joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40abfd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
and dword [ebp + 0x10], 0
test edx, edx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
cmovne ecx, edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0x10]
push eax
push 0xffff
push dword [ebp + 8]
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov esi, dword [ebp - 4]
mov ecx, eax
mov edx, dword [ebp + 0x10]
push 2
pop ebx
cmp esi, ebx
jae 0x40ac4a
cmp edx, 1
je 0x40ac48
cmp edx, ebx
jne 0x40ac4a
mov ecx, ebx
call fcn.0040a5df
test eax, eax
jne 0x40ac8b
test ecx, ecx
jne 0x40ac8b
cmp edx, ebx
je 0x40ac60
cmp edx, 1
jne 0x40ac6c
shr esi, 1
xor eax, eax
mov word [edi + esi*2 - 2], ax
mov edx, dword [ebp + 0x10]
movzx eax, byte [ebp + 0x14]
cmp edx, eax
je 0x40ac8b
sub edx, 1
je 0x40ac85
sub edx, 1
jne 0x40ac89
cmp eax, 1
jne 0x40ac89
jmp 0x40ac8b
cmp eax, ebx
je 0x40ac8b
mov ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40acb8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444f81
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x4570cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], edx
mov eax, ecx
mov dword [ebp - 0x14], eax
and dword [ebp - 0x20], 0
xor esi, esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or edx, 0xffffffff
mov dword [ebp - 0x18], edx
test esi, esi
jne 0x40ad0f
cmp dword [0x469278], esi
je 0x40ae3c
push 2
pop ebx
jmp 0x40ad29
cmp esi, 1
jne 0x40ae3c
mov ecx, eax
call fcn.0040ac96
test al, al
je 0x40ae39
xor ebx, ebx
push ecx
push 0x458aa0
lea ecx, [ebp - 0x40]
call fcn.0040a40c
and dword [ebp - 0x1c], 0
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x10]
lea eax, [ebp - 0x10]
and dword [ebp - 0x10], 0
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x28], eax
movzx eax, word [ecx + 0x14]
shr eax, 1
and eax, 0x10
push ecx
or eax, ebx
lea ecx, [ebp - 0x34]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040a6e2
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040b63a
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x40ad81
and dword [ebp - 0x30], 0
push eax
call edi
cmp dword [ebp - 0x18], 0
jne 0x40ae20
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp dword [ebp - 0x1c], 0
push ecx
push dword [ebp - 0x24]
mov dword [ecx], eax
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 0x10]
cmovne eax, dword [ebp - 0x1c]
push ecx
push 0
push dword [ebp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
mov dword [ebp - 0x18], ecx
call fcn.0040a5df
test eax, eax
je 0x40adee
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx + 0x10]
movzx eax, word [eax + 6]
and eax, 0xf
shl eax, 4
and dword [eax + 0x457100], 0
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x40ad3e
and dword [ebp - 0x10], 0
push eax
call edi
jmp 0x40ad3b
test ecx, ecx
jne 0x40ae20
mov eax, dword [ebp - 0x14]
movzx ecx, word [eax + 0x14]
mov eax, ecx
and eax, 0xf
cmp dword [ebp - 0x20], eax
je 0x40ae5c
cmp dword [ebp - 0x20], 3
jne 0x40ae19
mov eax, dword [ebp + 0xc]
cmp dword [eax], 4
jne 0x40ae19
and cl, 0xf
cmp cl, 4
je 0x40ae5c
mov dword [ebp - 0x18], 2
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x40ae2e
and dword [ebp - 0x10], 0
push eax
call edi
lea ecx, [ebp - 0x40]
call fcn.0040a3ea
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
inc esi
cmp esi, 2
jl 0x40acf4
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp + 0x14]
mov dword [eax], 1
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x40ae73
and dword [ebp - 0x10], 0
push eax
call edi
lea ecx, [ebp - 0x40]
call fcn.0040a3ea
xor eax, eax
jmp 0x40ae48
Function at 0x40ecb9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 4], 0x20a
mov word [eax], dx
lea edx, [ebp - 4]
push edx
push eax
push 0
push 2
push str.mso.dll
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
neg eax
sbb al, al
inc al
mov esp, ebp
pop ebp
ret 8

Function at 0x4107c3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, ecx
push eax
push 0x20019
push 0
push str.CLSID
push Ordinal_1
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x41085a
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push ebx
push dword [ebp - 8]
call edi
test eax, eax
jne 0x41084f
push 4
pop edi
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], edi
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x44a180
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41084f
cmp dword [ebp - 0xc], edi
jne 0x41084f
mov edi, dword [ebp - 0x10]
cmp edi, 3
ja 0x41084f
cmp dword [ebp - 4], eax
je 0x41085c
push dword [ebp - 4]
call esi
jmp 0x41085c
cmp dword [ebp - 4], 0
je 0x41085a
push dword [ebp - 4]
call esi
xor edi, edi
cmp dword [ebp - 8], 0
je 0x410867
push dword [ebp - 8]
call esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410b39
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp byte [0x4694f8], 0
je 0x410b51
mov eax, dword [0x4694f4]
jmp 0x410c1f
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x20019
push esi
push str.SoftwarePoliciesMicrosoftSecurity
push reloc.AppVIsvSubsystems32.dll_Ordinal_1
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x410b9f
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x4694f4
push esi
push esi
push str.CLSIDInterfaceTest
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x410b9f
cmp dword [ebp - 8], 4
je 0x410bf8
mov eax, dword [ebp - 4]
mov dword [ebp - 4], esi
test eax, eax
je 0x410bb0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push str.SoftwareMicrosoftSecurity
push reloc.AppVIsvSubsystems32.dll_Ordinal_1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x410c00
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x4694f4
push esi
push esi
push str.CLSIDInterfaceTest
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x410c00
cmp dword [ebp - 8], 4
jne 0x410c00
mov esi, dword [0x4694f4]
jmp 0x410c06
mov dword [0x4694f4], esi
cmp dword [ebp - 4], 0
mov byte [0x4694f8], 1
je 0x410c1c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4124b5
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x445781
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4570cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ecx], 0x44a43c
mov dword [ecx + 8], esi
mov eax, dword [ebx]
mov dword [ecx + 0x10], eax
mov eax, dword [ebx + 4]
mov dword [ecx + 0x14], eax
lea eax, [ebp + 0x20]
push eax
add ecx, 0x18
call fcn.0040c968
mov ecx, dword [ebp - 0x10]
lea eax, [ebp + 0x18]
push ebx
push eax
lea eax, [ebp + 0x20]
add ecx, 0x20
push eax
mov edx, esi
call fcn.004129e6
mov esi, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x14]
mov dword [esi + 0x28], edi
mov eax, dword [ecx]
mov dword [esi + 0x30], eax
mov eax, dword [ecx + 4]
lea ecx, [esi + 0x3c]
mov dword [esi + 0x34], eax
mov eax, dword [ebp + 8]
and dword [ebp + 8], 0
mov dword [esi], 0x44a748
mov dword [esi + 0x38], eax
lea eax, [ebp + 0x18]
push eax
call fcn.0040c968
lea eax, [ebp + 0x20]
push eax
lea ecx, [esi + 0x44]
call fcn.0040c968
mov eax, dword [ebx]
xor edi, edi
mov dword [esi + 0x50], eax
xor ecx, ecx
mov eax, dword [ebx + 4]
inc edi
mov dword [esi + 0x54], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x58], eax
mov eax, dword [ebp + 8]
mov dword [ebp + 0x10], ecx
test eax, eax
je 0x412583
mov edx, dword [eax]
mov ecx, eax
push edi
call dword [edx]
mov ecx, dword [ebp + 0x10]
and dword [ebp - 4], 0
cmp dword [ebp + 0x1c], 0
je 0x412598
mov ecx, dword [ebp + 0x1c]
call fcn.0040db94
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], edi
cmp dword [ebp + 0x24], 0
je 0x4125ac
mov ecx, dword [ebp + 0x24]
call fcn.0040db94
mov ecx, dword [ebp + 0x10]
or dword [ebp - 4], 0xffffffff
test ecx, ecx
je 0x4125c1
mov dword [ebp - 4], 2
mov eax, dword [ecx]
push edi
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20

Function at 0x419db6
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push esi
push edi
cmp dword [ecx + 0x14], 0x10
mov edi, dword [ecx + 0x10]
jb 0x419dc9
mov ecx, dword [ecx]
xor esi, esi
mov edx, 0x811c9dc5
test edi, edi
je 0x419de5
movzx eax, byte [esi + ecx]
xor eax, edx
imul edx, eax, 0x1000193
inc esi
cmp esi, edi
jb 0x419dd4
pop edi
mov eax, edx
pop esi
pop ebp
ret 4
Function at 0x41d63f
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444a4c
mov eax, dword fs:[0]
push eax
mov eax, dword [0x4570cc]
push ecx
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ecx + 0x100]
push eax
lea eax, [ecx + 0xe0]
push eax
lea eax, [ecx + 0xc4]
push eax
push ecx
push ecx
lea eax, [ecx + 0xa8]
push eax
lea eax, [ecx + 0x98]
push eax
lea eax, [ecx + 0x78]
push eax
lea eax, [ecx + 0x68]
push eax
lea eax, [ecx + 0x60]
push eax
lea eax, [ecx + 0x48]
push eax
lea eax, [ecx + 0x30]
push eax
lea eax, [ecx + 0x18]
lea edx, [ecx + 0x10]
mov ecx, dword [ebp + 8]
push eax
call fcn.00419360
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x420679
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x446000
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x4570cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
test byte [0x469540], 0x20
je 0x4206ce
push dword [ebx + 0xc]
mov edx, 0x44b870
push dword [ebx + 8]
call fcn.0041f035
mov eax, dword [0x4575f4]
mov ecx, 0x4575f4
push 0x1c135e
call dword [eax + 4]
lea eax, [esi + 8]
mov ecx, dword [eax]
mov esi, ecx
mov edi, dword [eax + 4]
mov edx, edi
mov dword [ebp - 0x14], eax
mov eax, ecx
shr eax, 0xc
dec eax
mov dword [ebp - 0x20], esi
shl eax, 0xc
xor eax, ecx
and eax, 0x7f000
xor ecx, eax
mov eax, esi
mov esi, dword [ebp - 0x14]
push ebx
mov ebx, ecx
mov ecx, edi
lock cmpxchg8b qword [esi]
pop ebx
mov ecx, edx
cmp eax, dword [ebp - 0x20]
jne 0x42071e
cmp ecx, edi
je 0x42074e
mov esi, eax
mov dword [ebp - 0x20], ecx
shr esi, 0xc
mov edi, eax
dec esi
mov edx, ecx
shl esi, 0xc
xor esi, eax
and esi, 0x7f000
xor esi, eax
push ebx
mov ebx, esi
mov esi, dword [ebp - 0x14]
lock cmpxchg8b qword [esi]
pop ebx
mov ecx, edx
cmp eax, edi
jne 0x42071e
cmp ecx, dword [ebp - 0x20]
jne 0x42071e
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc
Function at 0x423caa
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4451c8
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x4570cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
and dword [ebp - 4], 0
xor eax, eax
mov esi, dword [ebp + 8]
inc eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], 0x4494a8
and dword [ebx + 0x14], 0
mov dword [ebx], 0x44bda0
mov dword [ebx + 0x10], 0x44bd80
mov dword [ebx + 0x18], esi
mov eax, dword [esi]
push esi
call dword [eax + 0xc]
mov dword [ebx + 0x20], 0x4494a8
mov dword [ebx], 0x44bd48
mov dword [ebx + 0x10], 0x44bd38
mov dword [ebx + 0x20], 0x44bd00
mov eax, dword [esi + 0x20]
mov esi, dword [esi + 0x14]
mov edi, dword [eax + 0x428]
xor eax, eax
push eax
push eax
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], eax
lea eax, [ebx + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
and dword [ebx + 0x48], 0
lea eax, [esi + 0x10]
mov dword [ebx + 0x4c], eax
lea ecx, [ebx + 0x50]
mov eax, dword [ebp + 0xc]
push eax
push str._BootPulsar
push edi
mov dword [ebx + 0x454], eax
call fcn.004233ee
mov dword [ebx + 0x450], eax
xor eax, eax
mov dword [ebx + 0x24], eax
mov dword [ebx + 0x458], eax
mov byte [ebx + 0x45c], al
mov eax, ebx
mov dword [ebx + 0x460], 0x32
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x42419c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444b6a
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x4570cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor eax, eax
mov dword [edi], 0x44be1c
inc eax
lea ecx, [edi + 0x18]
mov dword [edi + 8], eax
xor ebx, ebx
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 0x4494a8
mov dword [ecx], ebx
push ebx
mov dword [edi + 0x14], ebx
call fcn.0040e9c4
mov eax, dword [ebp + 0xc]
lea ecx, [edi + 0x38]
mov dword [edi], 0x44bd10
mov dword [edi + 0x10], 0x44bcac
mov dword [edi + 0x28], eax
mov dword [ecx], ebx
mov dword [edi + 0x3c], ebx
push ebx
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x2c], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], ebx
call fcn.0040e9c4
push ebx
lea ecx, [edi + 0x3c]
call fcn.0040e9c4
mov ecx, dword [ebp + 8]
mov dword [edi + 0x24], ebx
mov dword [edi + 0x20], ecx
push ecx
mov eax, dword [ecx]
call dword [eax + 0xc]
push 0x32
pop eax
push 0xff
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], eax
lea eax, [edi + 0x48]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x425af7
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x445ad4
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4570cc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [edi + 8]
mov dword [ebp - 0x2c], eax
cmp eax, dword [edx + 4]
jne 0x425b76
mov ecx, dword [edi + 8]
xor eax, eax
mov ecx, dword [ecx]
and ecx, 0x7ff
cmp ecx, dword [edi + 0x14]
sete al
test eax, eax
je 0x425b76
mov eax, dword [edi + 8]
inc dword [eax + 8]
test byte [0x469540], 0x80
je 0x425b6f
mov eax, dword [edi + 8]
mov edx, 0x44b7f0
push dword [eax + 0xc]
push dword [eax + 8]
push edi
call fcn.0042321d
xor eax, eax
jmp 0x425cef
xor eax, eax
mov byte [ebp - 0x14], 0
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x21], al
nop dword [eax]
nop word [eax + eax]
mov ecx, dword [edi + 8]
mov ecx, dword [ecx]
mov eax, ecx
xor ebx, ebx
and eax, 0x7ff
mov edx, ecx
cmp eax, 0x7fb
sete bl
test ebx, ebx
jne 0x425bcf
test eax, eax
je 0x425bcf
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x22], bl
cmp byte [ebp - 0x21], bl
jne 0x425bf6
and ecx, 0xfffff800
add ecx, 0x800
and ecx, 0xfffff800
jmp 0x425bf4
mov eax, dword [edi + 0x14]
xor eax, ecx
mov byte [ebp - 0x22], 1
and eax, 0x7ff
xor ecx, eax
cmp byte [ebp - 0x21], 0
je 0x425bf6
mov eax, ecx
shr eax, 0xb
dec eax
shl eax, 0xb
and ecx, 0x7ff
or ecx, eax
mov esi, dword [edi + 8]
mov eax, edx
lock cmpxchg dword [esi], ecx
mov ecx, eax
cmp ecx, edx
jne 0x425b95
cmp byte [ebp - 0x22], 0
mov eax, dword [edi + 8]
jne 0x425cb6
mov eax, dword [eax]
and eax, 0xfffff800
cmp eax, 0x28f5800
jb 0x425c32
mov eax, dword [0x4575f4]
mov ecx, 0x4575f4
push 0x1c124c
call dword [eax + 4]
mov ebx, dword [ebp + 8]
cmp ebx, 0xffffffff
je 0x425c6a
cmp byte [ebp - 0x21], 0
jne 0x425c51
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
mov dword [ebp - 0x28], esi
test ebx, ebx
jne 0x425c6a
jmp 0x425c54
mov esi, dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, esi
cmp ecx, ebx
jae 0x425c87
sub ebx, ecx
mov dword [ebp - 0x28], eax
mov dword [ebp + 8], ebx
mov eax, dword [ebp + 0xc]
mov ecx, edi
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 0x21], 1
mov dword [ebp - 0x1c], ebx
call fcn.00425d0d
jmp 0x425b90
mov eax, dword [edi + 8]
mov eax, dword [eax]
nop dword [eax]
mov esi, dword [edi + 8]
mov ecx, eax
shr ecx, 0xb
mov edx, eax
dec ecx
and eax, 0x7ff
shl ecx, 0xb
or ecx, eax
mov eax, edx
lock cmpxchg dword [esi], ecx
cmp eax, edx
jne 0x425c90
mov eax, 0x102
jmp 0x425cef
mov ecx, dword [ebp - 0x2c]
mov dword [eax + 4], ecx
mov eax, dword [edi + 8]
mov dword [eax + 8], 1
test byte [0x469540], 0x80
je 0x425ce3
mov eax, dword [edi + 8]
mov edx, 0x44b7f0
push dword [eax + 0xc]
push dword [eax + 8]
push edi
call fcn.0042321d
neg ebx
sbb ebx, ebx
and ebx, 0x80
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004429bf
mov esp, ebp
pop ebp
ret 8
Function at 0x429b32
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
mov esi, ecx
cmp byte [esi + 8], 0
je 0x429b4e
mov ebx, 0x80004005
jmp 0x429c03
mov edx, dword [esi + 0x38]
push edi
cmp edx, dword [esi + 0x34]
ja 0x429b7b
lea edx, [edx*4 + 0x14]
lea ecx, [esi + 0x2c]
call fcn.00403e15
test eax, eax
jne 0x429b74
mov ebx, 0x8007000e
jmp 0x429c02
add dword [esi + 0x38], 5
mov dword [esi + 0x2c], eax
lea eax, [ebp - 4]
mov ecx, esi
push eax
call fcn.00429c0b
mov ebx, eax
test ebx, ebx
js 0x429bf4
mov ecx, dword [esi + 0x40]
or ecx, dword [esi + 0x44]
jne 0x429ba0
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], edx
mov edi, dword [ebp - 4]
lock inc dword [edi + 0x908]
lea eax, [edi + 0x8f0]
push eax
xor eax, eax
push eax
push edi
push 0x42a37b
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x429bd4
mov ecx, edi
call fcn.0042a8b8
mov ebx, 0x80004005
jmp 0x429bf7
mov dword [edi + 0x8ec], eax
mov ecx, dword [esi + 0x34]
mov eax, dword [esi + 0x2c]
push 0x3e
mov dword [eax + ecx*4], edi
xor edi, edi
inc dword [esi + 0x34]
lea eax, [esi + 0x30]
pop ecx
lock xadd dword [eax], ecx
jmp 0x429bf7
mov edi, dword [ebp - 4]
test edi, edi
je 0x429c02
mov ecx, edi
call fcn.0042a8b8
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x434d25
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x445340
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x4570cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x10]
mov ecx, dword [eax + 0x30]
mov eax, dword [ecx]
call dword [eax + 0xc]
test al, al
je 0x434d60
mov al, 1
jmp 0x434daf
mov eax, dword [esi + 0x10]
cmp byte [eax], 0
je 0x434d7c
and dword [ebp - 4], 0
mov ecx, 0x4578dc
mov eax, dword [0x4578dc]
call dword [eax]
test al, al
jne 0x434d5c
cmp byte [esi + 0x14], 0
jne 0x434d86
xor al, al
jmp 0x434daf
lea ecx, [ebp - 0x20]
call fcn.004112dc
mov edx, esi
mov ecx, dword [eax]
sub ecx, dword [esi + 8]
mov eax, dword [eax + 4]
sbb eax, dword [esi + 0xc]
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], eax
call fcn.004352ab
neg al
sbb al, al
inc al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x43e4c8
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x4570cc]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x40c], 0
push esi
mov esi, dword [ebp + 0x18]
push edi
mov edi, ecx
mov dword [ebp - 0x414], esi
test edi, edi
jne 0x43e4fa
xor eax, eax
jmp 0x43e5fa
and dword [edi], 0
lea ecx, [ebp - 0x404]
push ebx
xor ebx, ebx
inc ebx
push ebx
push esi
push edx
call fcn.0043f714
mov ecx, eax
mov byte [ebp - 0x405], 0
mov eax, esi
mov dword [ebp - 0x418], ecx
shr eax, 0x1a
not al
and eax, 0xffffff01
mov dword [ebp - 0x410], eax
test ecx, ecx
je 0x43e550
mov eax, esi
shr eax, 0x17
push ecx
and eax, ebx
push eax
push 0x120001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov dword [edi], eax
mov eax, dword [ebp - 0x410]
cmp dword [edi], 0
jne 0x43e5d1
test al, al
je 0x43e5cc
push ebx
lea edx, [ebp - 0x40c]
mov ecx, esi
call fcn.0043f516
test eax, eax
je 0x43e5cc
push dword [ebp - 0x418]
mov eax, esi
shr eax, 0x19
and eax, ebx
push eax
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
mov ecx, dword [ebp - 0x414]
lea edx, [ebp - 0x40c]
mov esi, eax
call fcn.0043f6d8
cmp esi, 5
jne 0x43e5cc
cmp byte [ebp - 0x405], 0
jne 0x43e5cc
mov eax, dword [ebp - 0x410]
mov esi, dword [ebp - 0x414]
mov ecx, dword [ebp - 0x418]
mov byte [ebp - 0x405], bl
jmp 0x43e530
cmp dword [edi], 0
je 0x43e5d6
cmp dword [edi], 0xffffffff
jne 0x43e5f6
cmp byte [ebp - 0x410], 0
je 0x43e5f1
mov eax, dword [0x4575f4]
mov ecx, 0x4575f4
push 0x1631e1
call dword [eax + 4]
and dword [edi], 0
xor bl, bl
movzx eax, bl
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004429bf
mov esp, ebp
pop ebp
ret 0x14