joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000bdd0
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push 0xf0000000
xor esi, esi
push 1
push esi
push esi
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x1000be18
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._nCryptAcquireContext_failed__Error0x_.8x_n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 8
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 8]
lea ecx, [ebp - 4]
push ecx
push esi
push esi
push 0x8004
push edx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x1000be4b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._nCryptCreateHash_failed___Error0x_.8x_n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 8
jmp 0x1000bef6
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 4]
push esi
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x1000be79
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._nCryptHashData_failed___Error0x_.8x_n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 8
jmp 0x1000bef6
mov edx, dword [ebp - 4]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 4
push edx
mov dword [ebp - 0x14], 4
call edi
test eax, eax
jne 0x1000beaa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._nCryptGetHashParam_failed__Error0x_.8x_n
jmp 0x1000beec
mov eax, dword [ebx]
mov ecx, dword [ebp - 0xc]
cmp eax, ecx
jae 0x1000bec5
push ecx
push eax
push str._nOutput_buffer___d__is_not_sufficient__Required_Size___d_n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 0xc
jmp 0x1000bef5
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
push esi
push ebx
push eax
push 2
push ecx
call edi
test eax, eax
je 0x1000bee0
mov dword [ebp - 0x10], 1
jmp 0x1000bef5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._nCryptGetHashParam_failed___Error0x_.8x_n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 8
pop edi
mov eax, dword [ebp - 4]
cmp eax, esi
je 0x1000bf04
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [ebp - 8]
cmp eax, esi
je 0x1000bf13
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebp - 0x10]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100135a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x10037018]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
xor ecx, ecx
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x214], 7
mov dword [ebp - 0x218], 0
mov word [ebp - 0x228], cx
lea edx, [eax + 2]
jmp 0x100135f0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100135f0
push ebx
push esi
sub eax, edx
sar eax, 1
push edi
push eax
lea eax, [ebp - 0x20c]
lea esi, [ebp - 0x228]
call fcn.10007710
cmp dword [ebp - 0x214], 8
mov ebx, dword [ebp - 0x228]
jae 0x10013625
mov ebx, esi
mov eax, ebx
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10013630
sub eax, edx
sar eax, 1
lea esi, [eax + eax + 2]
push esi
call dword [sym.imp.MSVCR100.dll_malloc]
push esi
mov edi, eax
push 0
push edi
call sub.MSVCR100.dll_memset
add esi, 0xfffffffe
push esi
push ebx
push edi
call sub.MSVCR100.dll_memcpy
add esp, 0x1c
cmp dword [ebp - 0x214], 8
jb 0x1001367c
mov edx, dword [ebp - 0x228]
push edx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100256d0
mov esp, ebp
pop ebp
ret

Function at 0x10013690
Capabilities:
Get common file path

Disassembly:
push esi
push 0x208
call dword [sym.imp.MSVCR100.dll_malloc]
push 0x208
mov esi, eax
push 0
push esi
call sub.MSVCR100.dll_memset
add esp, 0x10
push esi
push 0
push 0
push 0x801a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x100136ec
mov eax, esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100136d0
sub eax, edx
sar eax, 1
mov ecx, 0x5c
mov word [esi + eax*2], cx
mov eax, esi
pop esi
ret
pop esi
jmp sym.libBasic.dll_public:_static_wchar_t____cdecl_BASUtilitySys::GetTempDir_void_
Function at 0x10013700
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10027efb
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x10037018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x218]
push eax
xor edi, edi
push edi
push edi
push 0x8028
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x100138d4
xor ecx, ecx
lea eax, [ebp - 0x218]
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], edi
mov word [ebp - 0x234], cx
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x10013770
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x218]
lea esi, [ebp - 0x234]
call fcn.10007710
push 0xa
mov eax, str.Downloads
mov ecx, esi
mov dword [ebp - 4], edi
call fcn.10003b30
mov eax, dword [ebp - 0x234]
mov ebx, 8
cmp dword [ebp - 0x220], ebx
jae 0x100137b7
mov eax, esi
push edi
push eax
call dword [sym.imp.MSVCR100.dll__waccess]
add esp, 8
test eax, eax
jne 0x10013844
push 1
mov eax, 0x10029680
lea ecx, [ebp - 0x234]
call fcn.10003b30
cmp dword [ebp - 0x220], ebx
mov ebx, dword [ebp - 0x234]
jae 0x100137ec
lea ebx, [ebp - 0x234]
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x100137f1
sub eax, edx
sar eax, 1
lea esi, [eax + eax + 2]
push esi
call dword [sym.imp.MSVCR100.dll_malloc]
push esi
mov edi, eax
push 0
push edi
call sub.MSVCR100.dll_memset
add esi, 0xfffffffe
push esi
push ebx
push edi
call sub.MSVCR100.dll_memcpy
add esp, 0x1c
cmp dword [ebp - 0x220], 8
jb 0x1001383d
mov edx, dword [ebp - 0x234]
push edx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, edi
jmp 0x100138d9
mov eax, dword [ebp - 0x234]
cmp dword [ebp - 0x220], ebx
jae 0x10013858
lea eax, [ebp - 0x234]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x100138b1
push 1
mov eax, 0x10029680
lea ecx, [ebp - 0x234]
call fcn.10003b30
mov eax, dword [ebp - 0x234]
cmp dword [ebp - 0x220], ebx
jae 0x1001388a
lea eax, [ebp - 0x234]
push eax
call sym.libBasic.dll_public:_static_wchar_t____cdecl_BASUtilityString::Wcsdup_wchar_t_const__
add esp, 4
mov esi, eax
cmp dword [ebp - 0x220], ebx
jb 0x100138ad
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, esi
jmp 0x100138d9
call sym.libBasic.dll_public:_static_wchar_t____cdecl_BASUtilitySys::GetTempDir_void_
mov esi, eax
cmp dword [ebp - 0x220], ebx
jb 0x100138ad
mov ecx, dword [ebp - 0x234]
push ecx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, esi
jmp 0x100138d9
call sym.libBasic.dll_public:_static_wchar_t____cdecl_BASUtilitySys::GetTempDir_void_
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100256d0
mov esp, ebp
pop ebp
ret
Function at 0x10013ea0
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
push eax
mov esi, ecx
call sym.libBasic.dll_public:_static_wchar_t____cdecl_BASUtilityString::ConvertUtf8ToUnicode_char_const__
add esp, 4
push 0
push 0
push 3
push 0
push 0
mov ebx, eax
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
lea ecx, [ebp - 0x20]
push ecx
mov edi, eax
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x28]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
lea ecx, [ebp - 0x10]
push ecx
push esi
shr esi, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x18]
push edx
mov eax, ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10013f30
Capabilities:
Create directory

Disassembly:
push esi
push edi
push eax
call sym.libBasic.dll_public:_static_wchar_t____cdecl_BASUtilityString::ConvertUtf8ToUnicode_char_const__
add esp, 4
push 0
mov esi, eax
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push esi
mov edi, eax
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
mov eax, edi
pop edi
pop esi
ret
Function at 0x10013f60
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 8
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10013f70
sub eax, edx
push ebx
mov ebx, eax
test ebx, ebx
jg 0x10013f87
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push edi
lea esi, [ebx + 1]
push esi
call dword [sym.imp.MSVCR100.dll_malloc]
push esi
mov edi, eax
push 0
push edi
mov dword [ebp - 8], edi
call sub.MSVCR100.dll_memset
add esp, 0x10
test edi, edi
jne 0x10013fc0
push str.Error_allocating_memory_n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
lea eax, [edi - 0x68]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
mov edx, edi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x10013fc7
mov al, byte [edi + ebx - 1]
cmp al, 0x2f
je 0x10013fdd
cmp al, 0x5c
jne 0x10013fe2
mov byte [edi + ebx - 1], 0
push edi
call sym.libBasic.dll_public:_static_wchar_t____cdecl_BASUtilityString::ConvertUtf8ToUnicode_char_const__
add esp, 4
push 0
mov esi, eax
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push esi
mov esi, dword [sym.imp.MSVCR100.dll_free]
mov ebx, eax
call esi
add esp, 4
test ebx, ebx
jne 0x1001401a
push edi
call esi
add esp, 4
pop edi
pop esi
lea eax, [ebx + 1]
pop ebx
mov esp, ebp
pop ebp
ret
lea esi, [edi + 1]
lea ecx, [ecx]
cmp byte [esi], 0
je 0x10014035
mov al, byte [esi]
cmp al, 0x5c
je 0x10014035
cmp al, 0x2f
je 0x10014035
inc esi
cmp byte [esi], 0
jne 0x10014025
mov al, byte [esi]
push edi
mov byte [ebp - 1], al
mov byte [esi], 0
call sym.libBasic.dll_public:_static_wchar_t____cdecl_BASUtilityString::ConvertUtf8ToUnicode_char_const__
add esp, 4
push 0
mov edi, eax
push edi
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push edi
mov edi, dword [sym.imp.MSVCR100.dll_free]
mov ebx, eax
call edi
add esp, 4
cmp ebx, 0xffffffff
jne 0x10014071
call dword [sym.imp.MSVCR100.dll__errno]
cmp dword [eax], 2
je 0x10014080
mov al, byte [ebp - 1]
test al, al
je 0x1001409e
mov edi, dword [ebp - 8]
mov byte [esi], al
inc esi
jmp 0x10014020
mov esi, dword [ebp - 8]
push esi
push str.couldnt_create_directory__s_n
call dword [sym.imp.MSVCR100.dll_printf]
push esi
call edi
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
push ecx
call edi
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100256d0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10037018]
jne 0x100256da
repz ret
jmp fcn.10025caf
Function at 0x40c231
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
push ebx
mov edx, 0xa
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x40c238
call fcn.00438b00
mov edx, dword [esp + 0x34]
lea ecx, [esp]
call fcn.00417060
mov edx, dword [esp + 0x38]
lea ecx, [esp + 4]
call fcn.00417060
mov edx, dword [esp + 0x3c]
lea ecx, [esp + 8]
call fcn.00417060
mov edx, dword [esp + 0x40]
lea ecx, [esp + 0xc]
call fcn.00417060
mov edx, dword [esp + 0x44]
lea ecx, [esp + 0x10]
call fcn.00417060
mov edx, dword [esp + 0x48]
lea ecx, [esp + 0x14]
call fcn.00417060
push 0
call sub.ole32.dll_CoInitialize
lea eax, [esp + 0x24]
push eax
mov ebp, 0x7adc18
push ebp
push 1
push 0
mov ebp, 0x7adc08
push ebp
call sub.ole32.dll_CoCreateInstance
mov dword [esp + 0x18], eax
mov ebx, dword [esp + 0x18]
and ebx, ebx
jne 0x40c396
sub esp, 4
push dword [esp + 4]
mov eax, dword [esp + 0x2c]
push eax
mov eax, dword [eax]
call dword [eax + 0x50]
push eax
pop eax
add esp, 4
sub esp, 4
push dword [esp + 0xc]
mov eax, dword [esp + 0x2c]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
push eax
pop eax
add esp, 4
sub esp, 4
push dword [esp + 0x10]
mov eax, dword [esp + 0x2c]
push eax
mov eax, dword [eax]
call dword [eax + 0x1c]
push eax
pop eax
add esp, 4
sub esp, 4
push dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
push eax
pop eax
add esp, 4
sub esp, 4
push dword [esp + 0x50]
push dword [esp + 0x1c]
mov eax, dword [esp + 0x30]
push eax
mov eax, dword [eax]
call dword [eax + 0x44]
push eax
pop eax
add esp, 4
lea eax, [esp + 0x20]
push eax
mov ebp, 0x7adc28
push ebp
mov eax, dword [esp + 0x2c]
push eax
mov eax, dword [eax]
call dword [eax]
mov dword [esp + 0x18], eax
mov ebx, dword [esp + 0x18]
and ebx, ebx
jne 0x40c38c
sub esp, 4
push 1
push dword [esp + 0xc]
mov eax, dword [esp + 0x2c]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
push eax
pop eax
add esp, 4
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x20]
push eax
mov eax, dword [eax]
call dword [eax + 8]
mov eax, dword [esp + 0x24]
push eax
mov eax, dword [eax]
call dword [eax + 8]
call sub.ole32.dll_CoUninitialize
mov eax, dword [esp + 0x18]
jmp 0x40c3a3
push dword [esp]
call fcn.00438b60
push dword [esp + 4]
call fcn.00438b60
push dword [esp + 0x14]
call fcn.00438b60
push dword [esp + 0xc]
call fcn.00438b60
push dword [esp + 0x1c]
call fcn.00438b60
push dword [esp + 8]
call fcn.00438b60
push dword [esp + 0x10]
call fcn.00438b60
add esp, 0x28
pop ebx
pop ebp
ret 0x1c
Function at 0x4145d1
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00438b00
push 0xa0
call sub.USER32.dll_GetAsyncKeyState
mov dword [esp], eax
push 0x24
call sub.USER32.dll_GetAsyncKeyState
mov dword [esp + 4], eax
push 0x23
call sub.USER32.dll_GetAsyncKeyState
mov dword [esp + 8], eax
push 0x21
call sub.USER32.dll_GetAsyncKeyState
mov dword [esp + 0xc], eax
push 0x22
call sub.USER32.dll_GetAsyncKeyState
mov dword [esp + 0x10], eax
mov ebx, dword [esp]
and ebx, ebx
je 0x414639
mov ebx, dword [esp + 4]
and ebx, ebx
je 0x414639
mov eax, 1
jmp 0x41463b
xor eax, eax
and eax, eax
je 0x41464e
call fcn.0040c8fb
mov dword [0x7b0ac8], 0
mov ebx, dword [esp]
and ebx, ebx
je 0x414664
mov ebx, dword [esp + 8]
and ebx, ebx
je 0x414664
mov eax, 1
jmp 0x414666
xor eax, eax
and eax, eax
je 0x414679
call fcn.0040c0b2
mov dword [0x7b0ac8], 0
mov ebx, dword [esp]
and ebx, ebx
je 0x41468f
mov ebx, dword [esp + 0xc]
and ebx, ebx
je 0x41468f
mov eax, 1
jmp 0x414691
xor eax, eax
and eax, eax
je 0x41469a
call fcn.0040eb30
mov ebx, dword [esp]
and ebx, ebx
je 0x4146b0
mov ebx, dword [esp + 0x10]
and ebx, ebx
je 0x4146b0
mov eax, 1
jmp 0x4146b2
xor eax, eax
and eax, eax
je 0x4146bb
call fcn.00412387
xor eax, eax
add esp, 0x14
pop ebx
ret

Function at 0x41783d
Capabilities:
Create thread

Disassembly:
push ecx
push ebp
push esi
lea eax, [esp + 8]
xor esi, esi
push eax
push esi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebp, eax
test ebp, ebp
je 0x4178d5
push edi
push 0x7b36b4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x7b0cc8]
test edi, edi
je 0x4178a9
push ebx
push esi
lea ebx, [edi + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4178a2
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [edi]
push ebx
push 0x7b0cc8
call fcn.00438852
pop ecx
pop ecx
jmp 0x4178a4
mov edi, dword [edi]
test edi, edi
jne 0x417879
pop ebx
mov eax, dword [0x7adc38]
mov esi, eax
inc eax
push 0x10
push 0x7b0cc8
mov dword [0x7adc38], eax
call fcn.00438892
pop ecx
pop ecx
push 0x7b36b4
mov dword [eax], ebp
mov dword [eax + 4], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebp
pop ecx
ret 8
Function at 0x41c753
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x41c7a8
push dword [esp + 0x10]
push 0x41c6d2
call dword [sym.imp.USER32.dll_EnumWindows]
mov esi, dword [0x7b0f9c]
test esi, esi
je 0x41c801
xor edi, edi
mov ebx, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x41c7a0
cmp byte [esi + 0x10], 0
je 0x41c7a0
push 3
push edi
push edi
push edi
push edi
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov esi, ebx
test ebx, ebx
jne 0x41c77c
jmp 0x41c801
mov esi, dword [0x7b0f9c]
test esi, esi
je 0x41c801
xor edi, edi
push ebp
mov ebx, dword [esi]
lea ebp, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp], eax
jne 0x41c7fa
cmp byte [esi + 0x11], 0
je 0x41c7d6
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp byte [esi + 0x10], 0
je 0x41c7ed
push 3
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
push ebp
push 0x7b0f9c
call fcn.00438852
pop ecx
pop ecx
mov esi, ebx
test ebx, ebx
jne 0x41c7b5
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x41db2e
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [0x7b3a28]
call fcn.00437f0e
mov edi, dword [eax + 0x24]
test edi, edi
je 0x41dbec
cmp dword [edi + 8], 1
je 0x41dbec
mov edi, dword [edi + 0xc]
test edi, edi
je 0x41dbec
mov al, byte [edi]
cmp al, 0x20
je 0x41db67
cmp al, 9
jne 0x41db6a
inc edi
jmp 0x41db5d
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor eax, eax
push eax
push eax
push 0xffffffffffffffff
push edi
push eax
push 0xfde9
call esi
push dword [esp + 0x14]
mov ebx, eax
lea ecx, [ebx - 1]
push ecx
call fcn.00438cc0
push ebx
mov ebp, eax
push ebp
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call esi
test ebx, ebx
jle 0x41dbbb
push 9
pop edx
lea eax, [ebp - 2]
lea eax, [eax + ebx*2]
movzx ecx, word [eax]
push 0x20
pop esi
cmp cx, si
je 0x41dbd7
cmp cx, dx
je 0x41dbd7
pop edi
pop esi
pop ebp
pop ebx
ret 4
movzx ecx, word [eax]
cmp cx, si
je 0x41dbcf
cmp cx, dx
jne 0x41dbdb
xor ecx, ecx
mov word [eax], cx
sub eax, 2
cmp eax, ebp
jae 0x41dbc2
push ebp
call sub.MSVCRT.dll_wcslen
pop ecx
sub ebx, eax
push ebx
call fcn.00438dd0
jmp 0x41dbbb
pop edi
pop esi
pop ebp
pop ebx
jmp fcn.00438da0
Function at 0x41f8f0
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x7b0fb0], 0
jne 0x41f8fe
call fcn.0041f870
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [0x7b0fb4]
call esi
test eax, eax
jne 0x41f921
call fcn.0041f870
push dword [0x7b0fb4]
call esi
mov edx, dword [esp + 0x14]
lea esi, [eax + 8]
mov edi, 0x11
lea ecx, [ecx]
imul ecx, edx, 0x53a9b4fb
lea esi, [esi + 4]
mov edx, 1
sub edx, ecx
imul ecx, edx, 0x53a9b4fb
mov dword [esi + 0x40], edx
mov edx, 1
sub edx, ecx
mov dword [esi - 4], edx
dec edi
jne 0x41f930
mov dword [eax], edi
lea ebp, [edi + 0x1f]
mov dword [eax + 4], 0xa
mov ebx, dword [eax]
mov edi, dword [eax + 4]
mov edx, dword [eax + ebx*4 + 8]
mov ecx, dword [eax + ebx*4 + 0x4c]
mov esi, dword [eax + edi*4 + 8]
ror ecx, 0xd
add ecx, dword [eax + edi*4 + 0x4c]
dec edi
ror edx, 5
add edx, esi
mov dword [eax + ebx*4 + 8], ecx
mov dword [eax + ebx*4 + 0x4c], edx
dec ebx
jns 0x41f990
mov ebx, 0x10
test edi, edi
jns 0x41f999
mov edi, 0x10
mov dword [eax], ebx
mov dword [eax + 4], edi
dec ebp
jne 0x41f962
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x41f9b0
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x7b0fb0], 0
jne 0x41f9be
call fcn.0041f870
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [0x7b0fb4]
call esi
mov edx, eax
test edx, edx
jne 0x41f9e5
call fcn.0041f870
push dword [0x7b0fb4]
call esi
mov edx, eax
mov ebx, dword [edx]
mov esi, dword [edx + 4]
mov ebp, dword [esp + 0x14]
inc ebp
mov edi, dword [edx + ebx*4 + 0x4c]
mov eax, dword [edx + ebx*4 + 8]
mov ecx, dword [edx + esi*4 + 8]
ror edi, 0xd
add edi, dword [edx + esi*4 + 0x4c]
dec esi
ror eax, 5
add eax, ecx
mov dword [edx + ebx*4 + 8], edi
mov dword [edx + ebx*4 + 0x4c], eax
dec ebx
jns 0x41fa18
mov ebx, 0x10
test esi, esi
jns 0x41fa21
mov esi, 0x10
mov dword [edx], ebx
mov eax, edi
mov dword [edx + 4], esi
test ebp, ebp
je 0x41fa30
mul ebp
mov eax, edx
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x4221e5
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
push esi
push 0x422134
push 0x10
push 0x2c
call fcn.00438152
xor esi, esi
mov dword [0x7b1158], eax
push esi
push esi
push 8
call fcn.00437f79
mov dword [0x7b3a44], eax
cmp word [0x7b1150], si
jne 0x4222ce
push edi
lea eax, [esp + 8]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
xor edi, edi
inc edi
test eax, eax
jne 0x42223d
mov word [0x7b1150], di
jmp 0x422245
xor eax, eax
mov word [0x7b1150], ax
push 0x800
push esi
push str.ws2_32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x7b116c], eax
test eax, eax
je 0x4222cd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.getaddrinfo
push eax
call esi
push str.freeaddrinfo
push dword [0x7b116c]
mov dword [0x7b115c], eax
call esi
push str.getnameinfo
push dword [0x7b116c]
mov dword [0x7b1160], eax
call esi
push str.WSAStringToAddressA
push dword [0x7b116c]
mov dword [0x7b1164], eax
call esi
cmp dword [0x7b115c], 0
mov dword [0x7b1168], eax
je 0x4222cd
cmp dword [0x7b1160], 0
je 0x4222cd
cmp dword [0x7b1164], 0
je 0x4222cd
test eax, eax
je 0x4222cd
mov dword [0x7b1154], edi
pop edi
pop esi
add esp, 0x190
ret

Function at 0x422350
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 0x14], 0
jne 0x42238c
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4