joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10011dd0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0
push 0
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 8]
push edx
push ecx
call dword [sym.imp.WS2_32.dll_WSASend]
mov ebx, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword [0x101ace90]
mov edi, eax
mov ecx, dword [0x101ace94]
cmp edx, 0x257edfd1
jne 0x10011e19
cmp ecx, 0xb2ab117a
je 0x10011e29
cmp edx, 0x257edfd0
jne 0x10011e30
cmp ecx, 0xb2ab117a
jne 0x10011e30
test edi, edi
setne al
jmp 0x10011e40
mov eax, dword [0x101ace88]
mov ecx, 0x101ace88
push edi
mov eax, dword [eax + 0x18]
call eax
mov esi, dword [ebp + 0x10]
movzx ecx, al
mov dword [ebp + 8], 0x1ffff7
mov dword [esi], edi
mov dword [esi + 4], 0x101ace88
lea eax, [ecx + 2]
mov dword [esi + 8], eax
cmp ecx, 0xffffffff
je 0x10011e6a
mov eax, edi
mov edx, 0x101ace88
jmp 0x10011e7f
xor edx, edx
mov eax, 0x101ace88
div dword [ebp + 8]
imul eax, edx, 0x3e8
mov edx, dword [esi + 4]
add eax, edi
cmp eax, 0x40
jne 0x10011ed6
mov ecx, dword [0x101ace90]
mov eax, dword [0x101ace94]
cmp ecx, 0x257edfd1
jne 0x10011e9e
cmp eax, 0xb2ab117a
je 0x10011ead
cmp ecx, 0x257edfd0
jne 0x10011eba
cmp eax, 0xb2ab117a
jne 0x10011eba
mov al, 1
mov dword [esi], 0x2746
jmp 0x10011f3d
mov eax, dword [0x101ace88]
mov ecx, 0x101ace88
push 0x2746
mov eax, dword [eax + 0x18]
call eax
mov dword [esi], 0x2746
jmp 0x10011f3d
cmp ecx, 0xffffffff
jne 0x10011eee
mov eax, edx
mov ecx, 0x1ffff7
xor edx, edx
div ecx
imul eax, edx, 0x3e8
add edi, eax
cmp edi, 0x4d2
jne 0x10011f4d
mov ecx, dword [0x101ace90]
mov eax, dword [0x101ace94]
cmp ecx, 0x257edfd1
jne 0x10011f10
cmp eax, 0xb2ab117a
je 0x10011f1f
cmp ecx, 0x257edfd0
jne 0x10011f23
cmp eax, 0xb2ab117a
jne 0x10011f23
mov al, 1
jmp 0x10011f37
mov eax, dword [0x101ace88]
mov ecx, 0x101ace88
push 0x274d
mov eax, dword [eax + 0x18]
call eax
mov dword [esi], 0x274d
movzx eax, al
add eax, 2
mov dword [esi + 4], 0x101ace88
mov dword [esi + 8], eax
test ebx, ebx
je 0x10011f5b
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
xorps xmm0, xmm0
movq qword [esi], xmm0
pop edi
mov dword [esi + 8], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10012e40
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 4]
add eax, 0x18
lock inc dword [eax]
cmp byte [ebp + 0x18], 0
mov esi, dword [ebp + 0x1c]
je 0x10012ecb
mov edi, dword [edi + 4]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
push esi
push 2
push 0
mov dword [esi + 0x1c], 1
mov dword [esi], 0x101ace88
push dword [edi + 0x14]
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
jne 0x10012f9e
lea ebx, [edi + 0x38]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esi + 0x14], 0
mov eax, dword [edi + 0x58]
test eax, eax
je 0x10012eac
mov dword [eax + 0x14], esi
jmp 0x10012eaf
mov dword [edi + 0x54], esi
mov dword [edi + 0x58], esi
lea eax, [edi + 0x34]
mov ecx, 1
xchg dword [eax], ecx
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x18
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
cmp ecx, 0xffffffff
jne 0x10012ee1
mov edi, dword [edi + 4]
mov dword [esi + 8], 0x2719
jmp 0x10012e65
mov eax, dword [ebp + 0x14]
push 0
push esi
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0x18]
mov dword [ebp + 0x18], 0
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_WSARecv]
mov ebx, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
jne 0x10012f1a
mov eax, 0x2746
jmp 0x10012f27
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test ebx, ebx
je 0x10012f43
cmp eax, 0x3e5
je 0x10012f43
mov edi, dword [edi + 4]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 0xc], eax
jmp 0x10012e6c
mov edi, dword [edi + 4]
lea ecx, [esi + 0x1c]
mov ebx, 1
xor eax, eax
mov edx, ebx
lock cmpxchg dword [ecx], edx
cmp eax, ebx
jne 0x10012f9e
push esi
push 2
push 0
push dword [edi + 0x14]
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
jne 0x10012f9e
lea eax, [edi + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esi + 0x14], 0
mov eax, dword [edi + 0x58]
test eax, eax
je 0x10012f89
mov dword [eax + 0x14], esi
jmp 0x10012f8c
mov dword [edi + 0x54], esi
mov dword [edi + 0x58], esi
lea eax, [edi + 0x34]
xchg dword [eax], ebx
lea eax, [edi + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x18
Function at 0x10014b30
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1b4
mov eax, dword [0x101aa2a0]
xor eax, esp
mov dword [esp + 0x1b0], eax
push ebx
push esi
push edi
mov edi, ecx
mov eax, 1
lock xadd dword [0x101b1ba0], eax
inc eax
mov ebx, 0x101b1ba4
cmp eax, 1
jne 0x10014b76
lea eax, [esp + 0x28]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [ebx], eax
cmp byte [ebp + 8], 0
je 0x10014c01
xor esi, esi
lock xadd dword [ebx], esi
test esi, esi
je 0x10014c01
mov ecx, dword [0x101ace90]
mov eax, dword [0x101ace94]
cmp ecx, 0x257edfd1
jne 0x10014ba4
cmp eax, 0xb2ab117a
je 0x10014bb3
cmp ecx, 0x257edfd0
jne 0x10014bb7
cmp eax, 0xb2ab117a
jne 0x10014bb7
mov al, 1
jmp 0x10014bc7
mov eax, dword [0x101ace88]
mov ecx, 0x101ace88
push esi
mov eax, dword [eax + 0x18]
call eax
movzx eax, al
add eax, 2
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0x101ace88
mov dword [esp + 0x18], str.C:ProjectTrading_boost_1_81_0_boost_asiodetail_throw_error.hpp
mov dword [esp + 0x1c], str.throw_on_error
mov dword [esp + 0x20], 0x30
mov dword [esp + 0x24], 5
test al, 1
jne 0x10014c1a
mov ecx, dword [esp + 0x1bc]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100459e9
mov esp, ebp
pop ebp
ret 4
lea eax, [esp + 0x18]
mov edx, str.winsock
push eax
lea ecx, [esp + 0x10]
call fcn.1000f990
int3
Function at 0x10016410
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006b6b8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x101aa2a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.boost::exception_detail::clone_base.0
mov ebx, dword [ebp + 8]
lea eax, [edi + 8]
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov dword [edi + 4], vtable.std::exception.0
push eax
movq qword [eax], xmm0
lea eax, [ebx + 8]
push eax
call fcn.10046fa1
mov dword [edi + 4], vtable.boost::system::system_error.0
add esp, 8
movq xmm0, qword [ebx + 0x10]
movq qword [edi + 0x10], xmm0
mov eax, dword [ebx + 0x18]
mov dword [edi + 0x18], eax
lea esi, [edi + 0x1c]
mov byte [ebp - 4], 1
mov dword [esi], vtable.boost::exception.0
mov ecx, dword [ebx + 0x20]
mov dword [ebp + 8], esi
mov dword [esi + 4], ecx
test ecx, ecx
je 0x1001649f
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [ebx + 0x24]
mov dword [esi + 8], eax
mov eax, dword [ebx + 0x28]
mov dword [esi + 0xc], eax
mov eax, dword [ebx + 0x2c]
mov dword [esi + 0x10], eax
mov eax, dword [ebx + 0x30]
mov dword [esi + 0x14], eax
mov eax, edi
mov dword [edi], vtable.boost::wrapexcept_class_boost::system::system_error_.2.0
mov dword [edi + 4], vtable.boost::wrapexcept_class_boost::system::system_error_.0
mov dword [esi], vtable.boost::wrapexcept_class_boost::system::system_error_.1.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100192a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006ba45
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x101aa2a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x14], edi
mov eax, dword [edi + 4]
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 1
jne 0x10019303
push dword [0x101b1bf8]
and eax, 0xfffffffc
mov esi, dword [eax + 8]
lea eax, [esi + 0x14]
neg esi
sbb esi, esi
and esi, eax
call ebx
test eax, eax
je 0x10019303
cmp dword [eax], esi
je 0x10019321
mov eax, dword [eax + 8]
test eax, eax
jne 0x100192f8
push dword [0x101b1bf8]
lea eax, [edi + 1]
mov dword [ebp - 0x20], eax
call ebx
test eax, eax
je 0x100193b3
mov ecx, dword [eax + 4]
jmp 0x100193b5
cmp dword [eax + 4], 0
je 0x10019303
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
mov dword [ebp + 8], eax
mov dword [ecx], 0
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
mov byte [ebp - 4], 2
push eax
push eax
call fcn.10019840
add esp, 8
mov dword [ebp - 4], 3
mov eax, dword [ebp + 8]
test eax, eax
je 0x1001947d
push 0
push eax
mov eax, dword [eax]
call eax
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor ecx, ecx
push ecx
push dword [ebp + 8]
mov edx, 0x28
call fcn.10015df0
mov ecx, dword [ebp + 8]
mov esi, eax
add esp, 8
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0x100196c0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x1c], 0
mov eax, dword [ecx]
mov dword [esi + 0x20], eax
mov dword [ecx], 0
mov eax, dword [edi + 4]
and eax, 0xfffffffc
mov edi, dword [eax + 8]
lock inc dword [edi + 0x18]
push esi
push 0
push 0
mov dword [esi + 0x1c], 1
push dword [edi + 0x14]
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
jne 0x10019467
lea ebx, [edi + 0x38]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esi + 0x14], 0
mov eax, dword [edi + 0x58]
test eax, eax
je 0x10019450
mov dword [eax + 0x14], esi
jmp 0x10019453
mov dword [edi + 0x54], esi
mov dword [edi + 0x58], esi
lea eax, [edi + 0x34]
mov ecx, 1
xchg dword [eax], ecx
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
call fcn.100194b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100194b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006ba70
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x101aa2a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 8]
test eax, eax
je 0x100194fc
mov dword [ebp - 4], 0
mov eax, dword [eax + 0x20]
test eax, eax
je 0x100194f5
push 0
push eax
mov eax, dword [eax]
call eax
add esp, 8
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x1001953f
push dword [0x101b1bf8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1001952f
mov edx, dword [eax + 4]
test edx, edx
je 0x1001952f
xor eax, eax
nop dword [eax]
cmp dword [edx + eax*4], 0
lea ecx, [edx + eax*4]
je 0x10019550
inc eax
cmp eax, 2
jl 0x10019520
push esi
call fcn.100459e4
add esp, 4
mov dword [edi + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov al, byte [esi + 0x28]
mov byte [esi], al
mov dword [ecx], esi
jmp 0x10019538

Function at 0x10019a50
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 8]
test esi, esi
je 0x10019a8c
mov esi, dword [esi + 0x20]
test esi, esi
je 0x10019a85
push ebx
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x10019a84
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x10019a84
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
pop ebx
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x10019acf
push dword [0x101b1bf8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x10019abf
mov edx, dword [eax + 4]
test edx, edx
je 0x10019abf
mov eax, 4
nop
cmp dword [edx + eax*4], 0
lea ecx, [edx + eax*4]
je 0x10019ad2
inc eax
cmp eax, 6
jl 0x10019ab0
push esi
call fcn.100459e4
add esp, 4
mov dword [edi + 4], 0
pop edi
pop esi
ret
mov al, byte [esi + 0x3c]
mov byte [esi], al
mov dword [ecx], esi
mov dword [edi + 4], 0
pop edi
pop esi
ret
Function at 0x1005cd4f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1005c9cc
Function at 0x10069fe0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1006a00d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1006a00d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x100022f0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
mov ecx, 0x5a4d
push esi
push edi
cmp word [eax], cx
jne 0x10002341
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10002341
mov edi, dword [ecx + 0x78]
add edi, eax
xor ebx, ebx
cmp dword [edi + 0x18], ebx
jbe 0x10002341
mov esi, dword [edi + 0x20]
add esi, eax
jmp 0x10002326
mov eax, dword [ebp + 8]
mov edx, dword [esi]
add edx, eax
push edx
call fcn.100022c0
add esp, 4
cmp eax, dword [ebp + 0xc]
je 0x10002348
inc ebx
add esi, 4
cmp ebx, dword [edi + 0x18]
jb 0x10002323
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
mov eax, dword [edi + 0x24]
mov ecx, dword [ebp + 8]
lea edx, [eax + ebx*2]
movzx eax, word [edx + ecx]
mov edx, dword [edi + 0x1c]
lea eax, [edx + eax*4]
mov eax, dword [eax + ecx]
pop edi
pop esi
add eax, ecx
pop ebx
pop ebp
ret

Function at 0x10002420
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor esi, esi
xor edi, edi
cmp dword [ebp + 0x10], ebx
jbe 0x1000248c
mov ecx, dword [ebp + 8]
xor edx, edx
lea eax, [esi + 1]
div dword [0x10041158]
inc ebx
mov esi, edx
mov al, byte [esi + ecx]
mov byte [ebp - 1], al
movzx eax, al
add eax, edi
xor edx, edx
div dword [0x10041158]
mov edi, edx
movzx eax, byte [edi + ecx]
mov dl, byte [ebp - 1]
mov byte [esi + ecx], al
mov byte [edi + ecx], dl
movzx eax, byte [esi + ecx]
movzx edx, dl
add eax, edx
xor edx, edx
div dword [0x10041158]
mov eax, dword [ebp + 0xc]
movzx edx, byte [edx + ecx]
add dl, byte [0x1004115c]
xor byte [ebx + eax - 1], dl
cmp ebx, dword [ebp + 0x10]
jb 0x10002435
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403ec0
Capabilities:
Continue service
Query service status
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49d110
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x4bfdd0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov bl, cl
mov dword [ebp - 4], 0
call fcn.00470214
mov ecx, dword [eax + 4]
call fcn.0046f158
push 0x4a5590
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.004051c0
push 0
mov byte [ebp - 4], 2
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3b0]
push 0
push 0x147
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 3
ja case.default.0x403f38
jmp dword [eax*4 + 0x404060]
push 0x4a5590
jmp 0x403f59
push 0x4a55a0
jmp 0x403f59
push str.W3SVC
jmp 0x403f59
push str.ArcServerObjectManager
lea ecx, [ebp - 0x14]
call fcn.00404e20
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x404003
mov edx, dword [ebp - 0x14]
push 0xf01ff
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x403ffc
lea eax, [ebp - 0x30]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x403ff5
mov eax, dword [ebp - 0x2c]
sub eax, 1
je 0x403fe6
sub eax, 3
je 0x403fc1
sub eax, 3
jne 0x403ff5
test bl, bl
je 0x403ff5
lea ecx, [ebp - 0x30]
push ecx
push 3
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x403ff5
test bl, bl
jne 0x403fd4
lea edx, [ebp - 0x30]
push edx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x403ff5
lea eax, [ebp - 0x30]
push eax
push 0x81
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x403ff5
test bl, bl
je 0x403ff5
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp + 8]
call fcn.00403c40
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404039
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp + 0xb]
mov byte [ebp - 4], 0
call fcn.00404ae0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x404760
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x404779
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4047b4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4047b0
lea ebx, [ebx]
cmp esi, eax
jae 0x4047b4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4047a0
cmp esi, eax
jb 0x4047ba
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x4053c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [edi]
lea ecx, [esp]
push ecx
mov ecx, dword [esp + 0xc]
push esi
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x18]
push 0
mov dword [edi], 0
mov edx, dword [ecx]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40541f
mov eax, dword [esp + 0xc]
cmp eax, 1
je 0x4053fd
cmp eax, 2
jne 0x40540f
test esi, esi
mov eax, dword [esp]
je 0x40541b
test eax, eax
je 0x405418
cmp byte [eax + esi - 1], 0
je 0x40541b
mov eax, 0xd
pop ecx
ret 8
mov byte [esi], 0
mov dword [edi], eax
xor eax, eax
pop ecx
ret 8
Function at 0x40c940
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49c683
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x4bfdd0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x58], ecx
mov dword [ebp - 4], 0x11
mov ecx, dword [ebp - 0x58]
call fcn.0040caa0
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x58]
add ecx, 0x54
call fcn.00405510
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x58]
add ecx, 0x44
call fcn.00405510
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x58]
add ecx, 0x40
call fcn.00405510
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x58]
add ecx, 0x3c
call fcn.00405510
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x58]
add ecx, 0x38
call fcn.00405510
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x58]
add ecx, 0x34
call fcn.00405510
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x58]
add ecx, 0x30
call fcn.00405510
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x58]
add ecx, 0x2c
call fcn.00405510
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x58]
add ecx, 0x28
call fcn.00405510
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x58]
add ecx, 0x24
call fcn.00405510
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x58]
add ecx, 0x20
call fcn.00405510
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x58]
add ecx, 0x1c
call fcn.00405510
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x58]
add ecx, 0x18
call fcn.00405510
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x58]
add ecx, 0x14
call fcn.00405510
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x58]
add ecx, 0xc
call fcn.00405510
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x58]
add ecx, 8
call fcn.00405510
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x58]
add ecx, 4
call fcn.00405510
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x58]
call fcn.00405510
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x40db70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49cec9
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4bfdd0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
push 0x4a6221
mov esi, edx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], ebx
call fcn.004051c0
mov dword [ebp - 4], ebx
mov edi, 1
push 0x4a6221
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x28], edi
call fcn.004051c0
push 0x4a6221
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], edi
call fcn.004051c0
push 0x4a6221
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 2
call fcn.004051c0
xor edi, edi
mov dword [ebp - 0x34], edi
lea eax, [ebp - 0x18]
push eax
push 0x2001f
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
mov byte [ebp - 4], 5
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x40dc61
mov eax, dword [ebp - 0x18]
mov ecx, dword [esi + 0x38]
lea edx, [ebp - 0x2c]
push edx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x30]
push edx
push ebx
push ecx
mov edi, eax
push eax
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x2c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x40dc61
cmp dword [ebp - 0x30], 4
jne 0x40dc61
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0x1c]
push 0x4a6198
push ecx
call fcn.004051a0
add esp, 0xc
mov esi, dword [esi + 0x38]
push ebx
push str.Last_Count
push esi
call dword [sym.imp.KERNEL32.dll_GetProfileIntA]
push eax
lea edx, [ebp - 0x20]
push 0x4a6198
push edx
call fcn.004051a0
mov eax, dword [ebp - 0x1c]
add esp, 0xc
push eax
call fcn.00483c96
mov ecx, dword [ebp - 0x20]
push ecx
mov esi, eax
call fcn.00483c96
add esp, 8
cmp esi, eax
jle 0x40dca0
mov eax, esi
mov esi, dword [ebp - 0x24]
push eax
push 0x4a6198
push esi
call fcn.004051a0
add esp, 0xc
cmp edi, ebx
je 0x40dcbd
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 3
jmp 0x40dcd8
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x38]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40dcfb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40dd1e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40dd40
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00483c76
mov esp, ebp
pop ebp
ret