joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1008df90
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x1009b213
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
push ebx
push esi
mov eax, dword [0x100cba70]
xor eax, esp
push eax
lea eax, [esp + 0x88]
mov dword fs:[0], eax
mov esi, ecx
push 8
call fcn.100802a2
xor ebx, ebx
add esp, 4
cmp eax, ebx
je 0x1008ded4
mov ecx, dword [esi + 0x18]
mov dword [eax], ecx
mov dword [eax + 4], ebx
jmp 0x1008ded6
xor eax, eax
lea edx, [esi + 0xc]
push edx
push ebx
push eax
mov dword [esi + 4], eax
mov eax, dword [esi + 8]
push 0x1008dd90
push eax
push ebx
call fcn.100970b0
add esp, 0x18
cmp eax, 0xffffffff
jne 0x1008df70
push 0xc
mov esi, 0xf
push str..Thread.cpp
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
call fcn.10002b10
push 0x10
push str.Thread::launch__
lea ecx, [esp + 0x30]
mov dword [esp + 0x98], ebx
mov dword [esp + 0x48], esi
mov dword [esp + 0x44], ebx
mov byte [esp + 0x34], bl
call fcn.10002b10
push 0xfd
lea ecx, [esp + 0x10]
push ecx
mov byte [esp + 0x98], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [esp + 0x34]
push edx
lea ecx, [esp + 0x54]
call fcn.10089460
push 0x100bb2cc
lea eax, [esp + 0x48]
push eax
call fcn.10081af4
mov dword [esi + 0x14], eax
mov ecx, dword [esp + 0x88]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x88
ret
jmp 0x1008de90
Function at 0x100902f0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x1009b503
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x100cba70]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100cba70]
xor eax, esp
push eax
lea eax, [esp + 0xa0]
mov dword fs:[0], eax
mov esi, dword [esp + 0xb0]
mov ebp, dword [esp + 0xb4]
xor ebx, ebx
cmp dword [esi + 0x18], 0x10
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], 4
mov dword [esp + 0x14], ebx
jb 0x10090356
mov eax, dword [esi + 4]
jmp 0x10090359
lea eax, [esi + 4]
lea edx, [esp + 0x1c]
push edx
lea edx, [esp + 0x1c]
push edx
lea edx, [esp + 0x1c]
push edx
push ebx
push eax
call fcn.100901c0
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
cmp edi, 2
jne 0x100903a9
xor al, al
mov ecx, dword [esp + 0xa0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.10079ea5
add esp, 0x98
ret 8
cmp edi, ebx
jne 0x100903bf
cmp dword [esp + 0x14], 4
jne 0x100903bf
mov eax, dword [esp + 0x18]
mov dword [ebp], eax
mov al, 1
jmp 0x1009037f
push 0x1c
mov ebp, 0xf
push str.RegistryKey::getValue_ulong_
lea ecx, [esp + 0x88]
mov dword [esp + 0xa0], ebp
mov dword [esp + 0x9c], ebx
mov byte [esp + 0x8c], bl
call fcn.10002b10
push 0xffffffffffffffff
push ebx
push esi
lea ecx, [esp + 0x8c]
mov dword [esp + 0xb4], ebx
call fcn.1000a130
cmp dword [esp + 0x14], 4
je 0x1009041d
push 0x17
push str._:_incorrect_value_type
lea ecx, [esp + 0x88]
call fcn.1000dfc0
push 0x11
push str..RegistryKey.cpp
lea ecx, [esp + 0x28]
mov dword [esp + 0x40], ebp
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
call fcn.10002b10
push 0xc5
lea ecx, [esp + 0x24]
push ecx
push edi
lea edx, [esp + 0x8c]
push edx
lea ecx, [esp + 0x4c]
mov byte [esp + 0xb8], 1
call fcn.10089460
push 0x100bb2cc
lea eax, [esp + 0x40]
push eax
call fcn.10081af4
int3
Function at 0x10090470
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x1009b26b
mov eax, dword fs:[0]
push eax
sub esp, 0xc4
mov eax, dword [0x100cba70]
xor eax, esp
mov dword [esp + 0xc0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100cba70]
xor eax, esp
push eax
lea eax, [esp + 0xd8]
mov dword fs:[0], eax
mov edi, dword [esp + 0xe8]
mov eax, dword [esp + 0xec]
mov ebx, ecx
xor ecx, ecx
cmp dword [edi + 0x18], 0x10
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
lea ebp, [edi + 4]
jb 0x100904d7
mov eax, dword [ebp]
jmp 0x100904d9
mov eax, ebp
lea edx, [esp + 0x14]
push edx
push ecx
lea edx, [esp + 0x20]
push edx
push ecx
push eax
mov eax, dword [ebx + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
cmp esi, 2
jne 0x10090523
xor al, al
mov ecx, dword [esp + 0xd8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc0]
xor ecx, esp
call fcn.10079ea5
add esp, 0xd0
ret 8
test esi, esi
jne 0x10090637
mov eax, dword [esp + 0x18]
cmp eax, 1
je 0x1009053d
cmp eax, 2
jne 0x10090637
mov ecx, dword [esp + 0x14]
push ecx
call fcn.1007f852
add esp, 4
cmp dword [edi + 0x18], 0x10
mov esi, eax
jb 0x10090557
mov eax, dword [ebp]
jmp 0x10090559
mov eax, ebp
lea edx, [esp + 0x14]
push edx
push esi
push 0
push 0
push eax
mov ecx, ebx
call fcn.100901c0
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebp, eax
test ebp, ebp
push esi
je 0x100905ef
call fcn.10080547
add esp, 4
push str.RegistryKey::getValue__
lea ecx, [esp + 0x84]
call fcn.10002aa0
push 0xffffffffffffffff
push 0
push edi
lea ecx, [esp + 0x8c]
mov dword [esp + 0xec], 2
call fcn.1000a130
push str..RegistryKey.cpp
lea ecx, [esp + 0x24]
call fcn.10002aa0
push 0xf8
lea eax, [esp + 0x24]
push eax
push ebp
lea ecx, [esp + 0x8c]
push ecx
lea ecx, [esp + 0x4c]
mov byte [esp + 0xf0], 3
call fcn.10089460
push 0x100bb2cc
lea edx, [esp + 0x40]
push edx
call fcn.10081af4
lea ecx, [esp + 0xbc]
call fcn.10002aa0
mov ecx, dword [esp + 0x1c]
push 0xffffffffffffffff
push 0
lea eax, [esp + 0xc0]
push eax
mov dword [esp + 0xec], 4
call fcn.100023e0
push esi
call fcn.10080547
add esp, 4
lea ecx, [esp + 0xb8]
call fcn.10002a70
mov al, 1
jmp 0x100904f9
push 0x1e
mov ebx, 0xf
push str.RegistryKey::getValue_string_
lea ecx, [esp + 0xa4]
mov dword [esp + 0xbc], ebx
mov dword [esp + 0xb8], 0
mov byte [esp + 0xa8], 0
call fcn.10002b10
push 0xffffffffffffffff
xor ebp, ebp
push ebp
push edi
lea ecx, [esp + 0xa8]
mov dword [esp + 0xec], ebp
call fcn.1000a130
cmp dword [esp + 0x18], 1
je 0x1009069c
push 0x17
push str._:_incorrect_value_type
lea ecx, [esp + 0xa4]
call fcn.1000dfc0
push 0x11
push str..RegistryKey.cpp
lea ecx, [esp + 0x88]
mov dword [esp + 0xa0], ebx
mov dword [esp + 0x9c], ebp
mov byte [esp + 0x8c], 0
call fcn.10002b10
push 0xe7
lea ecx, [esp + 0x84]
push ecx
push esi
lea edx, [esp + 0xa8]
push edx
lea ecx, [esp + 0x4c]
mov byte [esp + 0xf0], 1
call fcn.10089460
push 0x100bb2cc
lea eax, [esp + 0x40]
push eax
call fcn.10081af4
int3
Function at 0x10090700
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x1009b2b3
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x100cba70]
xor eax, esp
mov dword [esp + 0x7c], eax
push ebx
push esi
push edi
mov eax, dword [0x100cba70]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
mov edi, dword [esp + 0xa0]
cmp dword [edi + 0x18], 0x10
jb 0x10090749
mov eax, dword [edi + 4]
jmp 0x1009074c
lea eax, [edi + 4]
push 4
lea edx, [esp + 0xa8]
push edx
push 4
xor ebx, ebx
push ebx
push eax
call fcn.100901c0
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
cmp esi, ebx
je 0x100907fc
push 0x2c
push str.RegistryKey::setValue_ulong_:_Unable_to_set
lea ecx, [esp + 0x78]
mov dword [esp + 0x90], 0xf
mov dword [esp + 0x8c], ebx
mov byte [esp + 0x7c], bl
call fcn.10002b10
push 0xffffffffffffffff
push ebx
push edi
lea ecx, [esp + 0x7c]
mov dword [esp + 0xa4], ebx
call fcn.1000a130
push 0x11
push str..RegistryKey.cpp
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
call fcn.10002b10
push 0x111
lea eax, [esp + 0x14]
push eax
push esi
lea ecx, [esp + 0x7c]
push ecx
lea ecx, [esp + 0x3c]
mov byte [esp + 0xa8], 1
call fcn.10089460
push 0x100bb2cc
lea edx, [esp + 0x30]
push edx
call fcn.10081af4
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x7c]
xor ecx, esp
call fcn.10079ea5
add esp, 0x8c
ret 8

Function at 0x10090830
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x1009b2b3
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x100cba70]
xor eax, esp
mov dword [esp + 0x7c], eax
push ebx
push esi
push edi
mov eax, dword [0x100cba70]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
mov eax, dword [esp + 0xa4]
mov edi, dword [esp + 0xa0]
mov ebx, 0x10
cmp dword [eax + 0x18], ebx
jb 0x10090884
mov esi, dword [eax + 4]
jmp 0x10090887
lea esi, [eax + 4]
cmp dword [edi + 0x18], ebx
mov eax, dword [eax + 0x14]
lea edx, [eax + 1]
jb 0x10090897
mov eax, dword [edi + 4]
jmp 0x1009089a
lea eax, [edi + 4]
push edx
push esi
push 1
xor ebx, ebx
push ebx
push eax
call fcn.100901c0
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
cmp esi, ebx
je 0x10090942
push 0x2d
push str.RegistryKey::setValue_string_:_Unable_to_set
lea ecx, [esp + 0x78]
mov dword [esp + 0x90], 0xf
mov dword [esp + 0x8c], ebx
mov byte [esp + 0x7c], bl
call fcn.10002b10
push 0xffffffffffffffff
push ebx
push edi
lea ecx, [esp + 0x7c]
mov dword [esp + 0xa4], ebx
call fcn.1000a130
push 0x11
push str..RegistryKey.cpp
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
call fcn.10002b10
push 0x127
lea eax, [esp + 0x14]
push eax
push esi
lea ecx, [esp + 0x7c]
push ecx
lea ecx, [esp + 0x3c]
mov byte [esp + 0xa8], 1
call fcn.10089460
push 0x100bb2cc
lea edx, [esp + 0x30]
push edx
call fcn.10081af4
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x7c]
xor ecx, esp
call fcn.10079ea5
add esp, 0x8c
ret 8
Function at 0x10090970
Capabilities:
Query or enumerate registry key

Disassembly:
push 0xffffffffffffffff
push 0x1009b31c
mov eax, dword fs:[0]
push eax
sub esp, 0x20c
mov eax, dword [0x100cba70]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100cba70]
xor eax, esp
push eax
lea eax, [esp + 0x220]
mov dword fs:[0], eax
mov edi, dword [esp + 0x230]
mov ebp, dword [esp + 0x234]
lea eax, [esp + 0x14]
push eax
push 0x1f
xor ebx, ebx
push ebx
push edi
push ebp
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
cmp esi, 2
je 0x10090b6a
cmp esi, ebx
je 0x10090a58
push 0x11
mov edi, 0xf
push str..RegistryKey.cpp
lea ecx, [esp + 0x48]
mov dword [esp + 0x60], edi
mov dword [esp + 0x5c], ebx
mov byte [esp + 0x4c], bl
call fcn.10002b10
push 0x2c
push str.RegistryKey::recurseDeleteKey___RegOpenKey__
lea ecx, [esp + 0x2c]
mov dword [esp + 0x230], ebx
mov dword [esp + 0x44], edi
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
call fcn.10002b10
push 0x140
lea ecx, [esp + 0x44]
push ecx
push esi
lea edx, [esp + 0x30]
push edx
lea ecx, [esp + 0xa4]
mov byte [esp + 0x238], 1
call fcn.10089460
push 0x100bb2cc
lea eax, [esp + 0x98]
push eax
call fcn.10081af4
push 0xff
lea ecx, [esp + 0x121]
push ebx
push ecx
mov byte [esp + 0x128], bl
call fcn.1007a340
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
add esp, 0xc
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x18]
push ebx
push ebx
push ebx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x130]
push ecx
push ebx
push edx
mov dword [esp + 0x38], 0x100
call esi
test eax, eax
jne 0x10090ae2
mov eax, dword [esp + 0x14]
push eax
lea ecx, [esp + 0x120]
push ecx
call fcn.10090970
add esp, 8
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x18]
push ebx
push ebx
push ebx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x130]
push ecx
push ebx
push edx
mov dword [esp + 0x38], 0x100
call esi
test eax, eax
je 0x10090aa4
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SOFTWARE
push edi
call fcn.100817aa
add esp, 8
test eax, eax
je 0x10090b6a
push edi
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
cmp esi, ebx
je 0x10090b6a
push str..RegistryKey.cpp
lea ecx, [esp + 0x7c]
call fcn.10002aa0
push str.RegistryKey::recurseDeleteKey___RegDeleteKey__
lea ecx, [esp + 0x60]
mov dword [esp + 0x22c], 2
call fcn.10002aa0
push 0x158
lea ecx, [esp + 0x7c]
push ecx
push esi
lea edx, [esp + 0x68]
push edx
lea ecx, [esp + 0xe8]
mov byte [esp + 0x238], 3
call fcn.10089460
push 0x100bb2cc
lea eax, [esp + 0xdc]
push eax
call fcn.10081af4
mov ecx, dword [esp + 0x220]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.10079ea5
add esp, 0x218
ret
Function at 0x401010
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x436004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 2
mov ebx, ecx
mov dword [ebp - 0x230], 0x22c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x401090
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
lea eax, [ebp - 0x230]
push eax
push esi
call edi
cmp eax, 1
jne 0x401090
nop word [eax + eax]
mov edx, ebx
lea ecx, [ebp - 0x20c]
call fcn.00408dc0
test eax, eax
jne 0x4010aa
lea eax, [ebp - 0x230]
push eax
push esi
call edi
cmp eax, 1
je 0x401070
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b3b6
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b3b6
mov esp, ebp
pop ebp
ret

Function at 0x4010d0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
push esi
push edi
mov edi, ecx
mov esi, dword [eax + 0xc]
mov esi, dword [esi + 0xc]
cmp dword [esi + 0x18], 0
je 0x4010fb
mov ecx, dword [esi + 0x30]
mov edx, edi
call fcn.00408dc0
test eax, eax
jne 0x401100
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x4010e6
pop edi
xor eax, eax
pop esi
ret
pop edi
mov eax, 1
pop esi
ret
Function at 0x401110
Capabilities:
Access peb ldr_data

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ecx, 0x1e
call fcn.00401010
cmp al, 1
je 0x401132
mov ecx, 0x23
call fcn.00401010
cmp al, 1
jne 0x401139
or dword [0x43b810], 2
mov ecx, 0x21
call fcn.00401010
cmp al, 1
je 0x40118d
mov ecx, 0x22
call fcn.00401010
cmp al, 1
je 0x40118d
mov ecx, 0x20
call fcn.00401010
cmp al, 1
je 0x40118d
mov ecx, 0x1f
call fcn.00401010
cmp al, 1
je 0x40118d
mov ecx, 0x24
call fcn.00401010
cmp al, 1
je 0x40118d
mov ecx, 0x25
call fcn.00401010
cmp al, 1
jne 0x401194
or dword [0x43b810], 4
mov eax, dword fs:[0x30]
push esi
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0xc]
cmp dword [esi + 0x18], 0
je 0x4011cc
nop word [eax + eax]
mov ecx, dword [esi + 0x30]
mov edx, 0x26
call fcn.00408dc0
test eax, eax
jne 0x4012a4
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x4011b0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0xc]
cmp dword [esi + 0x18], 0
je 0x4011fc
nop
mov ecx, dword [esi + 0x30]
mov edx, 0x27
call fcn.00408dc0
test eax, eax
jne 0x4012a4
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x4011e0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0xc]
cmp dword [esi + 0x18], 0
je 0x40122c
nop
mov ecx, dword [esi + 0x30]
mov edx, 0x28
call fcn.00408dc0
test eax, eax
jne 0x4012a4
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x401210
mov ecx, 0x29
call fcn.004010d0
cmp eax, 1
je 0x4012a4
mov ecx, 0x2a
call fcn.004010d0
cmp eax, 1
je 0x4012a4
mov ecx, 0x2b
call fcn.004010d0
cmp eax, 1
je 0x4012a4
mov ecx, 0x2c
call fcn.004010d0
cmp eax, 1
je 0x4012a4
mov ecx, 0x2d
call fcn.004010d0
cmp eax, 1
je 0x4012a4
mov ecx, 0x2e
call fcn.004010d0
cmp eax, 1
je 0x4012a4
mov ecx, 0x2f
call fcn.004010d0
cmp eax, 1
je 0x4012a4
mov ecx, 0x30
call fcn.004010d0
cmp eax, 1
jne 0x4012ab
or dword [0x43b810], 8
pop esi
ret
Function at 0x408d40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
mov eax, ecx
shl ebx, 4
push esi
push edi
xor esi, esi
mov dword [ebp + 8], ebx
mov ecx, dword [ebx + 0x436788]
mov edi, edx
mov dl, byte [ebx + 0x436784]
mov dword [ebp - 8], ecx
test ecx, ecx
je 0x408d99
sub eax, edi
lea ecx, [esi + 0x1e]
mov ebx, eax
movzx eax, dl
xor edx, edx
add eax, esi
div ecx
lea ecx, [esi + edi]
inc esi
mov al, byte [ebx + ecx]
mov dl, byte [edx + str.Y8OtcWo_rFb_ag9KIjm__W1WLR8qS8]
xor al, dl
mov byte [ecx], al
mov ecx, 0x1e
cmp esi, dword [ebp - 8]
jb 0x408d72
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x43678c], 1
jne 0x408daf
mov word [esi + edi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [esi + edi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409254
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x19c
push ebx
push esi
xor ebx, ebx
lea eax, [esp + 0x94]
push edi
mov dword [esp + 0xc], ebx
mov ecx, 0x109
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x409275
push 0x14
pop ecx
lea eax, [esp + 0x10]
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x409284
push 8
pop ecx
lea eax, [esp + 0x24]
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x409293
push 0x28
pop ecx
lea eax, [esp + 0x3c]
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x4092a2
cmp dword [ebp + 8], 0xdaadbeef
jne 0x40933b
mov esi, str.m_darkmutex11
lea edi, [esp + 0x2c]
lea eax, [esp + 0x2c]
push eax
push 1
movsd dword es:[edi], dword [esi]
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40936c
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], ebx
call fcn.00408fcf
test eax, eax
je 0x409351
lea edx, [esp + 0xc]
lea ecx, [esp + 0x3c]
call fcn.0040900c
test eax, eax
je 0x409351
mov eax, dword [0x43bbb4]
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [0x43bbb0]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], eax
mov byte [esp + 0x10], 2
call fcn.00409c3f
push dword [esp + 0x14]
push ebx
call fcn.0040a9fe
push eax
call dword [esp + 0x34]
jmp 0x409351
lea ecx, [esp + 0x64]
call fcn.0040a6bc
test eax, eax
je 0x409351
lea edx, [esp + 0x64]
call fcn.0040a8c1
mov ecx, 0xa6c05a5
call fcn.0040aaff
mov edx, 0x33fd29e7
mov ecx, eax
call fcn.0040abce
push ebx
push 0xffffffffffffffff
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409a2e
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88c
push ebx
push esi
push edi
lea eax, [ebp - 0x14]
mov esi, edx
push eax
push 0xffffffffffffffff
mov dword [ebp - 4], esi
call dword [ecx + 0x84]
cmp dword [ebp - 0x14], 0
je 0x409bed
mov ecx, esi
call fcn.0040b129
mov dword [ebp - 0x24], eax
test eax, eax
je 0x409bed
mov edx, esi
mov ecx, eax
call fcn.0040b283
test eax, eax
je 0x409bed
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
push 0x33
call fcn.00409a87
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40aa08
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x28]
ret

Function at 0x40aa18
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x18]
ret
Function at 0x40aaff
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x30]
sub esp, 0x20c
mov edx, 0x20a
push ebx
push esi
push edi
mov edi, dword [eax + 0xc]
mov ebx, ecx
add edi, 0xc
lea eax, [ebp - 0x20c]
mov esi, dword [edi]
mov byte [eax], 0
inc eax
sub edx, 1
jne 0x40ab26
jmp 0x40ab55
mov edx, dword [esi + 0x30]
lea ecx, [ebp - 0x20c]
call fcn.0040aa91
call fcn.0040aa70
lea ecx, [ebp - 0x20c]
call fcn.0040aa46
cmp eax, ebx
je 0x40ab62
mov esi, dword [esi]
cmp esi, edi
jne 0x40ab31
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x18]
jmp 0x40ab5b

Function at 0x40ab67
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x30]
sub esp, 0x20c
mov ecx, 0x20a
push esi
push edi
mov edi, dword [eax + 0xc]
lea eax, [ebp - 0x20c]
add edi, 0xc
mov esi, dword [edi]
mov byte [eax], 0
inc eax
sub ecx, 1
jne 0x40ab8b
jmp 0x40abbd
mov edx, dword [esi + 0x30]
lea ecx, [ebp - 0x20c]
call fcn.0040aa91
call fcn.0040aa70
lea ecx, [ebp - 0x20c]
call fcn.0040aa46
cmp eax, 0xa6c05a5
je 0x40abc9
mov esi, dword [esi]
cmp esi, edi
jne 0x40ab96
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x28]
jmp 0x40abc3

Function at 0x40abce
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov dword [ebp - 8], edx
push edi
test esi, esi
je 0x40ac41
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x40ac41
mov eax, dword [esi + 0x3c]
cmp dword [eax + esi], 0x4550
jne 0x40ac41
mov eax, dword [eax + esi + 0x78]
add eax, esi
je 0x40ac41
mov ebx, dword [eax + 0x20]
mov ecx, dword [eax + 0x1c]
add ebx, esi
mov edi, dword [eax + 0x24]
add ecx, esi
mov eax, dword [eax + 0x18]
add edi, esi
and dword [ebp - 4], 0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
test eax, eax
je 0x40ac41
mov ecx, dword [ebx]
add ecx, esi
call fcn.0040aa28
cmp eax, dword [ebp - 8]
je 0x40ac4a
mov eax, dword [ebp - 4]
add ebx, 4
add edi, 2
inc eax
mov dword [ebp - 4], eax
movzx eax, ax
cmp eax, dword [ebp - 0xc]
jb 0x40ac1e
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, word [edi]
test ax, ax
je 0x40ac41
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + eax*4]
add eax, esi
jmp 0x40ac43