joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101de680
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x101e9c54], 0
mov dword [0x101e9c58], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [0x101e9c64], 0
mov eax, dword [0x101e9c4c]
add eax, 0x3c3
mov dword [0x101e9c4c], eax
mov dword [0x101e9c50], 0x5f1
mov eax, dword [ebp - 0x10]
cmp eax, 0
jne 0x101de6f4
mov dword [0x101e9c4c], 0xb60
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
mov ecx, eax
mov edx, eax
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], eax
jmp 0x101de705
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
mov dword [0x101e9c50], 0x1cfd
add ecx, 1
mov dword [ebp - 0x2c], eax
mov eax, ecx
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x101e9c54], edx
mov dword [0x101e9c4c], 0x18db
mov ecx, dword [ebp - 0x1c]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x30]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x101e9c58], edx
mov dword [0x101e9c50], 0x198a
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x101e9c5c], cl
mov dword [0x101e9c4c], 0x13a5
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov dword [0x101e9c50], 0x1ce8
mov dword [0x101e9c4c], 0x15f
mov cl, byte [0x101e9c5c]
mov edx, dword [0x101e9c58]
mov byte [edi + edx], cl
mov edx, dword [0x101e9c4c]
add edx, 0xffffedd6
mov dword [0x101e9c4c], edx
mov edx, dword [0x101e9c54]
movzx edx, byte [edi + edx]
mov ebx, dword [0x101e9c58]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x101e9c64], ebx
mov dword [0x101e9c4c], 0x2cc
mov cl, byte [edi + ebx]
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x2c]
mov ch, byte [edx + ebx]
mov edx, dword [0x101e9c50]
mov bl, cl
add bl, byte [0x101e9c69]
mov byte [0x101e9c68], bl
mov byte [0x101e9c69], ch
mov byte [0x101e9c6a], cl
xor ch, cl
add edx, 0xffffee6e
mov dword [0x101e9c50], edx
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x2c]
mov byte [edx + esi], ch
mov dword [0x101e9c4c], 0x13c3
add esi, 1
mov edx, dword [ebp - 0x10]
cmp esi, edx
mov dword [ebp - 0x38], esi
je 0x101de860
mov eax, dword [0x101e9c54]
mov dword [ebp - 0x3c], eax
mov eax, dword [0x101e9c58]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x28], edx
jmp 0x101de705
jmp 0x101de6e2
Function at 0x101df050
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x50
mov eax, dword [ebp + 8]
mov dword [0x101e9c50], 0x1626
mov ecx, dword [0x101e9c4c]
add ecx, 0x31
mov dword [0x101e9c4c], ecx
mov dword [ebp - 0x10], eax
call fcn.101dea20
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov dword [0x101e9c4c], 0xd6b
mov esi, dword [eax + esi + 0x78]
mov dword [0x101e9c4c], 0x12
mov edi, edx
add edi, dword [eax + esi + 0x20]
mov ebx, dword [eax + esi + 0x24]
mov dword [0x101e9c50], 0x40a
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], ecx
je 0x101df1da
jmp 0x101df11b
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x101df1da
mov eax, dword [ebp - 0x2c]
add eax, 1
mov cl, byte [ebp - 0x2d]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x2e]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x35], ch
mov al, byte [ebp - 0x35]
test al, 1
mov ecx, dword [ebp - 0x34]
mov dl, byte [ebp - 0x2e]
mov dword [ebp - 0x3c], ecx
mov byte [ebp - 0x3d], dl
jne 0x101df14b
jmp 0x101df17d
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
add eax, ecx
mov dword [ebp - 0x44], eax
xor eax, eax
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x48]
xor edx, edx
mov esi, dword [ebp - 0x24]
mov edi, dword [esi + eax*4]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov ecx, eax
mov edx, dword [ebp - 0x58]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov bl, cl
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x2d], bh
mov byte [ebp - 0x2e], cl
mov byte [ebp - 0x3d], bl
jne 0x101df0e0
mov al, byte [ebp - 0x3d]
test al, 1
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x5c], ecx
jne 0x101df1ad
mov eax, dword [ebp - 0x54]
add eax, 2
mov ecx, dword [ebp - 0x50]
add ecx, 1
mov edx, dword [ebp - 0x18]
cmp ecx, edx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], ecx
jb 0x101df131
jmp 0x101df0d6
mov eax, dword [ebp - 0x5c]
movzx eax, word [eax]
mov dword [0x101e9c50], 0x182a
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
add ecx, dword [ecx + edx + 0x1c]
mov esi, dword [ebp - 0x1c]
add esi, dword [ecx + eax*4]
mov dword [0x101e9c4c], 0x274
mov dword [ebp - 0x28], esi
mov eax, dword [ebp - 0x28]
add esp, 0x50
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101df1f0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov eax, dword [0x101e9c50]
add eax, 0x1c78
mov dword [0x101e9c50], eax
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov dword [0x101e9c50], 0x19
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edx
je 0x101df260
mov eax, dword [ebp - 0x14]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], eax
jl 0x101df233
mov eax, dword [ebp - 0x18]
mov dword [0x101e9c50], 0x56e
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x1c], eax
jne 0x101df342
mov dword [0x101e9c4c], 0x582
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x18], 0x6f
sete dl
mov byte [ebp - 0x1d], dl
mov al, byte [ebp - 0x1d]
test al, 1
jne 0x101df2a9
jmp 0x101df342
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x101df342
mov dword [0x101e9c4c], 0x7df
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x14], 0x64
jne 0x101df342
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
mov dx, word [eax + ecx*2 - 0x12]
mov word [ebp - 0x20], dx
mov ax, word [ebp - 0x20]
cmp ax, 0x64
jne 0x101df342
mov dword [0x101e9c4c], 0x91c
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff8
shl eax, 1
mov ecx, dword [ebp - 0xc]
add ecx, eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
cmp word [eax], 0x6c
jne 0x101df342
mov dword [0x101e9c50], 0x153e
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0xe], 0x6c
jne 0x101df342
mov dword [0x101e9c50], 0x190e
mov eax, 1
mov dword [ebp - 0x28], eax
jmp 0x101df351
xor eax, eax
mov dword [0x101e9c4c], 0x10e3
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
add esp, 0x28
pop ebp
ret
Function at 0x101dfcb0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x98
mov dword [0x101e9c4c], 0x1594
call fcn.10001090
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x2c], ecx
je 0x101dfd0e
jmp 0x101dfe50
mov eax, dword [esp + 0x28]
add eax, 0x3c
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov ecx, dword [eax]
mov edx, dword [esp + 0x28]
cmp dword [edx + ecx], 0x4550
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], ecx
je 0x101dfdda
jmp 0x101dfdc6
lea eax, [esp + 0x40]
mov dword [0x101e9c50], 0x1aa1
mov dword [esp + 0x18], eax
mov dword [0x101e9c4c], 0x17ad
call fcn.101df1f0
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x14], ecx
jne 0x101dfe48
lea eax, [esp + 0x30]
mov dword [esp], eax
call fcn.101df440
lea ecx, [0x101de120]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x44], edx
mov dword [0x101e9c50], 0x1364
mov dword [esp + 0x64], 0x131e00
mov edx, dword [0x101e9c38]
mov dword [esp + 0x50], edx
mov edx, dword [0x101e9c3c]
mov dword [esp + 0x94], edx
mov edx, dword [0x101e9c40]
mov dword [esp + 0x7c], edx
mov edx, dword [0x101e9c44]
mov dword [esp + 0x4c], edx
mov edx, dword [0x101e9c48]
mov dword [esp + 0x48], edx
mov dword [0x101e9c4c], 0x423
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 0xc]
cmp word [eax], 0x5a4d
mov dword [esp + 0x28], eax
je 0x101dfcdd
mov eax, dword [esp + 0x28]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0xc], eax
jmp 0x101dfdb3
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x40]
mov dword [esp + 0x60], eax
mov dword [0x101e9c50], 0x2099
mov eax, dword [eax + ecx + 0x50]
mov dword [esp + 0x54], eax
mov dword [0x101e9c4c], 0xa15
mov eax, dword [esp + 0x38]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.101ded90
mov ecx, dword [0x101e9c4c]
add ecx, 0xbd7
mov dword [0x101e9c4c], ecx
mov ecx, esp
lea edx, [esp + 0x40]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov dword [0x101e9c4c], 0x1824
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov esp, ebp
pop ebp
ret
Function at 0x402710
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1f4
push ebx
push esi
push edi
lea edi, [ebp - 0x134]
mov ecx, 0x4d
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x45e034]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0xae703a
call fcn.0041ea00
mov esi, esp
call dword [sym.imp.USER32.dll_CreatePopupMenu]
cmp esi, esp
call fcn.0041e9d0
mov dword [0x45ef10], eax
push 8
call fcn.0041c020
add esp, 4
cmp dword [0x45ef10], 0
jne 0x402786
mov esi, esp
push 0x10
push 0x44c3bc
push str.Recent_Documents_Menu_Creation_Failed.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp esi, esp
call fcn.0041e9d0
mov dword [ebp - 0xc], 0
jmp 0x402798
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp eax, dword [0x4aadc4]
jge 0x4027cd
push 0
mov eax, dword [ebp - 0xc]
add eax, 0x834
push eax
mov ecx, dword [0x45ef10]
push ecx
imul edx, dword [ebp - 0xc], 0x208
add edx, 0x4adcd0
push edx
call fcn.00411e40
add esp, 0x10
jmp 0x40278f
cmp dword [0x4aadc4], 0x14
jl 0x402843
mov dword [ebp - 0x130], 0x11c
mov esi, esp
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp esi, esp
call fcn.0041e9d0
cmp dword [ebp - 0x12c], 6
jb 0x402822
push 0
mov eax, dword [0x4aadc4]
add eax, 0x835
push eax
mov ecx, dword [0x45ef10]
push ecx
push str.More_Recent_Items..
call fcn.00411e40
add esp, 0x10
jmp 0x402843
push 0
mov eax, dword [0x4aadc4]
add eax, 0x835
push eax
mov ecx, dword [0x45ef10]
push ecx
push str.More_Recent_Documents..
call fcn.00411e40
add esp, 0x10
push edx
mov ecx, ebp
push eax
lea edx, [0x402874]
call fcn.0041e970
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041ea40
add esp, 0x1f4
cmp ebp, esp
call fcn.0041e9d0
mov esp, ebp
pop ebp
ret
Function at 0x403c60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
push ebx
push esi
push edi
lea edi, [ebp - 0x10]
mov ecx, 4
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0xae703a
call fcn.0041ea00
mov esi, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp esi, esp
call fcn.0041e9d0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x403cb5
mov eax, dword [ebp - 8]
and eax, 0x10
je 0x403cb5
mov dword [ebp - 0xd0], 1
jmp 0x403cbf
mov dword [ebp - 0xd0], 0
mov eax, dword [ebp - 0xd0]
pop edi
pop esi
pop ebx
add esp, 0xd0
cmp ebp, esp
call fcn.0041e9d0
mov esp, ebp
pop ebp
ret
Function at 0x4116e0
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7d8
push ebx
push esi
push edi
lea edi, [ebp - 0x598]
mov ecx, 0x166
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x45e034]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0xae703a
call fcn.0041ea00
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x24c], 0x80004005
mov dword [ebp - 0x258], 0
mov dword [ebp - 0x264], 0
mov esi, esp
lea eax, [ebp - 0x228]
push eax
push 0x20019
mov ecx, dword [ebp - 0x264]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp esi, esp
call fcn.0041e9d0
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0
jne 0x41187c
mov dword [ebp - 0x234], 0x104
mov esi, esp
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x210]
push ecx
push 0
mov edx, dword [ebp - 0x258]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x228]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp esi, esp
call fcn.0041e9d0
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0
jne 0x411866
push 0x11c
push 0
lea eax, [ebp - 0x588]
push eax
call fcn.00420f80
add esp, 0xc
mov dword [ebp - 0x588], 0x11c
mov esi, esp
lea eax, [ebp - 0x588]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp esi, esp
call fcn.0041e9d0
cmp dword [ebp - 0x584], 6
jb 0x411850
lea eax, [ebp - 0x210]
push eax
call fcn.00425f60
add esp, 4
add eax, 1
mov dword [ebp - 0x594], eax
mov eax, dword [ebp - 0x594]
push eax
call fcn.004269b0
add esp, 4
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp - 0x594]
push ecx
mov edx, dword [ebp - 0x21c]
push edx
call fcn.00425800
add esp, 0xc
jmp 0x41185c
lea eax, [ebp - 0x210]
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x24c], 0
mov esi, esp
mov eax, dword [ebp - 0x228]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, esp
call fcn.0041e9d0
mov eax, dword [ebp - 0x21c]
push edx
mov ecx, ebp
push eax
lea edx, [0x4118b4]
call fcn.0041e970
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041ea40
add esp, 0x7d8
cmp ebp, esp
call fcn.0041e9d0
mov esp, ebp
pop ebp
ret
Function at 0x41c020
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf0
push ebx
push esi
push edi
lea edi, [ebp - 0x30]
mov ecx, 0xc
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0xae703a
call fcn.0041ea00
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0
mov dword [0x4aadc4], 0
mov esi, esp
push 0
mov eax, dword [ebp + 8]
push eax
push 0x4b0d40
mov ecx, dword [0x45ed14]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp esi, esp
call fcn.0041e9d0
test eax, eax
je 0x41c2ca
push 0x4b0d40
push 0x104
push 0x4b0f48
call fcn.00425800
add esp, 0xc
push 0x44c49c
push 0x104
push 0x4b0d40
call fcn.004254c0
add esp, 0xc
push 0x44c4e0
push 0x104
push 0x4b0f48
call fcn.004254c0
add esp, 0xc
push 0x250
call fcn.0041e6d0
add esp, 4
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x20], eax
mov esi, esp
mov eax, dword [ebp - 0x20]
push eax
push 0x4b0f48
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp esi, esp
call fcn.0041e9d0
mov dword [ebp - 8], eax
cmp dword [ebp - 0x20], 0
je 0x41c2ca
push 0x4b0d40
push 0x104
push 0x4ab228
call fcn.00425800
add esp, 0xc
mov eax, dword [ebp - 0x20]
add eax, 0x2c
push eax
push 0x104
push 0x4ab228
call fcn.004254c0
add esp, 0xc
mov eax, dword [ebp - 0x20]
add eax, 0x2c
push eax
imul ecx, dword [0x4aadc4], 0x208
add ecx, 0x4adcd0
push ecx
call fcn.004010a0
add esp, 8
imul eax, dword [0x4aadc4], 0x208
add eax, 0x4adcd0
mov ecx, dword [0x4aadc4]
mov dword [ecx*4 + 0x4aadc8], eax
mov dword [ebp - 0x14], 0x104
push 0x4ab228
mov eax, dword [ebp - 0x14]
push eax
imul ecx, dword [0x4aadc4], 0x208
add ecx, 0x4ab430
push ecx
call fcn.00425800
add esp, 0xc
imul eax, dword [0x4aadc4], 0x208
add eax, 0x4ab430
mov ecx, dword [0x4aadc4]
mov dword [ecx*4 + 0x4ab1d8], eax
mov eax, dword [0x4aadc4]
add eax, 1
mov dword [0x4aadc4], eax
mov esi, esp
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp esi, esp
call fcn.0041e9d0
test eax, eax
je 0x41c2b7
push 0x4b0d40
push 0x104
push 0x4ab228
call fcn.00425800
add esp, 0xc
mov eax, dword [ebp - 0x20]
add eax, 0x2c
push eax
push 0x104
push 0x4ab228
call fcn.004254c0
add esp, 0xc
mov eax, dword [ebp - 0x20]
add eax, 0x2c
push eax
imul ecx, dword [0x4aadc4], 0x208
add ecx, 0x4adcd0
push ecx
call fcn.004010a0
add esp, 8
imul eax, dword [0x4aadc4], 0x208
add eax, 0x4adcd0
mov ecx, dword [0x4aadc4]
mov dword [ecx*4 + 0x4aadc8], eax
mov dword [ebp - 0x14], 0x104
push 0x4ab228
mov eax, dword [ebp - 0x14]
push eax
imul ecx, dword [0x4aadc4], 0x208
add ecx, 0x4ab430
push ecx
call fcn.00425800
add esp, 0xc
imul eax, dword [0x4aadc4], 0x208
add eax, 0x4ab430
mov ecx, dword [0x4aadc4]
mov dword [ecx*4 + 0x4ab1d8], eax
mov eax, dword [0x4aadc4]
add eax, 1
mov dword [0x4aadc4], eax
cmp dword [0x4aadc4], 0x14
jne 0x41c2b2
jmp 0x41c2b7
jmp 0x41c1ca
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp esi, esp
call fcn.0041e9d0
pop edi
pop esi
pop ebx
add esp, 0xf0
cmp ebp, esp
call fcn.0041e9d0
mov esp, ebp
pop ebp
ret
Function at 0x41cab0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4a8
push ebx
push esi
push edi
lea edi, [ebp - 0x328]
mov ecx, 0xca
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x45e034]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0xae703a
call fcn.0041ea00
push 0x11c
push 0
lea eax, [ebp - 0x324]
push eax
call fcn.00420f80
add esp, 0xc
mov dword [ebp - 0x324], 0x11c
mov esi, esp
lea eax, [ebp - 0x324]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp esi, esp
call fcn.0041e9d0
cmp dword [ebp - 0x320], 6
jb 0x41cb4e
mov dword [ebp - 0x200], 0x1f8
mov esi, esp
push 0
lea eax, [ebp - 0x200]
push eax
mov ecx, dword [ebp - 0x200]
push ecx
push 0x29
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
cmp esi, esp
call fcn.0041e9d0
jmp 0x41cb88
mov dword [ebp - 0x200], 0x1f8
mov eax, dword [ebp - 0x200]
sub eax, 4
mov dword [ebp - 0x200], eax
mov esi, esp
push 0
lea eax, [ebp - 0x200]
push eax
mov ecx, dword [ebp - 0x200]
push ecx
push 0x29
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
cmp esi, esp
call fcn.0041e9d0
mov esi, esp
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
cmp esi, esp
call fcn.0041e9d0
push edx
mov ecx, ebp
push eax
lea edx, [0x41cbcc]
call fcn.0041e970
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041ea40
add esp, 0x4a8
cmp ebp, esp
call fcn.0041e9d0
mov esp, ebp
pop ebp
ret

Function at 0x41cc00
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4a8
push ebx
push esi
push edi
lea edi, [ebp - 0x328]
mov ecx, 0xca
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x45e034]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0xae703a
call fcn.0041ea00
push 0x11c
push 0
lea eax, [ebp - 0x324]
push eax
call fcn.00420f80
add esp, 0xc
mov dword [ebp - 0x324], 0x11c
mov esi, esp
lea eax, [ebp - 0x324]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp esi, esp
call fcn.0041e9d0
cmp dword [ebp - 0x320], 6
jb 0x41cca5
mov dword [ebp - 0x200], 0x1f8
mov esi, esp
push 0
lea eax, [ebp - 0x200]
push eax
mov ecx, dword [ebp - 0x200]
push ecx
push 0x29
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
cmp esi, esp
call fcn.0041e9d0
mov dword [ebp - 0x58], 0x2bc
jmp 0x41cce6
mov dword [ebp - 0x200], 0x1f8
mov eax, dword [ebp - 0x200]
sub eax, 4
mov dword [ebp - 0x200], eax
mov esi, esp
push 0
lea eax, [ebp - 0x200]
push eax
mov ecx, dword [ebp - 0x200]
push ecx
push 0x29
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
cmp esi, esp
call fcn.0041e9d0
mov dword [ebp - 0x58], 0x2bc
mov esi, esp
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
cmp esi, esp
call fcn.0041e9d0
push edx
mov ecx, ebp
push eax
lea edx, [0x41cd28]
call fcn.0041e970
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041ea40
add esp, 0x4a8
cmp ebp, esp
call fcn.0041e9d0
mov esp, ebp
pop ebp
ret
Function at 0x422b00
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.00422720
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x422b32
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x44c35c]
call dword [ebp - 8]
jmp 0x422b3c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret

Function at 0x437d30
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
call fcn.0043a950
mov byte [ebp - 1], al
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x437d6e
cmp dword [ebp + 8], 0
je 0x437d5c
lea eax, [ebp + 8]
push eax
call fcn.00437f90
add esp, 4
movzx ecx, byte [ebp - 1]
test ecx, ecx
je 0x437d6e
mov eax, 4
jmp 0x437e9e
call fcn.0043a780
movzx edx, al
test edx, edx
jne 0x437d9c
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x437d8d
mov dword [ebp - 0xc], 4
jmp 0x437d94
mov dword [ebp - 0xc], 3
mov eax, dword [ebp - 0xc]
jmp 0x437e9e
movzx eax, byte [ebp - 1]
test eax, eax
je 0x437e45
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0
push 0
push 0
lea ecx, [ebp - 0x34]
push ecx
push 0x437f40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
lea ecx, [ebp - 8]
call fcn.00437fb0
lea ecx, [ebp - 8]
call fcn.00437ff0
movzx edx, al
test edx, edx
jne 0x437e07
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 8]
call fcn.00437fd0
mov eax, dword [ebp - 0x10]
jmp 0x437e9e
push 0
push 0xffffffffffffffff
lea ecx, [ebp - 8]
call fcn.00438080
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
test eax, eax
je 0x437e32
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 8]
call fcn.00437fd0
mov eax, dword [ebp - 0x14]
jmp 0x437e9e
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 8]
call fcn.00437fd0
mov eax, dword [ebp - 0x18]
jmp 0x437e9e
call fcn.0043a8a0
movzx ecx, al
test ecx, ecx
jne 0x437e7e
mov edx, dword [ebp + 0x10]
or edx, 0x200000
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp + 0xc]
push ecx
lea edx, [ebp + 8]
push edx
lea eax, [ebp - 0x20]
push eax
call fcn.00437ee0
add esp, 0x10
jmp 0x437e9e
call fcn.0043a7b0
mov dword [ebp - 0x24], eax
lea ecx, [ebp + 0x10]
push ecx
lea edx, [ebp + 0xc]
push edx
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x24]
push ecx
call fcn.00437f10
add esp, 0x10
mov esp, ebp
pop ebp
ret