joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5707f0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x57080a
add ecx, 8
call fcn.0054dae0
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x57084c
push dword [0x603f88]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x57083c
mov edx, dword [eax + 4]
test edx, edx
je 0x57083c
mov ecx, 4
nop dword [eax]
cmp dword [edx + ecx*4], 0
je 0x57084f
inc ecx
cmp ecx, 6
jl 0x570830
push esi
call fcn.005360be
add esp, 4
mov dword [edi + 4], 0
pop edi
pop esi
ret
mov al, byte [esi + 0x98]
mov byte [esi], al
mov dword [edx + ecx*4], esi
mov dword [edi + 4], 0
pop edi
pop esi
ret

Function at 0x5710f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x585c20
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push esi
push edi
mov eax, dword [0x5fad8c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor edx, edx
lea eax, [esi + 0x18]
lock xadd dword [eax], edx
test edx, edx
jne 0x571153
call fcn.00574980
call fcn.0053ad60
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
xor eax, eax
mov dword [ecx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x4c]
call fcn.0054ab00
push dword [0x603f88]
mov ecx, esi
mov dword [ebp - 4], 0
neg ecx
lea eax, [esi + 0x14]
sbb ecx, ecx
and ecx, eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
push dword [0x603f88]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x4c]
push ebx
push eax
push 0xffffffffffffffff
mov ecx, esi
mov byte [ebp - 4], 1
xor edi, edi
call fcn.0055dbb0
test eax, eax
je 0x5711cd
cmp edi, 0xffffffff
lea eax, [edi + 1]
push ebx
cmove eax, edi
mov ecx, esi
mov edi, eax
lea eax, [ebp - 0x4c]
push eax
push 0xffffffffffffffff
call fcn.0055dbb0
test eax, eax
jne 0x5711b0
push dword [ebp - 0x10]
push dword [0x603f88]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebp - 4], 0xffffffff
xor esi, esi
mov eax, dword [ebp + esi*4 - 0x4c]
test eax, eax
je 0x5711f6
push eax
call fcn.005360be
add esp, 4
inc esi
cmp esi, 0xa
jl 0x5711e5
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.MSVCP140.dll_void___cdecl___ExceptionPtrDestroy_void__]
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5712f0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
push esi
push edi
test edx, edx
jne 0x571349
test ecx, ecx
jne 0x571349
test eax, eax
jne 0x571349
mov esi, dword [ebp + 0x18]
test esi, esi
je 0x57136b
mov eax, 0x10624dd3
imul dword [esi + 4]
imul eax, dword [esi], 0x3e8
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
add ecx, eax
mov eax, 1
cmove ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp + 0x1c]
pop edi
pop esi
mov dword [eax], 0
xor eax, eax
pop ebp
ret
mov esi, dword [ebp + 0x18]
test esi, esi
je 0x57136b
cmp dword [esi], 0
jne 0x57136b
mov edi, dword [esi + 4]
test edi, edi
jle 0x57136b
cmp edi, 0x3e8
jge 0x57136b
mov dword [esi + 4], 0x3e8
push esi
push eax
push ecx
push edx
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_select]
mov edi, eax
test edi, edi
js 0x57138b
mov ecx, dword [ebp + 0x1c]
pop edi
pop esi
mov dword [ecx], 0
pop ebp
ret
call fcn.00574ea0
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, dword [ebp + 0x1c]
mov dword [ecx], eax
mov eax, edi
pop edi
mov dword [ecx + 4], esi
pop esi
pop ebp
ret
Function at 0x574590
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 4]
add eax, 0x18
lock inc dword [eax]
cmp byte [ebp + 0x18], 0
je 0x5745b9
mov ecx, dword [esi + 4]
push 0
push 0
push dword [ebp + 0x1c]
call fcn.0056a100
pop esi
pop ebp
ret 0x18
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
cmp ecx, 0xffffffff
jne 0x5745da
mov ecx, dword [esi + 4]
push 0
push 0x2719
push dword [ebp + 0x1c]
call fcn.0056a100
pop esi
pop ebp
ret 0x18
mov eax, dword [ebp + 0x14]
push ebx
push edi
mov edi, dword [ebp + 0x1c]
push 0
push edi
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0x18]
mov dword [ebp + 0x18], 0
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_WSARecv]
mov ebx, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
jne 0x574618
mov eax, 0x2746
jmp 0x574625
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test ebx, ebx
je 0x574644
cmp eax, 0x3e5
je 0x574644
push dword [ebp + 0x18]
mov ecx, dword [esi + 4]
push eax
push edi
call fcn.0056a100
pop edi
pop ebx
pop esi
pop ebp
ret 0x18
mov ecx, dword [esi + 4]
push edi
call fcn.0056a180
pop edi
pop ebx
pop esi
pop ebp
ret 0x18

Function at 0x574660
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
mov eax, dword [edi + 4]
add eax, 0x18
lock inc dword [eax]
cmp byte [ebp + 0x18], 0
je 0x574689
mov ecx, dword [edi + 4]
push 0
push 0
push dword [ebp + 0x1c]
call fcn.0056a100
pop edi
pop ebp
ret 0x18
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cmp eax, 0xffffffff
jne 0x5746aa
mov ecx, dword [edi + 4]
push 0
push 0x2719
push dword [ebp + 0x1c]
call fcn.0056a100
pop edi
pop ebp
ret 0x18
push ebx
mov ebx, dword [ebp + 0x1c]
lea ecx, [ebp + 0x18]
push esi
push 0
push ebx
push dword [ebp + 0x14]
mov dword [ebp + 0x18], 0
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_WSASend]
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test esi, esi
je 0x574701
cmp eax, 0x3e5
je 0x574701
push dword [ebp + 0x18]
mov ecx, dword [edi + 4]
push eax
push ebx
call fcn.0056a100
pop esi
pop ebx
pop edi
pop ebp
ret 0x18
mov ecx, dword [edi + 4]
push ebx
call fcn.0056a180
pop esi
pop ebx
pop edi
pop ebp
ret 0x18
Function at 0x574720
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0
push 0
push 1
mov esi, ecx
push 0
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ebx, dword [ebp + 8]
mov edi, eax
mov dword [ebx + 4], edi
test edi, edi
jne 0x57476e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebx]
mov ecx, ebx
push 1
mov esi, eax
call dword [edx]
mov dword [ebp - 0x10], esi
call fcn.00574ea0
mov dword [ebp - 0xc], eax
test esi, esi
jne 0x57482c
mov esi, dword [ebp - 4]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 8], eax
mov dword [ebx + 8], eax
cmp dword [esi + 8], 0
jne 0x5747ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebx]
mov ecx, ebx
push 1
mov esi, eax
call dword [edx]
mov dword [ebp - 0x10], esi
call fcn.00574ea0
mov dword [ebp - 0xc], eax
test esi, esi
jne 0x57483a
mov esi, dword [ebp - 4]
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0
push ebx
push 0x576950
push dword [ebp + 0xc]
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 4], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x574813
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebx]
mov ecx, ebx
push 1
mov dword [ebp + 8], eax
call dword [edx]
test edi, edi
je 0x5747f4
push edi
call esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
test eax, eax
je 0x574801
push eax
call esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10], ebx
call fcn.00574ea0
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x574848
test edi, edi
je 0x574823
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.thread.entry_event
lea eax, [ebp - 0x10]
push eax
call fcn.0055e1a0
push str.thread.exit_event
lea eax, [ebp - 0x10]
push eax
call fcn.0055e1a0
push str.thread
lea eax, [ebp - 0x10]
push eax
call fcn.0055e1a0
int3
Function at 0x401981
Capabilities:
Clear file content
Get common file path
Get keyboard layout

Disassembly:
sub esp, 0x800
push esi
push edi
xor esi, esi
xor edi, edi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp edi, 0x58ced85
jg 0x4019a7
inc edi
cmp edi, 0x1f6502b1
jl 0x40198d
cmp dword [0x282941c], 0x400
jne 0x4019e7
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push esi
push esi
call dword [sym.imp.USER32.dll_DdeCmpStringHandles]
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
push esi
call dword [sym.imp.KERNEL32.dll_CancelIo]
push esi
call fcn.00401de1
push esi
call fcn.00401f47
push esi
call fcn.00401f56
add esp, 0xc
xor edi, edi
cmp edi, 0xd036
jge 0x4019f8
push esi
call dword [sym.imp.USER32.dll_GetCaretPos]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_LocalCompact]
cmp edi, 0xd2ced2
jg 0x401a1e
inc edi
cmp edi, 0x263ff
jl 0x4019e9
mov eax, dword [0x43b574]
mov dword [0x282941c], eax
call fcn.004016e4
mov edi, 0x3078f
cmp dword [0x282941c], 0x51f
jne 0x401a4a
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec edi
jne 0x401a32
pop edi
xor eax, eax
pop esi
add esp, 0x800
ret 0x10
Function at 0x404ecb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x421a80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004032a5
and dword [ebp - 0x14], 0
cmp dword [0x4460e0], 0
mov dword [ebp - 0x18], eax
jne 0x404f7e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x405026
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x405026
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4460e0], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4460e4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4460e8], eax
call edi
push eax
call esi
mov dword [0x4460f0], eax
test eax, eax
je 0x404f7e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4460ec], eax
mov eax, dword [0x4460ec]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x404fd7
cmp dword [0x4460f0], ecx
je 0x404fd7
push eax
call esi
push dword [0x4460f0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x404fd7
test ebx, ebx
je 0x404fd7
call edi
test eax, eax
je 0x404fce
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x404fce
test byte [ebp - 8], 1
jne 0x404fd7
or dword [ebp + 0x10], 0x200000
jmp 0x40500a
mov eax, dword [0x4460e4]
cmp eax, dword [ebp - 0x18]
je 0x40500a
push eax
call esi
test eax, eax
je 0x40500a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40500a
mov eax, dword [0x4460e8]
cmp eax, dword [ebp - 0x18]
je 0x40500a
push eax
call esi
test eax, eax
je 0x40500a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4460e0]
call esi
test eax, eax
je 0x405026
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x405028
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405236
leave
ret

Function at 0x405236
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x421a80]
jne 0x405240
repz ret
jmp fcn.00405fef
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x172a526e
nop
nop
nop
nop
nop
test eax, eax
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x799c0830
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x4010e0
Capabilities:
Create raw socket
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
sub esp, 0x1a0
lea eax, [esp + 0x10]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x401114
push 0
push str.Fatal_Error
push str.WINSOCK.DLL_couldnt_be_find_or_isnt_usable._Exiting_...
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
add esp, 0x1a0
ret
cmp byte [esp + 0x10], 2
jne 0x401199
cmp byte [esp + 0x11], 0
jne 0x401199
push 1
push 3
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov word [esp], 2
push 0x400
mov dword [0x40c8f0], eax
mov dword [esp + 8], 0
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 2], ax
push 0x10
lea eax, [esp + 4]
mov ecx, dword [0x40c8f0]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
je 0x40118d
push 0
push str.Fatal_Error
push str.Error_binding_raw_socket._Exiting_...
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
add esp, 0x1a0
ret
mov eax, 1
add esp, 0x1a0
ret
push 0
push str.Fatal_Error
push str.We_need_at_least_Winsock_v2.0._Exiting_...
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
add esp, 0x1a0
ret
Function at 0x401c20
Capabilities:
Get common file path

Disassembly:
sub esp, 0x100
mov ecx, 0xffffffff
sub eax, eax
push ebx
push esi
push edi
mov edi, dword [esp + 0x110]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0xc]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xc]
push ecx
call fcn.00408d30
lea eax, [esp + 0x10]
add esp, 4
push str._LOG
push eax
call fcn.004022d0
add esp, 8
test eax, eax
je 0x401cb5
mov dword [0x40c8b4], 1
cmp byte [eax + 4], 0x3a
jne 0x401cbf
lea ecx, [eax + 5]
cmp byte [ecx], 0x22
jne 0x401c93
mov dl, 0x22
add eax, 6
jmp 0x401c97
mov dl, 0x20
mov eax, ecx
mov ecx, 0x40c790
cmp byte [eax], 0
je 0x401cb0
mov bl, byte [eax]
cmp bl, dl
je 0x401cb0
inc eax
mov byte [ecx], bl
inc ecx
cmp byte [eax], 0
jne 0x401ca1
mov byte [ecx], 0
jmp 0x401d02
mov dword [0x40c8b4], 0
push 0x40c790
mov edi, str.icmpmon.log
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
mov edi, 0x40c790
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0xc]
push str._LOOKUP
push eax
call fcn.004022d0
mov dword [0x40c8c4], 1
add esp, 8
test eax, eax
jne 0x401d2c
mov dword [0x40c8c4], 0
lea eax, [esp + 0xc]
push str._SILENT
push eax
call fcn.004022d0
add esp, 8
test eax, eax
je 0x401d46
xor eax, eax
jmp 0x401d4b
mov eax, 1
push str._HIDE
mov dword [0x40c68c], eax
mov dword [0x40c8c0], eax
lea eax, [esp + 0x10]
push eax
call fcn.004022d0
add esp, 8
test eax, eax
je 0x401d7f
mov dword [0x40c8e8], 1
pop edi
pop esi
pop ebx
add esp, 0x100
ret
mov dword [0x40c8e8], 0
pop edi
pop esi
pop ebx
add esp, 0x100
ret

Function at 0x401f70
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
push edi
xor edi, edi
push 0x74
push 1
call fcn.004027e0
add esp, 8
mov esi, eax
cmp esi, edi
je 0x401fc3
push esi
call fcn.004026a0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
add esp, 4
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], ecx
push esi
mov edx, dword [esp + 0x14]
push 4
push esi
push 0x402000
push edx
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
mov edi, eax
test edi, edi
jne 0x401fe1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call fcn.004025d0
add esp, 4
test edi, edi
je 0x401fd9
push edi
call fcn.00402530
add esp, 4
mov eax, 0xffffffff
pop edi
pop esi
ret
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x401fbb
mov eax, edi
pop edi
pop esi
ret
Function at 0x402350
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x409010
push 0x402c78
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x40a6c8], eax
xor eax, eax
mov al, byte [0x40a6c9]
mov dword [0x40a6d4], eax
mov eax, dword [0x40a6c8]
shr dword [0x40a6c8], 0x10
and eax, 0xff
mov dword [0x40a6d0], eax
shl eax, 8
add eax, dword [0x40a6d4]
mov dword [0x40a6cc], eax
call fcn.00404cd0
test eax, eax
jne 0x4023c4
push 0x1c
call fcn.00402500
add esp, 4
call fcn.00402640
test eax, eax
jne 0x4023d7
push 0x10
call fcn.00402500
add esp, 4
mov dword [ebp - 4], 0
call fcn.00404af0
call fcn.00404ae0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x40da20], eax
call fcn.00404640
mov dword [0x40a530], eax
test eax, eax
je 0x40240a
cmp dword [0x40da20], 0
jne 0x402414
push 0xffffffffffffffff
call fcn.004029b0
add esp, 4
call fcn.004043d0
call fcn.004042e0
call fcn.00402980
mov esi, dword [0x40da20]
mov al, byte [esi]
cmp al, 0x22
je 0x40243b
cmp al, 0x20
jbe 0x402468
inc esi
cmp byte [esi], 0x20
ja 0x402433
jmp 0x402468
inc esi
cmp byte [esi], 0x22
je 0x402467
mov bl, byte [ebp - 0x28]
mov bl, byte [esi]
test bl, bl
je 0x402462
xor eax, eax
mov al, bl
push eax
call fcn.00404280
add esp, 4
test eax, eax
je 0x40245c
inc esi
inc esi
cmp byte [esi], 0x22
jne 0x402444
cmp byte [esi], 0x22
jne 0x402468
inc esi
cmp byte [esi], 0
je 0x402478
cmp byte [esi], 0x20
ja 0x402478
inc esi
cmp byte [esi], 0
jne 0x40246d
mov dword [ebp - 0x44], 0
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x44], 1
mov eax, 0xa
je 0x40249c
mov eax, dword [ebp - 0x40]
and eax, 0xffff
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call fcn.004029b0
jmp 0x4024dd
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402640
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push esi
call fcn.00403960
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x40a6b0], eax
cmp eax, 0xffffffff
jne 0x40265a
xor eax, eax
pop esi
ret
push 0x74
push 1
call fcn.004027e0
add esp, 8
mov esi, eax
test esi, esi
je 0x40269c
push esi
mov eax, dword [0x40a6b0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x40269c
push esi
call fcn.004026a0
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi], eax
mov eax, 1
mov dword [esi + 4], 0xffffffff
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x4026c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x40a6b0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x402723
push 0x74
push 1
call fcn.004027e0
add esp, 8
mov edi, eax
test edi, edi
je 0x402719
push edi
mov eax, dword [0x40a6b0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x402719
push edi
call fcn.004026a0
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [edi], eax
mov dword [edi + 4], 0xffffffff
jmp 0x402723
push 0x10
call fcn.00402500
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop esi
ret

Function at 0x402730
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x40a6b0], 0xffffffff
push esi
je 0x4027cf
mov esi, dword [esp + 8]
test esi, esi
jne 0x402758
mov eax, dword [0x40a6b0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x4027c1
mov eax, dword [esi + 0x24]
test eax, eax
je 0x402768
push eax
call fcn.004025d0
add esp, 4
mov eax, dword [esi + 0x28]
test eax, eax
je 0x402778
push eax
call fcn.004025d0
add esp, 4
mov eax, dword [esi + 0x30]
test eax, eax
je 0x402788
push eax
call fcn.004025d0
add esp, 4
mov eax, dword [esi + 0x38]
test eax, eax
je 0x402798
push eax
call fcn.004025d0
add esp, 4
mov eax, dword [esi + 0x40]
test eax, eax
je 0x4027a8
push eax
call fcn.004025d0
add esp, 4
mov eax, dword [esi + 0x44]
test eax, eax
je 0x4027b8
push eax
call fcn.004025d0
add esp, 4
push esi
call fcn.004025d0
add esp, 4
push 0
mov eax, dword [0x40a6b0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
ret

Function at 0x4029f0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
call fcn.00402ab0
cmp dword [0x40a704], 1
mov esi, dword [esp + 0x10]
jne 0x402a13
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x40a700], 1
cmp dword [esp + 0x14], 0
mov ebx, dword [esp + 0x18]
mov byte [0x40a6fc], bl
jne 0x402a6d
cmp dword [0x40da18], 0
je 0x402a5b
mov edi, dword [0x40da14]
sub edi, 4
cmp edi, dword [0x40da18]
jb 0x402a5b
mov eax, dword [edi]
test eax, eax
je 0x402a50
call eax
sub edi, 4
cmp edi, dword [0x40da18]
jae 0x402a48
push 0x40a01c
push 0x40a014
call fcn.00402ad0
add esp, 8
push 0x40a024
push 0x40a020
call fcn.00402ad0
add esp, 8
test ebx, ebx
je 0x402a8c
call fcn.00402ac0
pop edi
pop esi
pop ebx
ret
mov dword [0x40a704], 1
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]