joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410890
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x445040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea edx, [ebp - 8]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov esi, 4
mov eax, dword [edi + 0xec]
mov ebx, dword [edi + 0xf4]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x43d560]
sub esi, 1
jne 0x4108d0
mov eax, dword [edi]
not ebx
cmp dword [eax + 0x3fcc], ebx
jne 0x410907
push ecx
push dword [ebp - 0xc]
lea edx, [esi + 4]
mov ecx, ebx
call fcn.00419c80
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00439b22
mov esp, ebp
pop ebp
ret 4
Function at 0x4186a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x5e34], 0
lea esi, [edi + 0x5e38]
je 0x418722
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x4186dc
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.0041aa30
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.00404550
mov edx, dword [esi]
mov ecx, 0x4454a4
push dword [edi + 0x5e34]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x5e40]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.00404550
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x418b30
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
push edi
mov edi, dword [0x4454a8]
test bl, bl
je 0x418b76
or edi, 0xffffffff
cmp bl, 0x23
jne 0x418b57
cmp byte [esi], bl
jne 0x418b57
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x43d560]
test bl, bl
jne 0x418b48
mov edi, dword [0x4454a8]
mov ecx, dword [edi + 0x5dd8]
not eax
mov edx, dword [edi + 0x5de0]
pop edi
pop esi
lea ecx, [ecx + ecx*8]
lea ecx, [edx + ecx*4]
pop ebx
cmp edx, ecx
je 0x418b9d
cmp dword [edx + 4], eax
je 0x418ba0
add edx, 0x24
cmp edx, ecx
jne 0x418b91
xor eax, eax
ret
mov eax, edx
ret
Function at 0x42b730
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x445040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x4454a8]
lea eax, [ebp - 0x10]
push esi
push edi
push eax
mov dword [ebp - 0x24], ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x42b8dc
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x42b8dc
push 0x38
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, dword [0x4454a8]
add esp, 4
mov edi, eax
test esi, esi
je 0x42b7d3
movsx edx, word [esi + 0x5eec]
lea eax, [esi + 0x5ef0]
mov ecx, dword [esi + 0x3f10]
lea eax, [eax + edx*8]
cmp dword [eax], ecx
je 0x42b7c9
lea eax, [edx + 1]
mov dword [ebp - 0x1c], 6
cdq
idiv dword [ebp - 0x1c]
movzx eax, dx
mov word [esi + 0x5eec], ax
cwde
add eax, 0xbde
lea eax, [esi + eax*8]
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
inc word [eax + 4]
inc dword [esi + 0x5ee4]
test edi, edi
je 0x42b7e6
push 0x38
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
jmp 0x42b7e8
xor edi, edi
or dword [ebx + 0xc], 6
mov dword [ebx + 0x74], edi
mov dword [ebx + 0x6c], str.imgui_impl_win32
mov ebx, dword [ebp - 0x24]
mov dword [edi], ebx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], ecx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], ecx
mov dword [edi + 0x20], 9
test esi, esi
je 0x42b823
mov esi, dword [esi + 0x74]
jmp 0x42b825
xor esi, esi
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 4
add esi, 0x24
shr eax, 0x10
push esi
push 0x20001004
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x42b848
mov dword [esi], eax
mov eax, dword [0x4454a8]
xor esi, esi
mov dword [ebp - 0x38], str.xinput1_4.dll
mov dword [ebp - 0x34], str.xinput1_3.dll
mov dword [ebp - 0x30], str.xinput9_1_0.dll
mov eax, dword [eax + 0x4a40]
mov dword [ebp - 0x2c], str.xinput1_2.dll
mov dword [ebp - 0x28], str.xinput1_1.dll
mov eax, dword [eax]
mov dword [eax + 0x28], ebx
mov byte [edi + 0x29], 1
push dword [ebp + esi*4 - 0x38]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
jne 0x42b8aa
inc esi
cmp esi, 5
jl 0x42b881
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439b22
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.XInputGetCapabilities
push ebx
mov dword [edi + 0x2c], ebx
call esi
push str.XInputGetState
push ebx
mov dword [edi + 0x30], eax
call esi
mov dword [edi + 0x34], eax
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439b22
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00439b22
mov esp, ebp
pop ebp
ret
Function at 0x43a703
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x43a742
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43a742
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43a742
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x43a742
cmp dword [ecx + 0x74], 0xe
jbe 0x43a742
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
mov ebx, 0x408ed0
nop
mov ecx, 0x1f6a1f30
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x3ca2478
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x404660
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov edx, dword [0x4501a4]
mov eax, dword [ebp + 8]
test edx, edx
je 0x404690
sub esp, 0xc
push eax
call fcn.00407380
mov dword [esp], eax
call sub.msvcrt.dll__wgetenv
add esp, 0x10
mov dword [ebp + 8], eax
leave
jmp fcn.00406280
sub esp, 0xc
push eax
call fcn.00407360
mov dword [esp], eax
call sub.msvcrt.dll_getenv
add esp, 0x10
mov dword [ebp + 8], eax
leave
jmp fcn.004061f0

Function at 0x404850
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov edx, dword [0x4501a4]
mov eax, dword [ebp + 8]
test edx, edx
je 0x404877
sub esp, 0xc
push eax
call fcn.00407380
add esp, 0x10
mov dword [ebp + 8], eax
leave
jmp 0x410ad0
sub esp, 0xc
push eax
call fcn.00407360
add esp, 0x10
mov dword [ebp + 8], eax
leave
jmp 0x410ac8
jmp dword [sym.imp.msvcrt.dll__mkdir]
jmp dword [sym.imp.msvcrt.dll__wmkdir]

Function at 0x404890
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov edx, dword [0x4501a4]
mov eax, dword [ebp + 8]
test edx, edx
je 0x4048b7
sub esp, 0xc
push eax
call fcn.00407380
add esp, 0x10
mov dword [ebp + 8], eax
leave
jmp 0x410ac0
sub esp, 0xc
push eax
call fcn.00407360
add esp, 0x10
mov dword [ebp + 8], eax
leave
jmp 0x410ab8
jmp dword [sym.imp.msvcrt.dll__rmdir]
jmp dword [sym.imp.msvcrt.dll__wrmdir]

Function at 0x4048d0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
mov edx, dword [0x4501a4]
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
test edx, edx
je 0x404908
sub esp, 0xc
push eax
call fcn.00407380
mov dword [ebp + 0xc], eax
mov dword [esp], ebx
call fcn.00407380
add esp, 0x10
mov ebx, dword [ebp - 4]
mov dword [ebp + 8], eax
leave
jmp 0x410ab0
sub esp, 0xc
push eax
call fcn.00407360
mov dword [ebp + 0xc], eax
mov dword [esp], ebx
call fcn.00407360
add esp, 0x10
mov ebx, dword [ebp - 4]
mov dword [ebp + 8], eax
leave
jmp 0x410aa8
jmp dword [sym.imp.msvcrt.dll_rename]
jmp dword [sym.imp.msvcrt.dll__wrename]

Function at 0x404930
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xc
mov ebx, dword [ebp + 8]
push 0x1b6
push ebx
call fcn.00404800
mov eax, dword [0x4501a4]
add esp, 0x10
test eax, eax
je 0x404970
sub esp, 0xc
push ebx
call fcn.00407380
add esp, 0x10
mov ebx, dword [ebp - 4]
mov dword [ebp + 8], eax
leave
jmp 0x410aa0
sub esp, 0xc
push ebx
call fcn.00407360
add esp, 0x10
mov ebx, dword [ebp - 4]
mov dword [ebp + 8], eax
leave
jmp 0x410a98
jmp dword [sym.imp.msvcrt.dll_remove]
jmp dword [sym.imp.msvcrt.dll__wremove]
Function at 0x404d70
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push eax
call fcn.00407360
mov dword [esp], eax
call sub.WSOCK32.DLL_gethostbyname
mov ecx, eax
add esp, 0xc
xor eax, eax
test ecx, ecx
je 0x404da7
movsx edx, word [ecx + 8]
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
mov eax, dword [ebp + 0x10]
movsx edx, word [ecx + 0xa]
mov dword [eax], edx
mov eax, dword [ecx + 0xc]
leave
ret

Function at 0x404db0
Capabilities:
Connect socket

Disassembly:
push ebp
or eax, 0xffffffff
mov ebp, esp
push edi
sub esp, 0x14
cmp dword [ebp + 0x10], 2
jne 0x404e0d
cld
xor eax, eax
lea edi, [ebp - 0x18]
mov ecx, 4
sub esp, 0xc
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x18]
mov word [ebp - 0x18], 2
and eax, 0xffff
push eax
call sub.WSOCK32.DLL_htons
mov ecx, dword [ebp + 0x14]
pop edi
mov word [ebp - 0x16], ax
pop edx
lea eax, [ebp - 0x14]
mov edx, dword [ebp + 0xc]
push ecx
push edx
push eax
call fcn.00410a30
add esp, 0xc
lea eax, [ebp - 0x18]
push 0x10
push eax
mov eax, dword [ebp + 8]
push eax
call sub.WSOCK32.DLL_connect
mov edi, dword [ebp - 4]
leave
ret
Function at 0x405350
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a0
lea eax, [ebp - 0x198]
push eax
push 0x101
call sub.WSOCK32.DLL_WSAStartup
push eax
push 0x405340
call fcn.004012c0
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [0x450164], eax
lea edx, [eax + 0x20]
add eax, 0x40
mov dword [0x450184], edx
mov dword [0x450174], eax
leave
ret
Function at 0x40a2e0
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x10
push 0x4501b4
call sub.KERNEL32.dll_InitializeCriticalSection
add esp, 0xc
call sub.KERNEL32.dll_TlsAlloc
sub esp, 0xc
mov dword [0x44f760], eax
push 0xb8
call sub.msvcrt.dll_malloc
add esp, 0xc
mov ebx, eax
mov dword [eax + 4], 0
lea eax, [eax + 8]
push pe_nt_image_headers32
push 0
push eax
call sub.msvcrt.dll_memset
mov eax, dword [0x450194]
mov dword [ebx + 0x88], 0
mov dword [ebx + 0x8c], eax
call sub.KERNEL32.dll_GetCurrentThreadId
add esp, 0xc
mov dword [ebx + 0xb4], eax
lea eax, [ebx + 0xb0]
push 2
push 0
push 0
push eax
sub esp, 0xc
call sub.KERNEL32.dll_GetCurrentProcess
add esp, 0xc
push eax
push eax
push eax
call sub.KERNEL32.dll_GetCurrentThread
pop edx
pop ecx
push eax
push ecx
call sub.KERNEL32.dll_GetCurrentProcess
mov dword [esp], eax
call sub.KERNEL32.dll_DuplicateHandle
pop edx
test eax, eax
je 0x40a3a6
push eax
push eax
mov eax, dword [0x44f760]
push ebx
push eax
call sub.KERNEL32.dll_TlsSetValue
mov eax, dword [0x44f730]
mov dword [ebx], eax
mov dword [0x44f730], ebx
mov dword [0x44f750], ebx
mov ebx, dword [ebp - 4]
leave
ret
sub esp, 0xc
push 0xffffffffffffffff
call sub.msvcrt.dll_exit
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2e8
lea ebx, [ebp - 0x2e8]
push 0xb8
call sub.msvcrt.dll_malloc
mov edi, eax
add esp, 0xc
mov eax, dword [ebp + 8]
mov dword [edi + 4], eax
lea eax, [edi + 8]
push pe_nt_image_headers32
push 0
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x88], 0
mov dword [edi + 8], eax
pop eax
lea eax, [edi + 0xb4]
pop edx
push eax
push 4
push edi
push 0x40a210
push 0
push 0
call sub.KERNEL32.dll_CreateThread
mov dword [edi + 0xb0], eax
mov dword [esp], 0x2cc
push 0x42c284
push ebx
call fcn.00410a30
pop esi
pop eax
push ebx
mov ecx, dword [edi + 0xb0]
push ecx
call sub.KERNEL32.dll_GetThreadContext
mov eax, dword [ebp - 0x224]
mov dword [edi + 0x8c], eax
pop eax
mov eax, dword [0x4501d4]
pop edx
test eax, eax
jne 0x40a4c0
mov ebx, dword [0x44f740]
mov esi, 0x44f740
test ebx, ebx
je 0x40a472
nop
mov eax, dword [ebx + 0x88]
test eax, eax
jne 0x40a4a0
mov esi, ebx
mov ebx, dword [esi]
test ebx, ebx
jne 0x40a460
mov eax, dword [0x44f730]
mov dword [edi], eax
mov eax, dword [0x4501d4]
mov dword [0x44f730], edi
test eax, eax
jne 0x40a4d5
mov dword [0x4501d4], 1
mov eax, edi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebx]
sub esp, 0xc
mov dword [esi], eax
mov eax, dword [ebx + 0xb0]
push eax
call sub.KERNEL32.dll_CloseHandle
push ebx
call fcn.004109e8
add esp, 0x10
mov ebx, dword [esi]
jmp 0x40a46e
sub esp, 0xc
push 0x4501b4
call sub.KERNEL32.dll_EnterCriticalSection
add esp, 0xc
jmp 0x40a44f
sub esp, 0xc
push 0x4501b4
call sub.KERNEL32.dll_LeaveCriticalSection
mov dword [0x4501d4], 1
mov eax, edi
add esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40a3b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x10
push 0x4501b4
call sub.KERNEL32.dll_InitializeCriticalSection
add esp, 0xc
call sub.KERNEL32.dll_TlsAlloc
sub esp, 0xc
mov dword [0x44f760], eax
push 0xb8
call sub.msvcrt.dll_malloc
add esp, 0xc
mov ebx, eax
mov dword [eax + 4], 0
lea eax, [eax + 8]
push pe_nt_image_headers32
push 0
push eax
call sub.msvcrt.dll_memset
mov eax, dword [0x450194]
mov dword [ebx + 0x88], 0
mov dword [ebx + 0x8c], eax
call sub.KERNEL32.dll_GetCurrentThreadId
add esp, 0xc
mov dword [ebx + 0xb4], eax
lea eax, [ebx + 0xb0]
push 2
push 0
push 0
push eax
sub esp, 0xc
call sub.KERNEL32.dll_GetCurrentProcess
add esp, 0xc
push eax
push eax
push eax
call sub.KERNEL32.dll_GetCurrentThread
pop edx
pop ecx
push eax
push ecx
call sub.KERNEL32.dll_GetCurrentProcess
mov dword [esp], eax
call sub.KERNEL32.dll_DuplicateHandle
pop edx
test eax, eax
je 0x40a3a6
push eax
push eax
mov eax, dword [0x44f760]
push ebx
push eax
call sub.KERNEL32.dll_TlsSetValue
mov eax, dword [0x44f730]
mov dword [ebx], eax
mov dword [0x44f730], ebx
mov dword [0x44f750], ebx
mov ebx, dword [ebp - 4]
leave
ret
sub esp, 0xc
push 0xffffffffffffffff
call sub.msvcrt.dll_exit
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2e8
lea ebx, [ebp - 0x2e8]
push 0xb8
call sub.msvcrt.dll_malloc
mov edi, eax
add esp, 0xc
mov eax, dword [ebp + 8]
mov dword [edi + 4], eax
lea eax, [edi + 8]
push pe_nt_image_headers32
push 0
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x88], 0
mov dword [edi + 8], eax
pop eax
lea eax, [edi + 0xb4]
pop edx
push eax
push 4
push edi
push 0x40a210
push 0
push 0
call sub.KERNEL32.dll_CreateThread
mov dword [edi + 0xb0], eax
mov dword [esp], 0x2cc
push 0x42c284
push ebx
call fcn.00410a30
pop esi
pop eax
push ebx
mov ecx, dword [edi + 0xb0]
push ecx
call sub.KERNEL32.dll_GetThreadContext
mov eax, dword [ebp - 0x224]
mov dword [edi + 0x8c], eax
pop eax
mov eax, dword [0x4501d4]
pop edx
test eax, eax
jne 0x40a4c0
mov ebx, dword [0x44f740]
mov esi, 0x44f740
test ebx, ebx
je 0x40a472
nop
mov eax, dword [ebx + 0x88]
test eax, eax
jne 0x40a4a0
mov esi, ebx
mov ebx, dword [esi]
test ebx, ebx
jne 0x40a460
mov eax, dword [0x44f730]
mov dword [edi], eax
mov eax, dword [0x4501d4]
mov dword [0x44f730], edi
test eax, eax
jne 0x40a4d5
mov dword [0x4501d4], 1
mov eax, edi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebx]
sub esp, 0xc
mov dword [esi], eax
mov eax, dword [ebx + 0xb0]
push eax
call sub.KERNEL32.dll_CloseHandle
push ebx
call fcn.004109e8
add esp, 0x10
mov ebx, dword [esi]
jmp 0x40a46e
sub esp, 0xc
push 0x4501b4
call sub.KERNEL32.dll_EnterCriticalSection
add esp, 0xc
jmp 0x40a44f
sub esp, 0xc
push 0x4501b4
call sub.KERNEL32.dll_LeaveCriticalSection
mov dword [0x4501d4], 1
mov eax, edi
add esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40a650
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2dc
call fcn.0040a5b0
mov esi, eax
mov eax, dword [0x44f730]
mov ebx, eax
test eax, eax
je 0x40a721
lea edi, [ebp - 0x2e8]
cmp ebx, esi
je 0x40a712
sub esp, 0xc
mov eax, dword [ebx + 0xb0]
push eax
call sub.KERNEL32.dll_SuspendThread
pop ecx
pop eax
push 0x2cc
push 0x42c550
push edi
call fcn.00410a30
pop eax
pop edx
push edi
mov eax, dword [ebx + 0xb0]
push eax
call sub.KERNEL32.dll_GetThreadContext
mov eax, dword [ebp - 0x24c]
mov dword [ebx + 0x94], eax
mov eax, dword [ebp - 0x248]
mov dword [ebx + 0x98], eax
mov eax, dword [ebp - 0x244]
mov dword [ebx + 0x9c], eax
mov eax, dword [ebp - 0x240]
mov dword [ebx + 0xa0], eax
mov eax, dword [ebp - 0x23c]
mov dword [ebx + 0xa4], eax
mov eax, dword [ebp - 0x238]
mov dword [ebx + 0xa8], eax
mov eax, dword [ebp - 0x234]
mov dword [ebx + 0xac], eax
mov eax, dword [ebp - 0x224]
mov dword [ebx + 0x90], eax
pop edx
pop ecx
mov ebx, dword [ebx]
test ebx, ebx
jne 0x40a678
mov eax, dword [0x44f730]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40a730
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
call fcn.0040a5b0
mov ebx, dword [0x44f730]
mov esi, eax
test ebx, ebx
je 0x40a762
cmp ebx, esi
je 0x40a75c
sub esp, 0xc
mov eax, dword [ebx + 0xb0]
push eax
call sub.KERNEL32.dll_ResumeThread
add esp, 0xc
mov ebx, dword [ebx]
test ebx, ebx
jne 0x40a746
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x410430
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x28
mov ebx, dword [sym.imp.msvcrt.dll__iob]
lea eax, [esp + 0x34]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
add ebx, 0x40
mov dword [esp + 0xc], ebx
mov dword [esp], str.Mingw_runtime_failure:_n
mov dword [esp + 0x1c], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x1c]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]

Function at 0x410490
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x5c
mov dword [esp + 0x4c], ebx
mov ebx, eax
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [esp + 0x50], esi
mov esi, edx
mov dword [esp + 0x54], edi
mov edi, ecx
mov dword [esp + 0x58], ebp
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x410586
mov eax, dword [esp + 0x38]
cmp eax, 4
jne 0x410500
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.00410a30
mov ebx, dword [esp + 0x4c]
mov esi, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
mov ebp, dword [esp + 0x58]
add esp, 0x5c
ret
cmp eax, 0x40
je 0x4104d5
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov eax, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
cmp eax, 0x40
setne byte [esp + 0x1e]
cmp eax, 4
setne byte [esp + 0x1f]
call fcn.00410a30
cmp byte [esp + 0x1f], 0
je 0x4104e5
cmp byte [esp + 0x1e], 0
je 0x4104e5
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
jmp 0x4104e5
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00410430
nop

Function at 0x410780
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x450144
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [0x45015c]
sub esp, 4
test ebx, ebx
je 0x4107cb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov esi, eax
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x4107c4
test esi, esi
je 0x4107c4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4107a0
mov dword [esp], 0x450144
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret
Function at 0x40a19f
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push esi
push 0xe
mov esi, ecx
call dword [sym.imp.USER32.dll_GetSysColor]
push 0xd
mov dword [esi + 0x1084], eax
call dword [sym.imp.USER32.dll_GetSysColor]
push 8
mov dword [esi + 0x1080], eax
call dword [sym.imp.USER32.dll_GetSysColor]
push 5
mov dword [esi + 0x107c], eax
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
push dword [esi + 0x10]
mov dword [esi + 0x1078], eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetBkColor]
push dword [esi + 0x1078]
push 0
push 0x1001
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageW]
pop esi
ret
Function at 0x40ebd5
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 9
push esi
mov ebx, edx
mov dword [ebp - 0xc], esi
mov edi, ecx
push ebx
push edi
mov dword [ebp - 0x14], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40ec06
push ebx
push edi
jmp 0x40ecb4
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, eax
test edi, edi
je 0x40ec48
cmp edi, 0xea
je 0x40ec48
cmp edi, 0x7a
jne 0x40ec64
mov eax, dword [ebp - 8]
lea eax, [eax*2 + 2]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
jne 0x40ec71
push 8
pop edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x40ecba
mov eax, dword [ebp - 8]
inc eax
push eax
push edi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x40ec93
mov ecx, dword [ebp - 4]
mov edx, edi
call fcn.0049cd8d
test eax, eax
je 0x40ec94
inc esi
cmp eax, 0x103
je 0x40eca0
cmp esi, dword [ebp - 0x10]
jb 0x40ec71
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop edi
pop esi
pop ebx
leave
ret