joyce8/EMBER2024-capa huggingface dataset:
Function at 0x453f9c
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x454147
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x454128
mov dl, 1
mov eax, dword [0x415c4c]
call fcn.00403884
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004046e0
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x454117
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00446f40
test al, al
je 0x45410a
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x454158
lea eax, [ebp - 0x254]
call fcn.004098a8
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x45410a
xor eax, eax
push ebp
push 0x454103
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x454190
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4540ec
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404950
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x4540ec
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404950
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45410a
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x45400d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x25], 0
mov dl, 1
call fcn.0041992c
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45414e
lea eax, [ebp - 0x260]
call fcn.004046e0
ret

Function at 0x454ac0
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x523580]
cmp byte [eax + 0xad], 0
jne 0x454b31
cmp dword [0x523598], 0
jne 0x454af2
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x454a7c
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x523598], eax
cmp dword [0x523594], 0
jne 0x454b0d
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x523594], eax
cmp dword [0x52359c], 0
jne 0x454b31
push esp
push 0
push 0
push 0x454a20
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x52359c], eax
pop edx
ret
Function at 0x454d04
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x454d1b
add esp, 0xfffffff0
call fcn.00403bd8
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041db70
mov eax, dword [0x51f990]
cmp word [eax + 2], 0
jne 0x454d43
mov eax, dword [0x51f990]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004567b4
mov eax, dword [0x51fa4c]
cmp word [eax + 2], 0
jne 0x454d5d
mov eax, dword [0x51fa4c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004569c0
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x415828]
call fcn.00403884
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x415828]
call fcn.00403884
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x415828]
call fcn.00403884
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x4221ec]
call fcn.00429d7c
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x454f14
mov eax, dword [0x51f898]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042a150
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x457080
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x51f898]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040d0d8
test eax, eax
je 0x454e64
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00409260
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040d10c
test eax, eax
je 0x454e78
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404950
mov byte [ebx + 0xd4], 0
push ebx
push 0x456314
call fcn.0041ecec
mov dword [ebx + 0xc8], eax
mov eax, dword [0x51f764]
cmp byte [eax], 0
jne 0x454ec9
mov eax, ebx
call fcn.00455058
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.0045725c
mov eax, ebx
call fcn.00457dbc
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x454f09
call fcn.00403c30
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4552d8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x523580]
cmp dword [eax + 0x30], 0
je 0x455382
cmp dword [ebx + 0x94], 0
jne 0x45537c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x455268
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45537c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x455342
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45537c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00417bd4
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x455351
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45609c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4560d1
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004047d0
jmp 0x4560de
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404734
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x457440
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4574ae
mov eax, esi
call fcn.00441dfc
test al, al
je 0x4574ae
mov eax, dword [ebx + 0x84]
call fcn.00441aa0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4574ae
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x4574a2
push 0
mov eax, dword [ebx + 0x84]
call fcn.00441aa0
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00439fac
jmp 0x4574ae
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.0045727c
pop esi
pop ebx
ret
Function at 0x402c2c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x43b008], 0x8088405
inc edx
mov dword [ebx + 0x43b008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4030b4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x43b024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40314c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40312c
xor eax, eax
push ebp
push 0x403125
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403168
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40312c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x43b024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x43b024], ax
mov esp, ebp
pop ebp
ret
Function at 0x405298
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call fcn.00401228
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4054c8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40531b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4054c8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40531b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4054e4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4053a4
xor eax, eax
push ebp
push 0x40539d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004050e0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405382
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405504
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405382
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4053a4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call fcn.00401260
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call fcn.00401248
push eax
call fcn.00401220
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4054be
cmp byte [ebp - 0xd], 0
jne 0x4053eb
cmp byte [ebp - 0x12], 0
je 0x4054be
lea eax, [ebp - 0x11d]
push eax
call fcn.00401268
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405404
dec ebx
cmp byte [ebx], 0x2e
je 0x405413
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405403
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4054be
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405450
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call fcn.00401260
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call fcn.00401250
mov esi, eax
test esi, esi
jne 0x4054be
cmp byte [ebp - 0xd], 0
je 0x4054be
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call fcn.00401260
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call fcn.00401250
mov esi, eax
test esi, esi
jne 0x4054be
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call fcn.00401260
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call fcn.00401250
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409770
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
push ebx
mov ebx, eax
lea eax, [ebp - 0x14c]
push eax
mov eax, ebx
call fcn.004044a4
push eax
call sub.KERNEL32.DLL_ReadFile
cmp eax, 0xffffffff
je 0x4097c9
push eax
call sub.KERNEL32.DLL_OpenProcess
test byte [ebp - 0x14c], 0x10
jne 0x4097c9
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x138]
push eax
call sub.KERNEL32.DLL_LoadLibraryA
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 2]
push eax
lea eax, [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GlobalUnlock
test eax, eax
jne 0x4097d0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409870
Capabilities:
Create thread

Disassembly:
push ebx
push esi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
push esp
lea eax, [esp + 8]
push eax
push 0x104
mov eax, ebx
call fcn.004044a4
push eax
call sub.KERNEL32.DLL_CreateThread
mov ecx, eax
lea edx, [esp + 4]
mov eax, esi
call fcn.004040d4
add esp, 0x108
pop esi
pop ebx
ret
Function at 0x40cd34
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe90
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x150], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40ceef
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov ebx, dword [eax - 4]
cmp dword [ebx + 0x14], 0
jne 0x40cd85
lea edx, [ebp - 4]
mov eax, dword [0x43f7c4]
call fcn.00405afc
jmp 0x40cd92
lea edx, [ebp - 4]
mov eax, dword [0x43f604]
call fcn.00405afc
mov esi, dword [ebx + 0x18]
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebx + 0xc]
push eax
call sub.KERNEL32.DLL_TlsGetValue
cmp dword [ebp - 0x10], 0x1000
jne 0x40ce64
push 0x105
lea eax, [ebp - 0x125]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.KERNEL32.DLL_FindFirstFileA
test eax, eax
je 0x40ce64
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x148], eax
mov byte [ebp - 0x144], 5
lea eax, [ebp - 0x150]
lea edx, [ebp - 0x125]
mov ecx, 0x105
call fcn.00404254
mov eax, dword [ebp - 0x150]
lea edx, [ebp - 0x14c]
call fcn.00409838
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x140], eax
mov byte [ebp - 0x13c], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x138], eax
mov byte [ebp - 0x134], 0xb
mov dword [ebp - 0x130], esi
mov byte [ebp - 0x12c], 5
lea eax, [ebp - 0x148]
push eax
push 3
lea edx, [ebp - 0x154]
mov eax, dword [0x43f68c]
call fcn.00405afc
mov ecx, dword [ebp - 0x154]
mov dl, 1
mov eax, dword [0x408970]
call fcn.0040c95c
mov ebx, eax
jmp 0x40cebe
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x16c], eax
mov byte [ebp - 0x168], 5
mov eax, dword [ebp - 4]
mov dword [ebp - 0x164], eax
mov byte [ebp - 0x160], 0xb
mov dword [ebp - 0x15c], esi
mov byte [ebp - 0x158], 5
lea eax, [ebp - 0x16c]
push eax
push 2
lea edx, [ebp - 0x170]
mov eax, dword [0x43f61c]
call fcn.00405afc
mov ecx, dword [ebp - 0x170]
mov dl, 1
mov eax, dword [0x408970]
call fcn.0040c95c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cef6
lea eax, [ebp - 0x170]
call fcn.00403fe4
lea eax, [ebp - 0x154]
mov edx, 3
call fcn.00404008
lea eax, [ebp - 4]
call fcn.00403fe4
ret

Function at 0x40d6a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
add edi, 0xffffffec
push edi
mov eax, dword [0x44077c]
call fcn.0040d62c
push eax
call sub.KERNEL32.DLL_TerminateProcess
xor esi, esi
jmp 0x40d6eb
mov al, byte [edi + esi + 6]
mov bl, byte [edi + esi + 7]
sub bl, al
jb 0x40d6e8
inc ebx
mov byte [ebp - 1], al
mov al, byte [ebp - 1]
and eax, 0xff
bts dword [0x43b22c], eax
inc byte [ebp - 1]
dec bl
jne 0x40d6d2
add esi, 2
cmp esi, 0xc
jge 0x40d6fa
mov al, byte [edi + esi + 6]
or al, byte [edi + esi + 7]
jne 0x40d6c2
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x41b6c8
Capabilities:
Resume thread

Disassembly:
push 0
push 0x43b4e4
call sub.KERNEL32.DLL_SetEvent
test eax, eax
je 0x41b6e3
push eax
call sub.KERNEL32.DLL_ResumeThread
call fcn.0041c528
ret
Function at 0x41c474
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
xor edx, edx
push ebp
push 0x41c517
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [eax + eax*2]
lea ebx, [eax*4 + 0x43b4e8]
cmp dword [0x43b4e4], 0
jne 0x41c4e6
push 0x276d
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 8]
mov eax, dword [0x43f4d8]
call fcn.00405afc
mov eax, dword [ebp - 8]
mov edx, dword [ebx + 8]
mov dword [ebp - 0x10], edx
mov byte [ebp - 0xc], 6
lea edx, [ebp - 0x10]
xor ecx, ecx
call fcn.00409ebc
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x41b578]
call fcn.0041b5f0
call fcn.004039c0
mov eax, dword [ebx + 8]
push eax
mov eax, dword [0x43b4e4]
push eax
call sub.KERNEL32.DLL_GetCommandLineA
mov esi, eax
mov eax, dword [ebx + 4]
mov dword [eax], esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41c51e
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404008
ret

Function at 0x41c54c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x41c619
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x43b4e4], 0
jne 0x41c5fc
push 0x41c62c
call sub.KERNEL32.DLL_QueryPerformanceCounter
mov dword [0x43b4e4], eax
cmp dword [0x43b4e4], 0
jne 0x41c5d4
call sub.KERNEL32.DLL_ExitThread
push eax
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 8]
mov eax, dword [0x43f3e4]
call fcn.00405afc
mov eax, dword [ebp - 8]
push eax
mov eax, 0x41c640
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0xb
lea edx, [ebp - 0x10]
xor ecx, ecx
pop eax
call fcn.00409ebc
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x41b578]
call fcn.0041b5f0
call fcn.004039c0
push 0x41c64c
mov eax, dword [0x43b4e4]
push eax
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [0x440a88], eax
mov eax, dword [ebp + 0xc]
push eax
mov ax, word [ebp + 8]
push eax
call dword [0x440a88]
mov ebx, eax
jmp 0x41c5fe
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41c620
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404008
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x403203
pop dword [ebp - 0x1c]
mov eax, 0x594e8e4b
sub eax, 0x590e5c48
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x2cad830c
sub dword [ebp - 0x2c], 0xde5b3dc1
mov dword [ebp - 0x28], 0xefbe4c03
add dword [ebp - 0x28], 0x42750042
mov dword [ebp - 0x24], 0x973ba930
add dword [ebp - 0x24], 0xb5109afe
mov dword [ebp - 0x20], 0x6fc129a6
add dword [ebp - 0x20], 0x903ed65a
lea eax, [ebp - 0x2c]
push eax
mov eax, 0xf15f7891
sub eax, 0xf11ef805
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xf5140cb4
add dword [ebp - 0x2c], 0x7f5e5ca2
mov dword [ebp - 0x28], 0x14f097e
sub dword [ebp - 0x28], 0xbfe2a809
mov dword [ebp - 0x24], 0x641b5084
add dword [ebp - 0x24], 0xff541be8
mov dword [ebp - 0x20], 0x4ea31a71
add dword [ebp - 0x20], 0xb15ce58f
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x32e6f1dc
sub eax, 0x32a67108
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x35cf9
push 0
call eax
mov ecx, 0x30cfe7fc
sub ecx, 0x30cfa31e
xor edx, edx
add edx, eax
mov edi, 0x411000
add edi, dword [ebp - 0x1c]
mov esi, 0x3d779151
add dword [ebp - 0x14], esi
mov ebx, dword [edi]
xor dword [ebp - 0x10], 0x5e2fe26
xor ebx, esi
mov dword [edx], ebx
xor dword [ebp - 8], edx
add edx, 0x9548615c
sub edx, 0x95486158
add edi, 0xc372c000
add edi, 0x3c8d4004
loop 0x40331b
add eax, 0xcbeb094c
sub eax, 0xcbea0301
xor ebx, ebx
add ebx, eax
add eax, 0x196905ff
add eax, 0xe696fa06
mov ecx, 0x400000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x41c440
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
cmp eax, 3
ja case.default.0x41c451
jmp dword [eax*4 + 0x420ab0]
cmp dword [0x424118], 0
je 0x41c560
push 0x42411c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x424134]
test edi, edi
je 0x41c555
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x41c49b
mov edi, dword [edi + 8]
test edi, edi
je 0x41c555
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x41c490
test esi, esi
je 0x41c490
mov ecx, dword [edi + 4]
call dword [0x420b80]
push esi
call ecx
add esp, 4
jmp 0x41c490
call fcn.0041bd30
jmp case.default.0x41c451
cmp dword [0x424118], 0
je case.default.0x41c451
push 0x42411c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x424134]
test edi, edi
je 0x41c548
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x41c507
mov edi, dword [edi + 8]
test edi, edi
je 0x41c548
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x41c500
test esi, esi
je 0x41c500
mov ecx, dword [edi + 4]
call dword [0x420b80]
push esi
call ecx
add esp, 4
jmp 0x41c500
cmp dword [0x424118], 0
jne 0x41c53c
push 0x42411c
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x424118], 1
jmp case.default.0x41c451
push 0x42411c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.default.0x41c451
push 0x42411c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x424118]
cmp eax, 1
jne case.default.0x41c451
mov eax, dword [0x424134]
test eax, eax
je 0x41c592
nop word cs:[eax + eax]
mov esi, dword [eax + 8]
push eax
call sub.msvcrt.dll_free
add esp, 4
mov eax, esi
test esi, esi
jne 0x41c580
mov dword [0x424134], 0
mov dword [0x424118], 0
push 0x42411c
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, 1
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x41c6d0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push edi
push esi
mov esi, dword [0x41d004]
movzx ecx, word [esi]
xor eax, eax
cmp ecx, 0x5a4d
jne 0x41c736
mov ecx, dword [esi + 0x3c]
cmp dword [esi + ecx], 0x4550
jne 0x41c736
add esi, ecx
movzx ecx, word [esi + 0x18]
cmp ecx, 0x10b
jne 0x41c736
movzx ecx, word [esi + 6]
test ecx, ecx
je 0x41c736
mov edx, dword [esp + 0xc]
sub edx, dword [0x41d004]
movzx edi, word [esi + 0x14]
add esi, edi
add esi, 0x18
jmp 0x41c726
add esi, 0x28
dec ecx
je 0x41c736
mov edi, dword [esi + 0xc]
cmp edi, edx
ja 0x41c720
add edi, dword [esi + 8]
cmp edi, edx
jbe 0x41c720
mov eax, esi
pop esi
pop edi
ret