joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405838
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, dword [ebp + 8]
push 2
push 0xffffffffffffffff
push 0xffffffffffffffea
push edi
call fcn.0040b1d0
mov ebx, edx
add esp, 0x10
mov dword [ebp - 0xc], eax
test ebx, ebx
jg 0x40586b
jl 0x405861
test eax, eax
jae 0x40586b
or eax, 0xffffffff
or edx, eax
jmp 0x4059b7
push esi
mov esi, dword [ebp + 0xc]
push 0x16
push esi
push edi
call fcn.004174ab
add esp, 0xc
test eax, eax
js 0x4059b1
movzx eax, byte [esi + 3]
movzx ecx, byte [esi + 2]
shl eax, 8
or eax, ecx
movzx ecx, byte [esi + 1]
shl eax, 8
or eax, ecx
movzx ecx, byte [esi]
shl eax, 8
or eax, ecx
cmp eax, 0x6054b50
jne 0x4058cd
mov eax, esi
call fcn.00405751
test eax, eax
je 0x4058c5
push ebx
push dword [ebp - 0xc]
push edi
call fcn.004057c4
add esp, 0xc
jmp 0x4059b6
mov eax, dword [ebp - 0xc]
jmp 0x4059f6
push 2
push 0
push 0
push edi
call fcn.0040b1d0
mov ebx, edx
add esp, 0x10
mov esi, eax
test ebx, ebx
jg 0x4058f2
jl 0x4059b1
test esi, esi
jb 0x4059b1
mov edi, 0x10015
test ebx, ebx
jg 0x405908
jl 0x405901
cmp esi, edi
jae 0x405908
mov dword [ebp - 0xc], esi
mov eax, ebx
jmp 0x40590d
mov dword [ebp - 0xc], edi
xor eax, eax
mov ecx, dword [ebp - 0xc]
neg ecx
adc eax, 0
push 2
neg eax
push eax
push ecx
push dword [ebp + 8]
call fcn.0040b1d0
add esp, 0x10
test edx, edx
jg 0x405934
jl 0x4059b1
test eax, eax
jb 0x4059b1
push edi
call fcn.0040a177
mov edi, eax
pop ecx
mov dword [ebp - 4], edi
test edi, edi
je 0x4059b1
push dword [ebp - 0xc]
push edi
push dword [ebp + 8]
call fcn.004174ab
add esp, 0xc
test eax, eax
jns 0x40595a
push edi
jmp 0x4059ab
add eax, edi
mov dword [ebp - 8], eax
lea edi, [eax - 0x16]
jmp 0x4059a3
cmp byte [edi], 0x50
jne 0x4059a2
movzx ecx, byte [edi + 3]
movzx edx, byte [edi + 2]
shl ecx, 8
or ecx, edx
movzx edx, byte [edi + 1]
shl ecx, 8
or ecx, edx
shl ecx, 8
or ecx, 0x50
cmp ecx, 0x6054b50
jne 0x4059a2
movzx ecx, byte [edi + 0x15]
movzx edx, byte [edi + 0x14]
shl ecx, 8
or ecx, edx
lea ecx, [ecx + edi + 0x16]
cmp ecx, eax
je 0x4059bb
dec edi
cmp edi, dword [ebp - 4]
jae 0x405964
push dword [ebp - 4]
call fcn.00408f24
pop ecx
or edx, 0xffffffff
mov eax, edx
pop esi
pop edi
pop ebx
leave
ret
push 0x16
push edi
push dword [ebp + 0xc]
call fcn.00409360
push dword [ebp - 4]
call fcn.00408f24
mov eax, dword [ebp - 8]
sub eax, edi
cdq
add esp, 0x10
sub esi, eax
mov eax, dword [ebp + 0xc]
sbb ebx, edx
call fcn.00405751
test eax, eax
je 0x4059f4
push ebx
push esi
push dword [ebp + 8]
mov esi, dword [ebp + 0xc]
jmp 0x4058b8
mov eax, esi
mov edx, ebx
jmp 0x4059b6
Function at 0x4098c8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x424070]
jne 0x4098d2
repz ret
jmp fcn.0041152c

Function at 0x40af4e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x40af75
call fcn.0040ac64
mov dword [eax], esi
call fcn.0040ac51
push 0x16
pop esi
mov dword [eax], esi
call fcn.0040d426
mov eax, esi
jmp 0x40afca
test dword [ebp + 0xc], 0xfffffff9
jne 0x40af5b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40afa2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040ac77
pop ecx
call fcn.0040ac51
mov eax, dword [eax]
jmp 0x40afca
test al, 0x10
jne 0x40afc8
test al, 1
je 0x40afc8
test byte [ebp + 0xc], 2
je 0x40afc8
call fcn.0040ac64
mov dword [eax], 5
call fcn.0040ac51
mov dword [eax], 0xd
jmp 0x40af99
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4154fe
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x424070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040d46d
and dword [ebp - 0x14], 0
cmp dword [0x426280], 0
mov dword [ebp - 0x18], eax
jne 0x4155b1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x415659
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x415659
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x426280], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x426284], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x426288], eax
call edi
push eax
call esi
mov dword [0x426290], eax
test eax, eax
je 0x4155b1
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42628c], eax
mov eax, dword [0x42628c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41560a
cmp dword [0x426290], ecx
je 0x41560a
push eax
call esi
push dword [0x426290]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41560a
test ebx, ebx
je 0x41560a
call edi
test eax, eax
je 0x415601
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x415601
test byte [ebp - 8], 1
jne 0x41560a
or dword [ebp + 0x10], 0x200000
jmp 0x41563d
mov eax, dword [0x426284]
cmp eax, dword [ebp - 0x18]
je 0x41563d
push eax
call esi
test eax, eax
je 0x41563d
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41563d
mov eax, dword [0x426288]
cmp eax, dword [ebp - 0x18]
je 0x41563d
push eax
call esi
test eax, eax
je 0x41563d
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x426280]
call esi
test eax, eax
je 0x415659
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41565b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004098c8
leave
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x425b84
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov dword [ebp - 0x14], 1
and dword [ebp - 0x10], 0
and dword [ebp - 0x1c], 0
and dword [ebp - 0x20], 0
and dword [ebp - 0x44], 0
and dword [ebp - 4], 0
and dword [ebp - 0xc], 0
or dword [ebp - 0x18], 0xffffffff
and dword [ebp - 8], 0
mov dword [ebp - 0x40], 0x64616f4c
mov dword [ebp - 0x3c], 0x6f736552
mov dword [ebp - 0x38], 0x65637275
and dword [ebp - 0x34], 0
lea eax, [ebp - 0x40]
push eax
push 0x4092f0
call dword [0x409104]
push eax
call dword [0x4090f4]
mov dword [ebp - 8], eax
push 0x409300
movzx eax, word [ebp + 0x10]
push eax
push dword [ebp + 0xc]
call dword [0x4090c8]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x20]
push dword [ebp + 0xc]
call dword [0x4090e8]
mov dword [ebp - 4], eax
push dword [ebp - 0x20]
push dword [ebp + 0xc]
call dword [ebp - 8]
mov dword [ebp - 0x44], eax
push dword [ebp - 0x44]
call dword [0x4090fc]
cmp dword [ebp + 0x10], 0x65
jne 0x425c2a
mov dword [ebp - 0x1c], 0x843
cmp dword [ebp + 0x10], 0x66
jne 0x425c37
mov dword [ebp - 0x1c], 0x976
push dword [ebp - 4]
call fcn.0042d4e5
pop ecx
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
push dword [ebp - 0x44]
push dword [ebp - 0x10]
call fcn.0042d4d3
add esp, 0xc
push 0
push dword [ebp - 0x1c]
push dword [ebp - 4]
push dword [ebp - 0x10]
call int.00425697
push 0
push dword [ebp + 0x14]
push 2
push 0
push 3
push 0xc0000000
push dword [ebp + 8]
call dword [0x4090c4]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x425c94
and dword [ebp - 0x14], 0
jmp 0x425ca9
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
push dword [ebp - 0x10]
push dword [ebp - 0x18]
call dword [0x4090e0]
cmp dword [ebp - 0x10], 0
je 0x425cbe
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x4c], eax
push dword [ebp - 0x4c]
call fcn.0042d4df
pop ecx
cmp dword [ebp - 0x44], 0
je 0x425ccd
push dword [ebp - 0x44]
call dword [0x4090cc]
cmp dword [ebp - 0x18], 0xffffffff
je 0x425cdc
push dword [ebp - 0x18]
call dword [0x409110]
mov eax, dword [ebp - 0x14]
leave
ret 0x10
Function at 0x427561
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
or dword [ebp - 4], 0xffffffff
cmp dword [0x40dc64], 0
jne 0x4275ee
push 0x400
call fcn.0042d4e5
pop ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [0x40dc64], eax
and dword [ebp - 8], 0
jmp 0x427597
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x100
jge 0x4275ee
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 8
jmp 0x4275b6
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x4275dd
mov eax, dword [ebp - 0xc]
and eax, 1
je 0x4275d3
mov eax, dword [ebp - 0xc]
shr eax, 1
xor eax, 0xedb88320
mov dword [ebp - 0xc], eax
jmp 0x4275db
mov eax, dword [ebp - 0xc]
shr eax, 1
mov dword [ebp - 0xc], eax
jmp 0x4275af
mov eax, dword [ebp - 8]
mov ecx, dword [0x40dc64]
mov edx, dword [ebp - 0xc]
mov dword [ecx + eax*4], edx
jmp 0x427590
and dword [ebp - 0x14], 0
jmp 0x4275fb
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
jae 0x427637
and dword [ebp - 0x18], 0
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x14]
movsx eax, byte [eax]
xor eax, dword [ebp - 4]
and eax, 0xff
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
shr eax, 8
and eax, 0xffffff
mov ecx, dword [ebp - 0x18]
mov edx, dword [0x40dc64]
xor eax, dword [edx + ecx*4]
mov dword [ebp - 4], eax
jmp 0x4275f4
mov eax, dword [ebp - 4]
not eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
leave
ret 8

Function at 0x428e83
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x14], 0
mov eax, dword [ebp + 8]
and dword [eax + 0x10], 0
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x10325476
pop ebp
ret 4
Function at 0x42c3a2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
or dword [ebp - 0x14], 0xffffffff
and dword [ebp - 0x40], 0
mov dword [ebp - 8], 0x4000
and dword [ebp - 4], 0
and dword [ebp - 0xc], 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push 0
push 0
push 2
call fcn.0042d515
test eax, eax
je 0x42c3dd
jmp 0x42c57e
push dword [ebp - 8]
push 0x40
call dword [0x4090b8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x42c3f6
jmp 0x42c57e
mov dword [ebp - 0x3c], 0x74654e57
mov dword [ebp - 0x38], 0x6d756e45
mov dword [ebp - 0x34], 0x6f736552
mov dword [ebp - 0x30], 0x65637275
mov dword [ebp - 0x2c], 0x41
lea eax, [ebp - 0x3c]
push eax
push 0x409e70
call dword [0x409104]
push eax
call dword [0x4090f4]
mov dword [ebp - 0x10], eax
push dword [ebp - 8]
push 0
push dword [ebp - 0xc]
call fcn.0042d4d9
add esp, 0xc
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call dword [ebp - 0x10]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x42c555
and dword [ebp - 0x44], 0
jmp 0x42c46d
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x14]
jae 0x42c553
mov eax, dword [ebp - 0x44]
shl eax, 5
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx + eax + 0xc]
and eax, 1
je 0x42c52d
or dword [ebp - 0x154], 0xffffffff
mov eax, dword [ebp - 0x44]
shl eax, 5
mov ecx, dword [ebp - 0xc]
push dword [ecx + eax + 0x14]
push 0x409e78
lea eax, [ebp - 0x150]
push eax
call dword [0x409210]
add esp, 0xc
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x150]
push eax
call dword [0x4090c4]
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0xffffffff
je 0x42c52d
push dword [ebp - 0x154]
call dword [0x409110]
lea eax, [ebp - 0x150]
push eax
call dword [0x409118]
mov eax, dword [ebp - 0x44]
shl eax, 5
mov ecx, dword [ebp - 0xc]
push dword [ecx + eax + 0x14]
push 0x409a34
lea eax, [ebp - 0x150]
push eax
call dword [0x409210]
add esp, 0xc
lea eax, [ebp - 0x150]
push eax
call fcn.0042a7ed
mov eax, dword [ebp - 0x44]
shl eax, 5
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx + eax + 0xc]
and eax, 2
je 0x42c54e
mov eax, dword [ebp - 0x44]
shl eax, 5
add eax, dword [ebp - 0xc]
push eax
call fcn.0042c3a2
jmp 0x42c466
jmp 0x42c560
cmp dword [ebp - 0x40], 0x103
je 0x42c560
jmp 0x42c56d
cmp dword [ebp - 0x40], 0x103
jne 0x42c432
push dword [ebp - 0xc]
call dword [0x4090a0]
push dword [ebp - 4]
call fcn.0042d50f
leave
ret 4
Function at 0x409ec0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
stosd dword es:[edi], eax
mov eax, 0x33c67616
lds edi, [edx + 0x4990c701]
jb 0x409ecd
jle 0x409e52
and al, 0xd0
invalid

Function at 0x40a2d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor edi, edi
mov esi, dword [edx + 0x28]
movzx ecx, word [edx + 0x26]
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x40a2c7
sub al, 0x20
ror edi, 0xd
add edi, eax
dec ecx
jne 0x40a2be
push edx
mov edx, dword [edx + 0x10]
mov eax, dword [edx + 0x3c]
add eax, edx
mov eax, dword [eax + 0x78]
test eax, eax
push edi
je 0x40a32c
add eax, edx
push eax
mov ecx, dword [eax + 0x18]
mov ebx, dword [eax + 0x20]
add ebx, edx
test ecx, ecx
je 0x40a32b
xor edi, edi
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edx
xor eax, eax
ror edi, 0xd
lodsb al, byte [esi]
add edi, eax
cmp al, ah
jne 0x40a2f7
add edi, dword [ebp - 8]
cmp edi, dword [ebp + 0x24]
jne 0x40a2eb
pop eax
mov ebx, dword [eax + 0x24]
pop eax
pop edi
pop edx
mov edx, dword [edx]
jmp 0x40a2b5

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x6e592851
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x4304d8
mov ecx, 0x6d106d09
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x1000539b
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x100140d4]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push 0xff
push pe_nt_image_headers32
push eax
call fcn.1000dfa5
add esp, 0x14
test eax, eax
jle 0x100053de
mov byte [ebp + eax - 0x104], 0
jmp 0x100053e2
mov byte [ebp - 5], 0
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000debd
leave
ret
Function at 0x1000c028
Capabilities:
Create thread
Resume thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x10014084
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
xor ebx, ebx
cmp eax, 1
jne 0x1000c0ee
mov esi, dword [ebp + 0xc]
add esi, 0xc
cmp byte [esi + 0x100], bl
jne 0x1000c063
cmp byte [esi], bl
jne 0x1000c063
cmp byte [esi + 0x200], bl
jne 0x1000c063
xor esi, esi
cmp dword [0x100140bc], ebx
jne 0x1000c077
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x100140bc], eax
push ebx
push 0x4000
push 5
call dword [sym.imp.KERNEL32.dll_HeapCreate]
push eax
push esi
push ebx
push 0x10014090
mov dword [0x100140cc], eax
call fcn.100070e8
test eax, eax
je 0x1000c0db
push 0x100140c4
push 4
push 0x10014080
push 0x1000bf94
push ebx
push ebx
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
mov dword [0x100140c0], eax
cmp eax, ebx
je 0x1000c0db
cmp eax, 0xffffffff
je 0x1000c0db
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x1000c0db
push ebx
call fcn.1000b201
test eax, eax
jne 0x1000c0ee
push dword [0x10014090]
call sym.libusbK.dll_LstK_Free
mov dword [0x10014090], ebx
jmp 0x1000c129
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x401
push dword [0x10014080]
call dword [sym.imp.USER32.dll_SendMessageA]
mov esi, eax
cmp esi, ebx
je 0x1000c12d
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x1000c122
call sym.libusbK.dll_HotK_FreeAll
push 1
call fcn.1000b201
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1000c130
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x1000cfae
Capabilities:
Create thread
Resume thread
Terminate thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x10014480]
push edi
mov edi, dword [ebp + 8]
lea ecx, [eax + 0x3827c]
cmp edi, ecx
jb 0x1000cfcf
add eax, 0x38e98
cmp edi, eax
jbe 0x1000cfde
push 6
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1000d09d
push edi
call fcn.1000ade9
test eax, eax
jne 0x1000cfef
push 0x138e
jmp 0x1000cfd1
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
xor ebx, ebx
push ebx
lea eax, [edi + 0x40]
push 2
push eax
call esi
test eax, eax
je 0x1000d010
push 5
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1000d063
lea eax, [edi + 0x44]
push eax
push 4
push edi
push 0x1000ca4b
push ebx
push ebx
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
mov dword [edi + 0x48], eax
cmp eax, ebx
je 0x1000d058
cmp eax, 0xffffffff
je 0x1000d058
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
cmp eax, ebx
jne 0x1000d06d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [edi + 0x48]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push ebx
lea eax, [edi + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push edi
call fcn.1000afd6
xor eax, eax
jmp 0x1000d09b
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1000d081
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
test eax, eax
jne 0x1000d083
push eax
call ebx
push 1
push 1
lea eax, [edi + 0x40]
push eax
call esi
cmp eax, 1
jne 0x1000d076
push edi
call fcn.1000afd6
xor eax, eax
inc eax
pop esi
pop ebx
pop edi
pop ebp
ret 4
Function at 0x10010972
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
cmp esi, ebx
jne 0x100109a1
call dword [sym.imp.msvcrt.dll__errno]
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [eax], 0x16
call fcn.1000df88
add esp, 0x14
jmp 0x10010a7f
mov eax, dword [esi + 0xc]
test al, 0x83
je 0x10010a7f
test al, 0x40
jne 0x10010a7f
test al, 2
je 0x100109c3
or eax, 0x20
mov dword [esi + 0xc], eax
jmp 0x10010a7f
or eax, 1
mov dword [esi + 0xc], eax
test eax, 0x10c
je 0x10010983
push dword [esi + 0x18]
mov eax, dword [esi + 8]
mov edi, dword [sym.imp.msvcrt.dll__fileno]
push eax
push esi
mov dword [esi], eax
call edi
pop ecx
push eax
call dword [sym.imp.msvcrt.dll__read]
add esp, 0xc
mov dword [esi + 4], eax
cmp eax, ebx
je 0x10010a6f
cmp eax, 0xffffffff
je 0x10010a6f
test byte [esi + 0xc], 0x82
jne 0x10010a44
push esi
call edi
pop ecx
cmp eax, 0xffffffff
je 0x10010a2f
push esi
call edi
pop ecx
cmp eax, 0xfffffffe
je 0x10010a2f
push esi
call edi
mov ecx, dword [sym.imp.msvcrt.dll___pioinfo]
sar eax, 5
push esi
lea ebx, [ecx + eax*4]
call edi
and eax, 0x1f
imul eax, eax, 0x24
add eax, dword [ebx]
pop ecx
pop ecx
jmp 0x10010a34
mov eax, dword [sym.imp.msvcrt.dll___badioinfo]
mov al, byte [eax + 4]
and al, 0x82
cmp al, 0x82
jne 0x10010a44
or dword [esi + 0xc], 0x2000
cmp dword [esi + 0x18], 0x200
jne 0x10010a62
mov eax, dword [esi + 0xc]
test al, 8
je 0x10010a62
test eax, 0x400
jne 0x10010a62
mov dword [esi + 0x18], 0x1000
mov ecx, dword [esi]
dec dword [esi + 4]
movzx eax, byte [ecx]
inc ecx
mov dword [esi], ecx
jmp 0x10010a82
neg eax
sbb eax, eax
and eax, 0x10
add eax, 0x10
or dword [esi + 0xc], eax
mov dword [esi + 4], ebx
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x401828
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
mov eax, 0x1044
call fcn.0040e060
sub esp, eax
mov eax, dword [ebp + 0x18]
mov byte [ebp - 0x101c], al
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], str.getStringFromRegistry___n_tkeyName:__s_n_tvalueName:__s
call fcn.0040213a
mov dword [ebp - 0xc], 0
cmp byte [ebp - 0x101c], 0
je 0x401872
mov edx, 0x20119
jmp 0x401877
mov edx, 0x20019
lea eax, [ebp - 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x4019a5
mov dword [ebp - 0x10], 0x1000
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1014], 0
lea edx, [ebp - 0x1010]
mov eax, 0
mov ecx, 0x3ff
mov edi, edx
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x10]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x1014]
mov dword [esp + 0x10], edx
lea edx, [ebp - 0x14]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov edx, dword [ebp + 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
test eax, eax
jne 0x401924
mov eax, dword [ebp - 0x14]
cmp eax, 1
jne 0x401924
mov eax, 1
jmp 0x401929
mov eax, 0
test al, al
je 0x401977
lea eax, [ebp - 0x1014]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov dword [esp], str._s:__s
call fcn.0040213a
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov eax, dword [ebp + 0x14]
lea edx, [ebp - 0x1014]
mov dword [esp], edx
mov ecx, eax
call fcn.0041eae0
sub esp, 4
mov eax, 1
jmp 0x4019c6
mov dword [esp + 8], str.RegQueryValueEx___failed.
mov dword [esp + 4], 0
mov dword [esp], 1
call fcn.004020fd
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
jmp 0x4019c1
mov dword [esp + 8], str.RegOpenKeyEx___failed.
mov dword [esp + 4], 0
mov dword [esp], 1
call fcn.004020fd
mov eax, 0
mov edi, dword [ebp - 4]
leave
ret