joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f490
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [0x47cd00]
mov edx, dword [0x478448]
imul eax, eax, 0x26572c40
not edx
push esi
mov esi, ecx
xor edx, eax
xor dword [0x475770], edx
mov dword [esi], 0
inc dword [0x469188]
mov eax, dword [0x469188]
imul ecx, eax, 0xace45b2
movsx eax, word [0x45c1f0]
and ecx, eax
xor dword [0x47c174], ecx
mov dword [esi + 4], 0
mov dword [0x4733d0], 0x3a0f27cd
mov dword [esi + 8], 0x67452301
mov dword [0x470654], 0xfd9cf7d8
mov dword [esi + 0xc], 0xefcdab89
movzx eax, word [0x45e046]
sub eax, 0x61a18ef3
mov word [0x45e046], ax
mov dword [esi + 0x10], 0x98badcfe
inc dword [0x473398]
mov ecx, dword [0x473398]
mov eax, dword [0x470274]
inc dword [0x470274]
cmp eax, ecx
jne 0x40f552
mov ecx, dword [0x46ee20]
movzx eax, word [0x45c42e]
xor ecx, 0x9d371fef
or ecx, 0x1d371bed
add eax, ecx
mov word [0x45c42e], ax
mov dword [esi + 0x14], 0x10325476
movsx eax, word [0x460aea]
and eax, 0x15a3f769
xor dword [0x479a60], eax
pop esi
ret

Function at 0x40f4a3
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [0x47cd00]
mov edx, dword [0x478448]
imul eax, eax, 0x26572c40
not edx
push esi
mov esi, ecx
xor edx, eax
xor dword [0x475770], edx
mov dword [esi], 0
inc dword [0x469188]
mov eax, dword [0x469188]
imul ecx, eax, 0xace45b2
movsx eax, word [0x45c1f0]
and ecx, eax
xor dword [0x47c174], ecx
mov dword [esi + 4], 0
mov dword [0x4733d0], 0x3a0f27cd
mov dword [esi + 8], 0x67452301
mov dword [0x470654], 0xfd9cf7d8
mov dword [esi + 0xc], 0xefcdab89
movzx eax, word [0x45e046]
sub eax, 0x61a18ef3
mov word [0x45e046], ax
mov dword [esi + 0x10], 0x98badcfe
inc dword [0x473398]
mov ecx, dword [0x473398]
mov eax, dword [0x470274]
inc dword [0x470274]
cmp eax, ecx
jne 0x40f552
mov ecx, dword [0x46ee20]
movzx eax, word [0x45c42e]
xor ecx, 0x9d371fef
or ecx, 0x1d371bed
add eax, ecx
mov word [0x45c42e], ax
mov dword [esi + 0x14], 0x10325476
movsx eax, word [0x460aea]
and eax, 0x15a3f769
xor dword [0x479a60], eax
pop esi
ret

Function at 0x40f580
Capabilities:
Terminate process

Disassembly:
imul eax, dword [0x466210], 0x2e60664e
push dword [0x4580a8]
mov dword [0x466210], eax
call fcn.0041c800
mov eax, dword [0x46c368]
add esp, 4
sub eax, 0x4282bc9f
cmp eax, 0x9044004
jle 0x40f5e4
mov ecx, dword [0x46fff8]
mov eax, dword [0x4724fc]
sar ecx, 6
lea eax, [eax*2 + 0x7b93fbd5]
add eax, ecx
cmp eax, 0x6f77fff8
jne 0x40f5f2
mov eax, dword [0x470e9c]
add eax, dword [0x470858]
mov dword [0x470e9c], eax
dec dword [0x470858]
jmp 0x40f5f2
mov eax, dword [0x47e440]
shl eax, 7
add dword [0x471204], eax
push 1
call fcn.0042b8f0
int3
Function at 0x41ac30
Capabilities:
Encode data using xor

Disassembly:
push ecx
dec dword [0x46cf50]
mov ecx, dword [0x46cf50]
movzx eax, word [0x45a75a]
xor ecx, 0x250b52c9
mov edx, dword [esp + 8]
add ecx, eax
mov word [0x45a75a], cx
movsx eax, word [0x4612ec]
xor eax, 0x270d852
and dword [0x475c10], eax
mov eax, dword [esp + 0xc]
add dword [0x47fcd4], 0x1002a01
and dword [0x467a40], 0x73b6ff5e
push esi
lea esi, [edx + eax*4]
movsx eax, word [0x4591f2]
not eax
xor eax, 0x241299e6
cmp eax, 0xb79b5fd9
jge 0x41acb5
mov ecx, dword [0x47abb0]
movzx eax, word [0x45ec68]
or ecx, 0xcc6aa74d
xor eax, ecx
mov word [0x45ec68], ax
mov eax, dword [esp + 0x14]
mov dword [esp + 4], eax
or dword [0x478ddc], 0x9f49f859
cmp edx, esi
je 0x41ad55
nop
imul eax, dword [0x478428], 0xaeaacaae
mov dword [0x478428], eax
mov eax, dword [esp + 4]
xor dword [edx], eax
add edx, 4
add dword [0x47089c], 0xa80004cf
mov eax, dword [0x46f270]
movsx ecx, word [0x45ec74]
ror dword [esp + 4], 6
not ecx
imul eax, eax, 0x9d802b8
and ecx, eax
add dword [0x47a748], ecx
imul eax, dword [0x46bdb8], 0x40d041aa
mov dword [0x46bdb8], eax
mov eax, dword [esp + 4]
shr eax, 8
add al, byte [esp + 4]
mov byte [esp + 5], al
or dword [0x46b27c], 0xa8a4f284
mov al, byte [esp + 5]
add byte [esp + 4], al
mov dword [0x46ff10], 0xcc0d80
cmp edx, esi
jne 0x41acd0
mov eax, dword [esp + 4]
mov dword [0x46811c], 0xd8b8c4ec
pop esi
pop ecx
ret
Function at 0x41c5c0
Capabilities:
Write file on windows

Disassembly:
movsx eax, word [0x461cba]
mov ecx, dword [0x47cf18]
add eax, 0x622af316
dec word [0x461cba]
and ecx, eax
cmp ecx, 0x6fe6de85
jg 0x41c5f7
movsx eax, word [0x4644e0]
xor eax, 0xb5b73bbd
sub dword [0x471650], eax
jmp 0x41c601
and dword [0x46e8f4], 0x363e7c9f
mov ecx, dword [0x47a6a4]
mov eax, dword [0x473500]
not ecx
add eax, ecx
cmp eax, 0xf5f46506
jg 0x41c621
mov dword [0x472c8c], 0xaf3aaab2
cmp dword [0x47ff50], 0
jne 0x41c648
mov dword [0x46fae0], 0x7b382082
call fcn.0040cca0
mov dword [0x47ff50], eax
add dword [0x472c78], 0x649dcd23
movsx eax, word [0x45d65e]
push esi
push edi
shl eax, 2
xor eax, 0x62aceeb5
or dword [0x470404], eax
push 3
push 0x203d
call fcn.00422840
movsx edx, word [0x45b410]
mov edi, eax
movsx ecx, word [0x465132]
shl edx, 0xa
push edi
push dword [esp + 0x18]
or ecx, edx
xor dword [0x4735d0], ecx
call fcn.0042bf11
mov ecx, dword [0x474da4]
add esp, 0x10
not ecx
mov esi, eax
sub ecx, 0x585e0461
cmp ecx, 0xa3e2bec9
je 0x41c6c2
cmp dword [0x47f008], 0xbfeff5f6
jge 0x41c6c2
dec dword [0x46e8b4]
mov eax, dword [0x47f338]
push edi
push 3
call fcn.00429ff0
dec dword [0x46710c]
add esp, 8
mov eax, dword [0x46710c]
xor dword [0x47157c], eax
test esi, esi
jne 0x41c78a
movzx eax, word [0x46416c]
add eax, 0x4f4d6f26
mov word [0x46416c], ax
push 0x3e8
call dword [0x4588b4]
mov eax, dword [0x4717e8]
or eax, dword [0x46ed84]
or eax, 0x7b026297
push 3
mov dword [0x4717e8], eax
push 0x203d
call fcn.00422840
imul ecx, dword [0x47ee24], 0x1481ca43
mov edi, eax
push edi
push dword [esp + 0x18]
mov dword [0x47ee24], ecx
call fcn.0042bf11
imul ecx, dword [0x47593c], 0x438498f6
mov edx, 0xc1694098
add esp, 0x10
mov esi, eax
sub edx, ecx
cmp edx, 0xffbd7fed
jg 0x41c770
movzx eax, word [0x464a5e]
add eax, 0xc1c0a42
mov word [0x464a5e], ax
push edi
push 3
call fcn.00429ff0
add esp, 8
imul eax, dword [0x46ab38], 0x3bebfafd
mov dword [0x46ab38], eax
xor dword [0x46cda0], 0x22065cf5
test esi, esi
je 0x41c7db
add dword [0x46bf94], 0xbd6049cc
push esi
push 1
push 4
push 0x47ff50
call fcn.0042c0c4
mov ecx, dword [0x471488]
mov eax, dword [0x46f6fc]
add eax, 0x378aab95
add eax, ecx
mov dword [0x46f6fc], eax
push esi
call fcn.0042bbe6
add esp, 0x14
mov dword [0x471f70], 0x21aad50c
mov eax, dword [0x46db20]
mov ecx, dword [0x4744cc]
shl eax, 5
imul ecx, eax
mov eax, 0xa5fc1a80
pop edi
pop esi
sub eax, ecx
add dword [0x47e550], eax
ret
Function at 0x42a410
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x46b308]
add eax, 0xf0bd7fdf
or dword [0x467eb0], eax
mov dword [0x47e91c], 0xbf7e9dff
imul eax, dword [0x46b788], 0xdc79254e
push esi
mov esi, dword [esp + 0x10]
mov dword [0x46b788], eax
test esi, esi
jle 0x42a670
imul eax, dword [0x4678b0], 0x23e0544c
push ebx
push ebp
push edi
mov edi, dword [esp + 0x14]
mov ebp, 0x40
mov dword [0x4678b0], eax
imul eax, dword [0x47e394], 0x9d4dd863
mov edx, dword [edi]
and edx, 0x3f
sub ebp, edx
mov dword [esp + 0x1c], edx
mov dword [0x47e394], eax
cmp dword [0x46eab4], 0x9da14383
jl 0x42a494
mov eax, 0x759f
mov word [0x45ee04], ax
jmp 0x42a49e
xor dword [0x4762cc], 0xaf427e3
add dword [edi], esi
movsx eax, word [0x45a266]
imul ecx, eax, 0x36bd4bee
movzx eax, word [0x45d534]
or ecx, 0x6977e45
and eax, ecx
mov ecx, 0x3d99fbed
mov word [0x45d534], ax
dec word [0x45a266]
movsx eax, word [0x46449e]
imul eax, eax, 0x7a17e972
sub ecx, eax
cmp ecx, 0x60fcf56a
jne 0x42a4f5
mov eax, dword [0x470490]
and eax, 0x80310002
sub dword [0x474f40], eax
cmp dword [edi], esi
jae 0x42a4fc
inc dword [edi + 4]
mov eax, 0x5354
mov word [0x45a8fc], ax
test edx, edx
je 0x42a59c
cmp esi, ebp
jl 0x42a59c
imul eax, dword [0x477cc0], 0xa169520b
mov ebx, dword [esp + 0x18]
push ebp
push ebx
mov dword [0x477cc0], eax
lea eax, [edi + 0x28]
add eax, edx
push eax
call fcn.0042c4c0
mov eax, dword [0x46a03c]
not eax
and eax, 0x2886458
or eax, 0x795793a7
mov dword [0x47bf84], eax
lea eax, [edi + 0x28]
push eax
push edi
call fcn.00405090
xor dword [0x46e390], 0x50ab0464
add esp, 0x14
mov dword [0x467844], 0x726e3175
add ebx, ebp
add dword [0x47cd5c], 0xb7a02b4
sub esi, ebp
dec dword [0x469388]
mov eax, dword [0x469388]
imul eax, eax, 0x77167e3f
mov dword [esp + 0x1c], 0
mov dword [0x46dc38], eax
jmp 0x42a5a0
mov ebx, dword [esp + 0x18]
cmp esi, 0x40
jl 0x42a610
mov ebp, esi
shr ebp, 6
mov eax, ebp
neg eax
shl eax, 6
add esi, eax
movzx eax, word [0x4644a4]
and eax, 0x7dec4585
push ebx
mov word [0x4644a4], ax
push edi
call fcn.00405090
or dword [0x46666c], 0xc520cc09
mov ecx, 0xa4f0cf43
mov dword [0x47fbbc], 0x52483260
add esp, 8
mov eax, dword [0x4698c0]
add ebx, 0x40
mov edx, dword [0x46d580]
sub ecx, eax
mov eax, dword [0x469ce8]
xor edx, ecx
imul eax, edx
mov dword [0x469ce8], eax
dec dword [0x46d580]
dec ebp
jne 0x42a5b3
movzx eax, word [0x45cc52]
xor eax, 0x5fd4d806
mov word [0x45cc52], ax
test esi, esi
jle 0x42a653
imul eax, dword [0x47ade4], 0xcf77f9ed
push esi
push ebx
mov dword [0x47ade4], eax
mov eax, dword [esp + 0x24]
add eax, 0x28
add eax, edi
push eax
call fcn.0042c4c0
add esp, 0xc
add dword [0x47fd98], 0x36729bed
movsx eax, word [0x4627c4]
shl eax, 4
sub eax, 0x63539f99
pop edi
or eax, 0x7b9d9529
sub dword [0x46cabc], eax
pop ebp
pop ebx
pop esi
ret
Function at 0x43371a
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x457680]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0042d69c
mov dword [ebp - 0x14], eax
cmp dword [0x480af4], esi
jne 0x43380d
push 0x800
push esi
push 0x44d260
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x43379a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4338ed
push esi
push esi
push 0x44d260
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4338ed
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4338ed
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x480af4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x480af8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x480afc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x480b04], eax
test eax, eax
je 0x43380a
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x480b00], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x433832
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x433825
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x433847
push 4
pop eax
jmp 0x4338ef
cmp dword [ebp - 0x14], esi
je 0x433847
push dword [0x480af4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x43382c
mov eax, dword [0x480b00]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x4338a5
cmp dword [0x480b04], edi
je 0x4338a5
push eax
call ebx
push dword [0x480b04]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4338a5
test eax, eax
je 0x4338a5
call ecx
test eax, eax
je 0x43389a
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x43389a
test byte [ebp - 8], 1
jne 0x4338a5
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4338d5
mov eax, dword [0x480af8]
cmp eax, edi
je 0x4338d2
push eax
call ebx
test eax, eax
je 0x4338d2
call eax
mov esi, eax
test esi, esi
je 0x4338d2
mov eax, dword [0x480afc]
cmp eax, edi
je 0x4338d2
push eax
call ebx
test eax, eax
je 0x4338d2
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x480af4]
call ebx
test eax, eax
je 0x4338ed
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4338ef
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004334df
mov esp, ebp
pop ebp
ret
Function at 0x4504d0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x453190]
cmp byte [eax + 0xc], 0
je 0x45063d
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x450636
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x454c10], 0
jne 0x450524
push 0x450644
call sub.kernel32.dll_GetModuleHandleA_1
mov ebx, eax
push 0x45064c
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x454c10], eax
cmp dword [0x452d9c], 0
jne 0x45061f
push 0x45065c
call sub.kernel32.dll_LoadLibraryA
mov dword [0x452d9c], eax
cmp dword [0x452d9c], 0
je 0x45061f
push 0x450668
mov eax, dword [0x452d9c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x454c14], eax
push 0x450678
mov eax, dword [0x452d9c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x454c18], eax
push 0x45068c
mov eax, dword [0x452d9c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x454c1c], eax
push 0x4506a4
mov eax, dword [0x452d9c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x454c20], eax
push 0x4506bc
mov eax, dword [0x452d9c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x454c24], eax
push 0x4506d0
mov eax, dword [0x452d9c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x454c28], eax
push 0x4506e8
mov eax, dword [0x452d9c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x454c2c], eax
push 0x450700
mov eax, dword [0x452d9c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x454c30], eax
push 0x45071c
mov eax, dword [0x452d9c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x454c34], eax
push 0x450728
mov eax, dword [0x452d9c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x454c38], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45063d
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x433006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x433072
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x56922e8a
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
loop 0x433060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
je 0x4330d2
nop
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x30674bfd
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x4032e0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov eax, ecx
mov dword [ebp - 4], 0
push edi
lea ecx, [ebp - 4]
mov dword [ebp - 0xc], eax
push ecx
push eax
mov edi, edx
mov dword [ebp - 8], 0
xor bl, bl
mov dword [ebp - 0x10], 0
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 4], eax
test eax, eax
jne 0x403320
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push eax
call fcn.0040b8be
add esp, 4
mov esi, eax
push esi
push dword [ebp - 4]
push 0
push dword [ebp - 0xc]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x4033a1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0x4285c0
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x4033a1
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
movzx eax, word [ecx + 0xa]
mov word [edi], ax
movzx eax, word [ecx + 8]
mov word [edi + 2], ax
movzx eax, word [ecx + 0xe]
mov word [edi + 4], ax
movzx eax, word [ecx + 0xc]
mov word [edi + 6], ax
test edx, edx
je 0x40339f
movzx eax, word [ecx + 0x12]
mov word [edx], ax
movzx eax, word [ecx + 0x10]
mov word [edx + 2], ax
movzx eax, word [ecx + 0x16]
mov word [edx + 4], ax
movzx eax, word [ecx + 0x14]
mov word [edx + 6], ax
mov bl, 1
test esi, esi
je 0x4033ae
push esi
call fcn.0040b6fb
add esp, 4
pop esi
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4033c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x42d014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
lea eax, [ebp - 0x20c]
mov esi, ecx
push 0
push eax
call fcn.004078f0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x403479
push 0x4285c4
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0040b68c
lea eax, [ebp - 0x21c]
push eax
lea edx, [ebp - 0x214]
lea ecx, [ebp - 0x20c]
call fcn.004032e0
add esp, 0x10
test al, al
je 0x403479
movzx eax, word [ebp - 0x214]
mov dword [esi + 4], eax
movzx eax, word [ebp - 0x212]
mov dword [esi + 8], eax
movzx eax, word [ebp - 0x210]
mov dword [esi + 0xc], eax
xor eax, eax
mov word [esi + 0x14], ax
mov al, 1
mov dword [esi], 0x114
mov dword [esi + 0x10], 2
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405a68
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.00405a68
mov esp, ebp
pop ebp
ret
Function at 0x4035d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, ecx
mov eax, dword [ebx]
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push edi
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4036be
test edi, edi
je 0x403677
cmp word [edi], 0
je 0x403677
cmp byte [esi + 0x128], 0
lea ebx, [esi + 0x18]
jne 0x403623
mov ebx, dword [esi + 0x14]
mov ecx, dword [ebp + 8]
push eax
call fcn.00403b80
push 0x4286e4
mov esi, eax
push 0x42998c
push esi
call fcn.00403870
lea ecx, [ebx + 4]
push ecx
push 0x42998c
push esi
call fcn.00403870
push 0x4285c0
push 0x42998c
push esi
call fcn.00403870
push edi
push 0x42998c
push esi
call fcn.00403870
add esp, 0x30
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
cmp byte [esi + 0x128], 0
lea edi, [esi + 0x18]
jne 0x403686
mov edi, dword [esi + 0x14]
mov ecx, dword [ebp + 8]
push eax
call fcn.00403b80
push 0x4286e4
mov esi, eax
push 0x42998c
push esi
call fcn.00403870
lea ecx, [edi + 4]
push ecx
push 0x42998c
push esi
call fcn.00403870
add esp, 0x18
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x18]
je 0x403773
test edi, edi
je 0x403738
cmp word [edi], 0
je 0x403738
cmp byte [esi + 0x128], 0
lea ebx, [esi + 0x18]
jne 0x4036e3
mov ebx, dword [esi + 0x14]
mov ecx, dword [ebp + 8]
push 0
call fcn.00403b80
push 0x4286f4
mov esi, eax
push 0x42998c
push esi
call fcn.00403870
lea ecx, [ebx + 4]
push ecx
push 0x42998c
push esi
call fcn.00403870
push 0x4285c0
push 0x42998c
push esi
call fcn.00403870
push edi
push 0x42998c
push esi
call fcn.00403870
add esp, 0x30
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
cmp byte [esi + 0x128], 0
je 0x403746
add esi, 0x18
jmp 0x403749
mov esi, dword [esi + 0x14]
mov ecx, dword [ebp + 8]
push 0x4286f4
call fcn.00403280
lea ecx, [esi + 4]
push ecx
push 0x42998c
push eax
call fcn.00403870
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp + 0x10]
pop edi
mov dword [ebx], eax
mov al, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4051f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x42de60], 0
push ebx
je 0x40538f
push dword [0x42de68]
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call ebx
test eax, eax
je 0x40524d
cmp dword [eax], 0xd
jbe 0x40524d
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x34]
test eax, eax
je 0x40524d
push 0
push 0x42df30
push 0x42df68
push 0
push eax
call fcn.0041887b
add esp, 0x14
test eax, eax
je 0x40524d
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 8]
test eax, eax
jne 0x405443
cmp dword [0x42de60], 0
je 0x40538f
push esi
push edi
push 0x435a88
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x42de60], 0
je 0x4052b7
push dword [0x42de68]
call ebx
test eax, eax
je 0x4052b7
cmp dword [eax], 0xd
jbe 0x4052b7
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x34]
test eax, eax
je 0x4052b7
push 0
push 0x42df30
push 0x42df68
push 0
push eax
call fcn.0041887b
add esp, 0x14
test eax, eax
je 0x4052b7
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 8]
mov esi, eax
test esi, esi
jne 0x40537b
push 0x2014
call fcn.00405d4d
mov esi, eax
push 0x2000
push 0
push esi
mov dword [ebp - 4], esi
mov dword [esi + 0x2004], 0
mov dword [esi + 0x2008], 0
mov dword [esi + 0x200c], 0
mov byte [esi + 0x2000], 0
call fcn.004078f0
add esp, 0x10
mov dword [esi + 0x2010], 0
cmp dword [0x42de60], 0
je 0x40537b
push dword [0x42de68]
call ebx
test eax, eax
je 0x40537b
cmp dword [eax], 0xd
jbe 0x40537b
mov eax, dword [eax + 8]
mov ecx, dword [eax + 0x34]
test ecx, ecx
jne 0x405375
push 8
call fcn.00405d4d
mov edi, eax
add esp, 4
mov dword [ebp - 4], edi
mov dword [edi], vtable.t_visualDataItemPtr_class_t_perfManager_.0
mov dword [edi + 4], esi
cmp dword [0x42de60], 0
je 0x40537b
push dword [0x42de68]
call ebx
test eax, eax
je 0x40537b
cmp dword [eax], 0xd
jbe 0x40537b
mov eax, dword [eax + 8]
push 0x435a88
mov dword [eax + 0x34], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ecx]
push esi
call dword [eax + 0xc]
push 0x435a88
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x435ad0]
test eax, eax
jne 0x405443
push 0x435a88
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x435af8]
cmp eax, dword [ecx + 4]
jle 0x405429
push 0x435af8
call fcn.004060dc
add esp, 4
cmp dword [0x435af8], 0xffffffff
jne 0x405429
push 0x2000
push 0
push 0x435b00
mov dword [0x437b04], 0
mov dword [0x437b08], 0
mov dword [0x437b0c], 0
mov byte [0x437b00], 0
call fcn.004078f0
push 0x418d30
mov dword [0x437b10], 0
call fcn.00405d07
push 0x435af8
call fcn.00406092
add esp, 0x14
push 0x435a88
mov dword [0x435ad0], 0x435b00
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x435ad0]
pop ebx
mov esp, ebp
pop ebp
ret