joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e04f
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x41e231
lea eax, [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x50], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x50]
movzx eax, byte [eax]
test eax, eax
je 0x41e1be
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
movzx eax, byte [eax]
test eax, eax
je 0x41e197
mov dword [ebp - 0x24], 8
mov dword [ebp - 0x60], 0x401d1b98
mov dword [ebp - 0x2c], 0xeea53061
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x4c], 0xfffffff6
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x58], 8
mov dword [ebp - 0x5c], 0x42afa017
mov dword [ebp - 0x80], 1
mov dword [ebp - 0x34], 2
mov dword [ebp - 0x7c], 0x99e885dc
mov dword [ebp - 0x1c], 0xb3cf8132
mov dword [ebp - 0x74], 0x273d5943
push 2
lea ecx, [ebp - 0x6c]
call fcn.00431d6e
mov dword [ebp - 0xc], 0xfffffffc
push 0
push 1
lea eax, [ebp - 0x6c]
push eax
push 0
lea eax, [ebp - 0x78]
push eax
call fcn.00419ac7
add esp, 0x14
lea eax, [ebp - 0x1c]
push eax
push 0x6eb8
push 1
lea eax, [ebp - 0x4c]
push eax
push 0x55e8
lea eax, [ebp - 0x24]
push eax
push 0x4208
push 1
lea eax, [ebp - 0x6c]
push eax
push 0x4b11
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x60]
push eax
push 1
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x58]
push eax
push 0x6d1
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00414d8e
add esp, 0x4c
mov byte [ebp - 2], 0
lea eax, [ebp - 2]
push eax
push 1
push 0
call fcn.00426a2c
add esp, 0xc
lea ecx, [ebp - 0x6c]
call fcn.00431e40
jmp 0x41e1bc
mov byte [ebp - 1], 0
push 1
lea eax, [ebp - 1]
push eax
push 0x789c
push 0x563a
push 0x60e8
push 0
push 0
call fcn.00410b6e
add esp, 0x1c
jmp 0x41e22f
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x41e1e4
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x41e22f
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x41e212
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jge 0x41e22f
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x48]
call fcn.00431e5c
mov dword [eax], 0x43b2b74c
jmp 0x41e207
jmp 0x41e245
push 0x490
push 1
push 0x2920
call fcn.0041dc9c
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x420a11
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x420b21
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x420ad4
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x420a8e
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x420a8c
push 0x28
push 0
call fcn.0042b3ff
pop ecx
pop ecx
jmp 0x420ad2
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x420ab0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0xffffffef
jge 0x420ad2
push 1
push 0x565c
push 0
push 1
push 0x625b
call fcn.00426d3a
add esp, 0x14
jmp 0x420aa5
jmp 0x420b1f
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x420b06
push 0
push 0x24b1
push 0xf2c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
jmp 0x420b1f
push 0
push 0
push 0
push 0
push 0
push 0
push 0x482
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x420b8c
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x420b5b
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
push dword [ebp - 0x40]
push 0x1c72
push 1
push 0x46b6
push 0x3561
call fcn.00418755
add esp, 0x14
jmp 0x420b8c
push 1
push 0x3648
push 0x285f
push 0x2bc4
push 0x19dc
push 0x2353
push 0x6ac1
push 0
push 0x3a39
push 1
call fcn.0041220d
add esp, 0x28
mov esp, ebp
pop ebp
ret
Function at 0x4232f7
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x42334c
mov eax, dword [ebp + 0x28]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
push dword [ebp - 8]
push 1
push dword [ebp - 0xc]
push 0x4240
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
push eax
push 0x4f32
call fcn.004233a3
add esp, 0x20
jmp 0x42339f
lea eax, [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x42337c
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
push 1
push dword [ebp - 0x20]
call fcn.0041f120
pop ecx
pop ecx
jmp 0x42339f
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x423399
push 0x10ec
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
jmp 0x42339f
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esp, ebp
pop ebp
ret
Function at 0x426032
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x426136
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x4260e9
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x42609c
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
jmp 0x4260e7
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x4260ca
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x4260e7
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x2c]
call fcn.00431e5c
mov dword [eax], 0xd816f93b
jmp 0x4260bf
jmp 0x426134
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
push dword [ebp - 0x3c]
push 1
push 0x1cc5
push 0
push 0x438
push 0
push 1
push 0x166d
push 0x16f4
push dword [ebp - 0x40]
push 1
push dword [ebp - 0x44]
push 0x1e2d
push 0x49c
call fcn.0042d4cc
add esp, 0x38
jmp 0x42615f
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], eax
push 0x3a38
push 1
push 0
push 0x51f3
push 0x55c8
push dword [ebp - 0x48]
push 0x1ec2
call fcn.00425bc9
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x426d62
Capabilities:
Get file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x426e35
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x426dfc
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x426dd1
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x426dcf
push 0x2173
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x426dfa
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ecx]
mov eax, dword [eax + 0x24]
mov dword [ecx], eax
jmp 0x426e33
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x426e22
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x426e20
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x426e33
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
jmp 0x426e56
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x3c]
push 1
push dword [ebp - 0x40]
push 0x29c8
call fcn.00417945
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x42840a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x4284fd
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x4284ca
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x4284af
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
add eax, 7
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x4284c8
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x4284c8
push 0xcc0
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x4284fb
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
push 0x53c
push 0
push 1
push dword [ebp - 0x4c]
push 0x764
push 1
push 0
push dword [ebp - 0x50]
push 0x669e
call fcn.0041d0ec
add esp, 0x24
jmp 0x428554
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x5c], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x54]
movzx eax, byte [eax]
test eax, eax
je 0x428529
push 0x29f1
push 1
call fcn.0040b925
pop ecx
pop ecx
jmp 0x428554
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x60], eax
push dword [ebp - 0x60]
push 0
push dword [ebp - 0x64]
push 0x6a98
push 0x11fa
push 0x4e95
call fcn.00431a9a
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x428c6a
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x428c98
push 0x4481
push 1
push 0x55f2
push 0xcf2
push 1
call fcn.00428e08
add esp, 0x14
jmp 0x428e04
lea eax, [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x428de2
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x428cfd
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x428cf8
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x428de0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x428d1f
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0xfffffff4
jge 0x428de0
mov dword [ebp - 0x30], 0xbf495e3b
push 1
lea ecx, [ebp - 0x40]
call fcn.00431d6e
push 0x26a5
push 0
push 0x578
push 0x5ca7
push 0x3e8c
push 0x402d
push 0x3db0
push 0x75ab
push 0x2199
push 0x3898
push 0x494
push 1
lea eax, [ebp - 0x40]
push eax
push 0x629d
push 1
push 0
push 0x759f
lea eax, [ebp - 0x34]
push eax
call fcn.0041dcf4
add esp, 0x48
lea eax, [ebp - 0x30]
push eax
push 1
lea eax, [ebp - 0x40]
push eax
push 0x1836
push 0x5952
push 1
push 0x2bb2
push 1
push 0xae0
push 0
push 0x3e09
push dword [ebp - 4]
push 0x88c
push 0xf56
push 0x5227
call fcn.0040e05c
add esp, 0x3c
lea ecx, [ebp - 0x40]
call fcn.00431e40
jmp 0x428d14
jmp 0x428e04
push 0xe13
push 0x7cf5
push 1
push 0x685
push 0x4b23
push 0
push 1
call fcn.0040dd12
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x42cd79
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
movzx eax, byte [ebp + 0x2c]
test eax, eax
je 0x42cdde
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x3c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x48]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
push dword [ebp - 4]
push 1
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push 0x13f3
call fcn.0042ceb6
add esp, 0x24
jmp 0x42ceb2
mov eax, dword [ebp + 0x40]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x4c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0x44]
mov dword [ebp - 0x40], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x42ce7d
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
push dword [ebp - 0x44]
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
push dword [ebp - 0x54]
push dword [ebp - 0x58]
push 1
push 0x5995
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
call fcn.00411014
add esp, 0x28
jmp 0x42ceb2
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
movzx eax, byte [eax]
test eax, eax
je 0x42ceaa
push 0x1c86
push 0
push 0x204c
push 0x2121
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x42ceb2
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov esp, ebp
pop ebp
ret
Function at 0x42d3d5
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x42d430
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 8], eax
push dword [ebp - 4]
push dword [ebp - 8]
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x10]
push 1
push 1
push 0x3ba4
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.0042d491
add esp, 0x24
jmp 0x42d48d
lea eax, [ebp + 8]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x42d473
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x42d464
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
jmp 0x42d471
push 0
push 0x153b
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x42d48d
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x2c]
push 0
push 0x71ec
push 0
call fcn.004100c2
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x4368b6
Capabilities:
Allocate thread local storage
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x436929
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 4], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x43690b
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x436903
push 0x2173
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
jmp 0x436927
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push 0
call fcn.0043b853
add esp, 0xc
jmp 0x43694c
push 0x7b02
push 0x3efd
push 0x5cb1
push 0x2e85
push 0
push 0x1556
call fcn.004337c9
add esp, 0x18
mov esp, ebp
pop ebp
ret

Function at 0x4375a9
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0x34]
test eax, eax
je 0x437631
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x43760e
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x437604
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x437602
push 0x205d
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x43760c
push 0
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
jmp 0x43762f
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x1c]
push 0x7723
push 0
push dword [ebp - 0x20]
call fcn.004411ef
add esp, 0x10
jmp 0x437696
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x3c]
mov dword [ebp - 0x40], eax
push dword [ebp - 0x24]
push 0x1b0
push dword [ebp - 0x28]
push 0x746
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push 1
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push dword [ebp - 0x44]
call fcn.00436ec7
add esp, 0x30
mov esp, ebp
pop ebp
ret