joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4849d4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor edx, edx
mov dword [ebp - 0x2c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x484b85
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0xa8], 0
jne 0x484b6f
mov eax, dword [0x56b920]
cmp byte [eax], 0
jne 0x484b6f
push ebx
push fcn.00485264
call fcn.0047ae2c
mov dword [ebx + 0x174], eax
mov eax, fcn.004090bc
mov dword [fcn.004090bc], eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [0x568de4]
push eax
mov eax, dword [0x56eb20]
push eax
call fcn.004091c4
test eax, eax
jne 0x484a79
mov eax, dword [0x56eb20]
mov dword [0x568dd0], eax
push 0x568dc0
call sub.KERNEL32.DLL_GetStdHandle
test ax, ax
jne 0x484a79
lea edx, [ebp - 0x2c]
mov eax, dword [0x56b334]
call fcn.004083d4
mov ecx, dword [ebp - 0x2c]
mov dl, 1
mov eax, dword [0x41e49c]
call fcn.00411fe4
call fcn.00404c7c
push 0x84ca0000
push 0
mov eax, dword [0x56b524]
mov eax, dword [eax]
call eax
sar eax, 1
jns 0x484a90
adc eax, 0
push eax
push 1
mov eax, dword [0x56b524]
mov eax, dword [eax]
call eax
sar eax, 1
jns 0x484aa3
adc eax, 0
push eax
push 0
push 0
push 0
push 0
mov eax, dword [0x56eb20]
push eax
push 0
mov eax, dword [ebx + 0x88]
call fcn.00406080
mov ecx, eax
mov edx, dword [0x568de4]
mov eax, 0x80
call fcn.0040961c
mov dword [ebx + 0x170], eax
mov byte [ebx + 0xa8], 1
mov eax, dword [ebx + 0x174]
push eax
push 0xfffffffffffffffc
mov eax, dword [ebx + 0x170]
push eax
call sub.KERNEL32.DLL_RaiseException
mov eax, dword [0x56b634]
cmp byte [eax], 0
je 0x484b2e
mov eax, ebx
call fcn.004859a4
push eax
push 1
push 0x80
mov eax, dword [ebx + 0x170]
push eax
call sub.KERNEL32.DLL_GetVolumeInformationW
mov eax, ebx
call fcn.004859a4
push eax
push 0xfffffffffffffff2
mov eax, dword [ebx + 0x170]
push eax
call sub.KERNEL32.DLL_GlobalDeleteAtom
push 0
mov eax, dword [ebx + 0x170]
push eax
call sub.KERNEL32.DLL_lstrcpynW
mov ebx, eax
push 0
push 0xf030
push ebx
call fcn.004090c4
push 0
push 0xf000
push ebx
call fcn.004090c4
mov eax, dword [0x56b634]
cmp byte [eax], 0
je 0x484b6f
push 0
push 0xf010
push ebx
call fcn.004090c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484b8c
lea eax, [ebp - 0x2c]
call fcn.00405fe4
ret
Function at 0x484c7c
Capabilities:
Set thread local storage value

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x170]
test eax, eax
je 0x484d1e
cmp dword [ebx + 0x90], 0
jne 0x484d18
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x484bf4
call fcn.0040918c
mov eax, dword [ebx + 0x8c]
cmp dword [eax + 8], 0
je 0x484d18
push 3
mov eax, dword [esp + 4]
push eax
call sub.KERNEL32.DLL_TlsSetValue
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.KERNEL32.DLL_GetACP
test al, 8
je 0x484cde
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x8c]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x484d18
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x8c]
call fcn.00420f3c
push eax
call sub.KERNEL32.DLL_ResetEvent
dec esi
cmp esi, 0xffffffff
jne 0x484ced
inc dword [ebx + 0x90]
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x485c5c
Capabilities:
Copy file

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa8], 0
je 0x485cc7
cmp byte [ebx + 0xcf], 0
jne 0x485cc7
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.KERNEL32.DLL_CopyFileW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00406130
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x485cb4
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x485cd4
mov eax, esi
mov edx, dword [ebx + 0x88]
call fcn.00405ff4
jmp 0x485cd4
mov eax, esi
mov edx, dword [ebx + 0x88]
call fcn.00405ff4
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x485ce0
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
mov eax, dword [ebx + 0x88]
mov edx, esi
call fcn.00406650
je 0x485d38
cmp byte [ebx + 0xa8], 0
je 0x485d2b
cmp byte [ebx + 0xcf], 0
je 0x485d17
push 0
mov eax, dword [ebx + 0x170]
push eax
call sub.KERNEL32.DLL_ResumeThread
jmp 0x485d2b
mov eax, esi
call fcn.00406080
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.KERNEL32.DLL_ResumeThread
lea eax, [ebx + 0x88]
mov edx, esi
call fcn.00405ff4
pop esi
pop ebx
ret

Function at 0x485dd4
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov esi, edx
mov edi, eax
xor ebx, ebx
mov eax, dword [esi + 4]
cmp eax, 0x100
jb 0x485ec2
cmp eax, 0x109
ja 0x485ec2
call fcn.004091bc
mov ebp, eax
test ebp, ebp
jne 0x485e84
mov ebp, dword [esi]
mov eax, dword [edi + 0x40]
test eax, eax
je 0x485e27
cmp ebp, dword [eax + 0x36c]
jne 0x485e27
call fcn.0046d87c
mov ebp, eax
jmp 0x485e3c
push ebp
call sub.KERNEL32.DLL_GetFileType
mov ebp, eax
mov eax, ebp
call fcn.00461740
test al, al
jne 0x485e36
test ebp, ebp
jne 0x485e1f
test ebp, ebp
jne 0x485e3c
mov ebp, dword [esi]
push ebp
call sub.KERNEL32.DLL_InterlockedDecrement
test eax, eax
je 0x485e65
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
add eax, 0xbc00
push eax
push ebp
call sub.KERNEL32.DLL_GetVolumeInformationW
test eax, eax
je 0x485ec2
mov bl, 1
jmp 0x485ec2
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
add eax, 0xbc00
push eax
push ebp
call sub.KERNEL32.DLL_GetWindowsDirectoryW
test eax, eax
je 0x485ec2
mov bl, 1
jmp 0x485ec2
push esp
push ebp
call sub.KERNEL32.DLL_CreateEventW
lea eax, [esp + 4]
push eax
mov eax, dword [edi + 0x170]
push eax
call sub.KERNEL32.DLL_CreateEventW
mov eax, dword [esp]
cmp eax, dword [esp + 4]
jne 0x485ec2
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
add eax, 0xbc00
push eax
push ebp
call sub.KERNEL32.DLL_GetVolumeInformationW
test eax, eax
je 0x485ec2
mov bl, 1
mov eax, ebx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4865dc
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00487a9c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x48660c
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x170]
jmp 0x48660f
mov ebx, dword [ebp - 0x10]
push 2
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [0x56b660]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x14], eax
push 2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x170]
push eax
mov eax, dword [0x56b660]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x18]
je 0x4866a7
mov dword [ebp - 0x48], 0x28
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [0x56b4c8]
mov eax, dword [eax]
call eax
lea eax, [ebp - 0x58]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x170]
push eax
call sub.KERNEL32.DLL_CompareStringW
push 0x1d
push 0
push 0
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x40]
sub ecx, edx
sar ecx, 1
jns 0x486681
adc ecx, 0
add ecx, edx
push ecx
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x44]
sub edx, eax
sar edx, 1
jns 0x486693
adc edx, 0
add edx, eax
push edx
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x170]
push eax
call sub.KERNEL32.DLL_ResetEvent
mov eax, dword [ebp - 0x10]
call fcn.0047ab54
mov dword [ebp - 0x20], eax
call fcn.0047a9a8
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
call fcn.004850a8
test al, al
je 0x4866cc
or esi, 0x100000
xor ecx, ecx
push ebp
push 0x486753
push dword fs:[ecx]
mov dword fs:[ecx], esp
push esi
mov eax, dword [ebp - 8]
push eax
push edi
push ebx
call sub.KERNEL32.DLL_GetDiskFreeSpaceW
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48675a
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x18]
je 0x486739
push 0x1d
push 0
push 0
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x54]
sub ecx, edx
sar ecx, 1
jns 0x486713
adc ecx, 0
add ecx, edx
push ecx
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x58]
sub edx, eax
sar edx, 1
jns 0x486725
adc edx, 0
add edx, eax
push edx
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x170]
push eax
call sub.KERNEL32.DLL_ResetEvent
mov eax, dword [ebp - 0x20]
call fcn.0047ac18
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_GlobalAddAtomW
mov eax, dword [ebp - 0x1c]
call fcn.0047a9b0
ret
Function at 0x486874
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp], ecx
mov ebp, edx
mov esi, eax
xor edi, edi
mov byte [esp + 4], 1
lea eax, [esp + 4]
push eax
mov ecx, dword [esp + 4]
mov edx, ebp
mov eax, esi
call fcn.004869a8
mov ebx, eax
test bl, bl
jne 0x4868dd
mov eax, dword [0x5711c8]
mov edi, dword [eax + 0x60]
test edi, edi
je 0x4868b8
test byte [edi + 0x1c], 0x10
je 0x4868b8
mov byte [esp + 4], 0
test edi, edi
je 0x4868dd
mov eax, edi
call fcn.0046dac0
cmp ax, 0xffff
jne 0x4868dd
cmp byte [edi + 0x57], 0
jne 0x4868dd
cmp dword [edi + 0x278], 0
jne 0x4868dd
mov byte [esp + 4], 0
cmp byte [esp + 4], 0
je 0x48699c
test edi, edi
je 0x486936
mov eax, edi
call fcn.0046dc28
test al, al
je 0x486936
cmp dword [edi + 0x294], 0
je 0x486936
mov eax, edi
call fcn.0046d87c
mov dword [esp + 8], eax
mov eax, esi
call fcn.004870d4
test al, al
je 0x48699c
push ebp
mov eax, dword [esp + 4]
push eax
mov ecx, dword [edi + 0x294]
mov edx, dword [esp + 0x10]
mov eax, dword [esi + 0x48]
mov ebx, dword [eax]
call dword [ebx + 0x20]
mov ebx, eax
jmp 0x48699c
cmp dword [esi + 0x4c], 0
je 0x48697a
mov eax, dword [esi + 0x170]
mov dword [esp + 8], eax
mov eax, dword [esi + 0x40]
test eax, eax
je 0x486956
call fcn.0046d87c
mov dword [esp + 8], eax
mov eax, esi
call fcn.004870d4
test al, al
je 0x48699c
push ebp
mov eax, dword [esp + 4]
push eax
mov ecx, dword [esi + 0x4c]
mov edx, dword [esp + 0x10]
mov eax, dword [esi + 0x48]
mov ebx, dword [eax]
call dword [ebx + 0x20]
mov ebx, eax
jmp 0x48699c
cmp byte [esi + 0xa8], 0
jne 0x48699c
mov eax, dword [esp]
push eax
movzx eax, bp
push eax
push 0xb01f
mov eax, dword [esi + 0x170]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
mov eax, ebx
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4baee4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
mov eax, 8
test byte [edx + 1], 0x80
setne bl
movzx edi, word [edx]
add edi, edi
movzx esi, cl
mov ebp, esi
shr ebp, 7
or edi, ebp
cmp edi, 0xffff
jbe 0x4baf10
call fcn.00404148
mov word [edx], di
test bl, bl
je 0x4baf1c
xor word [edx], 0x1021
add esi, esi
and esi, 0xff
cmp esi, 0xff
jbe 0x4baf31
call fcn.00404148
mov ecx, esi
dec eax
jne 0x4baeed
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4cd454
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4cd4ae
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.004cd448
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004ccdc4
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.004cc928
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cd4b5
lea eax, [ebp - 4]
call fcn.00405fe4
ret
Function at 0x4df168
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4df196
mov eax, ebx
call fcn.004dfc1c
cmp dword [ebx + 0x40], 0
je 0x4df18f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4df207
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4df1f9
cmp dword [ebx + 8], 0
je 0x4df1b8
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4df1ca
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4df1f9
cmp dword [ebx + 8], 0
je 0x4df1ab
cmp eax, 3
je 0x4df1dd
dec eax
jne 0x4df1ab
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4df1ab
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4df1ab
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4df225
cmp dword [ebx + 0x14], 0xcc
je 0x4df225
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004df230
pop ebx
ret

Function at 0x4f1b58
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
test dl, dl
je 0x4f1b6b
add esp, 0xfffffff0
call fcn.004046d8
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4f1c0c
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, esi
call fcn.00429020
push 0x4f1c30
call sub.KERNEL32.DLL_GetSystemDirectoryW
mov word [esi + 0x40], ax
xor eax, eax
mov dword [esi + 0x48], eax
push 0
push 0
push 0x4f1948
lea eax, [esi + 0x48]
push eax
call fcn.004f0d88
test eax, eax
sete al
call fcn.004f1848
mov dl, 1
mov eax, dword [0x41e580]
call fcn.00404258
mov dword [esi + 0x34], eax
mov dl, 1
mov eax, dword [0x41e580]
call fcn.00404258
mov dword [esi + 0x38], eax
mov dl, 1
mov eax, dword [0x41e580]
call fcn.00404258
mov dword [esi + 0x3c], eax
lea edx, [ebp - 4]
xor eax, eax
call fcn.0040347c
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.004f1f38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f1c13
lea eax, [ebp - 4]
call fcn.00405fe4
ret
Function at 0x5081d4
Capabilities:
Get disk information

Disassembly:
push ebx
push esi
push ecx
mov ebx, eax
cmp dword [ebx + 0x284], 0
je 0x50825d
cmp dword [ebx + 0x24c], 0
jne 0x50825d
xor eax, eax
mov dword [esp], eax
push esp
mov eax, dword [ebx + 0x284]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
cmp dword [esp], 0
jne 0x50821a
mov ecx, dword [0x56bb90]
mov dl, 1
mov eax, dword [0x488030]
call fcn.004120a0
call fcn.00404c7c
mov esi, dword [esp]
mov dword [ebx + 0x24c], esi
push 0xfffffffffffffffc
push esi
call sub.KERNEL32.DLL_GetACP
mov dword [ebx + 0x248], eax
mov eax, dword [0x56b74c]
mov dword [eax], ebx
push 0x4615a0
push 0xfffffffffffffffc
mov eax, dword [ebx + 0x24c]
push eax
call sub.KERNEL32.DLL_RaiseException
push 0
push 0
push 0
mov eax, dword [ebx + 0x24c]
push eax
call sub.KERNEL32.DLL_GetVolumeInformationW
pop edx
pop esi
pop ebx
ret

Function at 0x55c3f8
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405fdc
mov eax, dword [ebp - 8]
call fcn.00405fdc
xor eax, eax
push ebp
push 0x55c460
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00406080
push eax
mov eax, dword [ebp - 8]
call fcn.00406080
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileW
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55c467
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405fec
ret
Function at 0x55c6a4
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x2a
push 0
push 0
dec ecx
jne 0x55c6ac
xor eax, eax
push ebp
push 0x55c829
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x90
lea eax, [ebp - 0x12a]
push eax
call fcn.00408c5c
lea edx, [ebp - 4]
lea eax, [ebp - 0x12a]
call fcn.0040da50
lea eax, [ebp - 8]
mov ecx, 0x55c840
mov edx, dword [ebp - 4]
call fcn.004063d8
lea eax, [ebp - 0x130]
call fcn.0055c3d0
lea eax, [ebp - 0x130]
mov edx, 0x55c860
call fcn.00406358
mov eax, dword [ebp - 0x130]
call fcn.0040d25c
test al, al
jne 0x55c7e3
lea eax, [ebp - 0x134]
call fcn.0055c3d0
lea eax, [ebp - 0x134]
mov edx, 0x55c860
call fcn.00406358
mov edx, dword [ebp - 0x134]
mov eax, dword [0x572204]
mov eax, dword [eax + 0x390]
mov eax, dword [eax + 0x290]
mov ecx, dword [eax]
call dword [ecx + 0x7c]
push 1
lea eax, [ebp - 0x148]
mov ecx, 0x55c884
mov edx, dword [ebp - 4]
call fcn.004063d8
mov edx, dword [ebp - 0x148]
lea eax, [ebp - 0x144]
call fcn.0041c408
lea eax, [ebp - 0x144]
push eax
mov ecx, 0x55c8ac
mov edx, 0x55c8c0
mov eax, 0x80000002
call fcn.0055c470
push 0x64
call fcn.00414064
push 0
lea eax, [ebp - 0x14c]
mov ecx, 0x55c92c
mov edx, dword [ebp - 8]
call fcn.004063d8
mov eax, dword [ebp - 0x14c]
call fcn.00406080
push eax
lea edx, [ebp - 0x150]
mov eax, dword [0x56b848]
mov eax, dword [eax]
call fcn.00486b94
mov eax, dword [ebp - 0x150]
call fcn.00406080
push eax
call fcn.00408a28
test eax, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55c830
lea eax, [ebp - 0x150]
mov edx, 3
call fcn.00405fec
lea eax, [ebp - 0x144]
call fcn.004172d0
lea eax, [ebp - 0x134]
mov edx, 2
call fcn.00405fec
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405fec
ret
Function at 0x401a34
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
push ebp
push 0x401aea
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x4815c8
call sub.KERNEL32.DLL_LocalAlloc
cmp byte [0x481049], 0
je 0x401a62
push 0x4815c8
call sub.KERNEL32.DLL_TlsGetValue
mov eax, 0x4815e8
call fcn.004013f8
mov eax, 0x4815f8
call fcn.004013f8
mov eax, 0x481624
call fcn.004013f8
push 0xff8
push 0
call sub.KERNEL32.DLL_WaitForSingleObject
mov dword [0x481620], eax
cmp dword [0x481620], 0
je 0x401ac9
mov eax, 3
mov edx, dword [0x481620]
xor ecx, ecx
mov dword [edx + eax*4 - 0xc], ecx
inc eax
cmp eax, 0x401
jne 0x401a9f
mov eax, 0x481608
mov dword [eax + 4], eax
mov dword [eax], eax
mov dword [0x481614], eax
mov byte [0x4815c0], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401af1
cmp byte [0x481049], 0
je 0x401ae9
push 0x4815c8
call sub.KERNEL32.DLL_TlsSetValue
ret

Function at 0x401af8
Capabilities:
Get thread local storage value
Set thread local storage value
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp byte [0x4815c0], 0
je 0x401bd5
xor edx, edx
push ebp
push 0x401bce
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [0x481049], 0
je 0x401b2a
push 0x4815c8
call sub.KERNEL32.DLL_TlsGetValue
mov byte [0x4815c0], 0
mov eax, dword [0x481620]
push eax
call sub.KERNEL32.DLL_WriteFile
xor eax, eax
mov dword [0x481620], eax
mov ebx, dword [0x4815e8]
jmp 0x401b5d
push 0x8000
push 0
mov eax, dword [ebx + 8]
push eax
call sub.KERNEL32.DLL_GetModuleHandleA
mov ebx, dword [ebx]
cmp ebx, 0x4815e8
jne 0x401b4b
mov eax, 0x4815e8
call fcn.004013f8
mov eax, 0x4815f8
call fcn.004013f8
mov eax, 0x481624
call fcn.004013f8
mov eax, dword [0x4815e0]
test eax, eax
je 0x401ba3
mov edx, dword [eax]
mov dword [0x4815e0], edx
push eax
call sub.KERNEL32.DLL_WriteFile
mov eax, dword [0x4815e0]
test eax, eax
jne 0x401b8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401bd5
cmp byte [0x481049], 0
je 0x401bc3
push 0x4815c8
call sub.KERNEL32.DLL_TlsSetValue
push 0x4815c8
call sub.KERNEL32.DLL_Sleep
ret
pop ebx
pop ebp
ret
Function at 0x402120
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, eax
cmp byte [0x4815c0], 0
jne 0x40213d
call fcn.00401a34
test al, al
je 0x402145
cmp ebx, 0x7ffffff8
jle 0x40214f
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4022a3
xor ecx, ecx
push ebp
push 0x40229c
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x481049], 0
je 0x402170
push 0x4815c8
call sub.KERNEL32.DLL_TlsGetValue
add ebx, 7
and ebx, 0xfffffffc
cmp ebx, 0xc
jge 0x402180
mov ebx, 0xc
cmp ebx, 0x1000
jg 0x40221f
mov eax, ebx
test eax, eax
jns 0x402195
add eax, 3
sar eax, 2
mov edx, dword [0x481620]
mov edx, dword [edx + eax*4 - 0xc]
test edx, edx
je 0x40221f
mov esi, edx
mov eax, esi
add eax, ebx
and dword [eax], 0xfffffffe
mov eax, dword [edx + 4]
cmp edx, eax
jne 0x4021d0
mov eax, ebx
test eax, eax
jns 0x4021bf
add eax, 3
sar eax, 2
mov ecx, dword [0x481620]
xor edi, edi
mov dword [ecx + eax*4 - 0xc], edi
jmp 0x4021f6
mov ecx, ebx
test ecx, ecx
jns 0x4021d9
add ecx, 3
sar ecx, 2
mov edi, dword [0x481620]
mov dword [edi + ecx*4 - 0xc], eax
mov ecx, dword [edx]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, esi
mov edx, dword [edx + 8]
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x4815b0]
sub ebx, 4
add dword [0x4815b4], ebx
call fcn.00403b04
jmp 0x4022a3
cmp ebx, dword [0x481618]
jg 0x402271
sub dword [0x481618], ebx
cmp dword [0x481618], 0xc
jge 0x402243
add ebx, dword [0x481618]
xor eax, eax
mov dword [0x481618], eax
mov eax, dword [0x48161c]
add dword [0x48161c], ebx
mov edx, ebx
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x4815b0]
sub ebx, 4
add dword [0x4815b4], ebx
call fcn.00403b04
jmp 0x4022a3
mov eax, ebx
call fcn.0040202c
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4022a3
cmp byte [0x481049], 0
je 0x40229b
push 0x4815c8
call sub.KERNEL32.DLL_TlsSetValue
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4022b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
mov dword [0x4815c4], eax
cmp byte [0x4815c0], 0
jne 0x4022e8
call fcn.00401a34
test al, al
jne 0x4022e8
mov dword [0x4815c4], 8
mov dword [ebp - 4], 8
jmp 0x402449
xor ecx, ecx
push ebp
push 0x402442
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x481049], 0
je 0x402309
push 0x4815c8
call sub.KERNEL32.DLL_TlsGetValue
mov esi, ebx
sub esi, 4
mov ebx, dword [esi]
test bl, 2
jne 0x402324
mov dword [0x4815c4], 9
jmp 0x402419
dec dword [0x4815b0]
mov eax, ebx
and eax, 0x7ffffffc
sub eax, 4
sub dword [0x4815b4], eax
test bl, 1
je 0x402384
mov eax, esi
sub eax, 0xc
mov edx, dword [eax + 8]
cmp edx, 0xc
jl 0x402354
test edx, 0x80000003
je 0x402363
mov dword [0x4815c4], 0xa
jmp 0x402419
mov eax, esi
sub eax, edx
cmp edx, dword [eax + 8]
je 0x40237b
mov dword [0x4815c4], 0xa
jmp 0x402419
add ebx, edx
mov esi, eax
call fcn.00401bd8
and ebx, 0x7ffffffc
mov eax, esi
add eax, ebx
mov edi, eax
cmp edi, dword [0x48161c]
jne 0x4023c4
sub dword [0x48161c], ebx
add dword [0x481618], ebx
cmp dword [0x481618], 0x3c00
jle 0x4023b5
call fcn.00401ec8
xor eax, eax
mov dword [ebp - 4], eax
call fcn.00403b04
jmp 0x402449
mov edx, dword [eax]
test dl, 2
je 0x4023e7
and edx, 0x7ffffffc
cmp edx, 4
jge 0x4023e2
mov dword [0x4815c4], 0xb
jmp 0x402419
or dword [eax], 1
jmp 0x402410
mov eax, edi
cmp dword [eax + 4], 0
je 0x4023fa
cmp dword [eax], 0
je 0x4023fa
cmp dword [eax + 8], 0xc
jge 0x402406
mov dword [0x4815c4], 0xb
jmp 0x402419
mov edx, dword [eax + 8]
add ebx, edx
call fcn.00401bd8
mov edx, ebx
mov eax, esi
call fcn.00401e40
mov eax, dword [0x4815c4]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402449
cmp byte [0x481049], 0
je 0x402441
push 0x4815c8
call sub.KERNEL32.DLL_TlsSetValue
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x403ea0
Capabilities:
Get disk information

Disassembly:
push ecx
cmp byte [0x481048], 0
je 0x403f01
cmp word [0x48121c], 0xd7b2
jne 0x403ec9
cmp dword [0x481224], 0
jbe 0x403ec9
mov eax, 0x481218
call dword [0x481234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x47f06c
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetTickCount
push eax
call sub.KERNEL32.DLL_GetVolumeInformationA
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403f28
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetTickCount
push eax
call sub.KERNEL32.DLL_GetVolumeInformationA
pop edx
ret
cmp byte [0x47f030], 0
jne 0x403f1d
push 0
push 0x47f064
push 0x47f06c
push 0
call sub.user32.dll_WinHelpA
pop edx
ret

Function at 0x404758
Capabilities:
Hide graphical window

Disassembly:
test eax, eax
je 0x40476c
push eax
push 0
call sub.user32.dll_ShowWindow
test eax, eax
je 0x404750
ret