joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431df4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
test byte [esi + 0x1c], 0x10
je 0x431e40
mov eax, esi
call fcn.0044753c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x431e40
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x250], 0
je 0x431e40
mov ecx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x250]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x24]
test al, al
jne 0x431f7f
mov eax, dword [ebx]
cmp eax, 0x100
jb 0x431e80
cmp eax, 0x108
ja 0x431e80
mov eax, esi
call fcn.0044753c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x431f76
mov ecx, ebx
mov edx, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xf0]
test al, al
jne 0x431f7f
jmp 0x431f76
mov eax, dword [ebx]
cmp eax, 0x200
jb 0x431f5f
cmp eax, 0x20a
ja 0x431f5f
test byte [esi + 0x50], 0x80
jne 0x431eb2
sub eax, 0x203
je 0x431eaf
sub eax, 3
je 0x431eaf
sub eax, 3
jne 0x431eb2
sub dword [ebx], 2
mov eax, dword [ebx]
sub eax, 0x200
je 0x431ec6
dec eax
je 0x431edb
dec eax
je 0x431ef8
dec eax
je 0x431edb
jmp 0x431eff
mov ecx, ebx
mov eax, dword [0x454040]
mov eax, dword [eax]
mov edx, esi
call fcn.00450e04
jmp 0x431f76
cmp byte [esi + 0x5d], 1
jne 0x431ef1
mov eax, esi
mov si, 0xffed
call fcn.00403c48
jmp 0x431f7f
or word [esi + 0x54], 1
jmp 0x431f76
and word [esi + 0x54], 0xfffe
jmp 0x431f76
mov eax, dword [0x455aa4]
cmp byte [eax + 0x20], 0
je 0x431f76
mov eax, dword [0x455aa4]
cmp dword [eax + 0x1c], 0
je 0x431f76
mov eax, dword [ebx]
mov edx, dword [0x455aa4]
cmp eax, dword [edx + 0x1c]
jne 0x431f76
lea eax, [ebp - 0x114]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
call fcn.00447480
mov byte [ebp - 0xc], al
mov ax, word [ebx + 4]
mov word [ebp - 0xa], ax
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, esi
mov si, 0xffc9
call fcn.00403c48
jmp 0x431f7f
cmp eax, 0xb00b
jne 0x431f76
mov edx, dword [ebx + 8]
push edx
mov ecx, dword [ebx + 4]
mov edx, eax
mov eax, esi
call fcn.00430708
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4354c0
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1f8], 0
je 0x4354dc
cmp dword [esi + 4], 0
je 0x435509
test byte [ebx + 0x55], 1
jne 0x4354fb
mov eax, ebx
call fcn.00434060
test eax, eax
jne 0x4354fb
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x435619
mov edx, esi
mov eax, ebx
call fcn.00434fe4
jmp 0x435619
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x435612
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00437330
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.00431d28
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.004354c0
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00437330
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x435619
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43bbb0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x45419c]
cmp byte [eax + 0xc], 0
je 0x43bd1d
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43bd16
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x455af8], 0
jne 0x43bc04
push 0x43bd24
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x43bd2c
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x455af8], eax
cmp dword [0x453b98], 0
jne 0x43bcff
push 0x43bd3c
call sub.kernel32.dll_LoadLibraryA
mov dword [0x453b98], eax
cmp dword [0x453b98], 0
je 0x43bcff
push 0x43bd48
mov eax, dword [0x453b98]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x455afc], eax
push 0x43bd58
mov eax, dword [0x453b98]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x455b00], eax
push 0x43bd6c
mov eax, dword [0x453b98]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x455b04], eax
push 0x43bd84
mov eax, dword [0x453b98]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x455b08], eax
push 0x43bd9c
mov eax, dword [0x453b98]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x455b0c], eax
push 0x43bdb0
mov eax, dword [0x453b98]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x455b10], eax
push 0x43bdc8
mov eax, dword [0x453b98]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x455b14], eax
push 0x43bde0
mov eax, dword [0x453b98]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x455b18], eax
push 0x43bdfc
mov eax, dword [0x453b98]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x455b1c], eax
push 0x43be08
mov eax, dword [0x453b98]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x455b20], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43bd1d
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x43fbd0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.004047b4
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x43fc1f
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.00404a24
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4473f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x447440]
test si, 4
je 0x447404
or bl, 1
test si, 8
je 0x44740e
or bl, 4
test si, 1
je 0x447418
or bl, 8
test si, 2
je 0x447422
or bl, 0x10
test si, 0x10
je 0x44742c
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44743b
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x447444
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x44747c]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44745d
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44746c
or bl, 4
test esi, 0x20000000
je 0x447477
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x44db40
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x44db52
add esp, 0xfffffff0
call fcn.00403d60
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00419f00
mov eax, dword [0x453e90]
mov dword [eax + 4], ebx
mov dword [eax], 0x44dee4
mov eax, dword [0x453e9c]
mov dword [eax + 4], ebx
mov dword [eax], 0x44def0
mov eax, ebx
call fcn.0044defc
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x412118]
call fcn.00403a10
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x412118]
call fcn.00403a10
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x412118]
call fcn.00403a10
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x412118]
call fcn.00403a10
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x412118]
call fcn.00403a10
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x44a314
push eax
push 0
push 0
mov eax, dword [0x453fcc]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41b930]
call fcn.0041cd98
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x41b930]
call fcn.0041cd98
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x41b930]
call fcn.0041cd98
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0044e34c
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44e214
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44e214
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44e214
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44dc8f
call fcn.00403db8
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x44dff8
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44e1a3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x44e184
mov dl, 1
mov eax, dword [0x412534]
call fcn.00403a10
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004047b4
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x44e173
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0043bf10
test al, al
je 0x44e166
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x44e1b4
lea eax, [ebp - 0x254]
call fcn.00409494
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x44e166
xor eax, eax
push ebp
push 0x44e15f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x44e1ec
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x44e148
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404a24
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x44e148
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404a24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44e166
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x44e069
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00416098
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44e1aa
lea eax, [ebp - 0x260]
call fcn.004047b4
ret

Function at 0x44eaec
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x455b44]
cmp byte [eax + 0xa5], 0
jne 0x44eb5d
cmp dword [0x455b5c], 0
jne 0x44eb1e
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x44eaa8
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x455b5c], eax
cmp dword [0x455b58], 0
jne 0x44eb39
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x455b58], eax
cmp dword [0x455b60], 0
jne 0x44eb5d
push esp
push 0
push 0
push 0x44ea4c
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x455b60], eax
pop edx
ret
Function at 0x44f1f0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x455b44]
cmp dword [eax + 0x30], 0
je 0x44f29a
cmp dword [ebx + 0x94], 0
jne 0x44f294
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x44f180
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x44f294
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x44f25a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x44f294
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00414494
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x44f269
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x44fdf8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x44fe2d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004048a4
jmp 0x44fe3a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404808
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x450f4c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x450f8d
mov eax, esi
call fcn.00437634
test al, al
je 0x450f8d
mov eax, dword [ebx + 0x84]
call fcn.00437330
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x450f8d
push 0
mov eax, dword [ebx + 0x84]
call fcn.00437330
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x10004770
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
nop
nop
mov eax, 0x4d7bd9f0
mov eax, ebx
mov eax, 0xc277fb7e
mov eax, 0x97ffb545
mov eax, 0xa7a88dad
mov eax, 0xa43e4468
inc eax
mov eax, ecx
mov eax, ecx
nop
cmp eax, 0x38e8a68
mov eax, ebx
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
mov eax, 0xfed301fb
nop
cmp eax, 0x884677f0
cmp eax, 0x10
cmp eax, 0x59
cmp eax, 0xffffff80
mov eax, ebx
mov eax, 0xdb9de98e
mov eax, ecx
nop
inc eax
cmp eax, 0x3b1aa207
mov eax, ebx
nop
mov eax, ecx
nop
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
nop
mov eax, 0x82ef1da6
cmp eax, 0x17
mov eax, ebx
cmp eax, 0xffffffef
cmp eax, 0x596cedd9
cmp eax, 0xffffffe1
mov eax, ebx
mov eax, ecx
mov eax, ebx
mov eax, ebx
cmp eax, 0xe782c9ca
mov eax, ecx
nop
mov eax, ecx
nop
nop
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
push 0x1002beb4
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp eax, 0x50c8feb9
inc eax
mov eax, 0x82af7081
mov eax, 0x93da5c13
nop
mov eax, ecx
mov eax, ebx
mov eax, ebx
mov eax, ecx
mov eax, ebx
cmp eax, 0xffffffac
mov eax, ecx
inc eax
nop
cmp eax, 0x47
cmp eax, 0x32
nop
inc eax
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x1003e22c], eax
cmp eax, 0x72b78d03
cmp eax, 0xb
mov eax, 0x6864cb77
nop
mov eax, ecx
mov eax, ebx
mov eax, ebx
mov eax, 0x8f74bafa
cmp eax, 0xc69bffe5
mov eax, ecx
cmp eax, 0xffffff87
mov eax, ebx
mov eax, 0xacceeb51
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
cmp dword [0x1003e22c], 0
jne 0x1000491f
push 0x41030
push str.DllWrap
push str.miss
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
inc eax
inc eax
nop
cmp eax, 0xffffffb9
mov eax, ecx
mov eax, ecx
cmp eax, 0xaaf5d4a5
mov eax, ebx
mov eax, 0x4e2c347f
cmp eax, 0x9db27b3c
mov eax, 0xd34aeda9
nop
mov eax, ecx
cmp eax, 0xfffffff4
nop
mov eax, ecx
inc eax
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
cmp dword [0x1003e22c], 0
je 0x10004931
mov dword [ebp - 4], 1
jmp 0x10004938
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4024d5
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x402514
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x402514
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x402514
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x402514
cmp dword [ecx + 0x74], 0xe
jbe 0x402514
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4080f3
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x408190
push ebx
push esi
call fcn.004080bc
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00408050
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40813d
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40818f
push edi
push eax
call fcn.00408d10
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40815d
call fcn.00406bb1
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40818e
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00408050
add esp, 0x20
test eax, eax
jne 0x40817c
push edi
call fcn.00406bb1
jmp 0x408184
push ebx
call fcn.00406bb1
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40948d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4142b8
push 0x4142b0
push str.FlsAlloc
push 0x1f
call fcn.0040934c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4094c1
push dword [ebp + 8]
mov ecx, esi
call dword [0x41212c]
call esi
jmp 0x4094c7
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40950b
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4142c8
push 0x4142c0
push str.FlsGetValue
push 0x21
call fcn.0040934c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x409542
push dword [ebp + 8]
mov ecx, esi
call dword [0x41212c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40954a
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4142d0
push 0x4142c8
push str.FlsSetValue
push 0x22
call fcn.0040934c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x409584
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x41212c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x40e9e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40ea0d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40ea0d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x100010f0
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
mov dword [esi], 0x10016558
nop
nop
nop
mov al, byte [esi + 0x44]
test al, al
je 0x1000114c
mov eax, dword [esi + 0x18]
push eax
call dword [sym.imp.WINMM.dll_waveInStop]
mov ecx, dword [esi + 0x18]
push ecx
call dword [sym.imp.WINMM.dll_waveInReset]
lea edi, [esi + 0x30]
mov ebx, 2
mov edx, dword [edi]
mov eax, dword [esi + 0x18]
push 0x20
push edx
push eax
call dword [sym.imp.WINMM.dll_waveInUnprepareHeader]
add edi, 4
dec ebx
jne 0x10001121
mov ecx, dword [esi + 0x18]
push ecx
call dword [sym.imp.WINMM.dll_waveInClose]
mov edx, dword [esi + 0x2c]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov al, byte [esi + 0x45]
test al, al
je 0x10001184
mov eax, dword [esi + 0x40]
push eax
call dword [sym.imp.WINMM.dll_waveOutReset]
lea edi, [esi + 0x30]
mov ebx, 2
mov ecx, dword [edi]
mov edx, dword [esi + 0x40]
push 0x20
push ecx
push edx
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
add edi, 4
dec ebx
jne 0x10001165
mov eax, dword [esi + 0x40]
push eax
call dword [sym.imp.WINMM.dll_waveOutClose]
lea edi, [esi + 0x30]
mov ebx, 2
mov ecx, dword [edi - 0x28]
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov edx, dword [edi]
push edx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [edi - 0x20]
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov ecx, dword [edi + 8]
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 0x10
add edi, 4
dec ebx
jne 0x1000118c
mov edx, dword [esi + 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov eax, dword [esi + 0x28]
push eax
call edi
mov ecx, dword [esi + 0x2c]
push ecx
call edi
pop edi
pop esi
pop ebx
ret