joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404a3b
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.0041faf0
mov eax, dword [0x42d4b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x1000
xor ebx, ebx
lea eax, [ebp - 0x1004]
push ebx
push eax
mov edi, edx
mov esi, ecx
call sub.msvcrt.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x1004]
push 0x427fec
call fcn.00404901
push edi
lea ecx, [ebp - 0x1004]
call fcn.00404901
push 0x427ff4
lea ecx, [ebp - 0x1004]
call fcn.00404901
push edi
lea ecx, [ebp - 0x1004]
call fcn.00404901
push str.vL
lea ecx, [ebp - 0x1004]
call fcn.00404901
push esi
lea ecx, [ebp - 0x1004]
call fcn.00404901
push 0x428044
lea ecx, [ebp - 0x1004]
call fcn.00404901
push 0x14
push edi
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x404b31
push 0xc8
push 0x428068
mov esi, str.http:__down.360safe.com_setup.exe
push esi
call sub.msvcrt.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x404b20
call fcn.0040495f
test eax, eax
je 0x404b20
push 5
push ebx
push ebx
push str.http:__down.360safe.com_setupbeta.exe
jmp 0x404b25
push 5
push ebx
push ebx
push esi
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push ebx
call dword [sym.imp.msvcrt.dll_exit]
int3

Function at 0x404bc9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
lea eax, [ebp - 4]
xor edi, edi
push eax
push 0x20019
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360Safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404c56
push esi
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 1
push eax
mov esi, 0x42f590
mov dword [ebp - 8], 0x208
push esi
lea eax, [ebp - 0xc]
push eax
push edi
push str.Path
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, di
jne 0x404c2b
sub esi, ecx
sar esi, 1
je 0x404c51
push 0x5c
pop eax
cmp word [esi*2 + 0x42f58e], ax
je 0x404c51
mov word [esi*2 + 0x42f590], ax
mov eax, esi
pop esi
jmp 0x404c58
xor eax, eax
pop edi
leave
ret
Function at 0x4053f2
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x126c
call fcn.0041faf0
mov eax, dword [0x42d4b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x44
pop esi
push esi
xor ebx, ebx
lea eax, [ebp - 0x1268]
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
mov dword [ebp - 0x1268], esi
lea edi, [ebp - 0x1220]
mov dword [ebp - 0x123c], 1
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
push 0x104
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push ecx
mov edx, str.appwiz.cpl
lea ecx, [ebp - 0x1210]
call fcn.00405b31
pop ecx
lea eax, [ebp - 0x1220]
push eax
lea eax, [ebp - 0x1268]
push eax
lea eax, [ebp - 0x210]
push eax
push ebx
push 0x10
push ebx
push ebx
push ebx
lea eax, [ebp - 0x1210]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4054a9
push dword [ebp - 0x1220]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x121c]
call esi
mov al, 1
jmp 0x4054ab
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041f870
leave
ret
Function at 0x4054ba
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x127c
call fcn.0041faf0
mov eax, dword [0x42d4b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.00405a9a
test al, al
je 0x40550e
call fcn.00405101
mov ebx, eax
test ebx, ebx
je 0x40550e
lea eax, [ebp - 0x1218]
xor edi, edi
push eax
push 0xf01ff
push ebx
mov dword [ebp - 0x1218], edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40551f
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041f870
leave
ret
lea eax, [ebp - 0x1214]
mov dword [ebp - 0x1214], edi
push eax
push 1
push 1
push edi
push 0x2000000
push dword [ebp - 0x1218]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x405559
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call esi
push dword [ebp - 0x1218]
call esi
jmp 0x40550e
push dword [ebp - 0x1214]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x405582
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call esi
push dword [ebp - 0x1218]
call esi
push dword [ebp - 0x1214]
jmp 0x405555
push 0x44
pop esi
push esi
lea eax, [ebp - 0x1278]
push edi
push eax
call sub.msvcrt.dll_memset
xor eax, eax
mov dword [ebp - 0x1278], esi
lea edi, [ebp - 0x122c]
mov dword [ebp - 0x1270], str.WinSta0Default
stosd dword es:[edi], eax
add esp, 0xc
mov dword [ebp - 0x124c], 1
stosd dword es:[edi], eax
push 5
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop eax
xor edi, edi
mov word [ebp - 0x1248], ax
push edi
push dword [ebp - 0x1214]
lea eax, [ebp - 0x121c]
mov dword [ebp - 0x121c], edi
push eax
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push ecx
mov edx, str.appwiz.cpl
lea ecx, [ebp - 0x1210]
call fcn.00405b31
pop ecx
lea eax, [ebp - 0x122c]
push eax
lea eax, [ebp - 0x1278]
push eax
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x121c]
lea eax, [ebp - 0x1210]
push 0x4000410
push edi
push edi
push edi
push eax
push edi
push dword [ebp - 0x1214]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x405677
lea eax, [ebp - 0x122c]
push eax
lea eax, [ebp - 0x1278]
push eax
lea eax, [ebp - 0x210]
push eax
push edi
push 0x4000410
push edi
push edi
push edi
lea eax, [ebp - 0x1210]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x405687
push dword [ebp - 0x122c]
call esi
push dword [ebp - 0x1228]
call esi
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
cmp dword [ebp - 0x121c], edi
je 0x4056a1
push dword [ebp - 0x121c]
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
push dword [ebp - 0x1218]
call esi
push dword [ebp - 0x1214]
call esi
push ebx
call esi
mov al, 1
jmp 0x405510
Function at 0x4056bb
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10e0
call fcn.0041faf0
mov eax, dword [0x42d4b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x44
lea eax, [ebp - 0x10e0]
mov esi, ecx
push 0
push eax
call sub.msvcrt.dll_memset
xor eax, eax
mov dword [ebp - 0x10e0], 0x44
lea edi, [ebp - 0x1098]
add esp, 8
stosd dword es:[edi], eax
lea ecx, [ebp - 0x1088]
mov edx, str.inetcpl.cpl
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00405b31
pop ecx
test esi, esi
je 0x405743
push esi
push str.___d
lea eax, [ebp - 0x88]
push 0x40
push eax
call fcn.00404f8a
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x1088]
push 0x800
push eax
call fcn.004185d0
add esp, 0x1c
lea eax, [ebp - 0x1098]
xor ecx, ecx
push eax
lea eax, [ebp - 0x10e0]
push eax
push ecx
push ecx
push 0x10
push ecx
push ecx
push ecx
lea eax, [ebp - 0x1088]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x405786
push dword [ebp - 0x1098]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1094]
call esi
mov al, 1
jmp 0x405788
xor al, al
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0041f870
leave
ret
Function at 0x405a9a
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov ecx, str.SeDebugPrivilege
push ebx
push esi
push edi
call fcn.00405a55
mov ecx, str.SeIncreaseQuotaPrivilege
call fcn.00405a55
mov ecx, str.SeAssignPrimaryTokenPrivilege
call fcn.00405a55
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, str.kernel32
push str.IsWow64Process
push ebx
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push str.GetNativeSystemInfo
push ebx
mov dword [0x42f7a8], eax
call edi
push eax
call esi
mov edx, eax
mov dword [0x42f7a4], edx
test edx, edx
je 0x405b23
push 9
pop esi
xor eax, eax
lea edi, [ebp - 0x24]
mov ecx, esi
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
push eax
call edx
cmp word [ebp - 0x24], si
je 0x405b18
cmp word [ebp - 0x24], 6
jne 0x405b23
mov byte [0x42f7a0], 1
xor al, al
jmp 0x405b2c
mov byte [0x42f7a0], 0
mov al, 1
pop edi
pop esi
pop ebx
leave
ret

Function at 0x405b31
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x42d4b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x104
lea eax, [ebp - 0x20c]
push esi
push eax
mov edi, edx
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x824]
push esi
push eax
call fcn.004143b0
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x824]
add esp, 0xc
push str.rundll32.exe
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push 0x104
push eax
call fcn.004143b0
add esp, 0xc
lea eax, [ebp - 0x61c]
push str.shell32.dll
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.004143b0
add esp, 0xc
lea eax, [ebp - 0x414]
push edi
push eax
call esi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x824]
push eax
push str.__ws____ws__Control_RunDLL___ws_
push 0x800
push ebx
call fcn.00404f8a
mov ecx, dword [ebp - 4]
add esp, 0x18
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0041f870
leave
ret
Function at 0x406c26
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x42d4b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x105
lea eax, [ebp - 0x10c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x406ca9
push ecx
push str._SYSTEMROOT__system32
push ecx
mov edx, esi
lea ecx, [ebp - 0x214]
call fcn.00406d69
test eax, eax
jns 0x406c82
push eax
push str.LoadUpdateProviderFunctions:_StringCchCopyA_failed:_0x_x_n
push 2
call fcn.00418480
pop ecx
push eax
call fcn.00405c50
add esp, 0xc
jmp 0x406cf8
push esi
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
jne 0x406ca9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.LoadUpdateProviderFunctions:_Unable_to_expand_environment_string:__d_n
jmp 0x406c6f
push ecx
lea ecx, [ebp - 0x10c]
call fcn.00406d1c
test eax, eax
jns 0x406cc1
push eax
push str.LoadUpdateProviderFunctions:_StringCchCatA_failed:_0x_x_n
jmp 0x406c6f
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x406cfc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x10c]
push eax
push str.LoadUpdateProviderFunctions:_Unable_to_load__s:__d_n
push 2
call fcn.00418480
pop ecx
push eax
call fcn.00405c50
add esp, 0x10
xor eax, eax
jmp 0x406d0f
push str.WSCUpdateProvider
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x42f7ac], eax
mov eax, esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0041f870
leave
ret
Function at 0x40708c
Capabilities:
Create thread
Query or enumerate registry value

Disassembly:
push 0x60
mov eax, 0x423c12
call fcn.00413d00
mov edi, ecx
push 8
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
pop ecx
mov dword [ebp - 0x54], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
test eax, eax
je 0x4070ba
push eax
lea ecx, [edi + 4]
call fcn.00407398
jmp 0x4070bc
mov eax, ebx
push ebx
push ebx
push eax
push 0x40721c
push ebx
push ebx
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
test eax, eax
je 0x407162
push 0x7d0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea esi, [edi + 0xc]
test esi, esi
je 0x4070f1
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [edi + 0x2c]
mov ebx, dword [edi + 0x28]
mov dword [ebp - 0x54], eax
test esi, esi
je 0x407108
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x54]
test ebx, ebx
je 0x407160
test eax, eax
je 0x407160
xor esi, esi
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], esi
push eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x44], ebx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea eax, [ebp - 0x48]
mov dword [ebp - 0x60], 0x1776
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x60]
push eax
push esi
push 0x4a
push dword [edi + 0x24]
mov dword [ebp - 0x5c], 0x1c
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, ebx
jmp 0x407216
xor ebx, ebx
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push 4
pop eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], ebx
push eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x24], ebx
push eax
push dword [0x42f7e8]
mov dword [ebp - 0x20], ebx
push dword [0x42f7e4]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
push ebx
mov dword [ebp - 0x2c], 2
call esi
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x50]
push eax
push dword [0x42f7ec]
push dword [0x42f7e4]
push ebx
call esi
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x50], 3
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x4c], 0x10
push eax
lea eax, [ebp - 0x50]
push eax
push dword [0x42f7f0]
push dword [0x42f7e4]
push ebx
call esi
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x6c], 0x1776
mov dword [ebp - 0x64], eax
xor esi, esi
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x68], 0x1c
push eax
push esi
push 0x4a
push dword [edi + 0x24]
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
call fcn.00413c80
ret
Function at 0x40eefa
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
push edi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x40ef26
mov eax, 0x4264e8
push eax
push eax
push edi
push edi
call fcn.0040e606
jmp 0x40ef52
mov esi, dword [ebp + 0x18]
lea eax, [ebp + 0x10]
push edi
push eax
push esi
push dword [ebp + 0x14]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40ef16
cmp esi, dword [ebp + 0x10]
je 0x40ef59
push 0x4264e8
push 1
push edi
push edi
call fcn.0040e5b9
add esp, 0x10
xor eax, eax
jmp 0x40ef5c
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret
Function at 0x410148
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x410172
mov eax, 0x4264e8
push eax
push eax
push 0
push 0
call fcn.0040e606
add esp, 0x10
xor eax, eax
pop ebp
ret
xor eax, eax
inc eax
pop ebp
ret

Function at 0x410ec1
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret

Function at 0x411404
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x20], 0
and dword [eax + 0x24], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
pop ebp
ret

Function at 0x4116c3
Capabilities:
Check mutex on windows

Disassembly:
push 0xa0
mov eax, 0x4242cb
call fcn.00413d80
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0xa0], esi
mov dword [esi], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.1830B7BD_F7A3_4c4d_989B_C004DE465EDE
push str._s__u
lea eax, [ebp - 0x98]
push 0x41
push eax
call fcn.00411d26
add esp, 0x14
xor eax, eax
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x98]
push eax
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
mov dword [ebp - 0x9c], edi
test edi, edi
je 0x411760
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x411738
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], ebx
call fcn.00411bde
test eax, eax
je 0x411768
mov dword [esi], eax
mov eax, dword [esi]
push edi
inc dword [eax + 0x5bc]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test ebx, ebx
jne 0x411760
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
call fcn.00413ca0
ret
push 0x5c0
call fcn.004118f2
pop ecx
mov dword [ebp - 0xac], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x41178b
push edi
mov ecx, eax
call fcn.0041181d
jmp 0x41178d
mov eax, ebx
mov byte [ebp - 4], bl
mov dword [esi], eax
test eax, eax
je 0x411801
xor ebx, ebx
push eax
inc ebx
call fcn.00411ce2
pop ecx
test eax, eax
jne 0x411746
mov dword [ebp - 0xa8], 3
lea eax, [ebp - 0xa8]
push 0x42afd4
jmp 0x411816
mov dword [ebp - 0xa4], 1
lea eax, [ebp - 0xa4]
push 0x42afd4
push eax
call sub.msvcrt.dll__CxxThrowException
int3
Function at 0x41181d
Capabilities:
Allocate thread local storage

Disassembly:
push 4
mov eax, 0x4242fe
call fcn.00413cc0
mov esi, ecx
mov dword [ebp - 0x10], esi
and dword [esi], 0
lea ecx, [esi + 8]
or dword [esi + 4], 0xffffffff
call fcn.00411694
and dword [ebp - 4], 0
and dword [esi + 0x5bc], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x411865
mov eax, dword [ebp + 8]
mov dword [esi], eax
mov eax, esi
call fcn.00413c60
ret 4
push 0x42afd4
lea eax, [ebp + 8]
mov dword [ebp + 8], 2
push eax
call sub.msvcrt.dll__CxxThrowException
int3

Function at 0x411962
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [ebx]
add ecx, 8
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0x5a8]
mov dword [ecx + 0x5b0], eax
call fcn.00411ae6
mov edi, eax
test edi, edi
je 0x4119ed
mov eax, dword [ebp - 4]
cmp eax, dword [edi]
jne 0x41199d
mov esi, edi
jmp 0x4119d9
push dword [edi]
push 1
push 0x40
call dword [sym.imp.KERNEL32.dll_OpenThread]
test eax, eax
jne 0x4119d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4119c5
mov ecx, dword [ebx]
push edi
add ecx, 8
call fcn.00411a81
jmp 0x4119d9
push str.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x4119d9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebx]
add ecx, 8
call fcn.00411ae6
mov edi, eax
test edi, edi
jne 0x411992
test esi, esi
jne 0x411a02
mov ecx, dword [ebx]
add ecx, 8
call fcn.00411c5f
mov esi, eax
test esi, esi
je 0x411a02
mov eax, dword [ebp - 4]
mov dword [esi], eax
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x413400
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
add eax, 0x18
add eax, ecx
movzx ecx, word [ecx + 6]
lea ecx, [ecx + ecx*4]
lea edi, [eax + ecx*8]
cmp eax, edi
je 0x41343e
mov esi, dword [ebp + 0xc]
mov edx, dword [eax + 0xc]
cmp esi, edx
jb 0x413437
mov ecx, dword [eax + 8]
add ecx, edx
cmp esi, ecx
jb 0x413440
add eax, 0x28
cmp eax, edi
jne 0x413427
xor eax, eax
pop edi
pop esi
pop ebp
ret

Function at 0x4139b0
Capabilities:
Get process heap force flags

Disassembly:
mov eax, dword fs:[0x18]
mov ecx, dword [eax + 0x30]
mov eax, dword [ecx + 0xa4]
shl eax, 0x10
or eax, dword [ecx + 0xa8]
ret
Function at 0x418030
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
mov eax, dword [0x42d4b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x418057
mov ecx, 5
int 0x29
push 2
call fcn.004141a0
push 0x50
lea eax, [ebp - 0x320]
push 0
push eax
call sub.msvcrt.dll_memset
push 0x2cc
lea eax, [ebp - 0x2d0]
push 0
push eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x320]
add esp, 0x1c
mov dword [ebp - 0x328], eax
lea eax, [ebp - 0x2d0]
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x234], edi
mov word [ebp - 0x208], ss
mov word [ebp - 0x214], cs
mov word [ebp - 0x238], ds
mov word [ebp - 0x23c], es
mov word [ebp - 0x240], fs
mov word [ebp - 0x244], gs
pushfd
pop dword [ebp - 0x210]
mov eax, dword [ebp + 4]
mov dword [ebp - 0x218], eax
lea eax, [ebp + 4]
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x2d0], 0x10001
mov eax, dword [eax - 4]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 4]
mov dword [ebp - 0x320], 0xc0000417
mov dword [ebp - 0x31c], 1
mov dword [ebp - 0x314], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x418162
test esi, esi
jne 0x418162
push 2
call fcn.004141a0
add esp, 4
push 0xc0000417
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0041f870
mov esp, ebp
pop ebp
ret