joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b3bf8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4b3c52
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.004b3be8
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004a3274
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.004a2e74
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b3c59
lea eax, [ebp - 4]
call fcn.00404878
ret

Function at 0x4ba558
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4ba6c9
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ba6a4
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x111], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x111]
push eax
lea eax, [ebp - 0x118]
mov edx, ebx
call fcn.00404a60
lea eax, [ebp - 0x118]
mov edx, 0x4ba6e0
call fcn.00404b40
mov eax, dword [ebp - 0x118]
call fcn.00404d38
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x4ba616
lea eax, [ebp - 0x111]
call fcn.00409e90
mov ecx, eax
lea edx, [ebp - 0x111]
mov eax, esi
call fcn.00404968
jmp 0x4ba61d
mov eax, esi
call fcn.00404878
cmp bl, 0x61
jae 0x4ba63e
lea edx, [ebp - 0x11c]
mov eax, dword [esi]
call fcn.0040e6e0
mov edx, dword [ebp - 0x11c]
mov eax, esi
call fcn.004048cc
jmp 0x4ba658
lea edx, [ebp - 0x120]
mov eax, dword [esi]
call fcn.0040e654
mov edx, dword [ebp - 0x120]
mov eax, esi
call fcn.004048cc
lea eax, [ebp - 0x124]
push eax
mov eax, dword [esi]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x128], 0xb
lea edx, [ebp - 0x12c]
xor ecx, ecx
mov eax, 0x4ba6ec
call fcn.0040a56c
mov edx, dword [ebp - 0x124]
mov eax, esi
call fcn.004048cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ba6ab
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x4bf9b4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404d28
xor eax, eax
push ebp
push 0x4bfaad
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [esi + 4]
mov word [ebx + 4], ax
mov ax, word [esi + 6]
mov word [ebx + 6], ax
mov ax, word [esi + 8]
mov word [ebx + 8], ax
mov ax, word [esi + 0xa]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xc]
call fcn.004c1328
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1e]
mov word [ebx + 0x1e], ax
mov ax, word [esi + 0x20]
mov word [ebx + 0x22], ax
mov ax, word [esi + 0x22]
mov word [ebx + 0x24], ax
mov ax, word [esi + 0x24]
mov word [ebx + 0x26], ax
mov eax, dword [esi + 0x26]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2a]
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00409cd8
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004c0374
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00409bbc
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004c03e8
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bfab4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040489c
ret
Function at 0x4bfabc
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404d28
xor eax, eax
push ebp
push 0x4bfbc5
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
mov ax, word [esi + 4]
mov word [ebx + 6], ax
mov ax, word [esi + 6]
mov word [ebx + 8], ax
mov ax, word [esi + 8]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xa]
call fcn.004c1328
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0xe]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x12]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x16]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1a]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], 0
mov word [ebx + 0x24], 0
mov word [ebx + 0x26], 0
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
cmp dword [ebp - 4], 0
je 0x4bfb8b
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00409cd8
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004c0374
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00409bbc
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004c03e8
jmp 0x4bfb9d
xor edx, edx
mov eax, ebx
call fcn.004c0374
xor edx, edx
mov eax, ebx
call fcn.004c03e8
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bfbcc
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040489c
ret

Function at 0x4c1584
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d28
xor eax, eax
push ebp
push 0x4c15e2
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 4]
call fcn.004c1660
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
je 0x4c15ca
lea eax, [ebp - 4]
call fcn.004c1660
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 5
jne 0x4c15cc
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c15e9
lea eax, [ebp - 4]
call fcn.00404878
ret

Function at 0x4c15f0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d28
xor eax, eax
push ebp
push 0x4c1654
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xe
lea eax, [ebp - 0x1a]
push eax
lea eax, [ebp - 4]
call fcn.004c1660
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov edx, ebx
lea eax, [ebp - 0x1a]
call fcn.0040a07c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c165b
lea eax, [ebp - 4]
call fcn.00404878
ret
Function at 0x4c6aa4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x170]
mov edx, ebx
mov eax, edi
call fcn.004c6cd8
mov esi, eax
mov dword [edi + 0x170], esi
and esi, 0xff
add dword [edi + 0x174], esi
imul esi, dword [edi + 0x174], 0x8088405
inc esi
mov dword [edi + 0x174], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x178]
mov eax, edi
call fcn.004c6cd8
mov dword [edi + 0x178], eax
pop edi
pop esi
pop ebx
ret

Function at 0x4c6b18
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x4c6b3d
inc esi
mov eax, edi
call fcn.004c6afc
xor byte [ebx], al
mov dl, byte [ebx]
mov eax, edi
call fcn.004c6aa4
inc ebx
dec esi
jne 0x4c6b27
pop edi
pop esi
pop ebx
ret

Function at 0x4c6bcc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00404d28
xor eax, eax
push ebp
push 0x4c6c41
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.004c6b44
mov dword [ebp - 8], 0xc
lea esi, [ebp - 0x14]
mov eax, edi
call fcn.004c6afc
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, edi
call fcn.004c6aa4
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x4c6c0c
mov bl, byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c6c48
lea eax, [ebp - 4]
call fcn.00404878
ret
Function at 0x4c7804
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4c79e8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x4c79a4
mov eax, dword [ebp - 4]
call fcn.004c9154
cmp ebx, eax
jge 0x4c79a4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x118]
mov edx, ebx
call fcn.004be0cc
mov edx, dword [0x4bf454]
call fcn.00403c54
mov esi, eax
mov eax, esi
call fcn.004c0308
test al, al
je 0x4c799a
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov edi, dword [esi + 0x44]
test edi, edi
jne 0x4c798e
xor eax, eax
push ebp
push 0x4c7987
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004c7dbc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
call fcn.0041c4b4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push dword [esi + 0x34]
push dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
lea edx, [ebp - 0x46]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 0xc]
movzx eax, word [ebp - 0x2a]
movzx edx, word [ebp - 0x28]
add eax, edx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x18]
movzx esi, word [ebp - 0x26]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.00404ec4
mov eax, dword [ebp - 8]
call fcn.00404d90
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
mov al, byte [eax + 0x28]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004c7b80
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
mov dl, byte [ebp - 9]
mov byte [eax + 0x28], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c79d2
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x4c7986
mov eax, dword [ebp - 4]
call fcn.004c7e40
ret
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.0040a07c
jmp 0x4c79d2
mov eax, dword [ebp - 8]
call fcn.00404878
jmp 0x4c79d2
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x4c], 0
lea eax, [ebp - 0x50]
push eax
push 0
lea edx, [ebp - 0x54]
mov eax, 0xb3
call fcn.00409604
mov ecx, dword [ebp - 0x54]
mov dl, 1
mov eax, dword [0x417450]
call fcn.0040d84c
call fcn.00404230
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c79ef
lea eax, [ebp - 0x54]
call fcn.00404878
ret
Function at 0x4ce818
Capabilities:
Check internet connectivity via wininet

Disassembly:
push 0
push 1
push 0x4ce830
call sub.wininet.dll_InternetCheckConnectionA
cmp eax, 1
sbb eax, eax
inc eax
ret
Function at 0x4d811c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d818a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x10
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x19]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4d8162
lea eax, [ebp - 4]
lea edx, [ebp - 0x19]
mov ecx, 0x11
call fcn.00404ae8
jmp 0x4d816a
lea eax, [ebp - 4]
call fcn.00404878
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.004048cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d8191
lea eax, [ebp - 4]
call fcn.00404878
ret

Function at 0x4d856c
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffe30
mov ebp, eax
lea eax, [esp + 0x40]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, ebp
call fcn.00404878
push 0x40
lea eax, [esp + 4]
push eax
call sub.wsock32.dll_gethostname
push esp
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x4d85c6
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x4d85ba
push dword [edi]
call sub.wsock32.dll_inet_ntoa
mov edx, ebp
call fcn.0040a07c
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x4d85ab
call sub.wsock32.dll_WSACleanup
add esp, 0x1d0
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4d86f8
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
or al, al
je 0x4d870f
jne 0x4d8716
mov dword [ebp - 4], 1
mov dword [ebp - 8], 1
cmp dword [ebp - 8], 1
jne 0x4d8725
mov dl, 1
cmp dword [ebp - 4], 1
jne 0x4d872d
xor edx, edx
mov eax, edx
pop ecx
pop ecx
pop ebp
ret
Function at 0x40311e
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
push str.GlobalDTShellHelper_
mov edi, 0x80
push edi
mov esi, 0x4078c0
push esi
mov dword [0x407460], eax
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
call fcn.00403464
push eax
push edi
push esi
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0x18
push esi
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40316f
xor eax, eax
jmp 0x403186
push ebx
call fcn.0040342c
push esi
mov bl, al
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
test bl, bl
sete al
pop ebx
pop edi
pop esi
ret 0x10
Function at 0x403290
Capabilities:
Check os version
Connect pipe
Create pipe
Create thread

Disassembly:
pushal
mov dword [esp + 0x1c], edx
call fcn.0040fb6c
add byte [eax], al
add byte [eax], al
push ebp
lea ebp, [esp - 0xd0]
sub esp, 0x150
mov eax, dword [0x407028]
xor eax, ebp
mov dword [ebp + 0xcc], eax
push ebx
push esi
push edi
xor edi, edi
cmp word [0x4077c0], di
jne 0x4032e1
push str..pipeDTShellHelper_
mov esi, 0x80
push esi
mov ebx, 0x4077c0
push ebx
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
call fcn.00403464
push eax
push esi
push ebx
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0x18
lea eax, [ebp - 0x74]
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x5c]
push eax
mov dword [ebp - 0x5c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40339f
cmp dword [ebp - 0x4c], 2
jne 0x40339f
cmp dword [ebp - 0x58], 6
jb 0x40339f
xor esi, esi
lea eax, [ebp + 0xb8]
inc esi
push esi
push eax
mov dword [ebp - 0x74], 0xc
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x70], eax
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
jne 0x40333a
inc bl
push edi
push edi
push esi
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
jne 0x40334c
mov bl, 1
push edi
lea eax, [ebp - 0x68]
push eax
push esi
push str.S:_ML__NW___LW_
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
jne 0x403363
mov bl, 1
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x68]
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x7c], edi
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorSacl]
test eax, eax
jne 0x403387
mov bl, 1
push edi
push dword [ebp - 0x64]
push esi
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorSacl]
test eax, eax
jne 0x40339b
mov bl, 1
test bl, bl
je 0x4033a2
mov dword [ebp - 0x60], edi
push dword [ebp - 0x60]
mov eax, 0x1000
push 0xbb8
push eax
push eax
push 0xff
push 6
push 3
push 0x4077c0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov esi, eax
cmp esi, 0xffffffff
je 0x403410
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x4033ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x217
neg eax
sbb eax, eax
inc eax
je 0x403404
lea eax, [ebp - 0x80]
push eax
push edi
push esi
push 0x40318b
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
je 0x403410
push eax
jmp 0x403405
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4032e1
mov ecx, dword [ebp + 0xcc]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00403a4b
add ebp, 0xd0
leave
ret 4

Function at 0x40342c
Capabilities:
Create thread

Disassembly:
push esi
xor esi, esi
push esi
push esi
push esi
push 0x403290
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
mov dword [0x407478], eax
pop esi
je 0x403461
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [0x407478]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
ret
xor al, al
ret
Function at 0x40355d
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x407028]
xor eax, ebp
mov dword [ebp + 0x9c], eax
cmp byte [0x4079c0], 0
jne 0x4035bd
push 0x118
lea eax, [ebp - 0x7c]
push 0
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4035b6
cmp dword [ebp - 0x7c], 6
jb 0x4035b6
mov byte [0x4079c1], 1
mov byte [0x4079c0], 1
mov ecx, dword [ebp + 0x9c]
movzx eax, byte [0x4079c1]
xor ecx, ebp
call fcn.00403a4b
add ebp, 0xa0
leave
ret

Function at 0x403a4b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x407028]
jne 0x403a55
repz ret
jmp fcn.00403ea6

Function at 0x40456e
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x407028]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00404503
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x4045bd
cmp dword [ebp - 0x1c], 5
jb 0x4045d5
jmp 0x4045d1
cmp dword [ebp - 0x10], 1
jne 0x4045d5
cmp dword [ebp - 0x1c], 4
ja 0x4045d1
jne 0x4045d5
cmp dword [ebp - 0x18], 0
jbe 0x4045d5
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x405330
call fcn.004043d7
test eax, eax
jge 0x4045f6
mov byte [0x4076b8], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00403a4b
add ebp, 0x78
leave
ret
Function at 0x408c93
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x408cb4
jl 0x408cab
test edi, edi
jne 0x408cb4
xor eax, eax
xor edx, edx
jmp 0x408d75
cmp dword [ebx + 0x38], 0
je 0x408cc9
push eax
push edi
push dword [ebp + 8]
call fcn.00408d7b
jmp 0x408d75
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x408d10
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x408d10
cmp eax, edi
jb 0x408cea
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.0040a4e0
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x408d16
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x408d6a
mov ecx, ebx
call fcn.004084e6
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x408d55
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.00412ac8
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x408d6a
jmp 0x408d28
test edx, edx
je 0x408d6a
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.00412ac8
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x40a125
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40a164
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40a164
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40a164
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40a164
cmp dword [ecx + 0x74], 0xe
jbe 0x40a164
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x41898a
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42c628
push 0x42c620
push str.FlsAlloc
push 0x1e
call fcn.004187f7
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4189be
push dword [ebp + 8]
mov ecx, esi
call dword [0x42816c]
call esi
jmp 0x4189c4
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x418a08
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42c638
push 0x42c630
push str.FlsGetValue
push 0x20
call fcn.004187f7
mov esi, eax
add esp, 0x10
test esi, esi
je 0x418a3f
push dword [ebp + 8]
mov ecx, esi
call dword [0x42816c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x41be04
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041bc75

Function at 0x41c1fe
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0040a490
mov eax, dword [0x4683c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00419df2
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x41c240
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x41c39c
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.004259c0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x46a9f8]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.0041cf9d
mov ecx, dword [esi*4 + 0x46a9f8]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x41c395
cmp eax, dword [edi + ecx + 0x24]
jne 0x41c395
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41c395
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0041cf9d
add esp, 0x14
test edx, edx
jl 0x41c395
jg 0x41c30b
test eax, eax
jb 0x41c395
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x41c395
jl 0x41c325
cmp dword [ebp - 0x1008], eax
ja 0x41c395
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x41c343
test ebx, ebx
je 0x41c37c
cmp ecx, edi
jae 0x41c37c
mov al, byte [ecx]
cmp al, 0xd
jne 0x41c35d
lea eax, [edi - 1]
cmp ecx, eax
jae 0x41c369
cmp byte [ecx + 1], 0xa
jne 0x41c369
inc ecx
jmp 0x41c369
movzx eax, al
movsx eax, byte [eax + 0x468688]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x41c343
cmp edx, ebx
jne 0x41c343
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x41c39a
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00409aec
leave
ret