joyce8/EMBER2024-capa huggingface dataset:
Function at 0x497fd0
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x498073
test eax, eax
jbe 0x498073
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x498073
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x49801e
xor esi, esi
jmp 0x498024
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x49804f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.00499fb0
add esi, eax
push esi
mov ebx, esi
call fcn.00499fb0
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x498030
pop ebp
test edi, edi
pop edi
jne 0x498073
test ebx, ebx
je 0x498073
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.004a56b0
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc

Function at 0x4981d5
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4982ed
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4982ed
mov eax, dword [esi + 0x3c]
push eax
call fcn.004b764c
mov esi, eax
test esi, esi
je 0x4982ed
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x4982ed
mov ecx, esi
call fcn.00498160
cmp edi, eax
jge 0x4982ed
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x498273
mov dword [esp + 0x34], 1
jmp 0x4982ce
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x4982ed
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.00497700
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x4b7fef
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4b8027
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004b5fdc
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004b5fb4
jmp 0x4b8033
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4b96e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4b9722
call fcn.004bf3d0
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4b9722
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4b9719
xor eax, eax
jmp 0x4b972a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004b9730
pop edi
pop esi
pop ebx
ret 4

Function at 0x4bf900
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4bf92e
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4bf94c
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004bf866
jmp 0x4bf94c
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4bf94c
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004bf866
test edi, edi
mov eax, edi
jne 0x4bf936
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x409580
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov dword [ebp - 0x18], 0x2e2
mov dword [ebp - 0x30], 0x3b4
mov dword [ebp - 0x34], 0x28f
mov dword [ebp - 0x1c], 0x34
mov dword [ebp - 0x38], 0x13b
mov dword [ebp - 8], 0x1c7
mov dword [ebp - 0x3c], 0x21b
mov dword [ebp - 0x40], 0x346
mov dword [ebp - 0x14], 0x16a
mov dword [ebp - 0x24], 0x314
mov dword [ebp - 0x28], 0x23f
mov dword [ebp - 0x44], 0x228
mov dword [ebp - 0x20], 0x38
mov dword [ebp - 0x48], 0x158
mov dword [ebp - 0x4c], 0xca
mov dword [ebp - 0x10], 0x2f1
mov dword [ebp - 0x50], 0x1e8
mov dword [ebp - 0x2c], 0x1f3
mov dword [ebp - 0x54], 0x86
mov dword [ebp - 0x58], 0x8c
mov dword [ebp - 0x5c], 0x10f
mov dword [ebp - 0x60], 0x274
mov dword [ebp - 0x64], 0x3d3
mov eax, dword [ebp - 8]
sub eax, 0xffffff14
push eax
mov ecx, dword [ebp - 0x14]
sub ecx, 0x18
push ecx
mov edx, dword [ebp - 0x1c]
add edx, 0x379
push edx
mov eax, dword [ebp - 0x20]
add eax, 0x3f
push eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0x171
push ecx
mov edx, dword [ebp - 0x18]
sub edx, 0x238
push edx
mov eax, dword [ebp - 0x14]
add eax, 0xffffff4b
push eax
call fcn.0040f620
add esp, 0x1c
mov dword [ebp - 4], 0
jmp 0x40967f
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0x10]
sub edx, 0x35b
cmp dword [ebp - 4], edx
jge 0x409698
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x409676
mov dword [ebp - 0xc], 0
jmp 0x4096aa
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x24]
sub edx, 0x189b4
cmp dword [ebp - 0xc], edx
jge 0x4096e2
mov eax, dword [ebp + 0x1c]
add eax, 1
mov dword [ebp + 0x1c], eax
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [ebp + 0x1c]
jge 0x4096e0
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 0x2c]
jge 0x4096da
mov eax, dword [ebp - 0x10]
nop
nop
dec eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
jmp 0x4096a1
mov esp, ebp
pop ebp
ret
Function at 0x40ebd0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov dword [ebp - 0x14], 0x17
mov dword [ebp - 0x18], 0x195
mov dword [ebp - 0x10], 0x2c
mov dword [ebp - 0x1c], 0x349
mov dword [ebp - 0x20], 0x24b
mov dword [ebp - 0x24], 0x1c8
mov dword [ebp - 0x28], 0x3a7
mov dword [ebp - 0x2c], 0x2b5
mov dword [ebp - 0x30], 0x15b
mov dword [ebp - 0x34], 0x133
mov dword [ebp - 0x38], 0x30c
mov dword [ebp - 0x3c], 0x306
mov dword [ebp - 0x40], 0x389
mov dword [ebp - 0xc], 0x1a6
mov dword [ebp - 0x44], 0x280
mov dword [ebp - 0x48], 0xb6
mov dword [ebp - 0x4c], 0x30b
mov dword [ebp - 0x50], 0x1ff
mov dword [ebp - 0x54], 0x229
mov dword [ebp - 0x58], 0x16d
mov dword [ebp - 0x5c], 0xe4
mov dword [ebp - 0x60], 0x2b1
mov dword [ebp - 4], 0
jmp 0x40ec82
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
sub ecx, 0x1a5
cmp dword [ebp - 4], ecx
jge 0x40ec9b
mov edx, dword [ebp + 0x1c]
nop
dec edx
nop
mov dword [ebp + 0x1c], edx
jmp 0x40ec79
mov dword [ebp - 8], 0
jmp 0x40ecad
mov eax, dword [ebp - 8]
nop
inc eax
nop
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
sub ecx, 0x18846
cmp dword [ebp - 8], ecx
jge 0x40eccc
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edx, dword [ebp - 0x10]
sub edx, 1
mov dword [ebp - 0x10], edx
jmp 0x40eca4
mov esp, ebp
pop ebp
ret
Function at 0x40fbc0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov dword [ebp - 0x1c], 0xe
mov dword [ebp - 0x30], 0x19c
mov dword [ebp - 0x38], 0x390
mov dword [ebp - 0x20], 0x203
mov dword [ebp - 0x3c], 0x1f5
mov dword [ebp - 0x40], 0x141
mov dword [ebp - 0x44], 0xd0
mov dword [ebp - 0x48], 0xb7
mov dword [ebp - 0xc], 0x121
mov dword [ebp - 0x4c], 0x29e
mov dword [ebp - 0x50], 0x38b
mov dword [ebp - 0x28], 0x28
mov dword [ebp - 0x54], 0x21d
mov dword [ebp - 0x58], 0x26d
mov dword [ebp - 0x5c], 0x167
mov dword [ebp - 0x14], 0x34d
mov dword [ebp - 0x24], 0x21c
mov dword [ebp - 0x60], 0x70
mov dword [ebp - 0x34], 0x36c
mov dword [ebp - 0x64], 0x2b3
mov dword [ebp - 0x18], 0x29e
mov dword [ebp - 0x2c], 0x3bf
mov dword [ebp - 0x68], 0x388
mov dword [ebp - 0x6c], 0x15d
mov dword [ebp - 4], 0
jmp 0x40fc80
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x1c]
sub ecx, 0xd
cmp dword [ebp - 4], ecx
jge 0x40fc96
mov edx, dword [ebp - 0xc]
inc edx
nop
nop
mov dword [ebp - 0xc], edx
jmp 0x40fc77
mov dword [ebp - 8], 0
jmp 0x40fca8
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x18]
sub ecx, 0x18963
cmp dword [ebp - 8], ecx
jge 0x40fcc7
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
mov edx, dword [ebp - 0x14]
sub edx, 1
mov dword [ebp - 0x14], edx
jmp 0x40fc9f
mov eax, dword [ebp - 0x20]
sub eax, 0x1a
push eax
mov ecx, dword [ebp + 0x20]
sub ecx, 0x1f2
push ecx
mov edx, dword [ebp + 8]
sub edx, 0x2a2
push edx
mov eax, dword [ebp - 0x24]
add eax, 0x1a8
push eax
mov ecx, dword [ebp + 0x18]
sub ecx, 0x21c
push ecx
mov edx, dword [ebp - 0x28]
add edx, 0x329
push edx
mov eax, dword [ebp - 0x2c]
add eax, 0xfffffc7e
push eax
mov ecx, dword [ebp - 0x30]
add ecx, 0x14c
push ecx
mov edx, dword [ebp + 0x24]
add edx, 0x2b9
push edx
mov eax, dword [ebp - 0xc]
sub eax, 0xfffffe7a
push eax
call fcn.00415710
add esp, 0x28
mov dword [ebp - 0x10], 0
jmp 0x40fd3f
mov ecx, dword [ebp - 0x10]
nop
inc ecx
nop
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x34]
sub edx, 0x18a0c
cmp dword [ebp - 0x10], edx
jge 0x40fd5e
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
jmp 0x40fd36
mov esp, ebp
pop ebp
ret
Function at 0x413ab0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov dword [ebp - 0x30], 0x2a
mov dword [ebp - 0x34], 9
mov dword [ebp - 0x38], 0x180
mov dword [ebp - 0x3c], 0x2d
mov dword [ebp - 0x2c], 0x33d
mov dword [ebp - 0x14], 0xf9
mov dword [ebp - 0x40], 0x39a
mov dword [ebp - 0xc], 0x3c7
mov dword [ebp - 0x10], 0x233
mov dword [ebp - 0x44], 0x1c2
mov dword [ebp - 0x48], 0x25e
mov dword [ebp - 0x4c], 0x74
mov dword [ebp - 0x28], 0x144
mov dword [ebp - 0x24], 0x30f
mov dword [ebp - 0x50], 0x2a9
mov dword [ebp - 0x54], 0x167
mov dword [ebp - 0x58], 0xd
mov dword [ebp - 0x5c], 0x36b
mov dword [ebp - 0x60], 0x34d
mov dword [ebp - 0x64], 0x3ac
mov dword [ebp - 0x68], 0x25d
mov dword [ebp - 0x20], 0x74
mov dword [ebp - 0x6c], 0x1d3
mov dword [ebp - 0x70], 0x46
mov dword [ebp - 4], 0
jmp 0x413b70
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x28]
sub ecx, 0x372
cmp dword [ebp - 4], ecx
jge 0x413b89
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
jmp 0x413b67
mov eax, dword [ebp - 0x14]
nop
inc eax
nop
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], 0
jmp 0x413ba4
mov ecx, dword [ebp - 8]
inc ecx
nop
nop
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 8]
sub edx, 0x1885b
cmp dword [ebp - 8], edx
jge 0x413c0f
mov eax, dword [ebp - 0xc]
sub eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
and ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp + 0x10]
jge 0x413c0d
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 0x24]
jge 0x413bdd
mov dword [ebp - 0x18], 1
jmp 0x413be4
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x2c]
jge 0x413bf5
mov dword [ebp - 0x1c], 1
jmp 0x413bfc
mov dword [ebp - 0x1c], 0
mov ecx, dword [ebp - 0x18]
and ecx, dword [ebp - 0x1c]
je 0x413c0d
mov edx, dword [ebp + 0x14]
nop
nop
inc edx
mov dword [ebp + 0x14], edx
jmp 0x413b9b
mov eax, dword [ebp + 0x1c]
add eax, 1
mov dword [ebp + 0x1c], eax
mov esp, ebp
pop ebp
ret
Function at 0x415500
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov dword [ebp - 0x58], 0x20c
mov dword [ebp - 0x30], 0x2fa
mov dword [ebp - 0x5c], 0x276
mov dword [ebp - 0x50], 0x3d2
mov dword [ebp - 0x3c], 0x16c
mov dword [ebp - 0x60], 0x394
mov dword [ebp - 0x64], 0x3b
mov dword [ebp - 0x4c], 0x2fd
mov dword [ebp - 0x10], 0xbd
mov dword [ebp - 0x40], 0x387
mov dword [ebp - 0x68], 0x264
mov dword [ebp - 0x6c], 0x143
mov dword [ebp - 4], 0x54
mov dword [ebp - 0x48], 0x2d
mov dword [ebp - 0x70], 0x1a8
mov dword [ebp - 0x2c], 0x202
mov dword [ebp - 0x74], 0x1cd
mov dword [ebp - 0x54], 0x385
mov dword [ebp - 0x78], 0x270
mov dword [ebp - 0x38], 0x31c
mov dword [ebp - 0x34], 0x197
mov dword [ebp - 0x7c], 0x26b
mov dword [ebp - 0x28], 0x26
mov dword [ebp - 8], 0
jmp 0x4155b9
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x28]
sub ecx, 0x3d7
cmp dword [ebp - 8], ecx
jge 0x415680
mov edx, dword [ebp - 0x3c]
xor edx, dword [ebp - 0x40]
cmp edx, dword [ebp - 0x10]
jge 0x4155df
mov dword [ebp - 0x14], 1
jmp 0x4155e6
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp + 0x20]
jge 0x4155f7
mov dword [ebp - 0x18], 1
jmp 0x4155fe
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 4]
and ecx, dword [ebp + 0x14]
or ecx, dword [ebp - 0x14]
or ecx, dword [ebp - 0x18]
mov dword [ebp - 0x44], ecx
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 0x44], 0
je 0x41567b
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x48]
jge 0x41562d
mov dword [ebp - 0x1c], 1
jmp 0x415634
mov dword [ebp - 0x1c], 0
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp - 0x2c]
cmp ecx, dword [ebp - 0x4c]
jge 0x415648
mov dword [ebp - 0x20], 1
jmp 0x41564f
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 0x30]
cmp edx, dword [ebp + 0x10]
jge 0x415660
mov dword [ebp - 0x24], 1
jmp 0x415667
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x1c]
or eax, dword [ebp - 0x20]
or eax, dword [ebp - 0x24]
je 0x41567b
mov ecx, dword [ebp - 0x28]
inc ecx
nop
nop
mov dword [ebp - 0x28], ecx
jmp 0x4155b0
mov dword [ebp - 0xc], 0
jmp 0x415692
mov edx, dword [ebp - 0xc]
nop
inc edx
nop
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x2c]
sub eax, 0x188a2
cmp dword [ebp - 0xc], eax
jge 0x4156b0
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
jmp 0x415689
mov edx, dword [ebp - 0x50]
sub edx, 0x29d
push edx
mov eax, dword [ebp - 0x38]
add eax, 0x7e
push eax
mov ecx, dword [ebp - 0x30]
sub ecx, 0x5a
push ecx
mov edx, dword [ebp + 0x20]
add edx, 0x66
push edx
mov eax, dword [ebp + 0x18]
sub eax, 0x8d
push eax
mov ecx, dword [ebp - 0x34]
add ecx, 0x13e
push ecx
mov edx, dword [ebp - 0x38]
sub edx, 0x17f
push edx
mov eax, dword [ebp - 0x54]
add eax, 0xfffffe5e
push eax
call fcn.00422560
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x415d70
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov dword [ebp - 0x2c], 0x160
mov dword [ebp - 0x30], 0x304
mov dword [ebp - 0x28], 0x164
mov dword [ebp - 0x10], 0x2e0
mov dword [ebp - 0x18], 0xde
mov dword [ebp - 0x34], 0x3cd
mov dword [ebp - 0x38], 0x3ae
mov dword [ebp - 0x3c], 0x2c7
mov dword [ebp - 0x40], 0x21d
mov dword [ebp - 0x20], 0x22c
mov dword [ebp - 0x44], 0x21a
mov dword [ebp - 0xc], 0x13
mov dword [ebp - 0x48], 0x2a1
mov dword [ebp - 8], 0x19d
mov dword [ebp - 0x4c], 0x72
mov dword [ebp - 0x50], 0x3f
mov dword [ebp - 0x54], 0x1dd
mov dword [ebp - 0x58], 0x48
mov dword [ebp - 0x5c], 0xe3
mov dword [ebp - 0x60], 0x330
mov dword [ebp - 0x64], 0x277
mov dword [ebp - 0x24], 0x21
mov dword [ebp - 0x68], 0x148
mov dword [ebp - 0x6c], 0x3d9
mov dword [ebp - 4], 0
jmp 0x415e30
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0x18980
cmp dword [ebp - 4], ecx
jge 0x415e60
mov edx, dword [ebp - 8]
inc edx
nop
nop
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x18]
jge 0x415e5e
mov ecx, dword [ebp - 0xc]
nop
dec ecx
nop
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x415e27
mov edx, dword [ebp - 0xc]
add edx, 0x15a
push edx
mov eax, dword [ebp - 0x10]
sub eax, 0x32
push eax
mov ecx, dword [ebp - 0x24]
add ecx, 0x305
push ecx
mov edx, dword [ebp - 0x10]
add edx, 0x43
push edx
call fcn.00424e50
add esp, 0x10
mov dword [ebp - 0x14], 0
jmp 0x415e9c
mov eax, dword [ebp - 0x14]
nop
inc eax
nop
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x28]
sub ecx, 0x163
cmp dword [ebp - 0x14], ecx
jge 0x415eb5
mov edx, dword [ebp - 0x18]
sub edx, 1
mov dword [ebp - 0x18], edx
jmp 0x415e93
mov dword [ebp - 0x1c], 0
jmp 0x415ec7
mov ecx, dword [ebp - 0x2c]
sub ecx, 0x18800
cmp dword [ebp - 0x1c], ecx
jge 0x415ee9
call dword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]
mov esp, ebp
pop ebp
ret
Function at 0x416b50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov dword [ebp - 0x28], 0x1f7
mov dword [ebp - 0x2c], 0x5d
mov dword [ebp - 0x30], 0x38f
mov dword [ebp - 0x14], 0x301
mov dword [ebp - 0x34], 0x65
mov dword [ebp - 0x24], 0x225
mov dword [ebp - 0x38], 0x3c9
mov dword [ebp - 0x3c], 0x44
mov dword [ebp - 0x40], 0x27c
mov dword [ebp - 0x10], 0x286
mov dword [ebp - 0x44], 0x1eb
mov dword [ebp - 0x48], 0x3de
mov dword [ebp - 0x4c], 0x10
mov dword [ebp - 0x20], 0x111
mov dword [ebp - 0xc], 0x88
mov dword [ebp - 0x50], 0x3c4
mov dword [ebp - 0x18], 0x37a
mov dword [ebp - 0x54], 0x165
mov dword [ebp - 0x58], 0x1a
mov dword [ebp - 0x5c], 0xb
mov dword [ebp - 0x60], 0x3e0
mov dword [ebp - 0x64], 0x37d
mov dword [ebp - 0x1c], 0x332
mov dword [ebp - 0x68], 0x291
mov eax, dword [ebp - 0x18]
sub eax, 0x319
push eax
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x73
push ecx
mov edx, dword [ebp - 0x20]
sub edx, 0xc8
push edx
mov eax, dword [ebp - 0x24]
add eax, 0x8e
push eax
mov ecx, dword [ebp + 0x14]
sub ecx, 0x2b9
push ecx
mov edx, dword [ebp + 0x10]
sub edx, 0xbf
push edx
call fcn.0040aef0
add esp, 0x18
mov dword [ebp - 4], 0
jmp 0x416c4f
mov eax, dword [ebp - 4]
nop
inc eax
nop
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
sub ecx, 0x189be
cmp dword [ebp - 4], ecx
jge 0x416c6e
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0xc]
nop
inc edx
nop
mov dword [ebp - 0xc], edx
jmp 0x416c46
mov dword [ebp - 8], 0
jmp 0x416c80
mov ecx, dword [ebp - 0x28]
sub ecx, 0x18897
cmp dword [ebp - 8], ecx
jge 0x416ca2
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x14]
sub eax, 1
mov dword [ebp - 0x14], eax
mov esp, ebp
pop ebp
ret
Function at 0x420810
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov dword [ebp - 0x14], 0x1ce
mov dword [ebp - 0x24], 0x2f7
mov dword [ebp - 0x28], 0x1a4
mov dword [ebp - 0x2c], 0x15d
mov dword [ebp - 0xc], 0x1f5
mov dword [ebp - 0x30], 0xf6
mov dword [ebp - 0x34], 0x43
mov dword [ebp - 0x38], 0x319
mov dword [ebp - 0x10], 0x2ae
mov dword [ebp - 0x3c], 0x19e
mov dword [ebp - 0x1c], 0x56
mov dword [ebp - 0x40], 0x1b4
mov dword [ebp - 0x20], 0x27d
mov dword [ebp - 0x44], 0x368
mov dword [ebp - 0x48], 0x28
mov dword [ebp - 0x4c], 0x1aa
mov dword [ebp - 0x50], 0xe1
mov dword [ebp - 0x18], 0x2a8
mov dword [ebp - 0x54], 0xf6
mov dword [ebp - 0x58], 0xb2
mov dword [ebp - 0x5c], 0x270
mov dword [ebp - 0x60], 0x164
mov dword [ebp - 0x64], 0x32b
mov dword [ebp - 4], 0
jmp 0x4208c9
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x18]
sub ecx, 0x18948
cmp dword [ebp - 4], ecx
jge 0x4208f0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ebp + 0x24]
jge 0x4208ee
mov eax, dword [ebp - 0xc]
dec eax
nop
nop
mov dword [ebp - 0xc], eax
jmp 0x4208c0
mov dword [ebp - 8], 0
jmp 0x420902
mov ecx, dword [ebp - 8]
nop
inc ecx
nop
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x20]
sub edx, 0x1891d
cmp dword [ebp - 8], edx
jge 0x420921
mov eax, dword [ebp - 0x10]
nop
nop
dec eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
jmp 0x4208f9
mov ecx, dword [ebp - 0x14]
nop
dec ecx
nop
mov dword [ebp - 0x14], ecx
mov esp, ebp
pop ebp
ret
Function at 0x423fb0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov dword [ebp - 0x24], 0x3b7
mov dword [ebp - 0x18], 0x289
mov dword [ebp - 0x28], 0x13f
mov dword [ebp - 0x2c], 0x24b
mov dword [ebp - 0x10], 0x12a
mov dword [ebp - 0x30], 0x2ed
mov dword [ebp - 0x34], 0x14
mov dword [ebp - 0x38], 0x198
mov dword [ebp - 0x3c], 0x11c
mov dword [ebp - 0x40], 0x13a
mov dword [ebp - 0x44], 0x314
mov dword [ebp - 0x48], 0x3ae
mov dword [ebp - 0x4c], 0x20a
mov dword [ebp - 0x1c], 0x30
mov dword [ebp - 0x50], 0x3de
mov dword [ebp - 8], 0x36f
mov dword [ebp - 0x54], 0x3c0
mov dword [ebp - 0x14], 0x126
mov dword [ebp - 0x58], 0x3dc
mov dword [ebp - 0x5c], 0x24d
mov dword [ebp - 0x60], 0x145
mov dword [ebp - 0x64], 0xcb
mov dword [ebp - 0x20], 0x3e3
mov dword [ebp - 0x68], 0x73
mov dword [ebp - 0x6c], 0x192
mov dword [ebp - 4], 0
jmp 0x424077
mov eax, dword [ebp - 4]
inc eax
nop
nop
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x14]
sub ecx, 0x125
cmp dword [ebp - 4], ecx
jge 0x424090
mov edx, dword [ebp - 8]
dec edx
nop
nop
mov dword [ebp - 8], edx
jmp 0x42406e
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x18]
test eax, eax
je 0x4240a4
mov ecx, dword [ebp + 0x14]
nop
nop
inc ecx
mov dword [ebp + 0x14], ecx
mov edx, dword [ebp - 8]
sub edx, 0x1f8
push edx
mov eax, dword [ebp - 0x10]
add eax, 0xffffff09
push eax
call fcn.004250d0
add esp, 8
mov dword [ebp - 0xc], 0
jmp 0x4240d1
mov ecx, dword [ebp - 0xc]
inc ecx
nop
nop
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x14]
sub edx, 0x187c6
cmp dword [ebp - 0xc], edx
jge 0x4240f0
mov eax, dword [ebp + 0x18]
add eax, 1
mov dword [ebp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x4240c8
mov ecx, dword [ebp - 0x1c]
add ecx, 0xdb
push ecx
mov edx, dword [ebp - 0x20]
sub edx, 0x15a
push edx
call fcn.00408c20
add esp, 8
mov esp, ebp
pop ebp
ret