joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43f200
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
pop ebp
ret

Function at 0x461550
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x462eeb
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x5143e4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor edi, edi
xor ebx, ebx
mov dword [ebp - 4], edi
mov dword [ebp - 0x230], edi
mov dword [ebp - 0x22c], edi
mov dword [ebp - 0x228], edi
mov edx, dword [ebp + 0x10]
lea ecx, [ebp - 0x230]
push ecx
push edx
push eax
mov byte [ebp - 4], 1
call fcn.0042fae0
add esp, 0xc
cmp eax, edi
je 0x4616f8
mov eax, dword [ebp - 0x230]
cmp eax, dword [ebp - 0x22c]
je 0x4616f8
lea ecx, [ebp - 0x230]
push 0x4019d8
push ecx
call fcn.004309b0
add esp, 8
push 0x4019c8
push 0x4019b0
call dword [0x401188]
push eax
call dword [fcn.004011ac]
cmp eax, edi
je 0x4616f8
push esi
call eax
cmp eax, edi
je 0x46167d
push esi
call dword [0x401068]
test eax, eax
jne 0x46167d
push 0x206
lea eax, [ebp - 0x21a]
xor edx, edx
push edi
push eax
mov word [ebp - 0x21c], dx
call fcn.00452d40
add esp, 0xc
lea ecx, [ebp - 0x21c]
push ecx
push 0x104
call dword [0x401064]
test eax, eax
je 0x4616f8
lea edx, [ebp - 0x21c]
push edx
push edi
push edi
mov eax, edx
push eax
call dword [0x401060]
test eax, eax
je 0x4616f8
push 1
lea ecx, [ebp - 0x21c]
push ecx
push esi
call dword [0x40105c]
test eax, eax
je 0x4616f8
push 0x4019a8
lea edx, [ebp - 0x220]
push esi
push edx
mov dword [ebp - 0x220], edi
call fcn.00454968
add esp, 0xc
test eax, eax
jne 0x4616f8
mov eax, dword [ebp - 0x220]
cmp eax, edi
je 0x4616f8
mov ecx, dword [ebp - 0x22c]
push eax
mov eax, dword [ebp - 0x230]
sub ecx, eax
push ecx
push 1
push eax
call fcn.00454830
mov edx, dword [ebp - 0x220]
push edx
call fcn.0045467d
mov eax, dword [ebp - 0x220]
mov esi, dword [ebp - 0x22c]
sub esi, dword [ebp - 0x230]
push eax
call fcn.0045448e
mov ecx, dword [ebp - 0x220]
xor ebx, ebx
cmp esi, eax
push ecx
sete bl
call fcn.00454286
add esp, 0x1c
mov eax, dword [ebp - 0x230]
cmp eax, edi
je 0x461723
push eax
call fcn.00452ba1
add esp, 4
jmp 0x461723
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00452822
mov esp, ebp
pop ebp
ret
Function at 0x4618b0
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x462f68
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x5143e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
cmp edi, ebx
je 0x461a97
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4618f3
sub eax, edx
sar eax, 1
je 0x461a97
push edi
call dword [0x4011c4]
test eax, eax
je 0x461a97
push 0x409
push 0x65
push ebx
call dword [0x401194]
mov esi, eax
cmp esi, ebx
je 0x461a89
push esi
push ebx
call dword [0x4011a0]
mov edi, eax
cmp edi, ebx
je 0x461a97
push esi
push ebx
call dword [fcn.00401198]
cmp eax, ebx
je 0x461a97
push eax
call dword [0x40119c]
cmp eax, ebx
je 0x461a97
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
lea ecx, [ebp - 0x2c]
push ecx
push edi
push eax
mov byte [ebp - 4], 1
call fcn.0042fae0
add esp, 0xc
cmp eax, ebx
je 0x461a70
mov edx, dword [ebp - 0x2c]
cmp edx, dword [ebp - 0x28]
je 0x461a70
mov edi, dword [ebp + 8]
push 0x4019a8
lea eax, [ebp - 0x18]
push edi
push eax
mov dword [ebp - 0x18], ebx
call fcn.00454968
add esp, 0xc
test eax, eax
jne 0x461a70
mov ecx, dword [ebp - 0x18]
cmp ecx, ebx
je 0x461a70
mov eax, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x28]
push ecx
sub esi, eax
push esi
push 1
push eax
call fcn.00454830
mov edx, dword [ebp - 0x18]
xor ecx, ecx
cmp esi, eax
sete cl
push edx
mov esi, ecx
call fcn.00454286
add esp, 0x14
cmp esi, ebx
je 0x461a70
mov eax, dword [0x5152e0]
mov edx, dword [eax + 0xc]
mov ecx, 0x5152e0
call edx
add eax, 0x10
mov dword [ebp - 0x1c], eax
push 0x6b
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.00428350
cmp eax, ebx
je 0x461a68
mov esi, dword [ebp - 0x1c]
cmp dword [esi - 0xc], ebx
je 0x461a68
push edi
lea ecx, [ebp + 8]
call fcn.00428aa0
lea ecx, [ebp + 8]
mov byte [ebp - 4], 3
call fcn.0044e220
push esi
lea ecx, [ebp + 8]
call int.0044d710
cmp eax, ebx
je 0x461a60
mov eax, dword [ebp + 8]
push eax
push edi
call dword [0x40106c]
test eax, eax
je 0x461a60
mov ecx, dword [ebp + 8]
push 1
push ebx
push ebx
push ecx
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x14], 1
lea ecx, [ebp + 8]
call fcn.0044c790
lea ecx, [ebp - 0x1c]
call fcn.004255e0
lea ecx, [ebp - 0x2c]
call fcn.0042d480
jmp 0x461a97
push edi
call dword [0x401068]
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x8e4930
Capabilities:
Hash data using sha1
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1068
call fcn.008f5580
mov eax, dword [0x902044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push 0x900720
push eax
lea eax, [ebp - 0x1064]
xor ebx, ebx
push eax
mov dword [ebp - 0x1064], ebx
call fcn.008ec28f
mov eax, dword [ebp - 0x1064]
add esp, 0xc
cmp eax, ebx
jne 0x8e4991
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.008ec02f
mov esp, ebp
pop ebp
ret
push esi
push 2
push ebx
push eax
call fcn.008ecfb7
mov ecx, dword [ebp - 0x1064]
push ecx
call fcn.008ed1c7
mov edx, dword [ebp - 0x1064]
push ebx
push ebx
push edx
mov dword [ebp - 0x1068], eax
call fcn.008ecfb7
mov eax, dword [ebp - 0x1064]
push eax
push 0x1000
lea ecx, [ebp - 0x1004]
push 1
push ecx
mov dword [ebp - 0x105c], ebx
mov dword [ebp - 0x1060], ebx
mov dword [ebp - 0x1058], 0x67452301
mov dword [ebp - 0x1054], 0xefcdab89
mov dword [ebp - 0x1050], 0x98badcfe
mov dword [ebp - 0x104c], 0x10325476
mov dword [ebp - 0x1048], 0xc3d2e1f0
call fcn.008ed476
mov esi, eax
add esp, 0x2c
test esi, esi
je 0x8e4a58
lea esp, [esp]
lea edx, [ebp - 0x1060]
push edx
push esi
lea ecx, [ebp - 0x1004]
call fcn.008e47a0
mov eax, dword [ebp - 0x1064]
push eax
push 0x1000
lea ecx, [ebp - 0x1004]
push 1
push ecx
add ebx, esi
call fcn.008ed476
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x8e4a20
push edi
lea esi, [ebp - 0x1060]
call fcn.008e4840
mov edx, dword [ebp - 0x1064]
push edx
call fcn.008ec514
add esp, 8
pop esi
cmp ebx, dword [ebp - 0x1068]
jb 0x8e4972
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.008ec02f
mov esp, ebp
pop ebp
ret

Function at 0x8e52f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.008f5580
mov eax, dword [0x902044]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebx]
mov eax, dword [ebp + 8]
push edi
xor edi, edi
push edi
push 4
lea ecx, [ebp - 0x1008]
push ecx
push edx
mov dword [ebp - 0x100c], eax
call dword [0x8fa1ec]
cmp eax, 4
je 0x8e533c
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.008ec02f
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x1008], edi
jbe 0x8e538e
push esi
mov ecx, dword [ebx]
push 0
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push ecx
call dword [0x8fa1ec]
mov esi, eax
test esi, esi
je 0x8e538d
mov edx, dword [ebp - 0x100c]
mov eax, dword [edx]
push eax
push esi
lea ecx, [ebp - 0x1004]
push 1
push ecx
call fcn.008ec42d
add edi, esi
add esp, 0x10
mov dword [0x904640], edi
cmp edi, dword [ebp - 0x1008]
jb 0x8e5345
pop esi
mov edx, dword [ebp - 0x100c]
mov eax, dword [edx]
push eax
call fcn.008ec514
mov ecx, dword [ebp - 4]
add esp, 4
cmp edi, dword [ebp - 0x1008]
pop edi
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.008ec02f
mov esp, ebp
pop ebp
ret
Function at 0x8e58b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x902044]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x206
xor edi, edi
lea ecx, [ebp - 0x20a]
xor eax, eax
push edi
push ecx
mov word [ebp - 0x20c], ax
call fcn.008f3750
add esp, 0xc
mov dword [ebp - 0x210], edi
cmp esi, edi
je 0x8e59a6
cmp dword [0x902f30], 3
jne 0x8e5928
push 0x104
lea edx, [ebp - 0x20c]
push edx
call dword [0x8fa024]
push 0x900150
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.008ecac5
add esp, 0xc
jmp 0x8e593a
lea ecx, [ebp - 0x20c]
push ecx
push 0x104
call dword [0x8fa028]
push 0x900180
lea edx, [ebp - 0x20c]
push 0x104
push edx
call fcn.008ecac5
push 0x900154
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x210]
push ecx
call fcn.008ec28f
mov eax, dword [ebp - 0x210]
add esp, 0x18
cmp eax, edi
je 0x8e59a6
push eax
push 1
push 0x200
push esi
call fcn.008ed476
mov edx, dword [ebp - 0x210]
push edx
call fcn.008ec514
add esp, 0x14
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.008ec02f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, edi
xor ecx, ebp
pop edi
call fcn.008ec02f
mov esp, ebp
pop ebp
ret

Function at 0x8e59c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x902044]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x206
xor edi, edi
lea ecx, [ebp - 0x20a]
xor eax, eax
push edi
push ecx
mov word [ebp - 0x20c], ax
call fcn.008f3750
add esp, 0xc
mov dword [ebp - 0x210], edi
cmp esi, edi
je 0x8e5a7a
lea edx, [ebp - 0x20c]
push edx
push 0x104
call dword [0x8fa028]
push 0x900164
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.008ecac5
push 0x90015c
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x210]
push edx
call fcn.008ec28f
mov eax, dword [ebp - 0x210]
add esp, 0x18
cmp eax, edi
je 0x8e5a7a
push eax
push 1
push 0x200
push esi
call fcn.008ed476
mov eax, dword [ebp - 0x210]
push eax
call fcn.008ec514
add esp, 0x14
lea eax, [edi + 1]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.008ec02f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, edi
xor ecx, ebp
pop edi
call fcn.008ec02f
mov esp, ebp
pop ebp
ret
Function at 0x8e5b40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x902044]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
test eax, eax
jne 0x8e5b6a
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.008ec02f
mov esp, ebp
pop ebp
ret
cmp dword [eax], 0x504d534d
jne 0x8e5b5a
push 0x200
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.008ed510
add esp, 0xc
xor eax, eax
lea esp, [esp]
mov cl, byte [ebp + eax - 0x414]
not cl
mov byte [ebp + eax - 0x414], cl
inc eax
cmp eax, 0x200
jb 0x8e5b90
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x212]
push eax
mov word [ebp - 0x214], dx
call fcn.008f3750
add esp, 0xc
lea ecx, [ebp - 0x214]
push ecx
push 0x104
mov dword [ebp - 0x418], 0
call dword [0x8fa028]
push 0x90012c
lea edx, [ebp - 0x214]
push 0x104
push edx
call fcn.008ecac5
push 0x900148
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x418]
push ecx
call fcn.008ec28f
mov eax, dword [ebp - 0x418]
add esp, 0x18
test eax, eax
je 0x8e5c40
push eax
push 1
lea edx, [ebp - 0x414]
push 0x200
push edx
call fcn.008ec42d
mov eax, dword [ebp - 0x418]
push eax
call fcn.008ec514
add esp, 0x14
mov ecx, dword [ebp - 8]
xor ecx, ebp
mov eax, 1
call fcn.008ec02f
mov esp, ebp
pop ebp
ret
Function at 0x8e7d50
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
jne 0x8e7d57
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x8e7e2d
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x8feb50]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x8feb50]
movzx edi, byte [ecx + 2]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x8feb50]
movzx edi, byte [ecx + 3]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x8feb50]
movzx edi, byte [ecx + 4]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x8feb50]
movzx edi, byte [ecx + 5]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x8feb50]
movzx edi, byte [ecx + 6]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x8feb50]
movzx edi, byte [ecx + 7]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x8feb50]
add ecx, 8
sub edx, 8
dec esi
jne 0x8e7d70
pop edi
test edx, edx
je 0x8e7e4a
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x8feb50]
inc ecx
dec edx
jne 0x8e7e31
not eax
pop esi
ret

Function at 0x8e7e50
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [edx]
movsx ecx, cl
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x8feb50]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x8feb50]
mov dword [edx + 8], ecx
ret

Function at 0x8e7ea0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov ecx, dword [esi + 8]
push ebx
mov edx, ecx
and edx, 0xfffd
or edx, 2
mov ebx, edx
xor ebx, 1
imul ebx, edx
mov edx, dword [esi]
shr ebx, 8
push edi
xor al, bl
movsx edi, al
xor edi, edx
shr edx, 8
and edi, 0xff
mov ebx, dword [edi*4 + 0x8feb50]
xor ebx, edx
movzx edx, bl
add edx, dword [esi + 4]
mov dword [esi], ebx
imul edx, edx, 0x8088405
inc edx
mov dword [esi + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x8feb50]
pop edi
mov dword [esi + 8], ecx
pop ebx
ret
Function at 0x8eaba0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x8fc3d0
push eax
lea ecx, [ebp - 4]
push ecx
mov dword [ebp - 4], 0
call fcn.008ec28f
add esp, 0xc
test eax, eax
je 0x8eabc9
xor eax, eax
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
push ebx
push esi
push edi
push 2
push 0
push edx
call fcn.008ecfb7
mov eax, dword [ebp - 4]
push eax
call fcn.008ed1c7
mov ecx, dword [ebp - 4]
push 0
push 0
push ecx
mov esi, eax
call fcn.008ecfb7
lea eax, [esi + 0x32]
push eax
mov dword [ebp - 8], eax
call fcn.008ec588
mov edx, dword [ebp - 4]
push edx
push 1
mov ebx, eax
push esi
push ebx
call fcn.008ed476
mov eax, dword [ebp - 4]
push eax
call fcn.008ec514
push 0x32
lea edi, [ebx + esi]
push 0
push edi
call fcn.008f3750
add esp, 0x40
call dword [0x8fa030]
push eax
call fcn.008ec0cf
add esp, 4
xor esi, esi
call fcn.008ec0e1
mov dword [edi + esi*4], eax
inc esi
cmp esi, 0xc
jl 0x8eac36
mov ecx, dword [ebp + 8]
push 0x8fc3d8
push ecx
lea edx, [ebp - 4]
push edx
call fcn.008ec28f
add esp, 0xc
test eax, eax
je 0x8eac66
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
push eax
push 1
push ecx
push ebx
call fcn.008ec42d
mov edx, dword [ebp - 4]
push edx
call fcn.008ec514
add esp, 0x14
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40152c
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call main
sub esp, 0x14
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x6f
jne 0x40164d
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov dword [esp], 0x40
mov eax, dword [sym.imp.KERNEL32.dll_LocalAlloc]
call eax
sub esp, 8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xc], 0
je 0x40164d
lea eax, [ebp - 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call main
sub esp, 0x14
mov dword [ebp - 0x1e], 0
mov word [ebp - 0x1a], 0
jmp 0x401637
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x34]
cmp eax, 6
jne 0x40162e
mov eax, dword [ebp - 0xc]
add eax, 0x2c
mov edx, dword [eax]
mov dword [ebp - 0x1e], edx
movzx eax, word [eax + 4]
mov word [ebp - 0x1a], ax
mov dword [esp + 8], 3
lea eax, [ebp - 0x1e]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x40162e
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_LocalFree]
call eax
sub esp, 4
mov eax, 1
jmp 0x401652
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4015db
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_LocalFree]
call eax
sub esp, 4
mov eax, 0
leave
ret

Function at 0x401f30
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00408000
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00408000
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]
Function at 0x401f90
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x40d06c]
test esi, esi
jle 0x4020b0
mov eax, dword [0x40d070]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x401fc4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x402047
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x401fb0
mov dword [esp], ebx
call fcn.00402980
mov edi, eax
test eax, eax
je 0x4020d7
mov eax, dword [0x40d070]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00402ac0
mov edx, dword [0x40d070]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x4020b7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x402040
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x402050
add dword [0x40d06c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x40d070]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x402040
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00401f30
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x401fce
mov eax, dword [0x40d070]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00401f30
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00401f30
lea esi, [esi]
nop

Function at 0x4025f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x40d088
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x40d080]
sub esp, 4
test ebx, ebx
je 0x402645
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40263e
test esi, esi
je 0x40263e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402620
mov dword [esp], 0x40d088
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402980
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x4029a5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x4029b0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x4029a5
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x4029f8
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x4029ee
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x4029fa
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x4029e0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x404690
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x2c
call fcn.0042ff60
add eax, 0x1c84
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], str.open
mov dword [esp], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
sub esp, 0x18
xor eax, eax
add esp, 0x2c
ret

Function at 0x4062e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x2c
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00433450
mov dword [ebx], fcn.00404400
sub esp, 0xc
mov dword [ebx + 0x70], 0
mov dword [ebx + 0x7c], 0
mov dword [ebx + 0x84], 2
mov ecx, ebx
call fcn.00405580
mov dword [esp], 0x51c
call fcn.0045fbe0
mov dword [esp], 0x465a80
mov ecx, eax
mov esi, eax
call fcn.00438050
sub esp, 4
mov dword [ebx + 0x58], esi
mov ecx, ebx
mov dword [esp], esi
call fcn.00440650
sub esp, 4
mov dword [esp], 0x54
call fcn.0045fbe0
mov dword [esp], 0x462c20
mov ecx, eax
mov esi, eax
call fcn.00431730
sub esp, 4
mov dword [ebx + 0x60], esi
mov dword [esp], 0x54
call fcn.0045fbe0
mov dword [esp], 0x4628e0
mov ecx, eax
mov esi, eax
call fcn.00431730
sub esp, 4
mov dword [ebx + 0x64], esi
mov ecx, ebx
mov dword [esp], esi
call fcn.00440650
mov eax, dword [ebx + 0x60]
sub esp, 4
mov ecx, ebx
mov dword [esp], eax
call fcn.00440650
sub esp, 4
mov dword [esp], pe_nt_image_headers32
call fcn.0045fbe0
mov dword [esp], ebx
mov ecx, eax
mov esi, eax
call fcn.00404280
sub esp, 4
mov dword [ebx + 0x5c], esi
mov ecx, ebx
mov dword [esp], esi
call fcn.00440650
sub esp, 4
mov dword [esp], 0x54
call fcn.0045fbe0
mov dword [esp], 0x462880
mov ecx, eax
mov esi, eax
call fcn.004317a0
sub esp, 4
mov dword [ebx + 0x68], esi
mov ecx, ebx
mov dword [esp], esi
call fcn.00440650
sub esp, 4
mov dword [esp], 0xbc
call fcn.0045fbe0
mov dword [esp + 4], str.Status
mov dword [esp], ebx
mov ecx, eax
mov esi, eax
call fcn.00403e10
mov eax, dword [ebx + 0x10]
sub esp, 8
mov dword [ebx + 0x6c], esi
mov dword [esp + 4], 3
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
sub esp, 8
mov dword [ebx + 0x78], 0xffffffff
call fcn.0042ff60
lea ecx, [eax + 0x74]
call fcn.0041bf90
mov dword [esp], eax
mov ecx, ebx
call fcn.00404b90
mov eax, dword [ebx + 0x7c]
sub esp, 4
mov ecx, dword [ebx + 0x5c]
test eax, eax
je 0x4064b2
mov eax, dword [ecx + 0x60]
mov dword [esp + 4], eax
mov eax, dword [ecx + 0x5c]
mov dword [esp], eax
call fcn.0043b420
mov dword [ebx + 0x74], 0
mov dword [ebx + 0x80], 0
sub esp, 8
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
mov dword [esp + 4], 0xffffffff
mov dword [esp], 0xffffffff
call fcn.0043b420
jmp 0x406494