joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e6ad
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x4435a8
call fcn.0041e6b7
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
cmp dword [0x47b8c0], ebx
jne 0x41e448
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x24], ebx
mov edi, 0x47b8b4
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x41e482
cmp eax, esi
jne 0x41e475
xor esi, esi
inc esi
mov dword [ebp - 0x24], esi
jmp 0x41e485
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41e45c
xor esi, esi
inc esi
mov eax, dword [0x47b8b0]
cmp eax, esi
jne 0x41e498
push 0x1f
call sub.MSVCR100.dll__amsg_exit
pop ecx
jmp 0x41e4d3
mov eax, dword [0x47b8b0]
test eax, eax
jne 0x41e4cd
mov dword [0x47b8b0], esi
push 0x401474
push 0x401460
call sub.MSVCR100.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x41e4d3
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x41e5ed
mov dword [0x479d48], esi
mov eax, dword [0x47b8b0]
cmp eax, esi
jne 0x41e4f7
push 0x40145c
push 0x401424
call sub.MSVCR100.dll__initterm
pop ecx
pop ecx
mov dword [0x47b8b0], 2
cmp dword [ebp - 0x24], ebx
jne 0x41e504
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x47b8c4], ebx
je 0x41e525
push 0x47b8c4
call fcn.0041eccd
pop ecx
test eax, eax
je 0x41e525
push ebx
push 2
push ebx
call dword [0x47b8c4]
mov eax, dword [sym.imp.MSVCR100.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x41e57e
cmp al, bl
je 0x41e53e
cmp dword [ebp - 0x1c], ebx
jne 0x41e57e
mov al, byte [esi]
cmp al, bl
je 0x41e54e
cmp al, 0x20
ja 0x41e54e
inc esi
mov dword [ebp - 0x20], esi
jmp 0x41e53e
test byte [ebp - 0x40], 1
je 0x41e55a
movzx eax, word [ebp - 0x3c]
jmp 0x41e55d
push 0xa
pop eax
push eax
push esi
push ebx
push 0x400000
call main
mov dword [0x479d44], eax
cmp dword [0x479d38], ebx
jne 0x41e5d3
push eax
call dword [sym.imp.MSVCR100.dll_exit]
cmp al, 0x22
jne 0x41e58d
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR100.dll__ismbblead]
pop ecx
test eax, eax
je 0x41e5a0
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x41e52c
cmp dword [0x479d48], ebx
jne 0x41e5e1
call dword [sym.imp.MSVCR100.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x479d44]
call fcn.0041e6fc
ret
call fcn.0041db37
jmp 0x41e41a
Function at 0x41eaac
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x479e58], eax
mov dword [0x479e54], ecx
mov dword [0x479e50], edx
mov dword [0x479e4c], ebx
mov dword [0x479e48], esi
mov dword [0x479e44], edi
mov word [0x479e70], ss
mov word [0x479e64], cs
mov word [0x479e40], ds
mov word [0x479e3c], es
mov word [0x479e38], fs
mov word [0x479e34], gs
pushfd
pop dword [0x479e68]
mov eax, dword [ebp]
mov dword [0x479e5c], eax
mov eax, dword [ebp + 4]
mov dword [0x479e60], eax
lea eax, [ebp + 8]
mov dword [0x479e6c], eax
mov eax, dword [ebp - 0x320]
mov dword [0x479da8], 0x10001
mov eax, dword [0x479e60]
mov dword [0x479d5c], eax
mov dword [0x479d50], 0xc0000409
mov dword [0x479d54], 1
mov eax, dword [0x408aa4]
mov dword [ebp - 0x328], eax
mov eax, dword [0x478934]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x479da0], eax
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x408ca8
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x479da0], 0
jne 0x41eb98
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret

Function at 0x42050d
Capabilities:
Query environment variable

Disassembly:
push 0x220
mov eax, 0x44210a
call fcn.0041e840
mov esi, 0x104
push esi
lea eax, [ebp - 0x21c]
push eax
push 0x408e70
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x42053f
mov al, 1
jmp 0x4205da
cmp eax, esi
jae 0x4205d8
and dword [ebp - 0x220], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x221]
push 0x47b858
push 8
mov byte [ebp - 4], 1
mov dword [ebp - 0x228], eax
call fcn.00440d9a
pop ecx
pop ecx
test eax, eax
jne 0x420579
call fcn.00441869
mov dword [ebp - 0x22c], eax
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.00420880
mov esi, eax
lea ecx, [ebp - 0x21c]
push ecx
mov ecx, esi
mov byte [ebp - 4], 1
mov dword [ebp - 0x220], esi
call fcn.004208be
mov dword [0x47a094], esi
jmp 0x420538
xor al, al
call fcn.0041e899
ret

Function at 0x42107d
Capabilities:
Write file on windows

Disassembly:
push 0xc
mov eax, 0x44220a
call fcn.0041e7a1
mov ebx, ecx
mov esi, dword [ebp + 8]
mov eax, dword [esi + 8]
mov edi, dword [eax + 8]
push 1
lea eax, [ebx + 0x58]
push eax
lea ecx, [ebp - 0x18]
mov dword [ebp + 8], edi
call fcn.0042145c
mov eax, dword [ebx + 0x70]
and dword [ebp - 4], 0
mov dword [edi + 8], eax
inc dword [ebx + 0x70]
push dword [edi + 8]
lea ecx, [ebx + 0x3c]
call fcn.00440ffc
push esi
mov ecx, eax
call fcn.00421438
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0042148d
push 5
pop ecx
lea eax, [esi + 0xc]
push eax
mov edi, eax
mov eax, dword [ebp + 8]
push 0
mov esi, 0x409010
rep movsd dword es:[edi], dword [esi]
push dword [eax + 0xc]
push eax
push dword [ebx + 0x14]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x421109
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x421109
call fcn.004419ff
call fcn.0041e879
ret 4
Function at 0x421162
Capabilities:
Read file on windows

Disassembly:
push 8
mov eax, 0x44222d
call fcn.0041e7a1
mov ebx, ecx
cmp byte [ebx + 0x21], 0
jne 0x421209
cmp dword [ebp + 8], 0x10
jne 0x4212d6
mov eax, dword [ebx + 0x80]
cmp eax, 0x10
jb 0x4212d6
lea esi, [ebx + 0x24]
push eax
mov ecx, esi
call fcn.00420b1e
cmp dword [esi], 0
jne 0x4211a8
call fcn.00441869
push dword [ebp + 8]
lea eax, [ebx + 0x74]
push eax
push dword [ebx + 0x80]
push dword [esi]
call dword [sym.imp.MSVCR100.dll_memcpy_s]
mov edx, dword [ebx + 0x80]
add esp, 0x10
cmp edx, dword [ebp + 8]
je 0x421209
push 5
pop ecx
lea eax, [ebx + 0x28]
push eax
mov edi, eax
lea eax, [ebp + 8]
push eax
mov esi, 0x409010
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebx + 0x24]
lea eax, [edx - 0x10]
push eax
lea eax, [ecx + 0x10]
push eax
push dword [ebx + 0x14]
mov word [ebx + 0x20], 0x101
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4212d6
mov byte [ebx + 0x20], al
jmp 0x4212d6
lea edi, [ebx + 0x24]
mov eax, dword [edi]
test dword [eax + 4], 0x2000000
je 0x42125e
push 0x47b858
push dword [eax + 0xc]
call fcn.00440dc9
pop ecx
pop ecx
mov ecx, eax
test ecx, ecx
je 0x4211a3
mov eax, dword [edi]
push dword [eax + 0xc]
mov dword [ebp - 0x10], ecx
push eax
push ecx
call sub.MSVCR100.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
mov ecx, ebx
call fcn.0042132e
cmp dword [ebp - 0x10], 0
je 0x4212bf
push dword [ebp - 0x10]
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
pop ecx
jmp 0x4212bf
and dword [ebp - 0x14], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push eax
push dword [ebx + 0x7c]
mov ecx, ebx
call fcn.004212de
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x4212b0
mov eax, dword [edi]
and dword [ebp - 0x10], 0
test byte [eax + 7], 1
je 0x421292
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
test eax, eax
js 0x4212a6
jmp 0x42129f
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
push edi
call dword [eax + 0xc]
test al, al
jne 0x4212a6
mov dword [ebp - 0x10], 0x8007000d
push dword [ebp - 0x10]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x4212bf
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov eax, dword [edi]
test eax, eax
je 0x4212cf
and dword [edi], 0
push eax
call fcn.00419826
pop ecx
mov ecx, ebx
call fcn.00421111
call fcn.0041e879
ret 4
Function at 0x42405a
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x1c
test byte [0x47a0c0], 0x20
push esi
push edi
mov esi, ecx
je 0x42409b
push dword [ebx + 0xc]
push dword [ebx + 8]
push 0x409138
push dword [0x47a0cc]
push dword [0x47a0c8]
call fcn.00425313
push 0x1c135e
call fcn.00419830
lea eax, [esi + 8]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ebp - 4], eax
mov eax, ecx
shr eax, 0xc
dec eax
shl eax, 0xc
xor eax, ecx
mov edi, ecx
and eax, 0x7f000
xor ecx, eax
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x18], ecx
push ebx
mov esi, dword [ebp - 4]
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
lock cmpxchg8b qword [esi]
pop ebx
mov ecx, eax
cmp ecx, edi
jne 0x4240b0
cmp edx, dword [ebp - 0xc]
jne 0x4240b0
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc
Function at 0x424935
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x20], ebx
jne 0x424950
mov eax, 0x80004005
jmp 0x424ae8
cmp byte [esi + 0x17c], bl
je 0x42495f
xor eax, eax
jmp 0x424ae8
mov ecx, dword [esi + 0x28]
mov eax, dword [ecx]
call dword [eax + 0x30]
mov ecx, dword [esi + 0x24]
mov eax, dword [ecx]
call dword [eax + 0x1c]
call fcn.00422096
test al, al
jne 0x42498c
mov eax, dword [esi]
push esi
call dword [eax + 0x30]
test eax, eax
je 0x42498c
push 0x1c1417
call fcn.00419830
push edi
push 0x2710
lea ecx, [esi + 0x38]
call fcn.0042c711
test eax, eax
je 0x4249fe
mov ecx, dword [esi + 0x24]
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov ecx, dword [ebp + 8]
mov eax, ecx
sub eax, ebx
je 0x4249dc
dec eax
je 0x4249f4
dec eax
je 0x4249dc
dec eax
je 0x4249c4
push 0x1c1418
call fcn.00419830
jmp 0x4249d2
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, 0x80004005
jmp 0x424ae7
neg ecx
sbb ecx, ecx
and ecx, 0x4e21
dec ecx
push ecx
lea ecx, [esi + 0x38]
call fcn.0042c711
test eax, eax
je 0x4249fe
mov eax, 0x80004004
jmp 0x424ae7
mov ecx, dword [esi + 0x24]
mov byte [esi + 0x17c], 1
mov eax, dword [ecx]
call dword [eax + 0x24]
lea edi, [esi + 0x124]
cmp dword [edi + 8], ebx
je 0x424a40
cmp dword [edi], ebx
je 0x424a40
jmp 0x424a31
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
push 1
call dword [eax + 0x7c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 4]
push eax
mov ecx, edi
call fcn.004262a3
test al, al
jne 0x424a1e
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x424a4c
call fcn.0043281a
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x424a58
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x78]
test ecx, ecx
je 0x424a64
call fcn.00430d81
lea edi, [esi + 0x7c]
cmp dword [edi + 8], ebx
je 0x424a93
cmp dword [edi], ebx
je 0x424a93
jmp 0x424a84
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 8]
push eax
mov ecx, edi
call fcn.004262a3
test al, al
jne 0x424a72
lea edi, [esi + 0xd0]
cmp dword [edi + 8], ebx
je 0x424abc
cmp dword [edi], ebx
je 0x424abc
jmp 0x424aad
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0xc]
push eax
mov ecx, edi
call fcn.004262a3
test al, al
jne 0x424aa4
cmp dword [esi + 0x178], ebx
je 0x424ae5
call fcn.00422096
test al, al
je 0x424adb
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [esi + 0x178], ebx
jmp 0x424ae5
push 0x1c141d
call fcn.00419830
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x427b31
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x408aa4]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [edi + 8]
mov dword [ebp - 0x24], eax
cmp eax, dword [edx + 4]
jne 0x427ba7
mov ecx, dword [edi + 8]
mov ecx, dword [ecx]
and ecx, 0x7ff
cmp ecx, dword [edi + 0x14]
jne 0x427ba7
mov eax, dword [edi + 8]
inc dword [eax + 8]
test byte [0x47a0c0], 0x80
je 0x427b94
mov eax, dword [edi + 8]
push dword [eax + 0xc]
push dword [eax + 8]
push edi
push 0x4091b8
push dword [0x47a0cc]
push dword [0x47a0c8]
call fcn.004297a4
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041dbf5
mov esp, ebp
pop ebp
ret 8
xor eax, eax
push ebx
mov byte [ebp - 8], 0
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x15], al
push esi
mov ecx, dword [edi + 8]
mov ecx, dword [ecx]
lea esp, [esp]
mov eax, ecx
and eax, 0x7ff
xor ebx, ebx
cmp eax, 0x7fb
sete bl
mov edx, ecx
test ebx, ebx
jne 0x427bf7
test eax, eax
je 0x427bf7
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], ebx
cmp byte [ebp - 0x15], bl
jne 0x427c21
and ecx, 0xfffff800
add ecx, 0x800
and ecx, 0xfffff800
jmp 0x427c1f
mov eax, dword [edi + 0x14]
xor eax, ecx
and eax, 0x7ff
xor ecx, eax
cmp byte [ebp - 0x15], 0
mov dword [ebp - 0x20], 1
je 0x427c21
mov eax, ecx
shr eax, 0xb
dec eax
shl eax, 0xb
and ecx, 0x7ff
or ecx, eax
mov esi, dword [edi + 8]
mov eax, edx
lock cmpxchg dword [esi], ecx
mov ecx, eax
cmp ecx, edx
jne 0x427bbd
cmp dword [ebp - 0x20], 0
mov eax, dword [edi + 8]
jne 0x427ce6
mov eax, dword [eax]
and eax, 0xfffff800
cmp eax, 0x28f5800
jb 0x427c55
push 0x1c124c
call fcn.00419830
mov ebx, dword [ebp + 8]
cmp ebx, 0xffffffff
je 0x427c8d
cmp byte [ebp - 0x15], 0
jne 0x427c74
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
mov dword [ebp - 0x1c], esi
test ebx, ebx
jne 0x427c8d
jmp 0x427c77
mov esi, dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, esi
cmp ecx, ebx
jae 0x427caa
sub ebx, ecx
mov dword [ebp + 8], ebx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
mov ecx, edi
mov byte [ebp - 0x15], 1
mov dword [ebp - 0x10], ebx
call fcn.00427f27
jmp 0x427bb5
mov eax, dword [edi + 8]
mov eax, dword [eax]
mov esi, dword [edi + 8]
mov ecx, eax
shr ecx, 0xb
dec ecx
mov edx, eax
and eax, 0x7ff
shl ecx, 0xb
or ecx, eax
mov eax, edx
lock cmpxchg dword [esi], ecx
cmp eax, edx
jne 0x427caf
pop esi
pop ebx
mov eax, 0x102
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041dbf5
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x24]
mov dword [eax + 4], ecx
mov eax, dword [edi + 8]
mov dword [eax + 8], 1
test byte [0x47a0c0], 0x80
je 0x427d1f
mov eax, dword [edi + 8]
push dword [eax + 0xc]
push dword [eax + 8]
push edi
push 0x4091b8
push dword [0x47a0cc]
push dword [0x47a0c8]
call fcn.004297a4
mov ecx, dword [ebp - 4]
neg ebx
sbb ebx, ebx
and ebx, 0x80
pop esi
mov eax, ebx
pop ebx
xor ecx, ebp
pop edi
call fcn.0041dbf5
mov esp, ebp
pop ebp
ret 8
Function at 0x42963c
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 0xc]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov dword [esi], eax
test edi, edi
je 0x42966c
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0xb7
setne cl
mov dword [edi], ecx
xor eax, eax
cmp dword [esi], eax
pop edi
setne al
pop esi
pop ebp
ret 0x14

Function at 0x42c3bf
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x47a160], 0
jne 0x42c43d
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x409be8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42c424
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0x409bc0
push dword [ebp - 4]
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x42c418
mov dword [ebp - 8], esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 8]
xor eax, eax
test esi, esi
setne al
mov dword [0x47a160], 1
pop esi
mov dword [0x47a164], eax
leave
ret
mov eax, dword [0x47a164]
leave
ret

Function at 0x42c8c5
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor esi, esi
push 0xffffffffffffffff
push esi
mov edi, ecx
mov dword [ebp - 4], esi
call fcn.004256b2
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x42c8e3
mov dword [eax], esi
mov eax, dword [ebp + 0x10]
cmp dword [eax], esi
je 0x42c8f4
mov esi, 0x80004005
jmp 0x42c974
cmp byte [edi + 0x30], 0
je 0x42c8ea
inc dword [edi + 0x2c]
test byte [edi + 0x2c], 0x3f
jne 0x42c90b
push esi
mov ecx, edi
call fcn.0042c711
push ebx
lea ecx, [edi + 0x20]
call fcn.0042c9cf
mov ebx, eax
test ebx, ebx
jne 0x42c921
mov esi, 0x8007000e
jmp 0x42c973
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 0xc]
mov dword [ebx], esi
push dword [ebp + 8]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, eax
test ecx, ecx
jne 0x42c95f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x42c956
and esi, 0xffff
or esi, 0x80070000
test esi, esi
js 0x42c96c
mov esi, 0x80004005
jmp 0x42c96c
mov eax, dword [ebp + 0x14]
mov dword [ebx], ecx
test eax, eax
je 0x42c96a
mov dword [eax], ecx
mov ebx, esi
test ebx, ebx
je 0x42c973
dec dword [edi + 0x24]
pop ebx
mov ecx, edi
call fcn.004256f9
pop edi
mov eax, esi
pop esi
leave
ret 0x10

Function at 0x42dbb0
Capabilities:
Encode data using xor

Disassembly:
push esi
lea esi, [ecx + 0x10]
mov edx, dword [esi]
mov eax, edx
and eax, 0xffffc000
add eax, 0x4000
xor eax, edx
and eax, 0xfffc000
mov ecx, edx
xor edx, eax
mov eax, ecx
lock cmpxchg dword [esi], edx
mov edx, eax
cmp edx, ecx
jne 0x42dbb6
pop esi
ret
Function at 0x42e7e7
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, ecx
xor esi, esi
cmp byte [ebx + 8], 0
mov dword [ebp - 4], esi
je 0x42e804
mov esi, 0x80004005
jmp 0x42e8be
mov ecx, dword [ebx + 0x38]
push edi
cmp ecx, dword [ebx + 0x34]
ja 0x42e832
lea eax, [ecx*4 + 0x14]
push eax
push dword [ebx + 0x2c]
call fcn.0042162a
test eax, eax
jne 0x42e82b
mov esi, 0x8007000e
jmp 0x42e8bd
add dword [ebx + 0x38], 5
mov dword [ebx + 0x2c], eax
lea eax, [ebp - 4]
push eax
mov ecx, ebx
call fcn.0042e990
test eax, eax
jns 0x42e848
mov edi, dword [ebp - 4]
mov esi, eax
jmp 0x42e8b2
mov eax, dword [ebx + 0x40]
or eax, dword [ebx + 0x44]
jne 0x42e85c
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x44], edx
mov edi, dword [ebp - 4]
xor ecx, ecx
lea eax, [edi + 0x908]
inc ecx
lock xadd dword [eax], ecx
lea eax, [edi + 0x8f0]
push eax
push esi
push edi
push 0x42ea0d
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x42e894
mov ecx, edi
call fcn.0042e173
mov esi, 0x80004005
jmp 0x42e8b2
mov dword [edi + 0x8ec], eax
mov ecx, dword [ebx + 0x34]
mov eax, dword [ebx + 0x2c]
mov dword [eax + ecx*4], edi
inc dword [ebx + 0x34]
push 0x3e
mov edi, esi
pop edx
lea eax, [ebx + 0x30]
lock xadd dword [eax], edx
test edi, edi
je 0x42e8bd
mov ecx, edi
call fcn.0042e173
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x43319e
Capabilities:
Register raw input devices

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x408aa4]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
xor eax, eax
inc eax
cmp byte [ebp + 0xc], 0
mov dword [ebp - 0x20], ecx
mov word [ebp - 0x28], ax
je 0x4331cc
xor edx, edx
mov dword [ebp - 0x24], 0x20
jmp 0x4331ff
and dword [ebp - 0x24], 0
and dword [ebp - 0x18], 0
push 2
pop edx
push 6
mov word [ebp - 0x1c], ax
pop eax
push 0xd
mov word [ebp - 0x1a], ax
pop eax
mov word [ebp - 0x10], ax
xor eax, eax
push 3
mov word [ebp - 0xe], ax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], 0x20
mov dword [ebp - 8], ecx
pop eax
push 0xc
push eax
lea eax, [ebp - 0x28]
push eax
mov word [ebp - 0x26], dx
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.0041dbf5
leave
ret 8

Function at 0x4394dc
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x904
mov eax, dword [0x408aa4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push 0x100
lea eax, [ebp - 0x904]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x400
lea eax, [ebp - 0x804]
push eax
push esi
xor edi, edi
call fcn.00439047
push 0x5c
pop esi
lea eax, [ebp - 0x804]
push esi
push eax
call dword [sym.imp.MSVCR100.dll_wcsrchr]
pop ecx
pop ecx
test eax, eax
je 0x439542
xor ecx, ecx
mov dword [ebp + edi*4 - 0x904], eax
mov word [eax], cx
inc edi
cmp edi, 0x40
jge 0x439585
test eax, eax
je 0x43957b
lea eax, [ebp - 0x804]
push eax
call fcn.00441fcc
test eax, eax
js 0x439521
jmp 0x43957b
mov eax, dword [ebp + edi*4 - 0x908]
dec edi
mov word [eax], si
push 0
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x439585
cmp edi, 1
jg 0x43955d
xor eax, eax
inc eax
jmp 0x439587
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0041dbf5
leave
ret 4

Function at 0x43959d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x10
push 1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x4395e5
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x4395e5
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4395e5
cmp word [eax + 2], 0
je 0x4395e5
cmp dword [eax + 0x28], 0xfeef04bd
jne 0x4395e5
add eax, 0x30
jmp 0x4395ea
mov eax, 0x40a74c
pop esi
pop ebp
ret