joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10028be1
Capabilities:
Print debug messages

Disassembly:
push esi
push 8
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
je 0x10028bfe
push 8
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp byte [0x1003cdfb], 0
jne 0x10028c14
cmp byte [0x1003cdfa], 0
je 0x10028d53
push edi
push 0x64
push str.sizeof__t_ASMBlock____d
mov edi, 0x1003e5f8
push edi
call fcn.100242af
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028c3a
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028c53
push edi
call fcn.10005eb0
cmp byte [0x1003cdfb], 0
pop ecx
jne 0x10028c5c
cmp byte [0x1003cdfa], 0
je 0x10028c7c
push 4
push str.sizeof_Uns32____d
push edi
call fcn.100242af
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028c7c
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028c95
push edi
call fcn.10005eb0
cmp byte [0x1003cdfb], 0
pop ecx
jne 0x10028c9e
cmp byte [0x1003cdfa], 0
je 0x10028cbe
push 4
push str.sizeof_HANDLE____d
push edi
call fcn.100242af
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028cbe
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028cd7
push edi
call fcn.10005eb0
cmp byte [0x1003cdfb], 0
pop ecx
jne 0x10028ce0
cmp byte [0x1003cdfa], 0
je 0x10028d00
push 4
push str.sizeof_Handle32____d
push edi
call fcn.100242af
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028d00
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028d19
push edi
call fcn.10005eb0
cmp byte [0x1003cdfb], 0
pop ecx
jne 0x10028d22
cmp byte [0x1003cdfa], 0
je 0x10028d42
push 4
push str.sizeof_void____d
push edi
call fcn.100242af
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028d42
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028d52
push edi
call fcn.10005eb0
pop ecx
pop edi
mov eax, esi
pop esi
ret

Function at 0x10028dec
Capabilities:
Print debug messages

Disassembly:
push 0x1c
mov eax, 0x1002e03a
call fcn.1002b09b
cmp byte [0x1003cdfb], 0
mov ebx, 0x1003e5f8
mov edi, dword [ebp + 8]
jne 0x10028e17
mov al, byte [0x1003cdfa]
test al, al
jne 0x10028e17
lea esi, [edi + 4]
jmp 0x10028e2e
lea esi, [edi + 4]
push esi
push str.ASM_Release__s
push ebx
call fcn.100242af
mov al, byte [0x1003cdfa]
add esp, 0xc
test al, al
je 0x10028e39
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028e49
push ebx
call fcn.10005eb0
pop ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.100242af
push dword [edi + 0x48]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.100028d9
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x10028e7c
mov ecx, dword [ebx]
push 1
mov esi, dword [ecx]
mov ecx, esi
call dword [0x1002f5c0]
mov ecx, ebx
call esi
lea ecx, [ebp - 0x28]
call fcn.100031be
and dword [edi + 0x4c], 0
and dword [edi + 0x44], 0
call fcn.1002b045
ret
Function at 0x10028e92
Capabilities:
Print debug messages

Disassembly:
push 0x24
mov eax, 0x1002e067
call fcn.1002b09b
cmp byte [0x1003cdfb], 0
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
jne 0x10028ebf
cmp byte [0x1003cdfa], 0
je 0x10028f0e
call fcn.100242af
test al, al
mov edx, 0x1002fb8c
mov ecx, str._in_AppContaner
cmove ecx, edx
push ecx
push str.ASM_Retrieve_retrieving_shared_memory_in_Plug_in_s
push 0x1003e5f8
call fcn.100242af
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028efa
push 0x1003e5f8
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028f0e
push 0x1003e5f8
call fcn.10005eb0
pop ecx
and dword [esi], 0
lea eax, [edi + 4]
and dword [ebx], 0
lea ecx, [ebp - 0x28]
push eax
call fcn.100242af
push dword [edi + 0x48]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.100028d9
or dword [ebp - 4], 0xffffffff
mov ebx, eax
pop ecx
pop ecx
lea ecx, [ebp - 0x28]
call fcn.100031be
test ebx, ebx
jne 0x10028f8c
cmp byte [0x1003cdfb], bl
jne 0x10028f58
cmp byte [0x1003cdfa], bl
je 0x10029000
push str.ASM_Retrieve_ERROR__finding_memory_mapped_file_
mov ebx, 0x1003e5f8
push ebx
call fcn.100242af
cmp byte [0x1003cdfa], 0
pop ecx
pop ecx
je 0x10028f7a
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10029000
push ebx
call fcn.10005eb0
pop ecx
jmp 0x10029000
mov eax, dword [ebx]
mov esi, dword [eax + 0x20]
mov ecx, esi
call dword [0x1002f5c0]
mov ecx, ebx
call esi
mov dword [edi + 0x44], eax
test eax, eax
jne 0x10028fbb
cmp byte [0x1003cdfb], al
jne 0x10028fb4
cmp byte [0x1003cdfa], al
je 0x10029000
push str.ASM_Retrieve_ERROR__getting_memory_mapped_file_handle_
jmp 0x10028f5d
mov eax, dword [ebx]
push dword [edi + 0x48]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x1002f5c0]
mov ecx, ebx
call esi
mov dword [edi + 0x4c], eax
test eax, eax
jne 0x10028ff0
cmp byte [0x1003cdfb], al
jne 0x10028fe6
cmp byte [0x1003cdfa], al
je 0x10029000
push str.ASM_Retrieve_ERROR__mapping_for_writing_
jmp 0x10028f5d
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edi + 0x48]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [edi + 0x4c]
mov dword [ecx], eax
call fcn.1002b045
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x40d08b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x40d09a
pop dword [ebp - 0x18]
mov eax, 0x40d09a
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x360de
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0xe6f61887
sub ecx, 0xe6f5dd41
mov edx, eax
mov ebx, 0x80769a49
sub ebx, 0x80355e85
add ebx, dword [ebp - 0x18]
mov edi, 0xbbffe538
add edi, 0x73791be8
mov dword [ebp - 0x14], 0x3e787dda
mov esi, dword [ebx]
xor dword [ebp - 4], 0x97ec7360
add esi, edi
mov dword [ebp - 0x14], 0xd6a45b9e
mov dword [edx], esi
add dword [ebp - 4], 0xddf5f950
add edx, 4
add ebx, 0xd9b90987
add ebx, 0x2646f67d
loop 0x40d0ef
add eax, 0xcc414670
sub eax, 0xcc406685
mov ebx, eax
add eax, 0x3cd7fcb
add eax, 0xfc32803a
mov ecx, 0x4e19af2c
sub ecx, 0x4dd9af2c
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x431004]
jne 0x40100a
repz ret
jmp fcn.0040164f

Function at 0x4071e4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x431004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040401f
and dword [ebp - 0x14], 0
cmp dword [0x435e64], 0
mov dword [ebp - 0x18], eax
jne 0x407297
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40733f
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40733f
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x435e64], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x435e68], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x435e6c], eax
call edi
push eax
call esi
mov dword [0x435e74], eax
test eax, eax
je 0x407297
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x435e70], eax
mov eax, dword [0x435e70]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4072f0
cmp dword [0x435e74], ecx
je 0x4072f0
push eax
call esi
push dword [0x435e74]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4072f0
test ebx, ebx
je 0x4072f0
call edi
test eax, eax
je 0x4072e7
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4072e7
test byte [ebp - 8], 1
jne 0x4072f0
or dword [ebp + 0x10], 0x200000
jmp 0x407323
mov eax, dword [0x435e68]
cmp eax, dword [ebp - 0x18]
je 0x407323
push eax
call esi
test eax, eax
je 0x407323
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x407323
mov eax, dword [0x435e6c]
cmp eax, dword [ebp - 0x18]
je 0x407323
push eax
call esi
test eax, eax
je 0x407323
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x435e64]
call esi
test eax, eax
je 0x40733f
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x407341
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret
Function at 0x42cd30
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x408
mov eax, dword [0x431004]
xor eax, esp
mov dword [esp + 0x404], eax
cmp dword [0x22d8ea4], 0xfc7
jne 0x42cd5f
push 0
lea eax, [esp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [0x436384]
imul eax, eax, 0x343fd
cmp dword [0x22d8ea4], 0x139e
mov dword [0x436384], eax
jne 0x42cd8e
mov ecx, dword [esp]
push 0
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_GetAce]
mov eax, dword [0x436384]
add eax, 0x269ec3
push esi
mov dword [0x436384], eax
movzx esi, word [0x436386]
and esi, 0x7fff
cmp dword [0x22d8ea4], 0x8e7
jne 0x42cdc3
push 0
lea edx, [esp + 0xc]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov ecx, dword [esp + 0x408]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00401000
add esp, 0x408
ret

Function at 0x42ce90
Capabilities:
Create pipe

Disassembly:
sub esp, 0x24
mov eax, dword [0x431004]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x432200]
push ebx
mov ebx, dword [0x22d8910]
push edi
mov edi, dword [0x22d8ea4]
call fcn.0042cde0
cmp dword [0x22d8ea4], 0x2f
jne 0x42cef5
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
call fcn.0042ce10
mov ecx, dword [esp + 0x24]
pop edi
pop ebx
xor ecx, esp
call fcn.00401000
add esp, 0x24
ret
Function at 0x42d1d0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1818
call fcn.00409160
mov eax, dword [0x431004]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
jmp 0x42d1f9
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xbbe2aa2
jge 0x42d29f
cmp dword [0x22d8ea4], 0xa5f
jne 0x42d243
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
push 0
lea ecx, [ebp - 0x818]
push ecx
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
lea edx, [ebp - 0x1018]
push edx
push 0x42fc7c
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
cmp dword [ebp - 4], 0x84526b
jne 0x42d268
mov eax, dword [0x4350f0]
mov dword [0x22d8ea4], eax
mov ecx, dword [0x22d8ea4]
add ecx, 0xa231
mov dword [0x22d8ea4], ecx
cmp dword [0x22d8ea4], 0x141
jne 0x42d29a
push str.durudaxo_payuyafelamelokeyir_tacadasevow_kipazoci_kanorowawacasolicalotija
lea edx, [ebp - 0x1818]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [0x436388], 0xec58acac
mov dword [0x43638c], 0xffffffff
jmp 0x42d1f0
call fcn.0042cf10
jmp dword [0x22d8910]
Function at 0x407350
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x40735f
pop dword [ebp - 0x48]
mov eax, 0x805f916f
sub eax, 0x801f1e10
sub dword [ebp - 0x48], eax
push 0x40
push 0x1000
push 0x3c69a
push 0
mov eax, 0xcac3a93b
sub eax, 0xca815723
add eax, dword [ebp - 0x48]
call dword [eax]
mov ecx, 0xd7feb68c
add ecx, 0x28018c16
mov esi, eax
mov edi, 0x983d46b8
sub edi, 0x97f9f2b8
add edi, dword [ebp - 0x48]
mov edx, 0x3abb6c5b
sub edx, 0xd7f6aacb
xor dword [ebp - 0x34], 0xe7e4bc7b
mov ebx, dword [edi]
sub ebx, edx
xor dword [ebp - 0x1c], 0x4668b927
mov dword [esi], ebx
sub dword [ebp - 0x34], 0xa3813ac1
add esi, 4
add edi, 0x3fad515d
add edi, 0xc052aea7
loop 0x4073be
add eax, 0x191c661b
add eax, 0xe6e49740
mov ebx, eax
add eax, 0x4ee7c21a
add eax, 0xb1183deb
mov ecx, 0xf2711e22
add ecx, 0xdcee1de
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x407875
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42f180]
jne 0x40787f
repz ret
jmp fcn.0040bbd7
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x403e59
pop dword [ebp - 0x14]
mov eax, 0xe255049a
sub eax, 0xe214c641
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xa70a1bb1
add dword [ebp - 0x24], 0xa748299a
mov dword [ebp - 0x20], 0x241780ba
sub dword [ebp - 0x20], 0xf1e43475
mov dword [ebp - 0x1c], 0x3c4a0f3a
sub dword [ebp - 0x1c], 0xeffdcb0c
mov dword [ebp - 0x18], 0x10f4cc82
sub dword [ebp - 0x18], 0x10f4cc82
lea eax, [ebp - 0x24]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x7d0d6b8b
add dword [ebp - 0x24], 0xf764fdcb
mov dword [ebp - 0x20], 0x552f38f8
add dword [ebp - 0x20], 0xec3d287d
mov dword [ebp - 0x1c], 0xa1ac3dc3
sub dword [ebp - 0x1c], 0x3e3cd157
mov dword [ebp - 0x18], 0x38187631
sub dword [ebp - 0x18], 0x38187631
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0xfc63f1e4
sub eax, 0xfc237110
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3acf9
push 0
call eax
mov ecx, 0xa8fcf514
sub ecx, 0xa8fc9cd3
mov edx, eax
mov ebx, 0x7153d9ce
add ebx, 0x8eed3632
add ebx, dword [ebp - 0x14]
mov esi, 0x26c39ca0
sub esi, 0x6441d03f
xor dword [ebp - 0x10], eax
mov edi, dword [ebx]
add edi, esi
add dword [ebp - 0xc], edi
mov dword [edx], edi
add dword [ebp - 0x10], ebx
add edx, 4
add ebx, 0xd8a712d4
sub ebx, 0xd8a712d0
loop 0x403f76
add eax, 0x153d7
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x4013b0
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
mov esi, 0x4565e0
cmp dword [esi], 0
jne 0x4013f6
push 0x644
push 0
call sub.KERNEL32.DLL_WinExec
mov ecx, eax
test ecx, ecx
jne 0x4013d3
xor eax, eax
pop esi
pop ebx
ret
mov eax, dword [0x4565dc]
mov dword [ecx], eax
mov dword [0x4565dc], ecx
xor edx, edx
mov eax, edx
add eax, eax
lea eax, [ecx + eax*8 + 4]
mov ebx, dword [esi]
mov dword [eax], ebx
mov dword [esi], eax
inc edx
cmp edx, 0x64
jne 0x4013e2
mov eax, dword [esi]
mov edx, dword [eax]
mov dword [esi], edx
pop esi
pop ebx
ret

Function at 0x401a3c
Capabilities:
Create process on windows
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
push ebp
push 0x401af2
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x4565c4
call sub.KERNEL32.DLL_LocalAlloc
cmp byte [0x456045], 0
je 0x401a6a
push 0x4565c4
call sub.KERNEL32.DLL_TlsGetValue
mov eax, 0x4565e4
call fcn.00401400
mov eax, 0x4565f4
call fcn.00401400
mov eax, 0x456620
call fcn.00401400
push 0xff8
push 0
call sub.KERNEL32.DLL_WinExec
mov dword [0x45661c], eax
cmp dword [0x45661c], 0
je 0x401ad1
mov eax, 3
mov edx, dword [0x45661c]
xor ecx, ecx
mov dword [edx + eax*4 - 0xc], ecx
inc eax
cmp eax, 0x401
jne 0x401aa7
mov eax, 0x456604
mov dword [eax + 4], eax
mov dword [eax], eax
mov dword [0x456610], eax
mov byte [0x4565bc], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401af9
cmp byte [0x456045], 0
je 0x401af1
push 0x4565c4
call sub.KERNEL32.DLL_TlsSetValue
ret

Function at 0x401b00
Capabilities:
Get thread local storage value
Set thread local storage value
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp byte [0x4565bc], 0
je 0x401bdd
xor edx, edx
push ebp
push 0x401bd6
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [0x456045], 0
je 0x401b32
push 0x4565c4
call sub.KERNEL32.DLL_TlsGetValue
mov byte [0x4565bc], 0
mov eax, dword [0x45661c]
push eax
call sub.KERNEL32.DLL_WriteFile
xor eax, eax
mov dword [0x45661c], eax
mov ebx, dword [0x4565e4]
jmp 0x401b65
push 0x8000
push 0
mov eax, dword [ebx + 8]
push eax
call sub.KERNEL32.DLL_GetModuleHandleA
mov ebx, dword [ebx]
cmp ebx, 0x4565e4
jne 0x401b53
mov eax, 0x4565e4
call fcn.00401400
mov eax, 0x4565f4
call fcn.00401400
mov eax, 0x456620
call fcn.00401400
mov eax, dword [0x4565dc]
test eax, eax
je 0x401bab
mov edx, dword [eax]
mov dword [0x4565dc], edx
push eax
call sub.KERNEL32.DLL_WriteFile
mov eax, dword [0x4565dc]
test eax, eax
jne 0x401b94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401bdd
cmp byte [0x456045], 0
je 0x401bcb
push 0x4565c4
call sub.KERNEL32.DLL_TlsSetValue
push 0x4565c4
call sub.KERNEL32.DLL_Sleep
ret
pop ebx
pop ebp
ret
Function at 0x402128
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, eax
cmp byte [0x4565bc], 0
jne 0x402145
call fcn.00401a3c
test al, al
je 0x40214d
cmp ebx, 0x7ffffff8
jle 0x402157
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4022ab
xor ecx, ecx
push ebp
push 0x4022a4
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x456045], 0
je 0x402178
push 0x4565c4
call sub.KERNEL32.DLL_TlsGetValue
add ebx, 7
and ebx, 0xfffffffc
cmp ebx, 0xc
jge 0x402188
mov ebx, 0xc
cmp ebx, 0x1000
jg 0x402227
mov eax, ebx
test eax, eax
jns 0x40219d
add eax, 3
sar eax, 2
mov edx, dword [0x45661c]
mov edx, dword [edx + eax*4 - 0xc]
test edx, edx
je 0x402227
mov esi, edx
mov eax, esi
add eax, ebx
and dword [eax], 0xfffffffe
mov eax, dword [edx + 4]
cmp edx, eax
jne 0x4021d8
mov eax, ebx
test eax, eax
jns 0x4021c7
add eax, 3
sar eax, 2
mov ecx, dword [0x45661c]
xor edi, edi
mov dword [ecx + eax*4 - 0xc], edi
jmp 0x4021fe
mov ecx, ebx
test ecx, ecx
jns 0x4021e1
add ecx, 3
sar ecx, 2
mov edi, dword [0x45661c]
mov dword [edi + ecx*4 - 0xc], eax
mov ecx, dword [edx]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, esi
mov edx, dword [edx + 8]
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x4565ac]
sub ebx, 4
add dword [0x4565b0], ebx
call fcn.00403fec
jmp 0x4022ab
cmp ebx, dword [0x456614]
jg 0x402279
sub dword [0x456614], ebx
cmp dword [0x456614], 0xc
jge 0x40224b
add ebx, dword [0x456614]
xor eax, eax
mov dword [0x456614], eax
mov eax, dword [0x456618]
add dword [0x456618], ebx
mov edx, ebx
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x4565ac]
sub ebx, 4
add dword [0x4565b0], ebx
call fcn.00403fec
jmp 0x4022ab
mov eax, ebx
call fcn.00402034
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4022ab
cmp byte [0x456045], 0
je 0x4022a3
push 0x4565c4
call sub.KERNEL32.DLL_TlsSetValue
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4022b8
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
mov dword [0x4565c0], eax
cmp byte [0x4565bc], 0
jne 0x4022f0
call fcn.00401a3c
test al, al
jne 0x4022f0
mov dword [0x4565c0], 8
mov dword [ebp - 4], 8
jmp 0x402451
xor ecx, ecx
push ebp
push 0x40244a
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x456045], 0
je 0x402311
push 0x4565c4
call sub.KERNEL32.DLL_TlsGetValue
mov esi, ebx
sub esi, 4
mov ebx, dword [esi]
test bl, 2
jne 0x40232c
mov dword [0x4565c0], 9
jmp 0x402421
dec dword [0x4565ac]
mov eax, ebx
and eax, 0x7ffffffc
sub eax, 4
sub dword [0x4565b0], eax
test bl, 1
je 0x40238c
mov eax, esi
sub eax, 0xc
mov edx, dword [eax + 8]
cmp edx, 0xc
jl 0x40235c
test edx, 0x80000003
je 0x40236b
mov dword [0x4565c0], 0xa
jmp 0x402421
mov eax, esi
sub eax, edx
cmp edx, dword [eax + 8]
je 0x402383
mov dword [0x4565c0], 0xa
jmp 0x402421
add ebx, edx
mov esi, eax
call fcn.00401be0
and ebx, 0x7ffffffc
mov eax, esi
add eax, ebx
mov edi, eax
cmp edi, dword [0x456618]
jne 0x4023cc
sub dword [0x456618], ebx
add dword [0x456614], ebx
cmp dword [0x456614], 0x3c00
jle 0x4023bd
call fcn.00401ed0
xor eax, eax
mov dword [ebp - 4], eax
call fcn.00403fec
jmp 0x402451
mov edx, dword [eax]
test dl, 2
je 0x4023ef
and edx, 0x7ffffffc
cmp edx, 4
jge 0x4023ea
mov dword [0x4565c0], 0xb
jmp 0x402421
or dword [eax], 1
jmp 0x402418
mov eax, edi
cmp dword [eax + 4], 0
je 0x402402
cmp dword [eax], 0
je 0x402402
cmp dword [eax + 8], 0xc
jge 0x40240e
mov dword [0x4565c0], 0xb
jmp 0x402421
mov edx, dword [eax + 8]
add ebx, edx
call fcn.00401be0
mov edx, ebx
mov eax, esi
call fcn.00401e48
mov eax, dword [0x4565c0]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402451
cmp byte [0x456045], 0
je 0x402449
push 0x4565c4
call sub.KERNEL32.DLL_TlsSetValue
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x404be8
Capabilities:
Hide graphical window

Disassembly:
test eax, eax
je 0x404bfc
push eax
push 0
call sub.user32.dll_ShowWindow
test eax, eax
je 0x404be0
ret
Function at 0x405608
Capabilities:
Clear file content
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
push 0x40579c
call sub.KERNEL32.DLL_LoadResource
mov esi, eax
test esi, esi
je 0x405670
push 0x4057ac
push esi
call sub.KERNEL32.DLL_LockResource
mov ebx, eax
test ebx, ebx
je 0x405670
push 0x105
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call ebx
test eax, eax
je 0x405670
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_SetEndOfFile
jmp 0x405792
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x4056b0
mov eax, dword [ebp - 4]
cmp byte [eax + 1], 0x5c
jne 0x405792
mov eax, dword [ebp - 4]
add eax, 2
call fcn.004055f4
mov esi, eax
cmp byte [esi], 0
je 0x405792
lea eax, [esi + 1]
call fcn.004055f4
mov esi, eax
cmp byte [esi], 0
je 0x405792
jmp 0x4056b6
mov esi, dword [ebp - 4]
add esi, 2
mov ebx, esi
sub ebx, dword [ebp - 4]
lea eax, [ebx + 1]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_SetEndOfFile
jmp 0x405775
lea eax, [esi + 1]
call fcn.004055f4
mov edi, eax
mov eax, edi
sub eax, esi
mov edx, eax
add edx, ebx
inc edx
cmp edx, 0x105
jg 0x405792
inc eax
push eax
push esi
lea eax, [ebp - 0x24f]
add eax, ebx
push eax
call sub.KERNEL32.DLL_SetEndOfFile
lea eax, [ebp - 0x14a]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_GlobalHandle
mov esi, eax
cmp esi, 0xffffffff
je 0x405792
push esi
call sub.KERNEL32.DLL_GlobalLock
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_SetErrorMode
lea edx, [ebx + 1]
add eax, edx
inc eax
cmp eax, 0x105
jg 0x405792
mov byte [ebp + ebx - 0x24f], 0x5c
mov eax, 0x105
sub eax, ebx
dec eax
push eax
lea eax, [ebp - 0x11e]
push eax
lea eax, [ebp - 0x24f]
add eax, ebx
inc eax
push eax
call sub.KERNEL32.DLL_SetEndOfFile
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_SetErrorMode
inc eax
add ebx, eax
mov esi, edi
cmp byte [esi], 0
jne 0x4056d4
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_SetEndOfFile
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret