joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44e8c3
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x44e960
push ebx
push esi
call fcn.0044e88c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0044e820
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x44e90d
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x44e95f
push edi
push eax
call fcn.0044f4e0
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x44e92d
call fcn.0044d381
pop ecx
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x44e95e
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0044e820
add esp, 0x20
test eax, eax
jne 0x44e94c
push edi
call fcn.0044d381
jmp 0x44e954
push ebx
call fcn.0044d381
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x44fc5d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0xde5410
push 0xde5408
push str.FlsAlloc
push 0x1f
call fcn.0044fb1c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x44fc91
push dword [ebp + 8]
mov ecx, esi
call dword [0x4572ec]
call esi
jmp 0x44fc97
call dword [sym.imp.kernel32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x44fcdb
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0xde5420
push 0xde5418
push str.FlsGetValue
push 0x21
call fcn.0044fb1c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x44fd12
push dword [ebp + 8]
mov ecx, esi
call dword [0x4572ec]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.kernel32.dll_TlsGetValue]

Function at 0x44fd1a
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0xde5428
push 0xde5420
push str.FlsSetValue
push 0x22
call fcn.0044fb1c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x44fd54
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x4572ec]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.kernel32.dll_TlsSetValue]
Function at 0x4551b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4551dd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4551dd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x456600
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
cmp dword [ecx + 4], 0
mov esi, ecx
je 0x456671
lea ebx, [esi + 0xc]
mov dword [esp + 4], 0
lea eax, [esp + 4]
push 0
push eax
push 0
push ebx
call dword [sym.imp.kernel32.dll_InitOnceBeginInitialize]
cmp eax, 1
mov dword [esp], eax
jne 0x4566ac
cmp dword [esp + 4], 0
je 0x456693
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x4566c1
mov edi, eax
inc eax
mov dword [esi], eax
mov eax, dword [0xdeca54]
nop dword [eax]
mov dword [esi + 8], eax
lock cmpxchg dword [0xdeca54], esi
jne 0x456650
mov byte [0xdeca50], 1
push 0
push 0
push ebx
call dword [sym.imp.kernel32.dll_InitOnceComplete]
jmp 0x4566a3
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esp], eax
je 0x456704
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [esi], ecx
jne 0x456697
mov edi, dword [esp]
jmp 0x4566a3
mov edi, dword [esi]
jmp 0x4566a2
mov edi, eax
push dword [esp]
call dword [sym.imp.kernel32.dll_TlsFree]
dec edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
ret
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0
call fcn.00456740
ud2
push 0
push 4
push ebx
call dword [sym.imp.kernel32.dll_InitOnceComplete]
lea ecx, [esp + 8]
mov edx, 0xde2d9c
mov dword [esp + 8], 0xde2d64
mov dword [esp + 0xc], 1
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], str._rustc_e20cb7702117f1ad8127a16406ba9edd230c4f65librarycore_src_sliceiter.rs
mov dword [esp + 0x14], 0
call fcn.00455610
ud2
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0xde2d64
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], str._rustc_e20cb7702117f1ad8127a16406ba9edd230c4f65librarycore_src_sliceiter.rs
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.00456780
ud2
Function at 0x4010ac
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push ecx
push edx
push esi
push edi
lea edi, [ebp - 0x104]
xor al, al
stosb byte es:[edi], al
mov ecx, 0x2a
mov al, 0xff
rep stosb byte es:[edi], al
mov al, 0x3e
stosb byte es:[edi], al
mov ecx, 3
mov al, 0xff
rep stosb byte es:[edi], al
mov al, 0x3f
stosb byte es:[edi], al
mov ecx, 0xa
mov al, 0x34
stosb byte es:[edi], al
inc al
loop 0x4010e2
mov ecx, 3
mov al, 0xff
rep stosb byte es:[edi], al
xor al, al
stosb byte es:[edi], al
mov ecx, 3
mov al, 0xff
rep stosb byte es:[edi], al
mov ecx, 0x1a
xor al, al
stosb byte es:[edi], al
inc al
loop 0x401103
mov dl, al
mov ecx, 6
mov al, 0xff
rep stosb byte es:[edi], al
mov ecx, 0x1a
mov al, dl
stosb byte es:[edi], al
inc al
loop 0x40111a
mov ecx, 0x85
mov al, 0xff
rep stosb byte es:[edi], al
mov edi, dword [ebp + 8]
xor eax, eax
mov esi, edi
mov al, byte [edi]
add edi, 4
test al, al
jne 0x40112f
lea ebx, [edi - 4]
mov eax, 0x3d
sub ebx, esi
je 0x4011c1
cmp al, byte [esi + ebx - 1]
sete dl
jne 0x401151
mov byte [esi + ebx - 1], ah
cmp al, byte [esi + ebx - 2]
sete al
jne 0x40115e
mov byte [esi + ebx - 2], ah
add al, dl
mov edi, dword [ebp + 0xc]
shr ebx, 2
lea edx, [ebx + ebx*2]
sub edx, eax
push edx
mov dword [ebp - 4], ebx
mov ecx, dword [esi]
movzx edx, cl
movzx ebx, ch
push edi
lea edi, [ebp - 0x104]
mov al, byte [edx + edi]
mov ah, byte [ebx + edi]
shr ecx, 0x10
add esi, 4
movzx edx, cl
movzx ecx, ch
mov bl, byte [edx + edi]
mov bh, byte [ecx + edi]
pop edi
mov dl, ah
mov dh, bl
shl al, 2
shr bl, 2
shl dh, 6
shl ah, 4
shr dl, 4
or bh, dh
or al, dl
or ah, bl
mov byte [edi], al
mov byte [edi + 2], bh
mov byte [edi + 1], ah
dec dword [ebp - 4]
lea edi, [edi + 3]
jne 0x40116f
pop eax
pop edi
pop esi
pop edx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4011cc
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push ecx
push edx
push esi
push edi
lea edi, [ebp - 0x44]
mov eax, 0x44434241
stosd dword es:[edi], eax
mov eax, 0x48474645
stosd dword es:[edi], eax
mov eax, 0x4c4b4a49
stosd dword es:[edi], eax
mov eax, 0x504f4e4d
stosd dword es:[edi], eax
mov eax, 0x54535251
stosd dword es:[edi], eax
mov eax, 0x58575655
stosd dword es:[edi], eax
mov eax, 0x62615a59
stosd dword es:[edi], eax
mov eax, 0x66656463
stosd dword es:[edi], eax
mov eax, 0x6a696867
stosd dword es:[edi], eax
mov eax, 0x6e6d6c6b
stosd dword es:[edi], eax
mov eax, 0x7271706f
stosd dword es:[edi], eax
mov eax, 0x76757473
stosd dword es:[edi], eax
mov eax, 0x7a797877
stosd dword es:[edi], eax
mov eax, 0x33323130
stosd dword es:[edi], eax
mov eax, 0x37363534
stosd dword es:[edi], eax
mov eax, 0x2f2b3938
stosd dword es:[edi], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [ebp - 4], 0
jne 0x40124e
jmp 0x4012a9
mov al, byte [esi]
mov dl, byte [esi + 1]
mov bl, byte [esi + 2]
mov ah, al
mov dh, dl
mov bh, bl
and ah, 3
and dh, 0xf
and bh, 0x3f
shr al, 2
shr dl, 4
shr bl, 6
shl ah, 4
shl dh, 2
or ah, dl
or bl, dh
movzx edx, al
movzx ecx, ah
push esi
lea esi, [ebp - 0x44]
mov al, byte [edx + esi]
mov ah, byte [ecx + esi]
movzx edx, bl
movzx ecx, bh
mov bl, byte [edx + esi]
mov bh, byte [ecx + esi]
pop esi
and eax, 0xffff
shl ebx, 0x10
add esi, 3
or eax, ebx
stosd dword es:[edi], eax
sub dword [ebp - 4], 3
jns 0x401246
cmp dword [ebp - 4], 0
je 0x4012bb
add edi, dword [ebp - 4]
mov byte [edi], 0x3d
inc edi
inc dword [ebp - 4]
jne 0x4012b2
mov eax, edi
mov word [eax], 0
sub eax, dword [ebp + 0x10]
pop edi
pop esi
pop edx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4012d0
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov dword [ebp - 4], 0
push 0
push 0x28
lea eax, [ebp - 0x20c]
push eax
push 0
call sub.SHELL32.dll_SHGetSpecialFolderPathW
push str.NTUSER.DAT
lea eax, [ebp - 0x20c]
push eax
call sub.SHLWAPI.dll_PathAppendW
lea eax, [ebp - 0x20c]
push eax
call sub.KERNEL32.dll_GetFileAttributesW
cmp eax, 0xffffffff
jne 0x40131b
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x401478
Capabilities:
Check os version
Get number of processors

Disassembly:
push esi
push edi
mov eax, dword fs:[0x30]
mov esi, dword [eax + 0xa4]
mov edi, dword [eax + 0xa8]
cmp esi, 5
jne 0x401496
cmp edi, 1
jb 0x40149b
cmp esi, 5
jae 0x4014a8
mov eax, 0
pop edi
pop esi
ret
cmp esi, 5
jne 0x4014bf
cmp edi, 1
jne 0x4014bf
mov eax, 0x33
pop edi
pop esi
ret
cmp esi, 5
jne 0x4014d3
cmp edi, 2
jne 0x4014d3
mov eax, 0x34
pop edi
pop esi
ret
cmp esi, 6
jne 0x4014e6
test edi, edi
jne 0x4014e6
mov eax, 0x3c
pop edi
pop esi
ret
cmp esi, 6
jne 0x4014fa
cmp edi, 1
jne 0x4014fa
mov eax, 0x3d
pop edi
pop esi
ret
cmp esi, 6
jne 0x40150e
cmp edi, 2
jne 0x40150e
mov eax, 0x3e
pop edi
pop esi
ret
cmp esi, 6
jne 0x401522
cmp edi, 3
jne 0x401522
mov eax, 0x3f
pop edi
pop esi
ret
cmp esi, 0xa
jne 0x401535
test edi, edi
jne 0x401535
mov eax, 0x64
pop edi
pop esi
ret
cmp esi, 0xa
jne 0x40153f
cmp edi, 0
ja 0x401544
cmp esi, 0xa
jbe 0x40154c
mov eax, 0x7fffffff
pop edi
pop esi
ret
mov eax, 0xffffffff
pop edi
pop esi
ret
Function at 0x401ec0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov eax, dword [esi]
mov edx, dword [esi + 4]
mov dword [edi], eax
mov dword [edi + 4], edx
imul edx, edx, 0x8088405
inc edx
mul edx
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], edx
mov eax, dword [esi + 8]
mov edx, dword [esi + 0xc]
mov dword [edi + 8], eax
mov dword [edi + 0xc], edx
imul edx, edx, 0x8088405
inc edx
mul edx
mov dword [edi + 0x48], eax
mov dword [edi + 0x4c], edx
mov eax, dword [esi + 0x10]
mov edx, dword [esi + 0x14]
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], edx
imul edx, edx, 0x8088405
inc edx
mul edx
mov dword [edi + 0x50], eax
mov dword [edi + 0x54], edx
mov eax, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], edx
imul edx, edx, 0x8088405
inc edx
mul edx
mov dword [edi + 0x58], eax
mov dword [edi + 0x5c], edx
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], edx
imul edx, edx, 0x8088405
inc edx
mul edx
mov dword [edi + 0x60], eax
mov dword [edi + 0x64], edx
mov eax, dword [esi + 0x28]
mov edx, dword [esi + 0x2c]
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], edx
imul edx, edx, 0x8088405
inc edx
mul edx
mov dword [edi + 0x68], eax
mov dword [edi + 0x6c], edx
mov eax, dword [esi + 0x30]
mov edx, dword [esi + 0x34]
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], edx
imul edx, edx, 0x8088405
inc edx
mul edx
mov dword [edi + 0x70], eax
mov dword [edi + 0x74], edx
mov eax, dword [esi + 0x38]
mov edx, dword [esi + 0x3c]
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], edx
imul edx, edx, 0x8088405
inc edx
mul edx
mov dword [edi + 0x78], eax
mov dword [edi + 0x7c], edx
pop edi
pop esi
pop ebp
ret 8

Function at 0x402230
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
cmp dword [ebp + 8], 0xffffffff
je 0x4022d9
cmp dword [ebp + 0x10], 0
je 0x4022d9
cmp dword [ebp + 0x14], 0
je 0x40226c
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push str.true_s_s_n
push 0x407710
call sub.msvcrt.dll_swprintf
add esp, 0x10
mov ecx, eax
jmp 0x4022b6
cmp dword [ebp + 0xc], 0
jne 0x402279
mov eax, str.file_empty
jmp 0x40229e
cmp dword [ebp + 0xc], 1
jne 0x402286
mov eax, str.file_not_found
jmp 0x40229e
cmp dword [ebp + 0xc], 2
jne 0x402293
mov eax, str.file_not_encrypted_or_damaged
jmp 0x40229e
cmp dword [ebp + 0xc], 3
jne 0x40229e
mov eax, str.file_rsa_key_not_valid
push eax
push dword [ebp + 0x10]
push str.false_s_s_n
push 0x407710
call sub.msvcrt.dll_swprintf
add esp, 0x10
mov ecx, eax
push 0x407710
push 0x407710
call fcn.00401084
push 0
lea eax, [ebp - 4]
push eax
push ecx
push 0x407710
push dword [ebp + 8]
call sub.KERNEL32.dll_WriteFile
mov esp, ebp
pop ebp
ret 0x10
Function at 0x402450
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push ecx
push edx
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0x400
push dword [ebp - 8]
call fcn.00401fa8
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push 5
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
jne 0x40248d
jmp 0x4024bc
cmp eax, 0xc0000004
jne 0x4024a6
push dword [ebp - 8]
push dword [ebp - 0xc]
call fcn.00401fc4
mov dword [ebp - 0xc], eax
jmp 0x402474
push dword [ebp - 0xc]
call fcn.00401fe4
mov eax, dword [ebp - 4]
pop edi
pop esi
pop edx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebx]
cmp dword [ebx + 0x3c], 0
je 0x4024e0
push 0
push dword [ebx + 0x3c]
call fcn.0040103c
cmp eax, 0x3eb272e6
jne 0x4024e0
mov eax, dword [ebx + 0x44]
mov dword [ebp - 4], eax
jmp 0x4024e7
lea ebx, [ebx + esi]
test esi, esi
jne 0x4024bf
push dword [ebp - 0xc]
call fcn.00401fe4
mov eax, dword [ebp - 4]
pop edi
pop esi
pop edx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402800
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], 0
push dword [ebp + 8]
call sub.SHLWAPI.dll_PathFindFileNameW
push 0xffffffffffffffff
push eax
call fcn.0040103c
cmp eax, dword [0x407700]
jne 0x40283d
push pe_nt_image_headers32
push dword [ebp + 8]
call sub.KERNEL32.dll_SetFileAttributesW
push dword [ebp + 8]
call sub.KERNEL32.dll_DeleteFileW
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4028f0
Capabilities:
Delete file
Delete registry key
Get common file path
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push ecx
push edx
push esi
push edi
mov dword [ebp - 0x10], 0
call fcn.00402678
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x402b22
push 0
push 0x23
lea eax, [ebp - 0x218]
push eax
push 0
call sub.SHELL32.dll_SHGetSpecialFolderPathW
lea eax, [ebp - 0x218]
push eax
call fcn.00401564
mov ebx, dword [ebp - 0x10]
lea eax, [ebx + 2]
push eax
lea eax, [ebp - 0x218]
push eax
call sub.msvcrt.dll_wcscat
add esp, 8
push str..bmp
lea eax, [ebp - 0x218]
push eax
call sub.msvcrt.dll_wcscat
add esp, 8
lea eax, [ebp - 0x218]
push eax
call sub.KERNEL32.dll_DeleteFileW
lea eax, [ebp - 0x218]
push eax
call sub.SHLWAPI.dll_PathFindExtensionW
push str..ico
push eax
call sub.msvcrt.dll_wcscpy
add esp, 8
lea eax, [ebp - 0x218]
push eax
call sub.KERNEL32.dll_DeleteFileW
lea eax, [ebx + 2]
push eax
lea eax, [ebp - 0x218]
push eax
call sub.msvcrt.dll_wcscpy
add esp, 8
push str.DefaultIcon
lea eax, [ebp - 0x218]
push eax
call sub.msvcrt.dll_wcscat
add esp, 8
push str.advapi32.dll
call sub.KERNEL32.dll_GetModuleHandleW
push str.RegDeleteKeyExW
push eax
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x407f10], eax
cmp dword [0x407f10], 0
je 0x402a1f
push 0
push 0x100
lea eax, [ebp - 0x218]
push eax
push 0x80000000
call dword [0x407f10]
push 0
push 0x100
lea eax, [ebx + 2]
push eax
push 0x80000000
call dword [0x407f10]
push 0
push 0x100
push ebx
push 0x80000000
call dword [0x407f10]
jmp 0x402a49
lea eax, [ebp - 0x218]
push eax
push 0x80000000
call sub.AdvAPI32.dll_RegDeleteKeyW
lea eax, [ebx + 2]
push eax
push 0x80000000
call sub.AdvAPI32.dll_RegDeleteKeyW
push ebx
push 0x80000000
call sub.AdvAPI32.dll_RegDeleteKeyW
lea eax, [ebp - 0x218]
push eax
push dword [0x408084]
call fcn.00402848
lea eax, [ebp - 0x218]
push eax
call fcn.00401564
push str.Control_PanelDesktop
lea eax, [ebp - 0x218]
push eax
call sub.msvcrt.dll_wcscat
add esp, 8
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0x20106
push 0
push 0
push 0
lea eax, [ebp - 0x218]
push eax
push 0x80000003
call sub.AdvAPI32.dll_RegCreateKeyExW
test eax, eax
jne 0x402abf
push 0
push 0
push 1
push 0
push str.WallPaper
push dword [ebp - 4]
call sub.AdvAPI32.dll_RegSetValueExW
cmp dword [ebp - 4], 0
je 0x402acd
push dword [ebp - 4]
call sub.ntdll.dll_NtClose
mov dword [ebp - 8], 1
xor eax, eax
mov ah, 0xa5
mov al, 0x6e
rol eax, 8
mov al, 0x3a
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 1
call sub.USER32.dll_SetSysColors
mov ebx, 2
call fcn.00401478
cmp eax, 0x34
je 0x402b03
or ebx, 1
push ebx
push 0
push 0
push 0x14
call sub.USER32.dll_SystemParametersInfoW
push 0
push 0
push 0x1000
push 0x8000000
call sub.SHELL32.dll_SHChangeNotify
cmp dword [ebp - 0x10], 0
je 0x402b30
push dword [ebp - 0x10]
call fcn.00401fe4
pop edi
pop esi
pop edx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402c28
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
push 0
push 4
lea eax, [ebp - 0x18]
push eax
push 0x402c0c
push 0
push 0
call sub.KERNEL32.dll_CreateThread
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x402cc9
cmp dword [ebp + 8], 0
je 0x402ca3
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.00402b8c
test eax, eax
jne 0x402ca3
push 0
push dword [ebp - 4]
call sub.ntdll.dll_NtTerminateThread
push dword [ebp - 4]
call sub.ntdll.dll_NtClose
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0x14
push dword [ebp - 4]
call sub.KERNEL32.dll_ResumeThread
push 0xffffffffffffffff
push dword [ebp - 4]
call sub.KERNEL32.dll_WaitForSingleObject
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
call sub.KERNEL32.dll_GetExitCodeThread
push dword [ebp - 4]
call sub.ntdll.dll_NtClose
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0x14

Function at 0x402ce8
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push ecx
push edx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0
push 4
lea eax, [ebp - 0x10]
push eax
push 0x402cd4
push 0
push 0
call sub.KERNEL32.dll_CreateThread
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x402d87
cmp dword [ebp + 8], 0
je 0x402d61
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.00402b8c
test eax, eax
jne 0x402d61
push 0
push dword [ebp - 4]
call sub.ntdll.dll_NtTerminateThread
push dword [ebp - 4]
call sub.ntdll.dll_NtClose
mov eax, dword [ebp - 8]
pop edi
pop esi
pop edx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push dword [ebp - 4]
call sub.KERNEL32.dll_ResumeThread
push 0xffffffffffffffff
push dword [ebp - 4]
call sub.KERNEL32.dll_WaitForSingleObject
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
call sub.KERNEL32.dll_GetExitCodeThread
push dword [ebp - 4]
call sub.ntdll.dll_NtClose
mov eax, dword [ebp - 8]
pop edi
pop esi
pop edx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x402da8
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push ecx
push edx
push esi
push edi
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0
push 4
push dword [ebp + 0xc]
push 0x402d98
push 0
push 0
call sub.KERNEL32.dll_CreateThread
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x402e3a
cmp dword [ebp + 8], 0
je 0x402e14
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.00402b8c
test eax, eax
jne 0x402e14
push 0
push dword [ebp - 4]
call sub.ntdll.dll_NtTerminateThread
push dword [ebp - 4]
call sub.ntdll.dll_NtClose
mov eax, dword [ebp - 8]
pop edi
pop esi
pop edx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
push dword [ebp - 4]
call sub.KERNEL32.dll_ResumeThread
push 0xffffffffffffffff
push dword [ebp - 4]
call sub.KERNEL32.dll_WaitForSingleObject
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
call sub.KERNEL32.dll_GetExitCodeThread
push dword [ebp - 4]
call sub.ntdll.dll_NtClose
mov eax, dword [ebp - 8]
pop edi
pop esi
pop edx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x402e48
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], 0
push 0
push 0
push 3
push 0
push 0
push 0x80000000
push dword [ebp + 8]
call sub.KERNEL32.dll_CreateFileW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x402e8b
push dword [ebp + 0xc]
push dword [ebp - 8]
call sub.KERNEL32.dll_GetFileSizeEx
mov dword [ebp - 4], eax
push dword [ebp - 8]
call sub.ntdll.dll_NtClose
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x4033b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push ebx
push esi
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0x64]
mov eax, 0x20
test eax, ebx
cmovg ebx, eax
lea ebx, [ebx*2 + 1]
mov dword [ebp - 4], 0
push ebx
push 0
push 0
push 0xffffffffffffffff
call sub.KERNEL32.dll_CreateIoCompletionPort
mov dword [0x407f14], eax
cmp dword [0x407f14], 0
je 0x40341c
push 0
push 0
push 0
push 0x4030dc
push 0
push 0
call sub.KERNEL32.dll_CreateThread
mov esi, eax
test esi, esi
je 0x403417
push esi
call sub.ntdll.dll_NtClose
inc dword [ebp - 4]
dec ebx
test ebx, ebx
jne 0x4033f4
push 0x407f20
call sub.ntdll.dll_RtlInitializeCriticalSection
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4034cc
Capabilities:
Read file on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
push ebx
mov dword [ebp - 4], 0
push pe_nt_image_headers32
push dword [ebp + 8]
call sub.KERNEL32.dll_SetFileAttributesW
push 0
push 0
push 3
push 0
push 0
push 0x80000000
push dword [ebp + 8]
call sub.KERNEL32.dll_CreateFileW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x40357a
xor eax, eax
xor edx, edx
sub eax, 0x84
sbb edx, 0
push 2
push 0
push edx
push eax
push dword [ebp - 8]
call sub.KERNEL32.dll_SetFilePointerEx
test eax, eax
je 0x403572
push 0
lea eax, [ebp - 0xc]
push eax
push 0x84
lea eax, [ebp - 0x90]
push eax
push dword [ebp - 8]
call sub.KERNEL32.dll_ReadFile
test eax, eax
je 0x403572
push pe_nt_image_headers32
lea eax, [ebp - 0x8c]
push eax
call fcn.00403474
mov ebx, eax
test ebx, ebx
je 0x403572
mov eax, dword [ebp - 0x90]
cmp dword [ebx], eax
jne 0x40356c
mov eax, dword [ebx]
mov dword [ebp - 4], eax
push ebx
call fcn.00401fe4
push dword [ebp - 8]
call sub.ntdll.dll_NtClose
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret 4