joyce8/EMBER2024-capa huggingface dataset:
Function at 0x462480
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x49b270]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
mov edx, dword [ebp - 4]
add eax, dword [edx + 8]
mov esp, ebp
pop ebp
ret

Function at 0x4624b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x49b270]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
add edx, 1
mov eax, dword [ebp - 4]
mov dword [eax + 8], edx
mov esp, ebp
pop ebp
ret

Function at 0x4625e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x49b270]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0xffffffff
jne 0x462604
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
mov dword [ebp + 0xc], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
add ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
sub eax, 4
cmp dword [ebp - 8], eax
jl 0x462651
mov ecx, dword [ebp - 8]
add ecx, 0x4000
mov edx, dword [ebp - 4]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
add ecx, 5
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
push 0
mov ecx, dword [0x4a11d8]
push ecx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
add ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0xc]
add edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov dword [eax + 8], edx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8

Function at 0x4626b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x49b270]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx]
jb 0x4626ee
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 8]
cmp dword [ebp + 8], ecx
ja 0x4626ee
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
sub ecx, dword [eax]
add ecx, 1
mov eax, ecx
jmp 0x4626f0
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x462f30
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x49b270]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 8]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4
Function at 0x465360
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push dword [ebp + 0x18]
mov dword [ebp - 8], 0
push dword [ebp + 0x1c]
push 1
call fcn.0046ba70
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x46551d
mov eax, dword [ebp - 4]
push 0x40
push dword [sym.imp.MSVCRT.dll_longjmp]
mov dword [eax + 0x280], 0x7fffffff
mov eax, dword [ebp - 4]
mov dword [eax + 0x284], 0x7fffffff
mov eax, dword [ebp - 4]
mov dword [eax + 0x288], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x28c], 0
mov eax, dword [ebp - 4]
push eax
call fcn.00466a40
push 0
push eax
call sub.MSVCRT.dll__setjmp3
add esp, 0x14
test eax, eax
je 0x4653e6
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp + 0x20]
mov eax, dword [ebp - 4]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push eax
call fcn.0046bc40
push dword [ebp + 0x14]
mov eax, dword [ebp - 4]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call fcn.00466a20
push dword [ebp + 8]
mov eax, dword [ebp - 4]
push eax
call fcn.004650d0
add esp, 0x28
test eax, eax
jne 0x465424
mov dword [ebp - 8], 1
cmp dword [ebp - 8], 0
jne 0x465468
mov eax, dword [ebp - 4]
mov dword [eax + 0xb4], 0x2000
mov eax, dword [ebp - 4]
push dword [eax + 0xb4]
mov eax, dword [ebp - 4]
push eax
call fcn.0046bbe0
mov ecx, dword [ebp - 4]
add esp, 8
mov dword [ecx + 0xb0], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xb0], 0
jne 0x465468
mov dword [ebp - 8], 1
mov eax, dword [ebp - 4]
mov dword [eax + 0x98], 0x4652e0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov dword [eax + 0x9c], fcn.00465330
mov eax, dword [ebp - 4]
cmp dword [ebp - 8], 0
mov dword [eax + 0xa0], ecx
jne 0x4654ec
mov eax, dword [ebp - 4]
push 0x38
add eax, 0x78
push str.1.2.8
push eax
call fcn.004880a0
add eax, 6
add esp, 0xc
cmp eax, 6
ja case.0x4654b2.5
jmp dword [eax*4 + 0x465560]
push str.zlib_memory_error
jmp 0x4654d3
push str.zlib_stream_error
jmp 0x4654d3
push str.zlib_version_error
jmp 0x4654d3
push str.Unknown_zlib_error
mov eax, dword [ebp - 4]
push eax
call fcn.00466a60
mov dword [ebp - 8], 1
add esp, 8
cmp dword [ebp - 8], 0
je 0x465523
mov eax, dword [ebp - 4]
push dword [eax + 0xb0]
mov eax, dword [ebp - 4]
push eax
call fcn.0046bb60
mov eax, dword [ebp - 4]
push dword [ebp + 0x18]
push dword [ebp + 0x20]
mov dword [eax + 0xb0], 0
mov eax, dword [ebp - 4]
push eax
call fcn.0046bb10
add esp, 0x14
xor eax, eax
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
push 0
push 0
mov eax, dword [eax + 0xb0]
mov dword [ecx + 0x84], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov eax, dword [eax + 0xb4]
mov dword [ecx + 0x88], eax
mov eax, dword [ebp - 4]
push eax
call fcn.00466bc0
mov eax, dword [ebp - 4]
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x4669b0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x4669c9
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x4669c9
push dword [esp + 8]
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x475680
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov eax, dword [esp + 4]
mov cl, byte [edx]
mov eax, dword [eax + 0x1f0]
test cl, cl
je 0x4756a8
imul eax, eax, 0xf4243
lea edx, [edx + 1]
movzx ecx, cl
xor eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x475694
ret
Function at 0x485533
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
xor ebp, ebp
mov edi, ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
mov esi, 0x4a0e68
cmp dword [0x4a0e64], edi
jne 0x485562
push esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4a0e64], 1
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x4a0e60]
test esi, esi
je 0x4855bd
test edi, edi
jne 0x485704
xor eax, eax
lea ecx, [esi + 0x114]
inc eax
cmp ebx, dword [ecx]
je 0x485593
inc eax
add ecx, 4
cmp eax, 0x40
jl 0x485584
jmp 0x4855af
push dword [esp + 0x1c]
add eax, 0x84
push dword [esp + 0x1c]
lea eax, [esi + eax*4]
push eax
call fcn.004854dc
xor edi, edi
add esp, 0xc
inc edi
mov esi, dword [esi]
test esi, esi
jne 0x485573
test edi, edi
jne 0x485704
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [esp + 0x10]
push ebp
push ebp
push 0x100000
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x485704
mov esi, dword [0x4a0e60]
jmp 0x4855fe
cmp dword [esi + 0xc], 0x3f
jl 0x48569f
mov esi, dword [esi]
test esi, esi
jne 0x4855f2
push 0x310
push 8
push dword [0x49d758]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
test esi, esi
je 0x4856fe
push ebp
push 1
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov dword [esi + 8], eax
test eax, eax
je 0x4856f0
push ebp
push ebp
push esi
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x1c]
push 0x485717
mov dword [esi + 0x114], ebx
lea ebx, [esi + 0x214]
push 0x1000
mov dword [esi + 0x14], eax
mov dword [ebx], ebp
push ebp
mov dword [esi + 0xc], 2
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x4856eb
push eax
call edi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push ebx
call fcn.004854dc
mov eax, dword [0x4a0e60]
add esp, 0xc
mov dword [esi + 4], ebp
mov dword [esi], eax
test eax, eax
je 0x485697
mov dword [eax + 4], esi
mov dword [0x4a0e60], esi
jmp 0x485704
mov ecx, dword [esi + 0xc]
mov eax, dword [esp + 0x10]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
mov dword [esi + ecx*4 + 0x10], eax
mov eax, dword [esi + 0xc]
mov dword [esi + eax*4 + 0x110], ebx
mov eax, dword [esi + 0xc]
mov dword [esi + eax*4 + 0x210], ebp
mov eax, dword [esi + 0xc]
add eax, 0x84
lea eax, [esi + eax*4]
push eax
call fcn.004854dc
add esp, 0xc
inc dword [esi + 0xc]
push ebp
push 1
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
jmp 0x485704
push dword [esi + 8]
call edi
push esi
push ebp
push dword [0x49d758]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [esp + 0x10]
call edi
push 0x4a0e68
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x4868c0
Capabilities:
Compress data via zlib inflate or deflate

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x34
push edi
test ecx, ecx
je 0x487ef6
mov edi, dword [ecx + 0x1c]
mov dword [esp + 0x14], edi
test edi, edi
je 0x487ef6
cmp dword [ecx + 0xc], 0
je 0x487ef6
cmp dword [ecx], 0
jne 0x4868f8
cmp dword [ecx + 4], 0
jne 0x487ef6
cmp dword [edi], 0xb
jne 0x486903
mov dword [edi], 0xc
mov eax, dword [ecx + 0xc]
mov edx, dword [edi + 0x38]
mov dword [esp + 0x18], eax
mov eax, dword [ecx + 0x10]
push ebx
mov ebx, dword [ecx]
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
xor eax, eax
push ebp
mov ebp, dword [ecx + 4]
mov dword [esp + 0x28], eax
mov eax, dword [edi]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], edx
mov dword [esp + 0x38], ebp
push esi
mov esi, dword [edi + 0x3c]
cmp eax, 0x1e
ja 0x487275
lea ebx, [edi + 0x54]
mov dword [esp + 0x40], ebx
mov ebx, dword [esp + 0x14]
jmp 0x486950
jmp dword [eax*4 + 0x487f00]
pop esi
pop ebp
pop ebx
mov eax, 0xfffffffe
pop edi
add esp, 0x34
ret
mov eax, 0xfffffffe
pop edi
add esp, 0x34
ret
Function at 0x10009943
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x100174bf
call fcn.10016e93
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x418], esi
push 0x60
push esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x100099c0
push 2
push esi
push ebx
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x100099c0
call fcn.100080da
mov esi, eax
jmp 0x10009ac6
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x100099e3
call fcn.100080da
jmp 0x10009ab9
push ebx
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x100099d9
push ebx
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
lea eax, [ebx + 1]
cmp eax, ebx
jae 0x10009a16
mov esi, 0x8007000e
jmp 0x10009abb
push 2
pop ecx
mul ecx
mov byte [ebp - 4], cl
cmp edx, esi
ja 0x10009ae9
jb 0x10009a31
cmp eax, 0xffffffff
ja 0x10009ae9
cmp eax, 0x400
jbe 0x10009a46
push eax
lea ecx, [ebp - 0x418]
call fcn.10002ff9
jmp 0x10009a68
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x10009a68
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], 0
je 0x10009a0c
push ebx
push dword [ebp - 0x418]
push ebx
push dword [ebp - 0x41c]
push esi
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x100099d9
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.10002ff9
mov esi, eax
test edi, edi
je 0x10009ac6
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x10009adf
lea ecx, [ebp - 0x418]
call fcn.100080a2
mov eax, esi
call fcn.10016de8
ret 0x10
push 0x80070216
call fcn.10002ff9
int3
Function at 0x401a30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x14]
push ebx
push ebp
mov ebx, ecx
push esi
push edi
test eax, eax
mov dword [esp + 0x10], ebx
je 0x401bcd
push 2
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x401bcd
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x401bcd
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
mov dword [esp + 0x14], eax
je 0x401bcd
mov ebp, dword [eax + 4]
mov esi, dword [eax + 8]
lea edi, [eax + 0x428]
mov eax, dword [esp + 0x28]
test eax, eax
mov dword [esp + 0x24], esi
je 0x401ab8
mov eax, ebp
mov ecx, dword [esp + 0x1c]
cdq
sub eax, edx
sar eax, 1
neg eax
add ecx, eax
mov eax, esi
mov esi, dword [esp + 0x20]
cdq
sub eax, edx
sar eax, 1
neg eax
add esi, eax
jmp 0x401ac0
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
xor eax, eax
test ecx, ecx
setle al
dec eax
and eax, ecx
mov ecx, dword [ebx + 4]
lea edx, [ecx - 1]
cmp eax, edx
jge 0x401adc
mov ebx, eax
mov dword [esp + 0x1c], ebx
jmp 0x401ae2
mov dword [esp + 0x1c], edx
mov ebx, edx
mov eax, dword [esp + 0x10]
xor edx, edx
test esi, esi
mov eax, dword [eax + 8]
setle dl
dec edx
and edx, esi
lea esi, [eax - 1]
cmp edx, esi
mov dword [esp + 0x20], edx
jl 0x401b02
mov dword [esp + 0x20], esi
sub ecx, ebx
xor edx, edx
test ebp, ebp
setle dl
dec edx
and edx, ebp
cmp edx, ecx
mov ebp, edx
jl 0x401b16
mov ebp, ecx
mov ecx, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
sub eax, ecx
xor edx, edx
test esi, esi
setle dl
dec edx
and edx, esi
cmp edx, eax
jl 0x401b30
mov edx, eax
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x401b4a
lea esi, [ebp + ebx]
mov dword [eax], ebx
mov dword [eax + 8], esi
lea esi, [edx + ecx]
mov dword [eax + 4], ecx
mov dword [eax + 0xc], esi
lea edx, [edx + ecx - 1]
cmp edx, ecx
mov dword [esp + 0x24], edx
jl 0x401bcd
add ebp, ebx
mov dword [esp + 0x28], ebp
mov ebp, dword [esp + 0x30]
mov eax, dword [esp + 0x10]
mov esi, edx
imul esi, dword [eax + 0xc]
mov edx, dword [eax + 0x28]
mov eax, dword [esp + 0x28]
add esi, ebx
add esi, edx
cmp ebx, eax
jge 0x401ba9
mov ebx, eax
mov eax, dword [esp + 0x1c]
sub ebx, eax
test ebp, ebp
jne 0x401b8b
mov cl, byte [edi]
mov byte [esi], cl
jmp 0x401b9c
mov dl, byte [edi]
mov al, byte [esi]
push ebp
push edx
push eax
call fcn.00401000
add esp, 0xc
mov byte [esi], al
inc edi
inc esi
dec ebx
jne 0x401b81
mov ebx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
mov edx, edi
sub edx, eax
test dl, 3
je 0x401bc0
inc edi
mov edx, edi
sub edx, eax
test dl, 3
jne 0x401bb6
mov edx, dword [esp + 0x24]
dec edx
cmp edx, ecx
mov dword [esp + 0x24], edx
jge 0x401b60
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0x18
Function at 0x404590
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push 0x43280c
mov esi, ecx
push str.HiScores.dat
call fcn.00406fe0
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x4045af
pop esi
pop ebx
ret
push edi
mov eax, esi
mov ecx, 0xa
mov edx, dword [eax]
add eax, 4
xor edx, 0x55555555
dec ecx
mov dword [eax - 4], edx
jne 0x4045b7
lea edi, [esi + 0x28]
mov edx, 0xa
mov ecx, edi
xor eax, eax
xor byte [eax + ecx], 0x55
inc eax
cmp eax, 0x10
jl 0x4045d4
add ecx, 0x10
dec edx
jne 0x4045d2
push ebx
push 0xa
push 4
push esi
call fcn.00406e10
add esp, 0x10
push ebx
push 0xa
push 0x10
push edi
call fcn.00406e10
add esp, 0x10
mov eax, esi
mov ecx, 0xa
mov edx, dword [eax]
add eax, 4
xor edx, 0x55555555
dec ecx
mov dword [eax - 4], edx
jne 0x404607
mov ecx, edi
mov edx, 0xa
xor eax, eax
xor byte [eax + ecx], 0x55
inc eax
cmp eax, 0x10
jl 0x404621
add ecx, 0x10
dec edx
jne 0x40461f
push ebx
call fcn.00406d60
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
ret

Function at 0x404650
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x43281c
mov ebx, ecx
push str.HiScores.dat
call fcn.00406fe0
mov edi, eax
add esp, 8
test edi, edi
jne 0x4046b0
mov edx, ebx
add ebx, 0x28
mov ebp, 0xa
mov edi, str....empty...
or ecx, 0xffffffff
xor eax, eax
mov dword [edx], 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
add edx, 4
mov eax, ecx
mov esi, edi
mov edi, ebx
add ebx, 0x10
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
dec ebp
rep movsb byte es:[edi], byte [esi]
jne 0x404678
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
push 0xa
push 4
push ebx
call fcn.00407000
add esp, 0x10
lea esi, [ebx + 0x28]
push edi
push 0xa
push 0x10
push esi
call fcn.00407000
add esp, 0x10
mov eax, ebx
mov ecx, 0xa
mov ebp, dword [eax]
add eax, 4
xor ebp, 0x55555555
dec ecx
mov dword [eax - 4], ebp
jne 0x4046d6
mov ecx, esi
mov edx, 0xa
xor eax, eax
mov bl, byte [eax + ecx]
xor bl, 0x55
mov byte [eax + ecx], bl
inc eax
cmp eax, 0x10
jl 0x4046f0
add ecx, 0x10
dec edx
jne 0x4046ee
push edi
call fcn.00406d60
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x407190
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42bba8
push 0x409aa8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edx, edx
mov dl, ah
mov dword [0x43884c], edx
mov ecx, eax
and ecx, 0xff
mov dword [0x438848], ecx
shl ecx, 8
add ecx, edx
mov dword [0x438844], ecx
shr eax, 0x10
mov dword [0x438840], eax
call fcn.0040c690
test eax, eax
jne 0x4071fa
push 0x1c
call fcn.00407370
add esp, 4
call fcn.00409880
test eax, eax
jne 0x40720d
push 0x10
call fcn.00407370
add esp, 4
mov dword [ebp - 4], 0
call fcn.0040c480
call fcn.00408430
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x439f50], eax
call fcn.0040c320
mov dword [0x438830], eax
test eax, eax
je 0x407240
mov eax, dword [0x439f50]
test eax, eax
jne 0x40724a
push 0xffffffffffffffff
call fcn.00407630
add esp, 4
call fcn.0040c070
call fcn.0040bf80
call fcn.00407600
mov esi, dword [0x439f50]
mov dword [ebp - 0x64], esi
cmp byte [esi], 0x22
jne 0x407329
inc esi
mov dword [ebp - 0x64], esi
mov al, byte [esi]
cmp al, 0x22
je 0x407291
test al, al
je 0x407291
and eax, 0xff
push eax
call fcn.0040bf20
add esp, 4
test eax, eax
je 0x40726b
inc esi
mov dword [ebp - 0x64], esi
jmp 0x40726b
cmp byte [esi], 0x22
jne 0x40729a
inc esi
mov dword [ebp - 0x64], esi
mov al, byte [esi]
test al, al
je 0x4072aa
cmp al, 0x20
ja 0x4072aa
inc esi
mov dword [ebp - 0x64], esi
jmp 0x40729a
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x4072cb
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x4072d0
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x60], eax
push eax
call fcn.00407630
jmp 0x40730e
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x40729a
inc esi
mov dword [ebp - 0x64], esi
jmp 0x407329

Function at 0x407370
Capabilities:
Terminate process

Disassembly:
cmp dword [0x438838], 1
jne 0x40737e
call fcn.0040c6d0
mov eax, dword [esp + 4]
push eax
call fcn.0040c710
add esp, 4
push 0xff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x407670
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
call fcn.00407730
mov eax, dword [0x43887c]
mov ebp, dword [esp + 0x10]
cmp eax, 1
jne 0x407694
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
test eax, eax
mov dword [0x438878], 1
mov byte [0x438874], bl
jne 0x4076ee
mov ecx, dword [0x439f4c]
test ecx, ecx
je 0x4076dc
mov esi, dword [0x439f48]
sub esi, 4
cmp esi, ecx
jb 0x4076dc
mov eax, dword [esi]
test eax, eax
je 0x4076d5
call eax
mov ecx, dword [0x439f4c]
sub esi, 4
cmp esi, ecx
jae 0x4076c7
push 0x432078
push 0x432070
call fcn.00407750
add esp, 8
push 0x432084
push 0x43207c
call fcn.00407750
add esp, 8
test ebx, ebx
je 0x40770d
call fcn.00407740
pop esi
pop ebp
pop ebx
ret
push ebp
mov dword [0x43887c], 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x409880
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push esi
call fcn.00408c50
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x433390], eax
je 0x4098d8
push 0x74
push 1
call fcn.00408a70
mov esi, eax
add esp, 8
test esi, esi
je 0x4098d8
mov eax, dword [0x433390]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x4098d8
push esi
call fcn.004098e0
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi], eax
mov dword [esi + 4], 0xffffffff
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x409900
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [0x433390]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x40996e
push 0x74
push 1
call fcn.00408a70
mov esi, eax
add esp, 8
test esi, esi
je 0x409964
mov ecx, dword [0x433390]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x409964
push esi
call fcn.004098e0
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
mov dword [esi], eax
mov dword [esi + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop edi
pop esi
ret
push 0x10
call fcn.00407340
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop edi
pop esi
ret