joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10025d30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1003200c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x10025dd3
cmp byte [esi + 0x3d], 0
je 0x10025dd3
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10025d88
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10025d9a
sub eax, 1
je 0x10025d9e
sub eax, 2
je 0x10025dd3
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002641f
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10025dbc
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10025d88
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002641f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.1002641f
mov esp, ebp
pop ebp
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..retplne
nop
nop
nop
nop
push 4
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x5f164efe
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..reloc
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x621e0474
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x10149af8
Capabilities:
Encode data using xor

Disassembly:
or bh, 0x6d
scasb al, byte es:[edi]
popfd
fdivr dword [edx + 0x5a3028a0]
jae 0x10149af0
movsb byte es:[edi], byte [esi]
xchg edi, eax
out dx, eax
invalid
int3
mov edi, ebx
push dword [esp]
cmc
pushfd
mov al, 0x2e
pushfd
repne scasb al, byte es:[edi]
pushal
call fcn.1016b936
or edi, dword [ebp + 0x7d91a9ac]
dec ebx
mov bl, 0xab
popfd
movsd dword es:[edi], dword [esi]
mov dword [0xd3183287], eax
outsb dx, byte [esi]
jbe 0x10149a9d
dec edi
jge 0x10149b6a
mov al, 0xc5
cmp eax, dword [edx + 0x5f3eb5fa]
fisubr dword [ebx + 0x3c]
invalid
stosb byte es:[edi], al
pushal
mov ch, 0x96
sub eax, 0x286fcdc8
add ebp, dword [ecx]
sbb esp, dword [ecx - 0x59]
mov al, 0x66
popal
stosd dword es:[edi], eax
adc dword [esi], edx
test al, 0xff
xchg byte [eax], ch
inc edx
adc edi, dword [eax + 0x49]
shr byte [ebx - 0x44], cl
fld dword [ebx - 0x565fec76]
xchg ecx, eax
jge 0x10149be1
adc esp, dword [eax + 0x4f7d91a9]
test eax, 0x584f7d91
pop eax
xlatb
push ds
sub bl, ch
jle 0x10149bce
shr byte [ebx + 0xc], 1
xor cl, bl
jne 0x10149bcf
imul edx, dword [ecx + 0x78], 0x32
seto byte [ecx]
sbb dword [eax - 0x4e], edx
ja 0x10149b8c
mov al, 0xdd
fsubr st(4)
out dx, eax
stc
add dword [eax - 0x61], edx
cli
invalid
ljmp 0x9819:0xeef2d2ab
stosd dword es:[edi], eax
sal dl, cl
out dx, al
sbb dword [eax + 0x22f85db2], ebx
in al, 0x5b
add ebp, dword [eax]
xor dword [ebx - 0x50], edi
das
sub dl, bl
out dx, al
jge 0x10149c65
fdivr dword [ebp - 0x33]
adc esp, dword [eax]
push 0xbc0e7d6f
shr dword [edx - 0x56fb48d9], 0xf1
dec edx
fstp xword [eax]
xor edi, esi
mov ecx, 0x2697e698
outsb dx, byte [esi]
outsd dx, dword [esi]
aam 0x75
mov edx, 0xae71a9bd
xchg ecx, eax
jge 0x10149b8e
loopne 0x10149be4
pop ss
sbb eax, 0x999e9bf0
sahf
cdq
xor eax, 0x139a8f72
xor esp, dword [eax]
push 0x9969d6f
in eax, dx
stosb byte es:[edi], al
daa
mov bh, 0
sbb eax, 0x9040e868
outsb dx, byte [esi]
jle 0x10149c14
or byte [edi - 0x36], dh
aam 0x85
cdq
sub byte [ebx + 0x14], ch
push esp
call 0x79df6b44
fcomp dword [esi]
aam 0x5d
cld
cmpsb byte [esi], byte es:[edi]
lea esi, [edx + 0x63111644]
add esp, ebp
xchg ecx, eax
ficomp word [edx + 0x584298ef]
lea esp, [esi + 0x3a]
inc esi
inc ecx
lcall 0x668d, 0x584298ef
cmp al, byte [esi + 0x41]
jmp 0x10149c68
ret 0xcdc5
sbb al, 0xb2
xchg edi, eax
outsb dx, byte es:[esi]
add bh, byte [ebx - 0x24bc6755]
scasb al, byte es:[edi]
xchg ecx, eax
jge 0x10149c4e
jnp 0x10149c34
and dword [edi + edi + 0x61], esp
and al, 0xd5
pop dword [ecx + 0x5d]
call 0xc64f0311
mov cl, 0x4c
jle 0x10149c5e
in al, dx
cmpsb byte [esi], byte es:[edi]
pop eax
popfd
cmc
xchg esp, eax
pushfd
mov byte [0x535731f2], al
cmp eax, 0x8f4ab5e0
mov byte [0x8616bcd9], al
mov esi, cs
ret
Function at 0x10164b29
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [esi + 0x78]
mov byte [esp], 0x15
stc
push 0x162936b4
pushal
test edx, edx
jmp 0x101676f4
rcl edx, cl
add esi, eax
lea edx, [edx*2 - 0x4cf67d51]
rcl dl, cl
shld dx, sp, 7
jmp 0x100d34b2
mov byte [esp + 4], 0xad
lea esp, [esp + 0x28]
je fcn.1013ad94
bswap ecx
add edx, eax
jmp 0x10169ca9
jmp 0x10166f2c
rcr cx, cl
bsr ecx, eax
rcl cl, 2
mov ecx, dword [esi + 0x7c]
bt eax, edx
call fcn.100d3f8e
Function at 0x412874
Capabilities:
Encode data using xor

Disassembly:
fmul st(3)
dec ebp
add eax, dword [edx + 0x69]
inc esp
imul ebp, dword [edi], 0xccb7ad7a
or eax, 0x9646e9a2
imul dword [esi - 0x62a5ca3a]
mov eax, dword [0x76a79f7b]
and dword [eax - 0x4c9aa00b], edx
and dword [edx], 0xcafd70e9
std
retf 0x2981
sub dword [ecx], 0xc3373465
and dword [edx + 0x72], ebx
xor eax, 0x4eabf682
push edi
mov word [eax], gs
mov al, 0x75
jge 0x4127d3
mov eax, dword [0x63221ae8]
fnstsw word [edx]
mov ah, 0xce
and ebp, dword [eax + 0x6f]
mov edx, 0x114b3dfa
dec byte [ecx - 0x53]
mov eax, dword [0x65c7e849]
inc esp
outsd dx, dword [esi]
call 0x7038f9c0
jg 0x41285f
stosd dword es:[edi], eax
ret
sub dl, ch
int 0xe7
sal byte [ebp - 0x5ad67896], 1
movsd dword es:[edi], dword [esi]
xchg ebx, eax
dec eax
jle 0x4127fc
out 0x83, al
mov bl, 0x1b
xchg esi, eax
jne 0x4127fa
test dword [ebp + ebx + 0x33], edi
mov dword [0x77562640], eax
ja 0x412887
ja 0x41283f
push edx
inc ebp
adc byte [eax + ebx*4 + 0x6f], ah
mov edx, 0xe9eb5efa
stc
jge 0x4128ea
jne 0x412856
pop eax
leave
ror dword [ebx + 0x78245809], 1
jo 0x4128b6
xor dword [ecx], esi
pop ecx
sbb al, 0xe
dec ecx
inc eax
invalid
invalid
mov ebx, 0xf55e31f5
or eax, dword [esi - 0x53]
inc edx
popfd
or ebx, dword cs:[edx - 0x44ba3ccd]
xor ah, bh
xor dword [eax - 0x5a2852eb], edx
push edi
push esi
invalid
sub bl, byte [ebp + 0x4f]
mov edx, 0x67730679
imul ebx, dword [eax + 0x39], 0xea457b55
pop ebp
je 0x41296b
cmp dword [ebp + 0x7b], edx
inc ebp
ljmp 0xbc73
js 0x412971
mov esp, 0x50e4ae0d
mov al, 0xd3
out dx, eax
jo 0x4128f4
pop edi
pop esi
je 0x41298b
lodsd eax, dword [esi]
xchg byte [ebp - 0x33588987], cl
xor al, 0x55
imul edx, ebp, 0xe8147f5d
jl 0x4128af
add al, 0xd6
out dx, eax
int1
xchg byte [esi], dh
movsb byte es:[edi], byte [esi]
in al, 0xc8
stc
ret
jge 0x41295c
insd dword es:[edi], dx
xchg edi, eax
sahf
lahf
sahf
hlt
or al, 0x3f
xchg edx, ecx
jg 0x412985
push edx
rcl ebx, 1
dec esi
test eax, 0x3e902834
cmp eax, 0xded288f5
sub byte [eax - 0x770ac2c2], dl
rcr dh, cl
mov ebx, 0x6e0bdc41
push ebx
dec ebp
aas
fist word [edi + ebx*2 + 0x79f44e03]
fild dword [ecx + 0x14183706]
jge 0x4129b1
sbb byte [edi*2 - 0x55c573be], dl
invalid
stosb byte es:[edi], al
cwde
inc esi
mov si, 0xac61
lodsb al, byte [esi]
stosd dword es:[edi], eax
hlt
out dx, al
ja 0x4129a5
sbb dword [ebp + edi*2 + 0x4d], ebp
insb byte es:[edi], dx
jge 0x4129dc
jbe 0x412977
scasb al, byte es:[edi]
aaa
das
outsd dx, dword [esi]
jns 0x412989
add esp, dword [ebx]
adc eax, 0x6fea148c
jo 0x4129fd
int3
jge 0x41293a
push es
mov cl, 0x2f
mov byte [0x2767440b], al
jmp 0x41294f
popfd
cmp byte [ebp - 0x21c51591], bh
push 0x1c
int 0x22
sbb eax, 0xcce7576b
push edi
out 0xcc, eax
int3
jnp 0x412943
jae 0x4129be
push 0xf0d4de92
pop ebx
invalid
invalid
pop ebp
and dword [ebx + 6], edi
push esp
xchg esi, eax
insd dword es:[edi], dx
inc ebp
dec edx
jge 0x4129c0
invalid
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
mov ecx, 0x3ed605e2
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
mov ecx, 0x12d60a3
nop
nop
nop
nop
nop
test eax, eax
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x403c50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
test ecx, ecx
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 8], esi
mov esi, edx
mov dword [ebp - 4], edi
mov edi, ecx
jne 0x403c76
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x38]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x403d0a
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x403cc5
cmp eax, 0x40
je 0x403cc5
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x403c69
cmp eax, 0x40
je 0x403c69
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
jmp 0x403c69
mov dword [esp + 8], 0x34
mov dword [esp + 4], str..._.._runtime_pseudo_reloc.c
mov dword [esp], str.VirtualQuery__addr__b__sizeof_b__
call sub.msvcrt.dll__assert
lea esi, [esi]
lea edi, [edi]

Function at 0x403f80
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call fcn.00403f60
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
je 0x404020
movzx edx, byte [ebx]
cmp dl, 9
je 0x404064
cmp dl, 0x20
je 0x404064
cmp dl, 0x22
je 0x404004
cmp dl, 9
mov eax, edx
je 0x404018
cmp dl, 0x20
je 0x404070
test dl, dl
lea esi, [esi]
jne 0x403ff2
jmp 0x404020
cmp al, 0x20
je 0x404070
test al, al
nop
je 0x404020
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
jne 0x403fe4
jmp 0x404018
cmp al, 0x22
je 0x40400e
add ebx, 1
movzx eax, byte [ebx]
test al, al
jne 0x404000
cmp al, 0x22
jne 0x404018
add ebx, 1
movzx eax, byte [ebx]
cmp al, 0x20
je 0x404070
cmp al, 9
je 0x404070
test byte [ebp - 0x30], 1
mov esi, 0xa
je 0x40402f
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00401480
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
add ebx, 1
jmp 0x403fb1
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
je 0x404070
cmp al, 0x20
jne 0x404020
nop
jmp 0x404070
Function at 0x404348
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [0x40cdb0]
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x404384
mov dword [ebx + 0x24], eax
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00404f10
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x28], eax
add esp, 0x14
pop ebx
leave
ret
call fcn.00404ebc
jmp 0x404372

Function at 0x4044a8
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, eax
mov esi, edx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x20], eax
mov edx, dword [ebx + 0x10]
mov dword [ebp - 0x1c], edx
mov eax, dword [esi]
jmp 0x4044d1
mov dword [eax + 0x20], edi
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [esi], eax
test eax, eax
je 0x404598
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x2c], eax
xor edi, edi
mov eax, 0xa
mov ecx, dword [ebp - 0x1c]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov edx, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], eax
mov dword [esp], 1
call dword [ebp - 0x20]
test eax, eax
jne 0x4045bc
cmp edi, 5
je 0x4045c1
mov edx, dword [ebp - 0x2c]
test edx, edx
je 0x40455b
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0xa
mov dword [esp], 1
call dword [ebp - 0x2c]
mov edi, eax
cmp eax, 7
je 0x4045c1
cmp eax, 8
jne 0x4045bc
mov eax, dword [esi]
mov edi, dword [eax]
mov eax, dword [0x40cdb0]
mov edx, dword [eax + 0x28]
test edx, edx
js 0x4045ac
test edx, edx
je 0x4044c8
mov dword [esp + 4], edi
mov eax, dword [eax + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsSetValue
sub esp, 8
test eax, eax
jne 0x4044cb
call fcn.00404ebc
jmp 0x4044cb
mov dword [ebp - 0x2c], 0
mov edi, 5
mov al, 0x1a
jmp 0x4044e6
call fcn.0040438c
mov eax, dword [0x40cdb0]
mov edx, dword [eax + 0x28]
jmp 0x40456b
mov edi, 2
mov eax, edi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x40479c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [ebp + 8]
mov eax, dword [0x40cdb0]
mov edx, dword [eax + 0x28]
test edx, edx
js 0x404881
test edx, edx
jne 0x404820
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
test eax, eax
je 0x404813
lea esi, [ebp - 0x20]
jmp 0x4047d3
mov dword [ebp - 0x20], eax
mov eax, dword [eax + 0x18]
test eax, eax
je 0x40480a
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov edx, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], 1
mov dword [esp], 1
call eax
cmp eax, 6
je 0x404848
cmp eax, 8
jne 0x404874
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
test eax, eax
jne 0x4047d0
mov eax, 5
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov edi, dword [eax + 0x24]
call fcn.00404ebc
mov esi, eax
mov dword [esp], edi
call sub.KERNEL32.dll_TlsGetValue
push edi
mov dword [esp], esi
mov dword [ebp - 0x2c], eax
call sub.KERNEL32.dll_SetLastError
push ecx
mov eax, dword [ebp - 0x2c]
jmp 0x4047bf
mov dword [ebx + 0xc], 0
mov eax, dword [ebp - 0x20]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov edx, esi
mov eax, ebx
call fcn.00404404
cmp eax, 7
jne 0x404818
lea eax, [ebp - 0x1c]
mov edx, esi
call fcn.004045cc
nop
mov eax, 3
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
call fcn.0040438c
mov eax, dword [0x40cdb0]
mov edx, dword [eax + 0x28]
jmp 0x4047b8
Function at 0x404894
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx + 0xc]
test ecx, ecx
jne 0x4048b8
mov dword [esp], ebx
call fcn.0040479c
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov eax, dword [0x40cdb0]
mov edx, dword [eax + 0x28]
test edx, edx
js 0x40490c
test edx, edx
jne 0x4048e8
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
lea esi, [ebp - 0x20]
mov edx, esi
mov eax, ebx
call fcn.004044a8
cmp eax, 7
je 0x40491c
call sub.msvcrt.dll_abort
nop
mov edi, dword [eax + 0x24]
call fcn.00404ebc
mov esi, eax
mov dword [esp], edi
call sub.KERNEL32.dll_TlsGetValue
push edx
mov dword [esp], esi
mov dword [ebp - 0x2c], eax
call sub.KERNEL32.dll_SetLastError
push eax
mov eax, dword [ebp - 0x2c]
jmp 0x4048cb
call fcn.0040438c
mov eax, dword [0x40cdb0]
mov edx, dword [eax + 0x28]
jmp 0x4048c4
lea eax, [ebp - 0x1c]
mov edx, esi
call fcn.004045cc
nop
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov edi, dword [ebp + 8]
mov eax, dword [0x40cdb0]
mov edx, dword [eax + 0x28]
test edx, edx
js 0x4049a8
test edx, edx
jne 0x404984
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x1c], eax
lea esi, [ebp - 0x1c]
jmp 0x40495d
cmp ebx, 5
je 0x40497a
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
cmp eax, 1
sbb ebx, ebx
and ebx, 5
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], esi
call edi
test eax, eax
je 0x404950
mov ebx, 3
mov eax, ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov esi, dword [eax + 0x24]
call fcn.00404ebc
mov ebx, eax
mov dword [esp], esi
call sub.KERNEL32.dll_TlsGetValue
push esi
mov dword [esp], ebx
mov dword [ebp - 0x2c], eax
call sub.KERNEL32.dll_SetLastError
push ebx
mov eax, dword [ebp - 0x2c]
jmp 0x404947
call fcn.0040438c
mov eax, dword [0x40cdb0]
mov edx, dword [eax + 0x28]
jmp 0x404940

Function at 0x4049b8
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
mov eax, dword [0x40cdb0]
mov edx, dword [eax + 0x28]
test edx, edx
js 0x404a3c
test edx, edx
jne 0x404a18
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov edi, dword [ebx + 0xc]
test edi, edi
jne 0x4049fc
lea esi, [ebp - 0x20]
mov edx, esi
mov eax, ebx
call fcn.00404404
cmp eax, 7
je 0x404a0d
call sub.msvcrt.dll_abort
nop
lea esi, [ebp - 0x20]
mov edx, esi
mov eax, ebx
call fcn.004044a8
cmp eax, 7
jne 0x4049f5
lea eax, [ebp - 0x1c]
mov edx, esi
call fcn.004045cc
nop
mov edi, dword [eax + 0x24]
call fcn.00404ebc
mov esi, eax
mov dword [esp], edi
call sub.KERNEL32.dll_TlsGetValue
push edx
mov dword [esp], esi
mov dword [ebp - 0x2c], eax
call sub.KERNEL32.dll_SetLastError
push eax
mov eax, dword [ebp - 0x2c]
jmp 0x4049d7
call fcn.0040438c
mov eax, dword [0x40cdb0]
mov edx, dword [eax + 0x28]
jmp 0x4049d0
Function at 0x402b14
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404610
test esi, esi
jne 0x402b4a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404700
jmp 0x402b68
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004029c8
mov edi, eax
test esi, esi
je 0x402b68
cmp dword [ebx], 0
je 0x402b68
dec esi
jmp 0x402b51
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403690
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x48500c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403728
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403708
xor eax, eax
push ebp
push 0x403701
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403744
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403708
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x48500c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x48500c], ax
mov esp, ebp
pop ebp
ret

Function at 0x404410
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x48a04c], 0
je 0x404471
cmp word [0x48a220], 0xd7b2
jne 0x404439
cmp dword [0x48a228], 0
jbe 0x404439
mov eax, 0x48a21c
call dword [fcn.0048a238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x485054
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404498
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x48501c], 0
jne 0x40448d
push 0
push 0x485074
push 0x485054
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4045c4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.0040278c
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x48a04d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x40458c
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc