joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008d18
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov dword [ebp - 4], esi
mov esi, eax
mov edx, dword [0x100a486c]
test edx, edx
jne 0x10008d42
push 0x17a
push 0x10094d18
push str.assertion_failure
call fcn.10009ff4
add esp, 0xc
add esi, 1
push esi
push dword [0x100a5b7c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x10008d5d
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
push str.Windows:_TLS_Set_Value_failed._n
call fcn.100088dc
pop ecx
jmp 0x10008d56

Function at 0x10008d98
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], edi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebx + 0x14], eax
test eax, eax
jl 0x10008dd3
mov edx, dword [0x100a2b2c]
mov ecx, dword [edx + eax*4]
test ecx, ecx
je 0x10008dd3
mov edx, dword [0x100a1e00]
mov edx, dword [edx + eax*4]
test edx, edx
je 0x10008dd3
cmp edx, dword [ecx + 0x14]
je 0x10008e28
mov edx, dword [0x100a2a5c]
imul edx, eax
xor ecx, ecx
add edx, dword [ebp + 0x10]
lea eax, [ebp - 0x10]
mov dword [ebx + 4], edx
mov dword [ebx + 8], ecx
push eax
push 0x10000
push ebx
push 0x10008c84
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x10008e12
mov dword [ebx + 0xc], eax
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.__kmp_create_worker:_CreateThread
call fcn.10008854
add esp, 8
jmp 0x10008e05
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
lea ecx, [ebx + 0xc]
xor edx, edx
push edx
push edx
push ecx
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x10008e6c
push 0x3af
push 0x10094d18
push str.assertion_failure
call fcn.10009ff4
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 4], 0
push ebx
mov dword [ebx + 0x1c], eax
mov dword [ebx + 8], 1
lea eax, [ebp - 0x14]
mov dword [ebx], eax
call fcn.10001d20
pop ecx
jmp 0x10008e05

Function at 0x1000fb88
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1009f0d0]
jne 0x1000fb92
repz ret
jmp fcn.10012c8f
Function at 0x1001b295
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10012e07
and dword [ebp - 4], 0
cmp dword [0x100a5240], 0
mov ebx, eax
jne 0x1001b346
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1001b3f7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1001b3f7
push eax
call fcn.10012d95
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x100a5240], eax
call esi
push eax
call fcn.10012d95
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x100a5244], eax
call esi
push eax
call fcn.10012d95
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x100a5248], eax
call esi
push eax
call fcn.10012d95
pop ecx
mov dword [0x100a5250], eax
test eax, eax
je 0x1001b346
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10012d95
pop ecx
mov dword [0x100a524c], eax
mov eax, dword [0x100a524c]
cmp eax, ebx
je 0x1001b39e
cmp dword [0x100a5250], ebx
je 0x1001b39e
push eax
call fcn.10012e10
push dword [0x100a5250]
mov esi, eax
call fcn.10012e10
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1001b39e
test edi, edi
je 0x1001b39e
call esi
test eax, eax
je 0x1001b395
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1001b395
test byte [ebp - 0xc], 1
jne 0x1001b39e
or dword [ebp + 0x10], 0x200000
jmp 0x1001b3d7
mov eax, dword [0x100a5244]
cmp eax, ebx
je 0x1001b3d7
push eax
call fcn.10012e10
pop ecx
test eax, eax
je 0x1001b3d7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1001b3d7
mov eax, dword [0x100a5248]
cmp eax, ebx
je 0x1001b3d7
push eax
call fcn.10012e10
pop ecx
test eax, eax
je 0x1001b3d7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x100a5240]
call fcn.10012e10
pop ecx
test eax, eax
je 0x1001b3f7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1001b3f9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1002d8e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebp, esp
and ebp, 0xffffffe0
sub esp, 0x50
mov eax, 0x3f000000
mov ebx, 0x80000000
xor ecx, ecx
mov edx, 0x3fe00000
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x10], 0x3f000000
movss xmm6, dword [ebp - 0x18]
mov ecx, dword [esp + 0x6c]
movss xmm7, dword [ebp - 0x14]
shufps xmm6, xmm6, 0
cmp ecx, 0x200
mov eax, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
jg 0x1002da81
fld qword [esp + 0x78]
fld st(0)
fmul dword [ebp - 0x10]
fsub qword [esp + 0x70]
fld st(0)
fst dword [ebp - 0xc]
fmul st(2)
fsub dword [ebp - 0x10]
fld st(0)
fst dword [ebp - 8]
fmul st(3)
fsubrp st(2)
fld st(1)
fst dword [ebp - 4]
mov edx, eax
shufps xmm7, xmm7, 0
sub ebx, 0xc
cmp ecx, 4
jl 0x1002da5a
and edx, 0xf
je 0x1002d9f0
lea esp, [esp]
lea esp, [esp]
fmul st(3)
sub ecx, 4
movlps xmm0, qword [eax]
movhps xmm0, qword [eax + 8]
movaps xmm2, xmmword [ebp - 0x10]
fsubrp st(1)
xorps xmm2, xmm6
fld st(0)
fst dword [ebp - 0x10]
fmul st(3)
addps xmm2, xmm7
movlps xmm1, qword [ebx]
movhps xmm1, qword [ebx + 8]
fsubrp st(2)
fld st(1)
fst dword [ebp - 0xc]
fmul st(3)
movaps xmm3, xmm2
fsubrp st(1)
fld st(0)
shufps xmm3, xmm3, 0x1b
fst dword [ebp - 8]
fmul st(3)
mulps xmm0, xmm2
fsubrp st(2)
fld st(1)
mulps xmm3, xmm1
fst dword [ebp - 4]
movlps qword [eax], xmm0
movhps qword [eax + 8], xmm0
add eax, 0x10
movlps qword [ebx], xmm3
movhps qword [ebx + 8], xmm3
sub ebx, 0x10
cmp ecx, 4
jge 0x1002d980
cmp ecx, 0
je 0x1002dab1
jmp 0x1002da5a
mov edx, ebx
and edx, 0xf
jne 0x1002d980
lea esp, [esp]
mov edi, edi
sub ecx, 4
fmul st(3)
movaps xmm0, xmmword [eax]
movaps xmm2, xmmword [ebp - 0x10]
fsubrp st(1)
fld st(0)
xorps xmm2, xmm6
fst dword [ebp - 0x10]
fmul st(3)
addps xmm2, xmm7
movaps xmm1, xmmword [ebx]
fsubrp st(2)
fld st(1)
fst dword [ebp - 0xc]
fmul st(3)
movaps xmm3, xmm2
fsubrp st(1)
fld st(0)
shufps xmm3, xmm3, 0x1b
fst dword [ebp - 8]
fmul st(3)
mulps xmm0, xmm2
mulps xmm3, xmm1
fsubrp st(2)
movaps xmmword [eax], xmm0
fld st(1)
fst dword [ebp - 4]
add eax, 0x10
movaps xmmword [ebx], xmm3
sub ebx, 0x10
cmp ecx, 4
jge 0x1002da00
cmp ecx, 0
je 0x1002dab1
mov edx, ebp
sub edx, 0x10
add ebx, 0xc
fld dword [edx]
fsubr qword [ebp - 0x20]
fld dword [eax]
fmul st(1)
fld dword [ebx]
fmulp st(2)
fstp dword [eax]
add edx, 4
add eax, 4
fstp dword [ebx]
sub ebx, 4
dec ecx
jne 0x1002da62
jmp 0x1002dab1
fld qword [esp + 0x78]
fld qword [ebp - 0x20]
fld qword [esp + 0x70]
fld qword [ebp - 0x20]
nop
fld st(0)
fsubr st(3)
fld dword [eax]
fmul st(1)
fld dword [ebx]
fmulp st(2)
fstp dword [eax]
add eax, 4
fstp dword [ebx]
sub ebx, 4
fld st(0)
fmul st(4)
fsubrp st(2)
fxch st(1)
dec ecx
jne 0x1002da90
fstp st(0)
fstp st(0)
fstp st(0)
fstp st(0)
add esp, 0x50
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4068a5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4068c9
xor eax, eax
test eax, eax
je 0x4068dc
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4068dc
xor ecx, ecx
jmp 0x4068df
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406a02
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4275ac], 0
push esi
jne 0x406a39
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406a13
mov dword [ecx*4 + 0x4275a8], eax
inc ecx
cmp ecx, 0x100
jl 0x406a0e
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406a6a
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4275a8]
xor eax, esi
inc ecx
dec edx
jne 0x406a4c
pop edi
not eax
pop esi
ret 0xc

Function at 0x40453a
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffadc
push esi
lea esi, [esp + 0x40]
mov dword [esi], 0x4f4c45
mov dword [esi + 4], 0
push esi
call dword [sym.imp.USER32.dll_CharLowerA]
cmp dword [esi], 0x6f6c65
jne 0x40456b
cmp eax, esi
je 0x40456c
leave
ret 4
add byte [ebx - 0x17a7dbcc], cl
sbb byte [eax], al
add byte [eax], al
mov esi, dword [esp]
pop eax
call fcn.0040458d
cmp eax, 0
je 0x404584
cmp edx, eax
jbe 0x40459b
jmp eax
push eax
notrack jmp dword ds:[sym.imp.KERNEL32.dll_GetTimeZoneInformation]
in al, 0x30
inc ebx
add byte [ebx], ah
lds eax, [eax + 0x3b]
les esp, [esi]
jp 0x4045aa
call dword es:[sym.imp.USER32.dll_GetKeyState]
dec eax
mov esp, 0x48004330
and eax, 0x7ffe
sub ax, 0x7ffc
xchg ecx, eax
push ecx
ror dword [esp], 4
rol dword [esp], 7
pop ecx
xchg ecx, eax
call dword cs:[eax*4 + sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
dec eax
and eax, 6
lea eax, [eax*2 - 0x5b]
mov edx, 0x40d690
add eax, edx
je 0x4045aa
ret

Function at 0x40458d
Capabilities:
Log keystrokes via polling

Disassembly:
push esp
push 0
mov eax, ebp
push 0
push 0
push 0xffffffffffffffff
call dword es:[sym.imp.GDI32.dll_EnumICMProfilesW]
and eax, ebp
inc eax
cmp eax, esp
jp 0x4045aa

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401b50
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x480c76
mov eax, dword fs:[0]
push eax
mov eax, 0x1050
call fcn.0047d4f0
mov eax, dword [0x4a9750]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x4aca58]
mov dword [ebp - 0x105c], 0
test al, 1
jne 0x401bc7
or eax, 1
mov dword [0x4aca54], 7
mov dword [0x4aca58], eax
xor eax, eax
push 0x48c200
mov dword [0x4aca50], 0
mov word [0x4aca40], ax
call fcn.004672af
add esp, 4
cmp dword [0x4aca50], 0
jne 0x401d41
xor eax, eax
push 0xffe
push eax
mov word [ebp - 0x1010], ax
lea eax, [ebp - 0x100e]
push eax
call fcn.0046ab60
add esp, 0xc
lea eax, [ebp - 0x1010]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp word [ebp - 0x1010], 0
je 0x401d41
push 0x493c00
lea ecx, [ebp - 0x1058]
call fcn.004031e0
lea eax, [ebp - 0x1010]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x1028]
call fcn.004031e0
lea eax, [ebp - 0x1058]
mov byte [ebp - 4], 1
push eax
lea edx, [ebp - 0x1028]
lea ecx, [ebp - 0x1040]
call fcn.00405d10
mov edi, eax
add esp, 4
cmp edi, 0x4aca40
je 0x401ca3
cmp dword [0x4aca54], 8
jb 0x401c7c
push dword [0x4aca40]
call fcn.00467305
add esp, 4
xor eax, eax
mov dword [0x4aca54], 7
push edi
mov ecx, 0x4aca40
mov dword [0x4aca50], 0
mov word [0x4aca40], ax
call fcn.00403580
cmp dword [ebp - 0x102c], 8
jb 0x401cba
push dword [ebp - 0x1040]
call fcn.00467305
add esp, 4
xor eax, eax
mov dword [ebp - 0x102c], 7
cmp dword [ebp - 0x1014], 8
mov dword [ebp - 0x1030], 0
mov word [ebp - 0x1040], ax
jb 0x401cee
push dword [ebp - 0x1028]
call fcn.00467305
add esp, 4
xor eax, eax
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x1044], 8
mov dword [ebp - 0x1014], 7
mov dword [ebp - 0x1018], 0
mov word [ebp - 0x1028], ax
jb 0x401d29
push dword [ebp - 0x1058]
call fcn.00467305
add esp, 4
mov ecx, 0x4aca40
call fcn.00408cc0
test al, al
jne 0x401d41
mov ecx, 0x4aca40
call fcn.00409410
xor eax, eax
mov dword [esi + 0x14], 7
push 0xffffffffffffffff
push eax
mov dword [esi + 0x10], 0
mov ecx, esi
push 0x4aca40
mov word [esi], ax
call fcn.004035e0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00466b29
mov esp, ebp
pop ebp
ret
Function at 0x4079a0
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], 0
mov word [esi + 4], 0
cmp dword [eax + 0x10], 0
je 0x4079c3
cmp dword [eax + 0x14], 8
jb 0x4079c5
mov eax, dword [eax]
jmp 0x4079c5
xor eax, eax
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
test eax, eax
je 0x4079ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
mov eax, esi
jne 0x4079ef
mov byte [esi + 5], 1
pop esi
ret 4
mov eax, esi
pop esi
ret 4

Function at 0x407a20
Capabilities:
Check mutex on windows

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
test eax, eax
je 0x407a36
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
mov eax, dword [esp + 8]
mov word [esi + 4], 0
cmp dword [eax + 0x10], 0
je 0x407a50
cmp dword [eax + 0x14], 8
jb 0x407a52
mov eax, dword [eax]
jmp 0x407a52
xor eax, eax
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
test eax, eax
je 0x407a74
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x407a74
mov byte [esi + 5], 1
cmp dword [esi], 0
pop esi
setne al
ret 4

Function at 0x407a80
Capabilities:
Check mutex on windows

Disassembly:
push 0xffffffffffffffff
push 0x481398
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x4a9750]
xor eax, esp
mov dword [esp + 8], eax
push ebx
push esi
push edi
mov eax, dword [0x4a9750]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
mov ebx, dword [esp + 0x2c]
test eax, eax
je 0x407aca
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
lea ecx, [esp + 0x14]
mov word [edi + 4], 0
mov dword [esp + 0x14], 0
call fcn.00419660
mov dword [esp + 0x24], 0
mov esi, dword [esp + 0x14]
cmp dword [esi], 0
je 0x407af7
lea eax, [esi + 8]
jmp 0x407af9
xor eax, eax
cmp dword [ebx + 0x10], 0
je 0x407b09
cmp dword [ebx + 0x14], 8
jb 0x407b0b
mov ebx, dword [ebx]
jmp 0x407b0b
xor ebx, ebx
push ebx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi], eax
test eax, eax
je 0x407b2c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x407b2c
mov byte [edi + 5], 1
cmp dword [edi], 0
setne bl
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esi]
test eax, eax
je 0x407b56
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], 0
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x407b6b
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi + 4], 0
push esi
call fcn.00467305
add esp, 4
mov dword [esp + 0x14], 0
mov al, bl
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00466b29
add esp, 0x18
ret 4
Function at 0x407ba0
Capabilities:
Check mutex on windows

Disassembly:
push 0xffffffffffffffff
push 0x4813c8
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x4a9750]
xor eax, esp
mov dword [esp + 4], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a9750]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
mov ebx, dword [esp + 0x2c]
test eax, eax
je 0x407beb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
push ecx
lea ecx, [esp + 0x18]
mov word [edi + 4], 0
mov dword [esp + 0x18], 0
call fcn.004197a0
mov dword [esp + 0x24], 0
mov esi, dword [esp + 0x14]
cmp dword [esi], 0
je 0x407c19
lea ebp, [esi + 8]
jmp 0x407c1b
xor ebp, ebp
cmp dword [ebx + 0x10], 0
je 0x407c2f
cmp dword [ebx + 0x14], 8
jb 0x407c2b
mov eax, dword [ebx]
jmp 0x407c31
mov eax, ebx
jmp 0x407c31
xor eax, eax
push eax
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi], eax
test eax, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x407c7d
call eax
cmp eax, 5
jne 0x407c73
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebx + 0x10], 0
je 0x407c65
cmp dword [ebx + 0x14], 8
jb 0x407c67
mov ebx, dword [ebx]
jmp 0x407c67
xor ebx, ebx
push ebx
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi], eax
cmp dword [edi], 0
je 0x407c94
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
cmp eax, 0xb7
jne 0x407c8a
mov byte [edi + 5], 1
mov ecx, dword [edi]
call fcn.00411c80
cmp dword [edi], 0
setne bl
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esi]
test eax, eax
je 0x407cbb
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], 0
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x407cd0
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi + 4], 0
push esi
call fcn.00467305
add esp, 4
mov dword [esp + 0x14], 0
mov al, bl
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00466b29
add esp, 0x14
ret 4
Function at 0x414f60
Capabilities:
Read file on windows

Disassembly:
mov edx, ecx
mov eax, dword [edx]
test eax, eax
jne 0x414f6d
xor al, al
ret 0xc
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x414f68
cmp dword [eax], 0xffffffff
je 0x414f68
mov eax, dword [esp + 0xc]
push 0
push eax
push dword [esp + 0x10]
mov dword [eax], 0
mov eax, dword [edx]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
setne al
ret 0xc

Function at 0x415020
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x4a9750]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push edi
mov edi, dword [esp + 0x10]
test eax, eax
jne 0x41504d
xor al, al
pop edi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00466b29
add esp, 8
ret 4
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x415039
push esi
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x415087
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x415087
pop esi
xor al, al
pop edi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00466b29
add esp, 8
ret 4
mov ecx, dword [esp + 8]
xor eax, eax
add eax, esi
mov dword [edi], eax
mov al, 1
adc ecx, 0
mov dword [edi + 4], ecx
mov ecx, dword [esp + 0xc]
pop esi
pop edi
xor ecx, esp
call fcn.00466b29
add esp, 8
ret 4

Function at 0x415140
Capabilities:
Clear file content

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, ecx
push edi
cmp dword [esi], 0
jne 0x41515a
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
lea eax, [esp + 0x18]
xorps xmm0, xmm0
push eax
push 1
push 0
push 0
movlpd qword [esp + 0x28], xmm0
call fcn.004150b0
test al, al
je 0x41514e
mov edi, dword [esp + 0x2c]
lea eax, [esp + 0x10]
mov ebp, dword [esp + 0x28]
xorps xmm0, xmm0
push eax
push 0
push edi
push ebp
mov ecx, esi
movlpd qword [esp + 0x20], xmm0
call fcn.004150b0
test al, al
je 0x41514e
xor bl, bl
cmp dword [esp + 0x10], ebp
jne 0x4151c7
cmp dword [esp + 0x14], edi
jne 0x4151c7
mov eax, dword [esi]
test eax, eax
jne 0x4151b4
xor bl, bl
jmp 0x4151c7
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x4151b0
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne bl
lea eax, [esp + 0x10]
xorps xmm0, xmm0
push eax
push 0
push dword [esp + 0x24]
mov ecx, esi
movlpd qword [esp + 0x1c], xmm0
push dword [esp + 0x24]
call fcn.004150b0
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x14
ret 8
Function at 0x415430
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x4a9750]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
mov esi, ecx
mov dword [esp + 4], 0x114
push 0x110
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov byte [esi], 0
call fcn.0046ab60
add esp, 0xc
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, esi
je 0x4154c7
cmp dword [esp + 8], 6
jb 0x4154c7
mov byte [esi], 1
mov ecx, dword [esp + 0x118]
pop esi
xor ecx, esp
call fcn.00466b29
add esp, 0x118
ret
Function at 0x4154e0
Capabilities:
Link many functions at runtime

Disassembly:
push 0xffffffffffffffff
push 0x482f6c
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a9750]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov ebx, ecx
push 0xc
xor eax, eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
lea ecx, [esp + 0x1c]
push 0x496fc0
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], 0
mov word [esp + 0x20], ax
call fcn.00403a40
mov dword [esp + 0x50], 0
mov eax, dword [0x4aca68]
test al, 1
jne 0x41557f
or eax, 1
mov dword [0x4aca68], eax
mov byte [esp + 0x50], 1
mov dword [0x4aca64], 0
call fcn.00419d00
push 0x48c3f0
call fcn.004672af
add esp, 4
mov byte [esp + 0x50], 0
lea eax, [esp + 0x18]
mov ecx, 0x4aca64
push eax
call fcn.00419ec0
mov edi, eax
mov dword [esp + 0x50], 0xffffffff
cmp dword [esp + 0x2c], 8
jb 0x4155ab
push dword [esp + 0x18]
call fcn.00467305
add esp, 4
xor eax, eax
mov dword [esp + 0x2c], 7
push 0xb
mov dword [esp + 0x44], eax
lea ecx, [esp + 0x34]
mov dword [esp + 0x48], eax
push str.crypt32.dll
mov dword [esp + 0x30], 0
mov word [esp + 0x20], ax
mov dword [esp + 0x4c], 7
mov dword [esp + 0x48], eax
mov word [esp + 0x38], ax
call fcn.00403a40
mov dword [esp + 0x50], 2
mov eax, dword [0x4aca68]
test al, 1
jne 0x41562a
or eax, 1
mov dword [0x4aca68], eax
mov byte [esp + 0x50], 3
mov dword [0x4aca64], 0
call fcn.00419d00
push 0x48c3f0
call fcn.004672af
add esp, 4
mov byte [esp + 0x50], 2
lea eax, [esp + 0x30]
mov ecx, 0x4aca64
push eax
call fcn.00419ec0
mov ebp, eax
mov dword [esp + 0x50], 0xffffffff
cmp dword [esp + 0x44], 8
jb 0x415656
push dword [esp + 0x30]
call fcn.00467305
add esp, 4
xor eax, eax
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], 0
mov word [esp + 0x30], ax
test edi, edi
je 0x4156e9
test ebp, ebp
je 0x4156e9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptCATAdminCalcHashFromFileHandle
push edi
call esi
push str.CryptCATAdminAcquireContext
push edi
mov dword [ebx + 4], eax
call esi
push str.CryptCATAdminEnumCatalogFromHash
push edi
mov dword [ebx + 8], eax
call esi
push str.CryptCATCatalogInfoFromContext
push edi
mov dword [ebx + 0xc], eax
call esi
push str.CryptCATAdminReleaseCatalogContext
push edi
mov dword [ebx + 0x10], eax
call esi
push str.CryptCATAdminReleaseContext
push edi
mov dword [ebx + 0x14], eax
call esi
push str.WTHelperProvDataFromStateData
push edi
mov dword [ebx + 0x18], eax
call esi
push str.WTHelperGetProvSignerFromChain
push edi
mov dword [ebx + 0x1c], eax
call esi
push str.WinVerifyTrust
push edi
mov dword [ebx + 0x20], eax
call esi
push str.CertNameToStrW
push ebp
mov dword [ebx + 0x24], eax
call esi
mov dword [ebx + 0x28], eax
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret