joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4027b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call sym.___wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x402988
mov edi, dword [0x4060a4]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], edi
je 0x402897
test byte [0x403030], 8
jne 0x402930
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x403040], 8
jne 0x4028f0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x402839
cmp esi, 3
jbe 0x4028a8
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x40284a
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x4043a8]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x402839
mov dword [esp], 0x403040
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x402810
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x402810
mov dword [esp], 0x403030
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x4027fb
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x402803
mov eax, 0xffffffff
jmp 0x402897

Function at 0x402a00
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.100080c7
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.100080c7
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.100080c7
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.100080c7
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.100080c7
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.100080c7
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.100080c7
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.100080c7
push 0xd008
push edi
call fcn.100080c7
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.100080c7
int3

Function at 0x100080c7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x100080d6
pop dword [ebp - 8]
mov eax, 0x578e3656
sub eax, 0x478db580
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x3c156
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0x2866a8ac
add ecx, 0xd799aba7
xor esi, esi
add esi, eax
mov edi, 0xb5113d0c
sub edi, 0xa50fb70c
add edi, dword [ebp - 8]
mov edx, 0x9918daa8
add edx, 0xc077118e
xor dword [ebp - 4], 0xa22684e7
mov ebx, dword [edi]
xor dword [ebp - 4], 0xe008f809
add ebx, edx
add dword [ebp - 4], 0x7c63d6f2
mov dword [esi], ebx
xor dword [ebp - 4], 0x89a518a2
add esi, 0x5086a192
add esi, 0xaf795e72
add edi, 0x74c22857
add edi, 0x8b3dd7ad
loop 0x10008132
add eax, 0x9b398945
sub eax, 0x9b384526
mov ebx, eax
add eax, 0x9473f560
sub eax, 0x9473f55b
mov ecx, 0x7cc58dd1
sub ecx, 0x6cc58dd1
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x403ba9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x30]
call fcn.004011a0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x30]
mov dword [eax], 0x4042ec
mov ecx, dword [ebp - 0x30]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 0x30]
mov dword [edx + 8], 2
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
and ecx, 0xffff
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x40107b
jmp 0x40111b
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x4010c1
jmp 0x40111b
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x2c]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x10]
push ecx
push 1
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov eax, dword [ebp - 0x30]
add eax, 4
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call sub.gdiplus.dll_GdipLoadImageFromStream
mov edx, dword [ebp - 0x30]
mov dword [edx + 8], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x10]
push edx
call dword [ecx + 8]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x403377
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4033cf
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push dword [ebp + 8]
push esi
push esi
push 0x40461c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4033c2
push 1
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x4033d1
xor eax, eax
pop esi
leave
ret 4
Function at 0x10005b90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x10005be8
cmp byte [esi + ebx - 1], 0xa
je 0x10005bbc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x1000b0a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x10006210
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call sym.___wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x100063e8
mov edi, dword [0x1000b0a4]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], edi
je 0x100062f7
test byte [0x10007030], 8
jne 0x10006390
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x10007040], 8
jne 0x10006350
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x10006299
cmp esi, 3
jbe 0x10006308
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x100062aa
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x10009948]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x10006299
mov dword [esp], 0x10007040
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x10006270
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x10006270
mov dword [esp], 0x10007030
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x1000625b
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x10006263
mov eax, 0xffffffff
jmp 0x100062f7
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x403203
pop dword [ebp - 0x3c]
mov eax, 0xbd11643b
sub eax, 0xbcd13238
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x71267109
add dword [ebp - 0x4c], 0xdd2bd442
mov dword [ebp - 0x48], 0x54bb76e0
add dword [ebp - 0x48], 0xdd77d565
mov dword [ebp - 0x44], 0x3307bf69
add dword [ebp - 0x44], 0x194484c5
mov dword [ebp - 0x40], 0x47d5e0cc
sub dword [ebp - 0x40], 0x47d5e0cc
lea eax, [ebp - 0x4c]
push eax
mov eax, 0xdab128bb
sub eax, 0xda70a82f
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x4abc6d7f
add dword [ebp - 0x4c], 0x29b5fbd7
mov dword [ebp - 0x48], 0xb515ce45
add dword [ebp - 0x48], 0x8c569330
mov dword [ebp - 0x44], 0xb65248a8
sub dword [ebp - 0x44], 0x52e2dc3c
mov dword [ebp - 0x40], 0xeca3387e
sub dword [ebp - 0x40], 0xeca3387e
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x35641
push 0
call eax
mov ecx, 0x176a49eb
sub ecx, 0x176a06bb
xor edx, edx
add edx, eax
mov edi, 0x87c69abd
sub edi, 0x87858abd
add edi, dword [ebp - 0x3c]
mov esi, 0xb665ba54
xor dword [ebp - 0x10], 0xfcc56a9f
mov ebx, dword [edi]
xor dword [ebp - 0xc], 0x8f7145c4
xor ebx, esi
sub dword [ebp - 8], ecx
mov dword [edx], ebx
xor dword [ebp - 0x28], edi
add edx, 0x62aa8392
sub edx, 0x62aa838e
add edi, 0x524fe8f1
sub edi, 0x524fe8ed
loop 0x40331c
add eax, 0x43fa2ab7
add eax, 0xbc06d4dc
mov ebx, eax
add eax, 0x443d6fd4
add eax, 0xbbc29031
mov ecx, 0x1274389f
add ecx, 0xedcbc761
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x401ad0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp byte [0x4625c0], 0
je 0x401bad
xor edx, edx
push ebp
push 0x401ba6
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [0x462049], 0
je 0x401b02
push 0x4625c8
call sub.KERNEL32.DLL_TlsSetValue
mov byte [0x4625c0], 0
mov eax, dword [0x462620]
push eax
call sub.KERNEL32.DLL_DeleteCriticalSection
xor eax, eax
mov dword [0x462620], eax
mov ebx, dword [0x4625e8]
jmp 0x401b35
push 0x8000
push 0
mov eax, dword [ebx + 8]
push eax
call sub.KERNEL32.DLL_LocalAlloc
mov ebx, dword [ebx]
cmp ebx, 0x4625e8
jne 0x401b23
mov eax, 0x4625e8
call fcn.004013d0
mov eax, 0x4625f8
call fcn.004013d0
mov eax, 0x462624
call fcn.004013d0
mov eax, dword [0x4625e0]
test eax, eax
je 0x401b7b
mov edx, dword [eax]
mov dword [0x4625e0], edx
push eax
call sub.KERNEL32.DLL_DeleteCriticalSection
mov eax, dword [0x4625e0]
test eax, eax
jne 0x401b64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401bad
cmp byte [0x462049], 0
je 0x401b9b
push 0x4625c8
call sub.KERNEL32.DLL_CreateWaitableTimerA
push 0x4625c8
call sub.KERNEL32.DLL_Sleep
ret
pop ebx
pop ebp
ret
Function at 0x4020f8
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, eax
cmp byte [0x4625c0], 0
jne 0x402115
call fcn.00401a0c
test al, al
je 0x40211d
cmp ebx, 0x7ffffff8
jle 0x402127
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x40227b
xor ecx, ecx
push ebp
push 0x402274
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x462049], 0
je 0x402148
push 0x4625c8
call sub.KERNEL32.DLL_TlsSetValue
add ebx, 7
and ebx, 0xfffffffc
cmp ebx, 0xc
jge 0x402158
mov ebx, 0xc
cmp ebx, 0x1000
jg 0x4021f7
mov eax, ebx
test eax, eax
jns 0x40216d
add eax, 3
sar eax, 2
mov edx, dword [0x462620]
mov edx, dword [edx + eax*4 - 0xc]
test edx, edx
je 0x4021f7
mov esi, edx
mov eax, esi
add eax, ebx
and dword [eax], 0xfffffffe
mov eax, dword [edx + 4]
cmp edx, eax
jne 0x4021a8
mov eax, ebx
test eax, eax
jns 0x402197
add eax, 3
sar eax, 2
mov ecx, dword [0x462620]
xor edi, edi
mov dword [ecx + eax*4 - 0xc], edi
jmp 0x4021ce
mov ecx, ebx
test ecx, ecx
jns 0x4021b1
add ecx, 3
sar ecx, 2
mov edi, dword [0x462620]
mov dword [edi + ecx*4 - 0xc], eax
mov ecx, dword [edx]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, esi
mov edx, dword [edx + 8]
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x4625b0]
sub ebx, 4
add dword [0x4625b4], ebx
call fcn.00403a90
jmp 0x40227b
cmp ebx, dword [0x462618]
jg 0x402249
sub dword [0x462618], ebx
cmp dword [0x462618], 0xc
jge 0x40221b
add ebx, dword [0x462618]
xor eax, eax
mov dword [0x462618], eax
mov eax, dword [0x46261c]
add dword [0x46261c], ebx
mov edx, ebx
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x4625b0]
sub ebx, 4
add dword [0x4625b4], ebx
call fcn.00403a90
jmp 0x40227b
mov eax, ebx
call fcn.00402004
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40227b
cmp byte [0x462049], 0
je 0x402273
push 0x4625c8
call sub.KERNEL32.DLL_CreateWaitableTimerA
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x402288
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
mov dword [0x4625c4], eax
cmp byte [0x4625c0], 0
jne 0x4022c0
call fcn.00401a0c
test al, al
jne 0x4022c0
mov dword [0x4625c4], 8
mov dword [ebp - 4], 8
jmp 0x402421
xor ecx, ecx
push ebp
push 0x40241a
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x462049], 0
je 0x4022e1
push 0x4625c8
call sub.KERNEL32.DLL_TlsSetValue
mov esi, ebx
sub esi, 4
mov ebx, dword [esi]
test bl, 2
jne 0x4022fc
mov dword [0x4625c4], 9
jmp 0x4023f1
dec dword [0x4625b0]
mov eax, ebx
and eax, 0x7ffffffc
sub eax, 4
sub dword [0x4625b4], eax
test bl, 1
je 0x40235c
mov eax, esi
sub eax, 0xc
mov edx, dword [eax + 8]
cmp edx, 0xc
jl 0x40232c
test edx, 0x80000003
je 0x40233b
mov dword [0x4625c4], 0xa
jmp 0x4023f1
mov eax, esi
sub eax, edx
cmp edx, dword [eax + 8]
je 0x402353
mov dword [0x4625c4], 0xa
jmp 0x4023f1
add ebx, edx
mov esi, eax
call fcn.00401bb0
and ebx, 0x7ffffffc
mov eax, esi
add eax, ebx
mov edi, eax
cmp edi, dword [0x46261c]
jne 0x40239c
sub dword [0x46261c], ebx
add dword [0x462618], ebx
cmp dword [0x462618], 0x3c00
jle 0x40238d
call fcn.00401ea0
xor eax, eax
mov dword [ebp - 4], eax
call fcn.00403a90
jmp 0x402421
mov edx, dword [eax]
test dl, 2
je 0x4023bf
and edx, 0x7ffffffc
cmp edx, 4
jge 0x4023ba
mov dword [0x4625c4], 0xb
jmp 0x4023f1
or dword [eax], 1
jmp 0x4023e8
mov eax, edi
cmp dword [eax + 4], 0
je 0x4023d2
cmp dword [eax], 0
je 0x4023d2
cmp dword [eax + 8], 0xc
jge 0x4023de
mov dword [0x4625c4], 0xb
jmp 0x4023f1
mov edx, dword [eax + 8]
add ebx, edx
call fcn.00401bb0
mov edx, ebx
mov eax, esi
call fcn.00401e18
mov eax, dword [0x4625c4]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402421
cmp byte [0x462049], 0
je 0x402419
push 0x4625c8
call sub.KERNEL32.DLL_CreateWaitableTimerA
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x403e2c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x462048], 0
je 0x403e8d
cmp word [0x46221c], 0xd7b2
jne 0x403e55
cmp dword [0x462224], 0
jbe 0x403e55
mov eax, 0x462218
call dword [0x462234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x45e06c
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_WriteFile
push eax
call sub.KERNEL32.DLL_FindClose
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403eb4
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_WriteFile
push eax
call sub.KERNEL32.DLL_FindClose
pop edx
ret
cmp byte [0x45e030], 0
jne 0x403ea9
push 0
push 0x45e064
push 0x45e06c
push 0
call sub.KERNEL32.DLL_GetStdHandle
pop edx
ret
Function at 0x403eb8
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x462634
mov esi, section.DATA
mov edi, 0x462044
cmp byte [ebx + 0x28], 0
jne 0x403ee7
cmp dword [edi], 0
je 0x403ee7
mov edx, dword [edi]
mov eax, edx
xor edx, edx
mov dword [edi], edx
mov ebp, eax
call ebp
cmp dword [edi], 0
jne 0x403ed6
cmp dword [0x45e004], 0
je 0x403f01
call fcn.00403da0
call fcn.00403e2c
xor eax, eax
mov dword [0x45e004], eax
cmp byte [ebx + 0x28], 2
jne 0x403f11
cmp dword [esi], 0
jne 0x403f11
xor eax, eax
mov dword [ebx + 0xc], eax
call fcn.00403c30
cmp byte [ebx + 0x28], 1
jbe 0x403f21
cmp dword [esi], 0
je 0x403f42
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x403f42
call fcn.00405654
mov edx, dword [ebx + 0x10]
mov eax, dword [edx + 0x10]
cmp eax, dword [edx + 4]
je 0x403f42
test eax, eax
je 0x403f42
push eax
call sub.KERNEL32.DLL_GetProcAddress
call fcn.00403c08
cmp byte [ebx + 0x28], 1
jne 0x403f50
call dword [ebx + 0x24]
cmp byte [ebx + 0x28], 0
je 0x403f5b
call fcn.00403dfc
cmp dword [ebx], 0
jne 0x403f77
cmp dword [0x462024], 0
je 0x403f6f
call dword [0x462024]
mov eax, dword [esi]
push eax
call sub.KERNEL32.DLL_GetCommandLineA
mov eax, dword [ebx]
push esi
mov esi, eax
mov edi, ebx
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
pop esi
jmp 0x403f01

Function at 0x404710
Capabilities:
Hide graphical window

Disassembly:
test eax, eax
je 0x404724
push eax
push 0
call fcn.004012e4
test eax, eax
je 0x404708
ret