joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101aace0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1020cac8
push 0x101b5b70
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 0x20], ebx
lea eax, [ebp - 0x20]
push eax
mov edi, dword [ebp + 0x14]
push edi
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.101aa540
add esp, 0x10
mov esi, eax
cmp esi, ebx
je 0x101aad93
mov eax, dword [esi]
push eax
mov eax, dword [ebp - 0x20]
push eax
call edi
add esp, 8
mov dword [ebp - 0x24], eax
mov edi, dword [ebp + 0x10]
sub edi, dword [ebp - 0x20]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], ebx
lea ecx, [ebp - 0x30]
push ecx
push 0x40
push 4
push esi
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call ebx
test eax, eax
je 0x101aad8c
mov dword [esi], edi
lea edx, [ebp - 0x30]
push edx
mov eax, dword [ebp - 0x30]
push eax
push 4
push esi
call ebx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x101ac000
Capabilities:
Get disk information

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x101d55f0
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x34]
push edi
push 0xffffffffffffffff
push 0
mov ecx, esi
call fcn.100ce270
mov edi, dword [esp + 0x3c]
push 0xffffffffffffffff
push 0
mov ecx, edi
call fcn.100ce270
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebp, eax
mov eax, dword [0x10262ef8]
test eax, eax
je 0x101ac0b8
cmp ebp, eax
jne 0x101ac0b8
mov eax, dword [0x10262efc]
test eax, eax
je 0x101ac0b8
cmp ebx, eax
jb 0x101ac0b8
add eax, 0x493e0
cmp eax, ebx
jb 0x101ac0b8
mov ebp, dword [0x10262f00]
push 1
inc ebp
push 0x10262e18
lea ecx, [esp + 0x18]
mov dword [0x10262f00], ebp
call fcn.100d53d0
push 0x10262e48
mov ecx, esi
mov dword [esp + 0x34], 0
call fcn.100ce450
push 0x10262e38
mov ecx, edi
call fcn.100ce450
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x10]
jmp 0x101ac12e
push edi
push esi
mov dword [0x10262f00], 0
call fcn.101ac430
add esp, 8
lea ecx, [esp + 0x1c]
push 1
push 0x10262e18
call fcn.100d53d0
push 0xffffffffffffffff
push 0
mov ecx, 0x10262e48
mov dword [esp + 0x38], 1
mov dword [0x10262ef8], ebp
mov dword [0x10262efc], ebx
call fcn.100ce270
push esi
mov ecx, 0x10262e48
call fcn.100ce450
push 0xffffffffffffffff
push 0
mov ecx, 0x10262e38
call fcn.100ce270
push edi
mov ecx, 0x10262e38
call fcn.100ce450
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.100d5430
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x101ac430
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x101d5656
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x224
push ebx
push ebp
push esi
mov esi, dword [esp + 0x240]
push edi
xor ebx, ebx
push 0xffffffffffffffff
push ebx
mov ecx, esi
call fcn.100ce270
mov ebp, dword [esp + 0x248]
push 0xffffffffffffffff
push ebx
mov ecx, ebp
call fcn.100ce270
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [esp + 0x28], eax
xor eax, eax
mov dword [esp + 0x10], 1
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x10]
test ecx, edx
je 0x101ac569
mov edx, dword [0x1024a28c]
mov cx, word [0x1024a290]
mov dword [esp + 0x18], edx
add word [esp + 0x18], ax
lea edx, [esp + 0x18]
mov word [esp + 0x1c], cx
push edx
lea ecx, [esp + 0x28]
mov word [esp + 0x22], bx
call fcn.100c8140
mov eax, dword [esi + 4]
lea ecx, [esp + 0x24]
push ecx
push eax
mov ecx, esi
mov dword [esp + 0x244], ebx
call fcn.100ce810
mov edx, dword [0x10200e98]
mov dword [esp + 0x14], edx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x2e]
mov word [esp + 0x2c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x2c]
push 0x104
lea ecx, [esp + 0x1c]
push eax
push ecx
mov byte [esp + 0x248], 1
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x14]
push edx
mov word [esp + 0x236], bx
call fcn.100c8b60
mov eax, dword [ebp + 4]
lea ecx, [esp + 0x14]
push ecx
push eax
mov ecx, ebp
call fcn.100ce810
lea ecx, [esp + 0x14]
mov byte [esp + 0x23c], bl
call fcn.100c88e0
lea ecx, [esp + 0x24]
mov dword [esp + 0x23c], 0xffffffff
call fcn.100c88e0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
inc eax
shl edx, 1
cmp eax, 0x1a
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], edx
jb 0x101ac48b
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x230
ret
Function at 0x101bdae0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x80
call fcn.10099630
push ebx
push ebp
push esi
mov esi, dword [esp + 0x9c]
xor eax, eax
push edi
test esi, esi
je 0x101bdb0b
mov ebx, dword [esp + 0x94]
mov eax, 1
mov dword [ebx], esi
jmp 0x101bdb1d
mov ebx, dword [esp + 0x94]
mov ecx, dword [ebx]
mov dword [esp + 0xa0], ecx
mov esi, ecx
mov ecx, dword [esp + 0x98]
test ecx, ecx
je 0x101bdc89
push esi
call fcn.10151d20
mov edi, eax
add esp, 4
cmp edi, 0x80
jle 0x101bdb53
push str.j____int_sizeof_ctx__key_
push 0x54
push str..cryptohmachmac.c
call fcn.1014f230
add esp, 0xc
mov ebp, dword [esp + 0x9c]
cmp edi, ebp
jge 0x101bdb92
mov edx, dword [esp + 0xa4]
lea edi, [ebx + 4]
push edx
push esi
push edi
call fcn.10159d10
mov eax, dword [esp + 0xa4]
push ebp
push eax
push edi
call fcn.10159e80
lea esi, [ebx + 0x34]
lea ecx, [ebx + 0x38]
push esi
push ecx
push edi
call fcn.10159f80
add esp, 0x24
jmp 0x101bdbd1
test ebp, ebp
jl 0x101bdb9e
cmp ebp, 0x80
jle 0x101bdbb2
push str.len_0__len__int_sizeof_ctx__key_
push 0x5e
push str..cryptohmachmac.c
call fcn.1014f230
add esp, 0xc
mov esi, dword [esp + 0x98]
mov ecx, ebp
mov edx, ecx
lea edi, [ebx + 0x38]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [ebx + 0x34]
mov dword [esi], ebp
mov esi, dword [esi]
cmp esi, 0x80
je 0x101bdbf6
mov ecx, 0x80
xor eax, eax
sub ecx, esi
lea edi, [esi + ebx + 0x38]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov esi, dword [esp + 0xa0]
xor eax, eax
mov cl, byte [ebx + eax + 0x38]
xor cl, 0x36
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x80
jl 0x101bdbff
mov ebp, dword [esp + 0xa4]
lea edi, [ebx + 0x14]
push ebp
push esi
push edi
call fcn.10159d10
push esi
call fcn.10151d20
lea edx, [esp + 0x20]
push eax
push edx
push edi
call fcn.10159e80
add esp, 0x1c
xor eax, eax
mov cl, byte [ebx + eax + 0x38]
xor cl, 0x5c
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x80
jl 0x101bdc3b
lea edi, [ebx + 0x24]
push ebp
push esi
push edi
call fcn.10159d10
push esi
call fcn.10151d20
lea edx, [esp + 0x20]
push eax
push edx
push edi
call fcn.10159e80
add esp, 0x1c
lea eax, [ebx + 0x14]
add ebx, 4
push eax
push ebx
call fcn.1015a030
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x80
ret
test eax, eax
je 0x101bdc6e
jmp 0x101bdbfd

Function at 0x101be190
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x58], ecx
mov eax, 1
ret
Function at 0x4019e4
Capabilities:
Set registry value

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
call fcn.00422ef0
mov edx, dword [esp + 0x1c]
lea ecx, [esp]
call fcn.00412000
mov edx, dword [esp + 0x20]
lea ecx, [esp + 4]
call fcn.00412000
mov dword [esp + 8], 0
lea eax, [esp + 8]
push eax
push dword [esp + 4]
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegCreateKeyW
mov ebx, eax
and ebx, ebx
jne 0x401a69
mov dword [esp + 0xc], 1
push 4
lea eax, [esp + 0x28]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [esp + 0x1c]
call sub.ADVAPI32.dll_RegSetValueExW
mov ebx, eax
and ebx, ebx
jne 0x401a60
mov dword [esp + 0xc], 2
push dword [esp + 8]
call sub.ADVAPI32.dll_RegCloseKey
mov eax, dword [esp + 0xc]
jmp 0x401a71
push dword [esp + 4]
call fcn.00422f50
push dword [esp]
call fcn.00422f50
add esp, 0x10
pop ebx
ret 0x10

Function at 0x403f24
Capabilities:
Set registry value

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00422ef0
mov edx, dword [esp + 0x20]
lea ecx, [esp]
call fcn.00412000
mov edx, dword [esp + 0x24]
lea ecx, [esp + 4]
call fcn.00412000
mov edx, dword [esp + 0x28]
lea ecx, [esp + 8]
call fcn.00412000
mov dword [esp + 0xc], 0
lea eax, [esp + 0xc]
push eax
push dword [esp + 4]
push dword [esp + 0x24]
call sub.ADVAPI32.dll_RegCreateKeyW
mov ebx, eax
and ebx, ebx
jne 0x403fc0
mov dword [esp + 0x10], 1
push dword [esp + 8]
call fcn.00420d90
mov ebx, eax
add ebx, ebx
push ebx
mov eax, dword [esp + 0xc]
push eax
push 1
push 0
push dword [esp + 0x14]
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegSetValueExW
mov ebx, eax
and ebx, ebx
jne 0x403fb7
mov dword [esp + 0x10], 2
push dword [esp + 0xc]
call sub.ADVAPI32.dll_RegCloseKey
mov eax, dword [esp + 0x10]
jmp 0x403fc8
push dword [esp + 8]
call fcn.00422f50
push dword [esp + 4]
call fcn.00422f50
push dword [esp]
call fcn.00422f50
add esp, 0x14
pop ebx
ret 0x10

Function at 0x40faf3
Capabilities:
Query service status

Disassembly:
push ebp
push ebx
mov edx, 0xa
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x40fafa
call fcn.00422ef0
mov edx, dword [esp + 0x34]
lea ecx, [esp]
call fcn.00412000
lea eax, [esp + 4]
push reloc.WS2_32.dll_accept
push 0
push 0
call sub.ADVAPI32.dll_OpenSCManagerW
mov dword [esp + 0x20], eax
cmp dword [esp + 0x20], 0
je 0x40fb97
push closesocket
push dword [esp + 4]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_OpenServiceW
mov dword [esp + 0x24], eax
cmp dword [esp + 0x24], 0
je 0x40fb93
lea eax, [esp + 4]
push eax
push dword [esp + 0x28]
call sub.ADVAPI32.dll_QueryServiceStatus
lea ebp, [esp + 4]
mov ebx, dword [ebp + 4]
cmp ebx, 4
jne 0x40fb84
push dword [esp + 0x24]
call sub.ADVAPI32.dll_CloseServiceHandle
mov eax, 1
jmp 0x40fb99
push dword [esp + 0x24]
call sub.ADVAPI32.dll_CloseServiceHandle
xor eax, eax
jmp 0x40fb99
xor eax, eax
jmp 0x40fb99
xor eax, eax
push dword [esp]
call fcn.00422f50
add esp, 0x28
pop ebx
pop ebp
ret 4
Function at 0x413954
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
push edi
xor edi, edi
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, dword [esp + 0x3c]
mov ebx, eax
and dword [esp + 0x10], edi
push str.PB_WindowID
push ebp
call dword [sym.imp.USER32.dll_GetPropW]
mov esi, eax
push 9
pop eax
test esi, esi
je 0x4139ec
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x4139e9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x14], eax
jne 0x4139e9
lea eax, [esi - 1]
push eax
push dword [0x74c8f4]
call fcn.00422544
mov edi, eax
mov dword [esp + 0x10], 1
xor eax, eax
push 9
cmp dword [edi + 0x10], eax
jle 0x4139eb
mov edx, dword [edi + 4]
xor ecx, ecx
pop esi
cmp word [ecx + edx + 2], si
jne 0x4139e0
mov esi, 0xfa01
push 9
cmp word [ecx + edx + 4], si
je 0x413ad3
pop esi
inc eax
add ecx, 6
cmp eax, dword [edi + 0x10]
jl 0x4139c6
push 9
pop eax
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
test ebx, ebx
je 0x413a92
push eax
call esi
test al, al
jns 0x413a92
push 0x11
call esi
test al, al
js 0x413a92
push 0x10
call esi
test al, al
js 0x413a92
push 0x12
call esi
test al, al
js 0x413a92
push 0x10
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameW]
cmp dword [esp + 0x10], 0
jne 0x413a92
push 5
lea eax, [esp + 0x1c]
push str.RichE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
je 0x413a66
push 4
lea eax, [esp + 0x1c]
push str.RICHE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
jne 0x413a7d
push 0
push 0
push 0x44e
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, 0x800
je 0x413add
lea eax, [esp + 0x18]
push str.Scintilla
push eax
call sub.MSVCRT.dll_wcscmp
pop ecx
pop ecx
test eax, eax
je 0x413add
test ebp, ebp
je 0x413ab6
push 0x11
call esi
test al, al
js 0x413aae
push 0x10
call esi
test al, al
js 0x413aae
push 0x12
call esi
test al, al
jns 0x413ab6
push 1
push ebp
call fcn.00413ae9
test ebx, ebx
je 0x413aca
push str.PB_Hotkey
push ebx
call dword [sym.imp.USER32.dll_GetPropW]
test eax, eax
jne 0x413add
test edi, edi
je 0x413add
mov eax, dword [edi + 8]
jmp 0x413adf
and dword [esp + 0x14], 0
jmp 0x4139eb
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4
Function at 0x41406e
Capabilities:
Create thread

Disassembly:
push ecx
push ebp
push esi
lea eax, [esp + 8]
xor esi, esi
push eax
push esi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebp, eax
test ebp, ebp
je 0x414106
push edi
push 0x74c938
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x74b60c]
test edi, edi
je 0x4140da
push ebx
push esi
lea ebx, [edi + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4140d3
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [edi]
push ebx
push 0x74b60c
call fcn.00422c45
pop ecx
pop ecx
jmp 0x4140d5
mov edi, dword [edi]
test edi, edi
jne 0x4140aa
pop ebx
mov eax, dword [0x745820]
mov esi, eax
inc eax
push 0x10
push 0x74b60c
mov dword [0x745820], eax
call fcn.00422c85
pop ecx
pop ecx
push 0x74c938
mov dword [eax], ebp
mov dword [eax + 4], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebp
pop ecx
ret 8
Function at 0x414798
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
push dword [0x74c95c]
call fcn.004223a5
mov ebp, eax
or ebx, 0xffffffff
xor eax, eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, dword [esp + 0x1c]
movzx edx, word [eax]
test dx, dx
je 0x414898
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0x20
mov dword [esp + 0x14], 0x22
cmp dx, word [esp + 0x10]
jne 0x4147ee
push 0x20
pop edx
add eax, 2
cmp word [eax], dx
je 0x4147e6
movzx edx, word [eax]
mov dword [esp + 0x1c], 1
cmp dx, word [esp + 0x14]
jne 0x41482e
add eax, 2
mov esi, eax
movzx ecx, word [eax]
test cx, cx
je 0x414870
push 0x22
pop edx
cmp cx, dx
je 0x414820
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x414810
xor ecx, ecx
cmp word [eax], cx
je 0x414870
mov ecx, eax
add eax, 2
jmp 0x414872
test dx, dx
je 0x414878
push 0x20
mov esi, eax
pop ecx
cmp dx, cx
je 0x414820
add eax, 2
push 0x22
pop edx
cmp word [eax], dx
jne 0x414866
add eax, 2
movzx ecx, word [eax]
test cx, cx
je 0x414870
cmp cx, dx
je 0x414863
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x414853
push 0x20
pop ecx
movzx edx, word [eax]
test dx, dx
jne 0x414838
jmp 0x414820
mov ecx, eax
mov edx, dword [esp + 0x1c]
jmp 0x41487a
xor edx, edx
cmp dword [ebp], ebx
jne 0x414883
test edi, edi
jne 0x4148a0
test edx, edx
je 0x414888
inc ebx
xor edx, edx
mov esi, edx
movzx edx, word [eax]
test dx, dx
jne 0x4147dc
test edi, edi
jne 0x4148b1
mov eax, ebx
jmp 0x4148b5
test esi, esi
je 0x4148b1
sub ecx, esi
mov eax, esi
sar ecx, 1
mov dword [edi], ecx
inc dword [ebp]
jmp 0x4148b5
xor ecx, ecx
mov dword [edi], ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret

Function at 0x414cec
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x414d50
cmp dword [ebp + 0x10], 0x18
push esi
jne 0x414d0d
call fcn.0055b850
mov esi, eax
push esi
call sub.MSVCRT.dll_strlen
jmp 0x414d21
cmp dword [ebp + 0x10], 2
jne 0x414d1a
call fcn.0055b8f0
jmp 0x414d03
call sub.MSVCRT.dll_wcslen
add eax, eax
pop ecx
push 0
lea ecx, [ebp + 0xc]
push ecx
push eax
mov eax, dword [ebp + 8]
push esi
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp + 0x10], 0x18
jne 0x414d44
push esi
call fcn.0055b840
jmp 0x414d50
cmp dword [ebp + 0x10], 2
jne 0x414d50
push esi
call fcn.0055b8e0
pop esi
pop ebp
ret 0xc
Function at 0x414fab
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x34
mov eax, dword [esp + 0x38]
push ebp
xor ebp, ebp
push edi
cmp dword [eax + 8], 1
mov edi, ebp
mov dword [esp + 0x10], edi
mov dword [esp + 8], ebp
jne 0x41514a
push esi
mov esi, dword [esp + 0x48]
test esi, esi
je 0x415149
push ebx
push ebp
push pe_nt_image_headers32
push 3
push ebp
push 7
push closesocket
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x415148
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0x200000
push ebp
push dword [0x74ad6c]
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
test ebp, ebp
je 0x415141
call fcn.00434f70
mov edi, eax
mov dword [esp + 0x1c], edi
test edi, edi
je 0x41512e
lea eax, [esp + 0x20]
push eax
push esi
call sub.MSVCRT.dll__wstat
push 0x1a4
push edi
call fcn.00435440
lea eax, [esp + 0x30]
push eax
push edi
call fcn.004355c0
mov esi, dword [esp + 0x60]
add esp, 0x18
mov eax, dword [esi + 0x20]
cmp dword [eax + 8], 1
je 0x41507a
cmp dword [eax + 8], 3
je 0x41507a
push dword [esp + 0x50]
push edi
call fcn.00434d10
pop ecx
pop ecx
jmp 0x415098
push dword [esp + 0x50]
call fcn.0055b8f0
mov esi, eax
push esi
push edi
call fcn.00435430
pop ecx
pop ecx
push esi
call fcn.0055b8e0
mov esi, dword [esp + 0x48]
mov eax, dword [esp + 0x14]
cdq
push edx
push eax
push edi
call fcn.00435490
push 0x8000
push edi
call fcn.004352e0
push edi
push dword [esi]
call fcn.00435730
add esp, 0x1c
lea eax, [esp + 0x4c]
push 0
push eax
push 0x200000
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x4c]
test eax, eax
jle 0x415115
mov edi, dword [esp + 0x10]
push eax
push ebp
push dword [esi]
call fcn.004356f0
add esp, 0xc
cmp eax, dword [esp + 0x4c]
jne 0x41510d
add edi, dword [esp + 0x4c]
lea eax, [esp + 0x4c]
push 0
push eax
push 0x200000
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x4c]
test eax, eax
jg 0x4150db
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x10], eax
jne 0x415127
mov dword [esp + 0x18], 1
push edi
call fcn.00434ea0
pop ecx
push ebp
push 0
push dword [0x74ad6c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [esp + 0x18]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop esi
mov eax, edi
pop edi
pop ebp
add esp, 0x34
ret 0xc

Function at 0x415204
Capabilities:
Delete file

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
xor edi, edi
test esi, esi
je 0x415266
cmp word [esi], di
je 0x415266
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.00436140
push dword [esp + 0x1c]
mov ebx, eax
push ebx
call dword [esp + 0x20]
push esi
push ebx
call fcn.00436350
add esp, 0x10
test eax, eax
jne 0x415265
push 0x24
push 8
push dword [0x74ad6c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov eax, dword [esp + 0x10]
mov dword [ecx + 0x14], edi
mov edi, ecx
mov dword [ecx], ebx
mov dword [ecx + 8], 1
mov dword [ecx + 0x20], eax
mov dword [eax + 4], ecx
pop ebx
mov eax, edi
pop edi
pop esi
ret 0x10
Function at 0x4159e0
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x74b820], 0
jne 0x4159ee
call fcn.00415960
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [0x74b824]
call esi
test eax, eax
jne 0x415a11
call fcn.00415960
push dword [0x74b824]
call esi
mov edx, dword [esp + 0x14]
lea esi, [eax + 8]
mov edi, 0x11
lea ecx, [ecx]
imul ecx, edx, 0x53a9b4fb
lea esi, [esi + 4]
mov edx, 1
sub edx, ecx
imul ecx, edx, 0x53a9b4fb
mov dword [esi + 0x40], edx
mov edx, 1
sub edx, ecx
mov dword [esi - 4], edx
dec edi
jne 0x415a20
mov dword [eax], edi
lea ebp, [edi + 0x1f]
mov dword [eax + 4], 0xa
mov ebx, dword [eax]
mov edi, dword [eax + 4]
mov edx, dword [eax + ebx*4 + 8]
mov ecx, dword [eax + ebx*4 + 0x4c]
mov esi, dword [eax + edi*4 + 8]
ror ecx, 0xd
add ecx, dword [eax + edi*4 + 0x4c]
dec edi
ror edx, 5
add edx, esi
mov dword [eax + ebx*4 + 8], ecx
mov dword [eax + ebx*4 + 0x4c], edx
dec ebx
jns 0x415a80
mov ebx, 0x10
test edi, edi
jns 0x415a89
mov edi, 0x10
mov dword [eax], ebx
mov dword [eax + 4], edi
dec ebp
jne 0x415a52
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x415aa0
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x74b820], 0
jne 0x415aae
call fcn.00415960
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [0x74b824]
call esi
mov edx, eax
test edx, edx
jne 0x415ad5
call fcn.00415960
push dword [0x74b824]
call esi
mov edx, eax
mov ebx, dword [edx]
mov esi, dword [edx + 4]
mov ebp, dword [esp + 0x14]
inc ebp
mov edi, dword [edx + ebx*4 + 0x4c]
mov eax, dword [edx + ebx*4 + 8]
mov ecx, dword [edx + esi*4 + 8]
ror edi, 0xd
add edi, dword [edx + esi*4 + 0x4c]
dec esi
ror eax, 5
add eax, ecx
mov dword [edx + ebx*4 + 8], edi
mov dword [edx + ebx*4 + 0x4c], eax
dec ebx
jns 0x415b08
mov ebx, 0x10
test esi, esi
jns 0x415b11
mov esi, 0x10
mov dword [edx], ebx
mov eax, edi
mov dword [edx + 4], esi
test ebp, ebp
je 0x415b20
mul ebp
mov eax, edx
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x416136
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push dword [0x74c9b4]
xor edi, edi
call fcn.004223a5
mov ebx, eax
cmp dword [ebp + 8], edi
je 0x4161ed
cmp dword [ebp + 0xc], edi
je 0x4161ed
push esi
push 0x60
push 8
push dword [0x74ad6c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push dword [ebp + 8]
mov esi, eax
or dword [esi + 4], 0xffffffff
mov dword [esi], edi
call sub.MSVCRT.dll__wcsdup
push dword [ebp + 0xc]
mov dword [esi + 8], eax
call sub.MSVCRT.dll__wcsdup
push dword [ebp + 0x14]
mov dword [esi + 0xc], eax
call sub.MSVCRT.dll__wcsdup
mov dword [esi + 0x40], eax
add esp, 0xc
mov eax, dword [ebx]
mov dword [esi + 0x28], eax
mov eax, dword [ebx + 4]
mov dword [esi + 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x24], eax
test al, 1
je 0x4161dc
lea eax, [ebp + 8]
push eax
push edi
push esi
push 0x41637d
push 0x10000
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x4161d4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, esi
jmp 0x4161ec
push esi
call fcn.00416428
jmp 0x4161eb
push esi
call fcn.004161f5
push esi
mov edi, eax
call fcn.00416428
pop ecx
pop ecx
pop esi
mov eax, edi
pop edi
pop ebx
pop ebp
ret 0x10