joyce8/EMBER2024-capa huggingface dataset:
Function at 0x907df9b
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90ac387
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x13f0
call fcn.090a6f20
mov eax, dword [0x90e6610]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x13e8], edi
mov esi, dword [ebx + 8]
push 0
mov dword [ebp - 0x13e4], esi
mov eax, dword [esi + 4]
add eax, 0x94
push eax
call fcn.0900ba50
cmp dword [edi], 0
pop ecx
pop ecx
jne 0x907e020
push 0
push 0x753
push 0xb71b
push dword [esi + 4]
call fcn.0900ba50
add esp, 0x10
mov dword [edi], eax
mov ecx, esi
mov dword [ebp - 0x13ec], esi
call fcn.090168fd
and dword [ebp - 4], 0
lea edi, [ebp - 0x48]
push 0xc
pop ecx
mov eax, ecx
mov dword [ebp - 0x13dc], 0x18
xor edx, edx
add ecx, 0x8000
div dword [ebp - 0x13dc]
mov word [edi], ax
lea edi, [edi + 2]
cmp ecx, 0xc800c
jb 0x907e037
and dword [ebp - 0x13e0], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x13dc], eax
movzx eax, word [eax]
lea ecx, [ebp - 0x13cc]
xor edx, edx
mov dword [ebp - 0x13d8], eax
mov dword [ebp - 0x13d4], edx
movzx esi, word [ebp + edx*2 - 0x48]
xor edi, edi
mov edx, dword [ebp - 0x13d8]
mov ax, word [ebp + edi*2 - 0x48]
inc edi
mov word [ecx - 2], dx
mov word [ecx], si
mov word [ecx + 2], ax
add ecx, 8
cmp edi, 0x19
jb 0x907e093
mov edx, dword [ebp - 0x13d4]
inc edx
mov dword [ebp - 0x13d4], edx
cmp edx, 0x19
jb 0x907e086
mov ecx, dword [ebp - 0x13e4]
mov eax, 0x504c4142
push 0
push eax
push eax
push 0x271
lea eax, [ebp - 0x13d0]
push eax
push eax
call fcn.0900ba50
mov eax, dword [ebp - 0x13e8]
lea ecx, [ebp - 0x1400]
mov edi, dword [ebp - 0x13e0]
push 1
push 0x753
push edi
push dword [eax]
call fcn.0900ba50
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 1
call fcn.09005d4d
lea esi, [ebp - 0x13d0]
mov dword [ebp - 0x13d8], 0x19
lea edi, [eax + 2]
mov dword [ebp - 0x13d4], 0x19
mov eax, dword [esi]
mov edx, dword [esi + 4]
shr eax, 0x10
imul eax, eax, 0xff
movzx ecx, dx
add ecx, 0x40
shr ecx, 7
add eax, 0x4000
shr eax, 0xf
cmp ecx, 0xff
mov byte [edi - 2], al
movzx eax, cl
mov ecx, 0xff
cmova eax, ecx
shr edx, 0x10
add edx, 0x40
mov byte [edi - 1], al
shr edx, 7
cmp edx, ecx
movzx eax, dl
cmova eax, ecx
add esi, 8
mov byte [edi], al
add edi, 3
sub dword [ebp - 0x13d4], 1
jne 0x907e12c
sub dword [ebp - 0x13d8], 1
jne 0x907e122
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 0
call fcn.09005e1d
mov edi, dword [ebp - 0x13e0]
mov eax, dword [ebp - 0x13dc]
add edi, 0x753
mov esi, dword [ebp - 0x13e4]
add eax, 2
mov dword [ebp - 0x13dc], eax
mov dword [ebp - 0x13e0], edi
cmp edi, 0xb71b
jb 0x907e06f
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.09016a6b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09001f80
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x907e5ad
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90ac387
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x13f0
call fcn.090a6f20
mov eax, dword [0x90e6610]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x13e8], edi
mov esi, dword [ebx + 8]
push 0
mov dword [ebp - 0x13e4], esi
mov eax, dword [esi + 4]
add eax, 0x94
push eax
call fcn.0900ba50
cmp dword [edi], 0
pop ecx
pop ecx
jne 0x907e632
push 0
push 0x9c4
push 0xf424
push dword [esi + 4]
call fcn.0900ba50
add esp, 0x10
mov dword [edi], eax
mov ecx, esi
mov dword [ebp - 0x13ec], esi
call fcn.090168fd
and dword [ebp - 4], 0
lea edi, [ebp - 0x48]
push 0xc
pop ecx
mov eax, ecx
mov dword [ebp - 0x13dc], 0x18
xor edx, edx
add ecx, 0x8000
div dword [ebp - 0x13dc]
mov word [edi], ax
lea edi, [edi + 2]
cmp ecx, 0xc800c
jb 0x907e649
and dword [ebp - 0x13e0], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x13dc], eax
movzx eax, word [eax]
lea ecx, [ebp - 0x13cc]
xor edx, edx
mov dword [ebp - 0x13d8], eax
mov dword [ebp - 0x13d4], edx
movzx esi, word [ebp + edx*2 - 0x48]
xor edi, edi
mov edx, dword [ebp - 0x13d8]
mov ax, word [ebp + edi*2 - 0x48]
inc edi
mov word [ecx - 2], dx
mov word [ecx], si
mov word [ecx + 2], ax
add ecx, 8
cmp edi, 0x19
jb 0x907e6a5
mov edx, dword [ebp - 0x13d4]
inc edx
mov dword [ebp - 0x13d4], edx
cmp edx, 0x19
jb 0x907e698
mov ecx, dword [ebp - 0x13e4]
lea eax, [ebp - 0x13d0]
push 0
push 0x434d594b
push 0x50524742
push 0x271
push eax
push eax
call fcn.0900ba50
mov eax, dword [ebp - 0x13e8]
lea ecx, [ebp - 0x1400]
mov edi, dword [ebp - 0x13e0]
push 1
push 0x9c4
push edi
push dword [eax]
call fcn.0900ba50
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 1
call fcn.09005d4d
lea esi, [ebp - 0x13d0]
mov dword [ebp - 0x13d8], 0x19
lea edi, [eax + 2]
mov dword [ebp - 0x13d4], 0x19
mov ecx, dword [esi]
mov edx, dword [esi + 4]
add esi, 8
movzx eax, cx
imul eax, eax, 0xff
shr ecx, 0x10
add eax, 0x4000
shr eax, 0xf
mov byte [edi - 2], al
imul eax, ecx, 0xff
mov ecx, 0x4000
add eax, ecx
shr eax, 0xf
mov byte [edi - 1], al
movzx eax, dx
imul eax, eax, 0xff
shr edx, 0x10
add eax, ecx
shr eax, 0xf
mov byte [edi], al
imul eax, edx, 0xff
add eax, ecx
shr eax, 0xf
mov byte [edi + 1], al
add edi, 4
sub dword [ebp - 0x13d4], 1
jne 0x907e741
sub dword [ebp - 0x13d8], 1
jne 0x907e737
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 0
call fcn.09005e1d
mov edi, dword [ebp - 0x13e0]
mov eax, dword [ebp - 0x13dc]
add edi, 0x9c4
mov esi, dword [ebp - 0x13e4]
add eax, 2
mov dword [ebp - 0x13dc], eax
mov dword [ebp - 0x13e0], edi
cmp edi, 0xf424
jb 0x907e681
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.09016a6b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09001f80
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x909f010
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90ace1d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xb20
mov eax, dword [0x90e6610]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebx + 8]
mov esi, dword [ebx + 0x18]
push eax
mov dword [ebp - 0xb2c], eax
call fcn.0900ba50
add esp, 4
lea ecx, [ebp - 0xb24]
push eax
call fcn.0900ba50
push 0
push 0
push 0
push 1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
push dword [ebp - 0xb24]
mov dword [ebp - 4], 0
push esi
call fcn.09008247
add esp, 0x3c
lea ecx, [ebp - 0xb20]
push eax
call fcn.0900ba50
mov byte [ebp - 4], 1
xor eax, eax
nop dword [eax]
nop dword [eax + eax]
mov byte [ebp + eax - 0x118], al
inc eax
cmp eax, 0x100
jb 0x909f0c0
mov ecx, dword [ebp - 0xb20]
lea eax, [ebp - 0x918]
push 0
push 0x5058595a
push 0x67386b30
push 0x100
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.0900ba50
movzx ecx, word [ebp - 0x11c]
movzx edi, word [ebp - 0x914]
mov dword [ebp - 0xb28], ecx
cmp ecx, edi
jbe 0x909f23a
mov edx, ecx
sub edx, edi
xor esi, esi
mov dword [ebp - 0xb1c], edx
movzx eax, word [ebp + esi*8 - 0x914]
cmp eax, edi
ja 0x909f131
xor eax, eax
jmp 0x909f15e
cmp eax, ecx
jb 0x909f13c
mov eax, 0x8000
jmp 0x909f15e
sub eax, edi
mov ecx, edx
shl eax, 0xf
xor edx, edx
shr ecx, 1
add eax, ecx
mov ecx, dword [ebp - 0xb28]
div dword [ebp - 0xb1c]
mov edx, dword [ebp - 0xb1c]
movzx eax, ax
mov word [ebp + esi*2 - 0xb18], ax
inc esi
cmp esi, 0x100
jb 0x909f121
lea ecx, [ebp - 0xb20]
mov byte [ebp - 4], 0
call fcn.09017177
lea ecx, [ebp - 0xb24]
mov dword [ebp - 4], 0xffffffff
call fcn.0901b295
mov esi, dword [ebp - 0xb2c]
lea eax, [esi + 8]
push eax
push 0x278
mov dword [ebp - 0xb2c], eax
call fcn.0900ba50
add esp, 8
mov dword [ebp - 0xb28], eax
mov dword [ebp - 4], 2
test eax, eax
je 0x909f1ca
push esi
mov ecx, eax
call fcn.0900ba50
mov edx, eax
jmp 0x909f1cc
xor edx, edx
mov ecx, dword [ebx + 0xc]
xorps xmm0, xmm0
movsd xmm1, qword [ebx + 0x10]
mulsd xmm1, qword [0x90bee38]
mov eax, dword [ecx]
mov dword [edx + 0x68], eax
mov eax, dword [ecx + 4]
comisd xmm0, xmm1
mov dword [edx + 0x6c], eax
jbe 0x909f1fa
subsd xmm1, qword [0x90b4780]
jmp 0x909f202
addsd xmm1, qword [0x90b4780]
cvttsd2si eax, xmm1
lea edi, [edx + 0x72]
mov ecx, 0x80
lea esi, [ebp - 0xb18]
rep movsd dword es:[edi], dword [esi]
mov word [edx + 0x70], ax
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09001f80
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0x6250726f
call fcn.0900ba50
int3
Function at 0x4099a4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409a77
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409a90
push ebx
push 0x409a9c
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409a24
mov al, 0x69
call fcn.00409648
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.00409978
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a2d
call fcn.00409978
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409a7e
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409b30
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409be4
jmp 0x409bd9
cmp dword [esi + 0x10], 0x1000
jne 0x409bc5
test byte [esi + 0x15], 1
jne 0x409bc5
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409b84
cmp eax, 2
je 0x409b84
cmp eax, 0x10
je 0x409b84
cmp eax, 0x20
jne 0x409b99
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409b99
mov bl, 1
xor ebp, ebp
jmp 0x409baa
mov eax, dword [esi]
add eax, ebp
call fcn.00409b28
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409b9d
test bl, bl
je 0x409bc5
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409be4
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409b5c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53
Function at 0x1c41fa0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x3fd000]
push edi
jmp 0x1c41fba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1c41fc1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1c41fb0
mov eax, 1
add ebx, ebx
jne 0x1c41fd3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1c41fe4
jne 0x1c42003
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1c42003
dec eax
add ebx, ebx
jne 0x1c41ff0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x1c41fc8
add ebx, ebx
jne 0x1c41fff
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x1c42055
xor ecx, ecx
sub eax, 3
jb 0x1c4201b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1c4208a
sar eax, 1
mov ebp, eax
jmp 0x1c42026
add ebx, ebx
jne 0x1c42026
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1c41ff4
inc ecx
add ebx, ebx
jne 0x1c42034
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1c41ff4
add ebx, ebx
jne 0x1c42041
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1c42036
jne 0x1c42052
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1c42036
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1c42074
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1c42066
jmp 0x1c41fb6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1c42074
add edi, ecx
jmp 0x1c41fb6
pop esi
mov edi, esi
mov ecx, 0x5b04
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x1c42092
cmp byte [edi], 0x2c
jne 0x1c42092
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x1c42097
lea edi, [esi + 0x183e000]
mov eax, dword [edi]
or eax, eax
je 0x1c4210f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1844290]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x18443dc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1c420c4
mov ecx, edi
jns 0x1c420f3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x18443e4]
or eax, eax
je 0x1c42109
mov dword [ebx], eax
add ebx, 4
jmp 0x1c420e1
call dword [esi + 0x18443e0]
mov ebp, dword [esi + 0x18443e8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1c42143
sub esp, 0xffffff80
jmp 0x4c852d
Function at 0x4013a0
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
mov esi, 0x4875e8
cmp dword [esi], 0
jne 0x4013e6
push 0x644
push 0
call sub.KERNEL32.DLL_WinExec
mov ecx, eax
test ecx, ecx
jne 0x4013c3
xor eax, eax
pop esi
pop ebx
ret
mov eax, dword [0x4875e4]
mov dword [ecx], eax
mov dword [0x4875e4], ecx
xor edx, edx
mov eax, edx
add eax, eax
lea eax, [ecx + eax*8 + 4]
mov ebx, dword [esi]
mov dword [eax], ebx
mov dword [esi], eax
inc edx
cmp edx, 0x64
jne 0x4013d2
mov eax, dword [esi]
mov edx, dword [eax]
mov dword [esi], edx
pop esi
pop ebx
ret

Function at 0x401a2c
Capabilities:
Create process on windows
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
push ebp
push 0x401ae2
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x4875cc
call sub.KERNEL32.DLL_LocalAlloc
cmp byte [0x48704d], 0
je 0x401a5a
push 0x4875cc
call sub.KERNEL32.DLL_TlsGetValue
mov eax, 0x4875ec
call fcn.004013f0
mov eax, 0x4875fc
call fcn.004013f0
mov eax, 0x487628
call fcn.004013f0
push 0xff8
push 0
call sub.KERNEL32.DLL_WinExec
mov dword [0x487624], eax
cmp dword [0x487624], 0
je 0x401ac1
mov eax, 3
mov edx, dword [0x487624]
xor ecx, ecx
mov dword [edx + eax*4 - 0xc], ecx
inc eax
cmp eax, 0x401
jne 0x401a97
mov eax, 0x48760c
mov dword [eax + 4], eax
mov dword [eax], eax
mov dword [0x487618], eax
mov byte [0x4875c4], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401ae9
cmp byte [0x48704d], 0
je 0x401ae1
push 0x4875cc
call sub.KERNEL32.DLL_TlsSetValue
ret

Function at 0x401af0
Capabilities:
Get thread local storage value
Set thread local storage value
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp byte [0x4875c4], 0
je 0x401bcd
xor edx, edx
push ebp
push 0x401bc6
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [0x48704d], 0
je 0x401b22
push 0x4875cc
call sub.KERNEL32.DLL_TlsGetValue
mov byte [0x4875c4], 0
mov eax, dword [0x487624]
push eax
call sub.KERNEL32.DLL_WriteFile
xor eax, eax
mov dword [0x487624], eax
mov ebx, dword [0x4875ec]
jmp 0x401b55
push 0x8000
push 0
mov eax, dword [ebx + 8]
push eax
call sub.KERNEL32.DLL_GetModuleHandleA
mov ebx, dword [ebx]
cmp ebx, 0x4875ec
jne 0x401b43
mov eax, 0x4875ec
call fcn.004013f0
mov eax, 0x4875fc
call fcn.004013f0
mov eax, 0x487628
call fcn.004013f0
mov eax, dword [0x4875e4]
test eax, eax
je 0x401b9b
mov edx, dword [eax]
mov dword [0x4875e4], edx
push eax
call sub.KERNEL32.DLL_WriteFile
mov eax, dword [0x4875e4]
test eax, eax
jne 0x401b84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401bcd
cmp byte [0x48704d], 0
je 0x401bbb
push 0x4875cc
call sub.KERNEL32.DLL_TlsSetValue
push 0x4875cc
call sub.KERNEL32.DLL_Sleep
ret
pop ebx
pop ebp
ret
Function at 0x402118
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, eax
cmp byte [0x4875c4], 0
jne 0x402135
call fcn.00401a2c
test al, al
je 0x40213d
cmp ebx, 0x7ffffff8
jle 0x402147
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x40229b
xor ecx, ecx
push ebp
push 0x402294
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x48704d], 0
je 0x402168
push 0x4875cc
call sub.KERNEL32.DLL_TlsGetValue
add ebx, 7
and ebx, 0xfffffffc
cmp ebx, 0xc
jge 0x402178
mov ebx, 0xc
cmp ebx, 0x1000
jg 0x402217
mov eax, ebx
test eax, eax
jns 0x40218d
add eax, 3
sar eax, 2
mov edx, dword [0x487624]
mov edx, dword [edx + eax*4 - 0xc]
test edx, edx
je 0x402217
mov esi, edx
mov eax, esi
add eax, ebx
and dword [eax], 0xfffffffe
mov eax, dword [edx + 4]
cmp edx, eax
jne 0x4021c8
mov eax, ebx
test eax, eax
jns 0x4021b7
add eax, 3
sar eax, 2
mov ecx, dword [0x487624]
xor edi, edi
mov dword [ecx + eax*4 - 0xc], edi
jmp 0x4021ee
mov ecx, ebx
test ecx, ecx
jns 0x4021d1
add ecx, 3
sar ecx, 2
mov edi, dword [0x487624]
mov dword [edi + ecx*4 - 0xc], eax
mov ecx, dword [edx]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, esi
mov edx, dword [edx + 8]
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x4875b4]
sub ebx, 4
add dword [0x4875b8], ebx
call fcn.00403ad0
jmp 0x40229b
cmp ebx, dword [0x48761c]
jg 0x402269
sub dword [0x48761c], ebx
cmp dword [0x48761c], 0xc
jge 0x40223b
add ebx, dword [0x48761c]
xor eax, eax
mov dword [0x48761c], eax
mov eax, dword [0x487620]
add dword [0x487620], ebx
mov edx, ebx
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x4875b4]
sub ebx, 4
add dword [0x4875b8], ebx
call fcn.00403ad0
jmp 0x40229b
mov eax, ebx
call fcn.00402024
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40229b
cmp byte [0x48704d], 0
je 0x402293
push 0x4875cc
call sub.KERNEL32.DLL_TlsSetValue
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4022a8
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
mov dword [0x4875c8], eax
cmp byte [0x4875c4], 0
jne 0x4022e0
call fcn.00401a2c
test al, al
jne 0x4022e0
mov dword [0x4875c8], 8
mov dword [ebp - 4], 8
jmp 0x402441
xor ecx, ecx
push ebp
push 0x40243a
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x48704d], 0
je 0x402301
push 0x4875cc
call sub.KERNEL32.DLL_TlsGetValue
mov esi, ebx
sub esi, 4
mov ebx, dword [esi]
test bl, 2
jne 0x40231c
mov dword [0x4875c8], 9
jmp 0x402411
dec dword [0x4875b4]
mov eax, ebx
and eax, 0x7ffffffc
sub eax, 4
sub dword [0x4875b8], eax
test bl, 1
je 0x40237c
mov eax, esi
sub eax, 0xc
mov edx, dword [eax + 8]
cmp edx, 0xc
jl 0x40234c
test edx, 0x80000003
je 0x40235b
mov dword [0x4875c8], 0xa
jmp 0x402411
mov eax, esi
sub eax, edx
cmp edx, dword [eax + 8]
je 0x402373
mov dword [0x4875c8], 0xa
jmp 0x402411
add ebx, edx
mov esi, eax
call fcn.00401bd0
and ebx, 0x7ffffffc
mov eax, esi
add eax, ebx
mov edi, eax
cmp edi, dword [0x487620]
jne 0x4023bc
sub dword [0x487620], ebx
add dword [0x48761c], ebx
cmp dword [0x48761c], 0x3c00
jle 0x4023ad
call fcn.00401ec0
xor eax, eax
mov dword [ebp - 4], eax
call fcn.00403ad0
jmp 0x402441
mov edx, dword [eax]
test dl, 2
je 0x4023df
and edx, 0x7ffffffc
cmp edx, 4
jge 0x4023da
mov dword [0x4875c8], 0xb
jmp 0x402411
or dword [eax], 1
jmp 0x402408
mov eax, edi
cmp dword [eax + 4], 0
je 0x4023f2
cmp dword [eax], 0
je 0x4023f2
cmp dword [eax + 8], 0xc
jge 0x4023fe
mov dword [0x4875c8], 0xb
jmp 0x402411
mov edx, dword [eax + 8]
add ebx, edx
call fcn.00401bd0
mov edx, ebx
mov eax, esi
call fcn.00401e38
mov eax, dword [0x4875c8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402441
cmp byte [0x48704d], 0
je 0x402439
push 0x4875cc
call sub.KERNEL32.DLL_TlsSetValue
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x402a14
Capabilities:
Extract resource via kernel32 functions
Move file

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040406c
test esi, esi
jne 0x402a4a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_MoveFileA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0040415c
jmp 0x402a68
call sub.KERNEL32.DLL_LoadResource
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402928
mov edi, eax
test esi, esi
je 0x402a68
cmp dword [ebx], 0
je 0x402a68
dec esi
jmp 0x402a51
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x404724
Capabilities:
Hide graphical window

Disassembly:
test eax, eax
je 0x404738
push eax
push 0
call sub.user32.dll_ShowWindow
test eax, eax
je 0x40471c
ret