joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d28cc
Capabilities:
Create process on windows
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0xc], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4d2a30
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x532ef0], 0x7d9
cmp si, 2
jne 0x4d2926
lea eax, [ebp - 0x20]
mov edx, dword [0x53451c]
mov edx, dword [edx]
call fcn.00404e38
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0xc]
mov edx, 0x4d2a48
call fcn.0046d3ec
jmp 0x4d2952
cmp si, 8
je 0x4d2932
cmp si, 1
jne 0x4d2952
lea eax, [ebp - 0x24]
mov edx, dword [0x53451c]
mov edx, dword [edx]
call fcn.00404e38
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0xc]
mov edx, 0x4d2a58
call fcn.0046d3ec
cmp dword [ebp - 0xc], 0
je 0x4d296d
push 1
lea eax, [ebp - 0xc]
call fcn.00404a84
push eax
call sub.kernel32.dll_WinExec
jmp 0x4d2a05
test si, 2
jne 0x4d2982
test si, 1
jne 0x4d2982
test si, 8
je 0x4d29eb
lea eax, [ebp - 4]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x4d29eb
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x28]
mov eax, 0x29
call fcn.004a94e4
mov eax, dword [ebp - 0x28]
call fcn.00404a2c
push eax
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle_1
test bl, bl
je 0x4d29f3
or si, 4
push 0
movzx eax, si
push eax
call sub.user32.dll_ExitWindowsEx
xor eax, eax
mov dword [0x532ef0], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d2a37
lea eax, [ebp - 0x28]
call fcn.0040457c
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00404cb0
lea eax, [ebp - 0xc]
call fcn.0040457c
ret

Function at 0x4d3650
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
mov dword [0x532ef0], 0x7e9
push 0
push 0x10
lea eax, [esp + 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathA
test eax, eax
je 0x4d3687
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.004047e4
jmp 0x4d368e
mov eax, ebx
call fcn.0040457c
xor eax, eax
mov dword [0x532ef0], eax
add esp, 0x108
pop ebx
ret

Function at 0x4d36a0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
mov dword [0x532ef0], 0x7ea
push 0
push 7
lea eax, [esp + 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathA
test eax, eax
je 0x4d36d7
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.004047e4
jmp 0x4d36de
mov eax, ebx
call fcn.0040457c
xor eax, eax
mov dword [0x532ef0], eax
add esp, 0x108
pop ebx
ret
Function at 0x4d6868
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x4d69a9
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x53b52c], 0
je 0x4d6959
mov dl, 1
mov eax, dword [0x414af0]
call fcn.00403740
mov edi, eax
mov edx, dword [0x53b520]
mov eax, 0x4d69c0
call fcn.00404b70
test eax, eax
jle 0x4d68e1
push 0x4d69cc
push dword [0x53b520]
push 0x4d69d8
push dword [0x53b524]
lea eax, [ebp - 8]
mov edx, 4
call fcn.004048f4
mov edx, dword [ebp - 8]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4d690e
push 0x4d69e4
push dword [0x53b520]
push 0x4d69c0
push dword [0x53b524]
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.004048f4
mov edx, dword [ebp - 0xc]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [0x534848]
mov edx, dword [edx]
lea eax, [ebp - 4]
mov ecx, 0x4d69f4
call fcn.00404880
mov edx, dword [ebp - 4]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x74]
push 1
mov eax, dword [0x53b528]
call fcn.00404a2c
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00404a2c
push eax
push 0x4d6a00
mov eax, esi
call fcn.0045dd60
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4d698e
push 1
mov eax, dword [0x53b528]
call fcn.00404a2c
push eax
mov eax, dword [0x53b524]
call fcn.00404a2c
push eax
mov eax, dword [0x53b520]
call fcn.00404a2c
push eax
push 0x4d6a00
mov eax, esi
call fcn.0045dd60
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d69b0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004045a0
ret
Function at 0x4ddb00
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4ddc17
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x532ef0], 0x808
lea edx, [ebp - 8]
mov eax, 0xfb
call fcn.004a94e4
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0xc]
mov edx, 0x53b19c
mov ecx, 0x105
call fcn.004047e4
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
pop ecx
call fcn.00404880
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00404e38
mov eax, dword [ebp - 0x10]
mov dx, 0xffff
call fcn.0046da4c
mov ebx, eax
test ebx, ebx
je 0x4ddbe0
mov ecx, dword [esi + 4]
sub ecx, 0x20
lea edx, [esi + 0x20]
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, ebx
call fcn.00403770
mov eax, 0xc8
call fcn.004d25dc
push 1
push 0x4ddc24
push 0x4ddc30
push dword [ebp - 4]
push 0x4ddc40
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004048f4
mov eax, dword [ebp - 0x14]
call fcn.00404a2c
push eax
lea edx, [ebp - 0x18]
mov eax, 0x62
call fcn.004a94e4
mov eax, dword [ebp - 0x18]
call fcn.00404a2c
push eax
push 0x4ddc44
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
mov dword [0x532ef0], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ddc1e
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004045a0
lea eax, [ebp - 0x10]
call fcn.00404c98
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004045a0
ret

Function at 0x4dfadc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4dfc3e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp word [0x53b2ac], 0
jbe 0x4dfb51
mov ax, word [0x532f30]
cmp ax, word [0x53b2ac]
jb 0x4dfb51
mov eax, dword [0x532ef8]
mov dword [0x532f20], eax
mov eax, dword [0x532efc]
mov dword [0x532f24], eax
mov word [0x532f30], 0
mov eax, dword [0x53a15c]
call fcn.0049dc18
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.004e39d0
mov dl, 1
mov ax, 2
call fcn.004d28cc
jmp 0x4dfc28
cmp word [0x53b2ae], 0
jbe 0x4dfbbf
mov ax, word [0x532f30]
cmp ax, word [0x53b2ae]
jb 0x4dfbbf
mov eax, dword [0x532ef8]
mov dword [0x532f20], eax
mov eax, dword [0x532efc]
mov dword [0x532f24], eax
mov word [0x532f30], 0
cmp dword [0x53b2b0], 0
je 0x4dfbbf
lea eax, [ebp - 4]
mov ecx, dword [0x53b2b0]
mov edx, 0x4dfc54
call fcn.00404880
lea eax, [ebp - 4]
call fcn.004d3850
push 0
lea eax, [ebp - 4]
call fcn.00404a84
push eax
call sub.kernel32.dll_WinExec
cmp word [0x53b2b4], 0
jbe 0x4dfc28
mov ax, word [0x532f30]
cmp ax, word [0x53b2b4]
jb 0x4dfc28
mov eax, dword [0x532ef8]
mov dword [0x532f20], eax
mov eax, dword [0x532efc]
mov dword [0x532f24], eax
mov word [0x532f30], 0
cmp dword [0x53b2b8], 0
je 0x4dfc28
lea eax, [ebp - 4]
mov edx, dword [0x53b2b8]
call fcn.00404614
lea eax, [ebp - 4]
call fcn.004d3850
push 0
lea eax, [ebp - 4]
call fcn.00404a84
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dfc45
lea eax, [ebp - 4]
call fcn.0040457c
ret
Function at 0x4e2d80
Capabilities:
Change the wallpaper

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4e2ea3
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x532ef0], 0x821
mov dl, 1
mov eax, dword [0x4221e0]
call fcn.0042881c
mov ebx, eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov edx, eax
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
mov edx, eax
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x34]
push esi
mov eax, ebx
call fcn.00428de4
xor ecx, ecx
xor edx, edx
call fcn.00423c10
lea edx, [ebp - 8]
mov eax, 0x105
call fcn.004a94e4
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, dword [0x53b2a4]
call fcn.00404880
mov edx, dword [ebp - 4]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, ebx
call fcn.00403770
lea edx, [ebp - 0xc]
mov eax, 0x106
call fcn.004a94e4
mov eax, dword [ebp - 0xc]
push eax
lea edx, [ebp - 0x10]
mov eax, 0xb0
call fcn.004a94e4
mov eax, dword [ebp - 0x10]
mov ecx, 0x4e2eb8
pop edx
call fcn.0046c0c0
lea edx, [ebp - 0x14]
mov eax, 0x107
call fcn.004a94e4
mov eax, dword [ebp - 0x14]
push eax
lea edx, [ebp - 0x18]
mov eax, 0xb0
call fcn.004a94e4
mov eax, dword [ebp - 0x18]
mov ecx, 0x4e2ec4
pop edx
call fcn.0046c0c0
push 3
lea eax, [ebp - 4]
call fcn.00404a84
push eax
push 0
push 0x14
call sub.user32.dll_SystemParametersInfoA
xor eax, eax
mov dword [0x532ef0], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e2eaa
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004045a0
ret
Function at 0x4e623c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4e6244
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a1c
xor eax, eax
push ebp
push 0x4e6446
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.00408d84
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x20]
call fcn.00404e38
mov eax, dword [0x53b31c]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4e6406
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov eax, dword [0x53b31c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x10]
mov eax, 0x4e6460
call fcn.00404b70
mov ebx, eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, ebx
sub ecx, 2
mov edx, 2
mov eax, dword [ebp - 0x10]
call fcn.00404a8c
mov eax, dword [ebp - 0x1c]
call fcn.004093f8
mov dword [0x53b618], eax
cmp dword [0x53b618], 4
je 0x4e63fa
lea eax, [ebp - 0x10]
mov ecx, ebx
mov edx, 1
call fcn.00404acc
mov eax, dword [ebp - 0x10]
mov edx, 0x4e646c
call fcn.00404978
jne 0x4e6313
mov byte [0x533634], 1
jmp 0x4e631a
mov byte [0x533634], 0
cmp byte [0x533634], 0
je 0x4e63b7
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
call fcn.00404614
mov ebx, 1
jmp 0x4e6363
mov eax, dword [ebp - 0x18]
mov al, byte [eax + ebx - 1]
cmp al, 0x61
jb 0x4e634e
mov edx, dword [ebp - 0x18]
cmp al, 0x7a
ja 0x4e634e
inc ebx
jmp 0x4e6363
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x400
mov edx, ebx
mov eax, dword [ebp - 0x18]
call fcn.00404a8c
jmp 0x4e636f
mov eax, dword [ebp - 0x18]
call fcn.00404834
cmp ebx, eax
jl 0x4e6339
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 0x18]
mov edx, 0x4e6480
call fcn.00404880
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x14]
call fcn.00405ae4
mov ebx, eax
cmp dword [ebp - 0x14], 0
jne 0x4e63b7
cmp ebx, 0x3e8
jbe 0x4e63b7
call sub.kernel32.dll_GetTickCount
cmp ebx, eax
jae 0x4e63b7
call sub.kernel32.dll_GetTickCount
sub eax, 0x30d40
cmp ebx, eax
jbe 0x4e63b7
mov byte [ebp - 5], 1
jmp 0x4e6406
cmp byte [0x533634], 0
je 0x4e63d3
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x10]
call fcn.00404978
jne 0x4e63d3
mov byte [ebp - 5], 1
jmp 0x4e6406
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 0x10]
call fcn.00404e38
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
call fcn.0040516c
test eax, eax
jle 0x4e63fa
mov byte [0x533634], 0
mov byte [ebp - 5], 1
jmp 0x4e6406
inc dword [ebp - 0xc]
dec dword [ebp - 0x2c]
jne 0x4e629d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e644d
lea eax, [ebp - 0x30]
call fcn.0040457c
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00404cb0
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.004045a0
lea eax, [ebp - 0x10]
call fcn.0040457c
lea eax, [ebp - 4]
call fcn.0040457c
ret
Function at 0x4e69b4
Capabilities:
Enumerate gui resources
Get graphical window text
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff74
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404a1c
xor eax, eax
push ebp
push 0x4e6aa7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41448c]
call fcn.00403740
mov edi, eax
push edi
push 0x4e653c
call sub.user32.dll_EnumWindows
mov ebx, dword [edi + 8]
dec ebx
test ebx, ebx
jl 0x4e6a8a
inc ebx
xor esi, esi
push 0x7f
lea eax, [ebp - 0x8c]
push eax
mov edx, esi
mov eax, edi
call fcn.00416da8
push eax
call sub.user32.dll_GetWindowTextA
test eax, eax
jle 0x4e6a82
lea eax, [ebp - 4]
call fcn.00404a84
mov edx, eax
lea eax, [ebp - 0x8c]
call fcn.00409d6c
test eax, eax
jne 0x4e6a82
lea eax, [ebp - 8]
push eax
mov edx, esi
mov eax, edi
call fcn.00416da8
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [ebp - 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
xor edx, edx
cmp edx, 0xffffffff
jne 0x4e6a66
cmp eax, 0xffffffff
je 0x4e6a82
cmp dword [ebp - 0xc], 0
je 0x4e6a82
push 0x31
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_TerminateProcess
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
inc esi
dec ebx
jne 0x4e6a01
mov eax, edi
call fcn.00403770
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e6aae
lea eax, [ebp - 4]
call fcn.0040457c
ret

Function at 0x4e6ab8
Capabilities:
Terminate process

Disassembly:
push ebx
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov ebx, eax
mov eax, ebx
xor edx, edx
cmp edx, 0xffffffff
jne 0x4e6ad1
cmp eax, 0xffffffff
je 0x4e6ae5
test ebx, ebx
je 0x4e6ae5
push 0x31
push ebx
call sub.kernel32.dll_TerminateProcess
push ebx
call sub.kernel32.dll_CloseHandle_1
pop ebx
ret
Function at 0x4ef6f8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa4
mov ebp, edx
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
mov dl, 1
mov eax, dword [0x41448c]
call fcn.00403740
mov esi, eax
push esi
push 0x4ef6e0
call sub.user32.dll_EnumWindows
mov edi, dword [esi + 8]
dec edi
test edi, edi
jl 0x4ef778
inc edi
xor ebx, ebx
mov edx, ebx
mov eax, esi
call fcn.00416da8
cmp ebp, eax
je 0x4ef774
push 0x50
lea eax, [esp + 0xc]
push eax
mov edx, ebx
mov eax, esi
call fcn.00416da8
push eax
call sub.user32.dll_GetClassNameA
test eax, eax
jle 0x4ef774
lea eax, [esp + 8]
mov edx, dword [esp]
call fcn.00409d6c
test eax, eax
jne 0x4ef774
mov edx, ebx
mov eax, esi
call fcn.00416da8
mov dword [esp + 4], eax
jmp 0x4ef778
inc ebx
dec edi
jne 0x4ef72e
mov eax, esi
call fcn.00403770
mov eax, dword [esp + 4]
add esp, 0x5c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4ef7f4
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff74
push ebx
xor ecx, ecx
mov dword [ebp - 0x8c], ecx
mov dword [ebp - 0x88], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x4ef8af
push dword fs:[edx]
mov dword fs:[edx], esp
test al, al
jne 0x4ef847
lea ecx, [ebp - 0x88]
mov edx, 0x4ef8c4
mov eax, 0x4ef8d8
call fcn.0046c2ec
mov eax, dword [ebp - 0x88]
mov edx, ebx
call fcn.00408d84
cmp dword [ebx], 0
jne 0x4ef891
mov dword [ebp - 4], 0x21
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x83]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4ef891
lea eax, [ebp - 0x83]
call fcn.00409c6c
mov byte [ebp - 0x84], al
lea eax, [ebp - 0x8c]
lea edx, [ebp - 0x84]
call fcn.004047d8
mov eax, dword [ebp - 0x8c]
mov edx, ebx
call fcn.00408d84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ef8b6
lea eax, [ebp - 0x8c]
mov edx, 2
call fcn.004045a0
ret
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x402954
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4029ec
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4029cc
xor eax, eax
push ebp
push 0x4029c5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402a08
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4029cc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
jmp 0x41b3a8

Function at 0x404e58
Capabilities:
Get file size

Disassembly:
push ebx
mov ebx, eax
mov edx, dword [ebx + 4]
sub edx, 0xd7b1
cmp edx, 2
ja 0x404e88
push 0
push dword [ebx]
call sub.kernel32.dll_GetFileSize
cmp eax, 0xffffffff
je 0x404e7e
jmp 0x4191ea
pop ebx
ret
jmp 0x41f04a
mov eax, 0x67
call fcn.0040267c
or eax, 0xffffffff
jmp 0x404e7c

Function at 0x40771c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x407755
mov ecx, eax
dec ecx
jmp 0x41a837
mov eax, ebx
mov edx, esi
jmp 0x418423
Function at 0x407b00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
call fcn.00407b09
Function at 0x4359a0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov byte [ecx], 0
xor eax, eax
mov dword [ecx + 4], eax
push str.A946A6A9_917E_4949_B9BC_6BADA8C7FD63
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x4359d3
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
sete byte [esi]
mov eax, esi
pop esi
pop ebp
ret
Function at 0x43d1a0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov ecx, dword [ebp + 8]
mov eax, dword [0x603024]
xor eax, ebp
mov dword [esp + 0x28], eax
test ecx, ecx
je 0x43d3e2
cmp dword [0x604d00], 0xe69e32f3
jne 0x43d3e5
mov edx, dword [ecx + 8]
lea esi, [edx + 0x1c8]
mov byte [esp + 0xf], 0xff
cmp byte [ecx + 3], 0
mov eax, esi
jne 0x43d22d
lea ecx, [edx + 0xc7]
mov eax, esi
cmp ecx, 0x7fefe
ja 0x43d22d
xor ecx, ecx
cmp esi, 1
sbb ecx, ecx
or ecx, 0x20
add edx, 0x1c7
je 0x43d212
bsr eax, edx
xor eax, 0x1f
jmp 0x43d217
mov eax, 0x20
sub ecx, eax
xor edx, edx
inc edx
shl edx, cl
mov eax, edx
shr eax, 1
lea eax, [eax + eax*4]
shr eax, 2
cmp eax, esi
cmovb eax, edx
mov dword [esp + 4], esi
mov edx, 0x20
mov ecx, 0x20
test eax, eax
je 0x43d245
bsr ecx, eax
xor ecx, 0x1f
sub edx, ecx
mov cl, byte [edx + 0x5e0d48]
mov esi, eax
shr esi, cl
and esi, 3
and eax, dword [edx*4 + 0x5e0d6c]
lea ecx, [esi + edx*4]
cmp eax, 1
sbb ecx, 0xffffffff
movzx edi, word [ecx + ecx + 0x5e0c3c]
shl edi, 5
mov eax, dword [ebp + 8]
lea ebx, [eax + edi]
add ebx, 0x48
lea esi, [eax + 0x40]
push esi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
jne 0x43d28d
mov ecx, esi
call fcn.004d6f70
mov dword [esp + 8], esi
mov eax, dword [ebx]
mov esi, dword [eax]
test esi, esi
je 0x43d360
mov byte [esp + 0xf], 0
mov ecx, dword [esi]
test ecx, ecx
je 0x43d2d6
mov edx, dword [ebp + 8]
mov ebx, dword [edx + edi + 0x54]
mov edi, edx
bswap ecx
mov edx, ecx
xor edx, esi
cmp edx, 0x1fffff
ja 0x43d3b1
mov edx, ecx
and edx, 0x1fc000
je 0x43d3b1
prefetcht0 byte [ecx]
jmp 0x43d2db
xor ecx, ecx
mov edi, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [eax + 0xc]
lea edx, [ecx + 2]
and edx, 0x3ffe
and ecx, 0xffffc001
or ecx, edx
mov dword [eax + 0xc], ecx
mov eax, dword [eax + 8]
mov ecx, dword [edi + 0x8fc]
add ecx, dword [eax + 0xc]
mov eax, dword [edi + 0x900]
mov dword [edi + 0x8fc], ecx
cmp eax, ecx
cmova ecx, eax
mov dword [edi + 0x900], ecx
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov ecx, esi
push edi
call fcn.004d7330
push esi
push dword [0x61354c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x6072f0]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov dword [eax + 0x90], esi
mov ecx, dword [esp + 0x28]
xor ecx, ebp
call fcn.00504b53
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esp + 0xf]
mov ecx, ebx
push eax
push 0x4000
push dword [esp + 0xc]
push 2
mov edi, dword [ebp + 8]
push edi
call fcn.004d5ca0
test eax, eax
je 0x43d3db
mov esi, eax
mov ecx, eax
and ecx, 0xffe00000
mov edx, eax
shr edx, 9
and edx, 0xfe0
lea eax, [edx + ecx]
movzx ecx, byte [edx + ecx + 0x101e]
and ecx, 0x3f
shl ecx, 5
sub eax, ecx
add eax, 0x1000
jmp 0x43d2f4
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x10]
movdqa xmmword [edi], xmm0
mov ecx, edi
push dword [esi]
push 0x5e0b20
call fcn.00538120
push edi
call fcn.004d50d0
add esp, 4
mov ecx, ebx
call fcn.00538210
xor esi, esi
jmp 0x43d317
int3
int3
Function at 0x43d450
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 0xc]
cmp eax, 3
je 0x43d467
test eax, eax
je 0x43d467
pop esi
pop edi
pop ebp
ret 0xc
test eax, eax
jne 0x43d475
mov ecx, dword [0x61358c]
test ecx, ecx
jne 0x43d4b1
cmp dword [0x613584], 0
je 0x43d461
mov esi, dword [0x613588]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test edi, edi
jne 0x43d4bb
test esi, esi
je 0x43d461
mov ecx, dword [0x613584]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
jmp 0x43d461
call dword [section..00cfg]
call ecx
jmp 0x43d475
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x43d499