7
push 0
call esi
add byte [edi + ebp], 0xf8
push 0
call esi
add byte [edi + ebp], 0x7c
push 0
call esi
add byte [edi + ebp], 0xe7
push 0
call esi
xor byte [edi + ebp], 0xb3
push 0
call esi
xor byte [edi + ebp], 9
push 0
call esi
xor byte [edi + ebp], 0x60
push 0
call esi
add byte [edi + ebp], 0x4d
push 0
call esi
add byte [edi + ebp], 0xd4
push 0
call esi
xor byte [edi + ebp], 0xbf
push 0
call esi
add byte [edi + ebp], 0xf6
push 0
call esi
add byte [edi + ebp], 0xe2
push 0
call esi
xor byte [edi + ebp], 0x41
push 0
call esi
add byte [edi + ebp], 0x83
push 0
call esi
xor byte [edi + ebp], 0x15
push 0
call esi
add byte [edi + ebp], 0x52
push 0
call esi
xor byte [edi + ebp], 0xb9
push 0
call esi
add byte [edi + ebp], 0x60
push 0
call esi
xor byte [edi + ebp], 0xa5
push 0
call esi
add byte [edi + ebp], 0xfc
push 0
call esi
add byte [edi + ebp], 0xb8
push 0
call esi
dec byte [edi + ebp]
inc edi
cmp edi, ebx
jb 0x405d10
pop esi
pop ebp
pop edi
pop ebx
ret