joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404950
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp byte [ecx + 0x14], 0
jne 0x475002
push dword [ebp + 8]
call fcn.00423e65
pop ecx
leave
ret 4
clc
dec dword [ebx + 0x498b0c45]
adc byte [esi - 0x75], dl
xor dword [edi - 0x73], edx
jge 0x475009
push edi
push dword [ebp + 0x10]
cdq
push edx
push eax
push ecx
call dword [esi + 0x14]
mov eax, dword [ebp - 8]
pop edi
pop esi
jmp fcn.0040455b
Function at 0x413200
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb4
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edx, dword [esi]
mov edi, ecx
sub esp, 0x10
mov eax, dword [edi + 0xf4]
mov dword [esp + 0x50], eax
and al, 0x50
Function at 0xbf9186
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xbf52b0
push 0xbf8e6c
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov dword [ebp - 0x2c], 0x35
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0xd8
call fcn.00bf9060
add esp, 4
test eax, eax
je 0xbf91ca
mov ecx, eax
call fcn.00bfa4c0
mov dword [ebp - 0x1c], eax
jmp 0xbf91d1
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x1c]
add eax, 0xb8
mov ecx, eax
mov dword [ebp - 0x24], eax
call fcn.00bfa420
test eax, eax
je 0xbf9212
cmp dword [ebp - 0x1c], 0
je 0xbf9208
mov ecx, dword [ebp - 0x1c]
call fcn.00bfa530
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00bf9070
add esp, 4
mov eax, 0x7895
jmp 0xbf9345
wait
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x24]
call fcn.00bf9bb0
mov ecx, dword [ebp - 0x1c]
call fcn.00bf96b0
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x24]
call fcn.00bf9a20
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xc4], 0
je 0xbf9270
mov esi, eax
test esi, esi
je 0xbf925e
mov ecx, esi
call fcn.00bfa530
push esi
call fcn.00bf9070
add esp, 4
mov eax, 0x7895
wait
mov dword [ebp - 4], 0xffffffff
jmp 0xbf9345
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xbc], 0
mov eax, dword fs:[0x20]
je 0xbf928c
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.00bf9480
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xd0], 0
je 0xbf92d0
mov esi, eax
test esi, esi
je 0xbf92c1
mov ecx, esi
call fcn.00bfa530
push esi
call fcn.00bf9070
add esp, 4
mov eax, 0x7895
wait
mov dword [ebp - 4], 0xffffffff
jmp 0xbf9345
cmp dword [ebp - 0x2c], 0
jne 0xbf92dc
mov eax, dword ds:[0]
mov ecx, dword [ebp - 0x1c]
call fcn.00bf9890
xor dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 0x7895
wait
jmp 0xbf9314
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x28], 0
je 0xbf9328
mov dword [ebp - 0x20], 0x7895
cmp dword [ebp - 0x1c], 0
je 0xbf9342
mov ecx, dword [ebp - 0x1c]
call fcn.00bfa530
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00bf9070
add esp, 4
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
pop edi
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0xbf9360
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov dword [ecx + 0xc], 0x45f479d7
mov dword [ecx], 0
mov esi, ecx
mov dword [ecx + 0x18], 0xf3cb3e57
mov dword [esi + 0x1c], 0x40092ee0
mov dword [esi + 8], 0x75bbf938
mov dword [esi + 0x10], 0xfd3371b0
mov dword [esi + 0x20], 0x8a4406c7
mov dword [esi + 0x24], 0x2cc8e4f
mov dword [esi + 0x28], 0xd12c3bc9
mov dword [esi + 0x30], 0xebcc478b
mov dword [esi + 0x34], 0x489225be
mov dword [esi + 0x38], 0xafda13f8
mov dword [esi + 0x10], 0x3f4cdc6c
mov dword [esi + 0x28], 0xea71e659
mov dword [esi + 8], 0x1d6efe4e
mov dword [esi + 0x30], 0x5a92a305
mov dword [esi + 0x34], 0x412b44f5
xor eax, eax
mov ecx, eax
inc eax
xor ecx, 0x3c2d1e0f
cmp eax, 0x1e
not ecx
mov dword [esi + eax*4 + 0x38], ecx
jl 0xbf93dc
mov eax, dword [esi + 8]
mov edi, dword [esi + 0x38]
mov ecx, dword [esi + 0x28]
mov edx, eax
or edx, edi
and eax, edi
and edx, dword [esi + 0x10]
or edx, eax
mov eax, ecx
shl eax, 5
shr ecx, 0x1b
or eax, ecx
add edx, eax
mov eax, edi
shr eax, 2
add edx, dword [esi + 0x24]
shl edi, 0x1e
add edx, 0x5a837999
or eax, edi
add dword [esi + 0x20], edx
mov dword [esi + 0x38], eax
call fcn.00bf9150
mov edi, dword [esi + 0x28]
mov ecx, dword [esi + 8]
xor ecx, dword [esi + 0x38]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x20]
xor ecx, edi
mov edx, eax
shl edx, 5
shr eax, 0x1b
or edx, eax
mov eax, edi
shr eax, 2
add ecx, edx
shl edi, 0x1e
add ecx, dword [esi + 0x24]
add ecx, 0x5a837999
or eax, edi
pop edi
add dword [esi + 0x10], ecx
mov dword [esi + 0x28], eax
mov eax, esi
pop esi
ret

Function at 0xbf9ac0
Capabilities:
Resolve function by hash

Disassembly:
sub esp, 0x10
push esi
push edi
mov esi, ecx
mov edi, dword [esp + 0x1c]
push edi
push 0xec0e4e8e
call fcn.00bf9770
mov ecx, dword [esi + 0x14]
push edi
push 0xffd97fb
mov dword [ecx], eax
call fcn.00bf9770
mov ecx, dword [esi + 0x14]
push edi
push 0x7c0017a5
mov dword [ecx + 4], eax
call fcn.00bf9770
mov ecx, dword [esi + 0x14]
push edi
push 0x4dc9d5a0
mov dword [ecx + 8], eax
call fcn.00bf9770
mov ecx, dword [esi + 0x14]
push edi
push 0x753a4fc
mov dword [ecx + 0xc], eax
call fcn.00bf9770
mov edi, dword [0xbf3970]
mov ecx, 0xbf396c
lea edx, [esp + 8]
mov dword [0xbf3930], eax
mov eax, dword [ecx]
push edx
mov dword [edx], eax
mov eax, dword [ecx + 8]
mov cl, byte [ecx + 0xc]
mov dword [edx + 4], edi
mov dword [edx + 8], eax
mov byte [edx + 0xc], cl
mov ecx, esi
call fcn.00bf99d0
mov ecx, dword [esi + 0x14]
lea eax, [esp + 8]
push eax
mov edx, dword [ecx]
mov dword [0xbf3938], edx
call fcn.00bf9870
mov dword [esi], eax
test eax, eax
je 0xbf9b9a
push eax
push 0xa84aeb81
call fcn.00bf9770
mov ecx, dword [esi + 0x14]
mov dword [ecx + 0x10], eax
mov eax, dword [esi]
push eax
push 0xfcba95ab
call fcn.00bf9770
mov ecx, dword [esi + 0x14]
mov dword [ecx + 0x14], eax
mov edx, dword [esi]
push edx
push 0x35e273e6
call fcn.00bf9770
mov ecx, dword [esi + 0x14]
mov dword [ecx + 0x18], eax
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0xbfa556
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xbf5318
push 0xbf8e6c
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov dword [ebp - 0x2c], 0x3459fe
mov dword [ebp - 0x28], 0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0xd8
call fcn.00bf9060
add esp, 4
test eax, eax
je 0xbfa5a1
mov ecx, eax
call fcn.00bfa4c0
mov dword [ebp - 0x1c], eax
jmp 0xbfa5a8
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
add eax, 0xb8
mov ecx, eax
mov dword [ebp - 0x20], eax
call fcn.00bfa420
test eax, eax
je 0xbfa5e2
cmp dword [ebp - 0x1c], 0
je 0xbfa5d8
mov ecx, dword [ebp - 0x1c]
call fcn.00bfa530
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00bf9070
add esp, 4
mov eax, 0x2a
jmp 0xbfa70e
wait
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x20]
call fcn.00bf9a20
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xbc], 0
mov eax, dword fs:[0x20]
je 0xbfa611
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x20]
call fcn.00bf9bb0
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xc4], 0
je 0xbfa654
mov esi, eax
test esi, esi
je 0xbfa642
mov ecx, esi
call fcn.00bfa530
push esi
call fcn.00bf9070
add esp, 4
mov eax, 0x926
wait
mov dword [ebp - 4], 0xffffffff
jmp 0xbfa70e
mov ecx, dword [ebp - 0x20]
call fcn.00bf9e60
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x2c], 0
jne 0xbfa69c
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xd0], 0
je 0xbfa696
mov esi, eax
test esi, esi
je 0xbfa687
mov ecx, esi
call fcn.00bfa530
push esi
call fcn.00bf9070
add esp, 4
mov eax, 0xc3
wait
mov dword [ebp - 4], 0xffffffff
jmp 0xbfa70e
mov eax, dword ds:[0]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.00bf95c0
mov ecx, dword [ebp - 0x20]
call fcn.00bf9fc0
xor dword [ebp - 0x24], eax
wait
jmp 0xbfa6dd
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x1c], 0
je 0xbfa6fe
mov ecx, dword [ebp - 0x1c]
call fcn.00bfa530
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00bf9070
add esp, 4
cmp dword [ebp - 0x28], 0
je 0xbfa70b
mov dword [ebp - 0x24], 0x4e6
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
pop edi
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0xbfd1e0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0xbfe2e0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov ecx, dword [esp + 0xc]
push ebp
mov eax, ecx
push edi
sub eax, 0x80
je 0xbfe30f
sub eax, 0x40
je 0xbfe308
sub eax, 0x40
je 0xbfe301
pop edi
mov eax, 0xfffffffe
pop ebp
ret
mov edi, 8
jmp 0xbfe314
mov edi, 6
jmp 0xbfe314
mov edi, 4
mov eax, dword [esp + 0x10]
cmp eax, ecx
jge 0xbfe31e
mov eax, ecx
sub eax, 0x80
je 0xbfe345
sub eax, 0x40
je 0xbfe33e
sub eax, 0x40
je 0xbfe337
pop edi
mov eax, 0xfffffffd
pop ebp
ret
mov ebp, 0xe
jmp 0xbfe34a
mov ebp, 0xc
jmp 0xbfe34a
mov ebp, 0xa
push ebx
mov ebx, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x14]
push edi
push ebx
push esi
call fcn.00bfe3e0
add esp, 0xc
cmp ebp, 1
jle 0xbfe3a7
lea eax, [ebp - 1]
add ebx, 0x20
mov dword [esp + 0x1c], eax
push edi
push 0xbf5034
push esi
call fcn.00bfe4c0
push edi
push 0
push esi
call fcn.00bfe430
push edi
push esi
call fcn.00bfe500
push edi
push ebx
push esi
call fcn.00bfe3e0
mov eax, dword [esp + 0x48]
add esp, 0x2c
add ebx, 0x20
dec eax
mov dword [esp + 0x1c], eax
jne 0xbfe36e
mov ebx, dword [esp + 0x20]
push edi
push 0xbf5034
push esi
call fcn.00bfe4c0
push edi
push 0
push esi
call fcn.00bfe430
shl ebp, 5
add ebp, ebx
push edi
push ebp
push esi
call fcn.00bfe3e0
add esp, 0x24
xor eax, eax
pop esi
pop ebx
pop edi
pop ebp
ret

Function at 0xbfe3e0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
and edi, 0xff
mov ebp, edx
mov dword [esp + 0x1c], 4
test edi, edi
jle 0xbfe413
mov ecx, dword [esp + 0x18]
mov eax, ebp
sub ecx, edx
mov esi, edi
mov bl, byte [ecx + eax]
xor byte [eax], bl
inc eax
dec esi
jne 0xbfe40a
mov eax, dword [esp + 0x1c]
add ebp, 8
dec eax
mov dword [esp + 0x1c], eax
jne 0xbfe3fc
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x70ca20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.sect_1
lea edi, [esi - 0x22c000]
push edi
or ebp, 0xffffffff
jmp 0x70ca42
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x70ca49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x70ca38
mov eax, 1
add ebx, ebx
jne 0x70ca5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x70ca6c
jne 0x70ca8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x70ca8b
dec eax
add ebx, ebx
jne 0x70ca78
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x70ca50
add ebx, ebx
jne 0x70ca87
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x70cadd
xor ecx, ecx
sub eax, 3
jb 0x70caa3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x70cb12
sar eax, 1
mov ebp, eax
jmp 0x70caae
add ebx, ebx
jne 0x70caae
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x70ca7c
inc ecx
add ebx, ebx
jne 0x70cabc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x70ca7c
add ebx, ebx
jne 0x70cac9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x70cabe
jne 0x70cada
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x70cabe
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x70cafc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x70caee
jmp 0x70ca3e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x70cafc
add edi, ecx
jmp 0x70ca3e
pop esi
mov edi, esi
mov ecx, 0x19e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x70cb1a
cmp byte [edi], 9
jne 0x70cb1a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x70cb1f
lea edi, [esi + 0x30a000]
mov eax, dword [edi]
or eax, eax
je 0x70cb97
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x30ccc0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x30ccfc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x70cb4c
mov ecx, edi
jns 0x70cb7b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x30cd00]
or eax, eax
je 0x70cb91
mov dword [ebx], eax
add ebx, 4
jmp 0x70cb69
call dword [esi + 0x30cd10]
mov ebp, dword [esi + 0x30cd04]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x70cbcb
sub esp, 0xffffff80
jmp 0x401298
Function at 0x401f90
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x41dfb8], eax
pop esi
pop edi
pop ebp
ret
Function at 0x4035a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [ebp + 8]
mov edx, dword [0x41d5f0]
xor edx, ebp
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp + 8]
mov dword [esp], ecx
mov dword [ebp - 0x20], eax
call fcn.00403700
lea ecx, [ebp - 0x10]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00403720
lea eax, [0x4037a0]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
add eax, 4
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x24], eax
call fcn.00403820
xor ecx, ecx
mov dword [esp], 0
mov dword [esp + 4], 0
lea edx, [0x4037a0]
mov dword [esp + 8], edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0x24]
mov dword [esp + 0x14], eax
mov dword [ebp - 0x28], ecx
call fcn.00409086
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov dword [ebp - 0x1c], 0x83b4ec41
mov eax, dword [ebp - 0x1c]
mov ecx, eax
sub ecx, 0x83b4ec41
mov dword [ebp - 0x2c], eax
je 0x403695
jmp 0x403657
mov eax, dword [ebp - 0x2c]
sub eax, 0xad48b9f7
je 0x4036da
jmp 0x40366a
mov eax, dword [ebp - 0x2c]
sub eax, 0xecab3eef
je 0x4036c4
jmp 0x40367d
mov eax, dword [ebp - 0x2c]
sub eax, 0x5cd7b515
je 0x4036b0
jmp 0x403690
jmp 0x4036f5
mov eax, dword [ebp - 8]
cmp eax, 0
mov eax, 0x5cd7b515
mov ecx, 0xecab3eef
cmovne ecx, eax
mov dword [ebp - 0x1c], ecx
jmp 0x4036f5
lea ecx, [ebp - 0x10]
call fcn.00403840
mov dword [ebp - 0x1c], 0xad48b9f7
jmp 0x4036f5
mov eax, dword [ebp - 0xc]
mov dword [eax + 4], 0
mov dword [esp], 6
call fcn.004067bd
lea ecx, [ebp - 0x10]
call fcn.00403890
mov eax, dword [ebp - 4]
xor eax, ebp
mov ecx, eax
call fcn.004065e1
add esp, 0x44
pop ebp
ret 4
jmp 0x40363e

Function at 0x40778c
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4077cb
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4077cb
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4077cb
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4077cb
cmp dword [ecx + 0x74], 0xe
jbe 0x4077cb
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40bb20
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40bb4d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40bb4d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x40beb2
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x415dcc
push 0x415dc4
push str.FlsAlloc
push 0x1f
call fcn.0040c23e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40bee6
push dword [ebp + 8]
mov ecx, esi
call dword [section..bss]
call esi
jmp 0x40beec
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4
Function at 0x40bf30
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x415ddc
push 0x415dd4
push str.FlsGetValue
push 0x21
call fcn.0040c23e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40bf67
push dword [ebp + 8]
mov ecx, esi
call dword [section..bss]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40bf6f
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x415de4
push 0x415ddc
push str.FlsSetValue
push 0x22
call fcn.0040c23e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40bfa9
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [section..bss]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x40f5cd
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40f66a
push ebx
push esi
call fcn.0040f66d
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040f4d1
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40f617
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40f669
push edi
push eax
call fcn.0040dfe5
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40f637
call fcn.0040d46b
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40f668
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040f4d1
add esp, 0x20
test eax, eax
jne 0x40f656
push edi
call fcn.0040d46b
jmp 0x40f65e
push ebx
call fcn.0040d46b
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x4021d0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x402230
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x40d06c]
test esi, esi
jle 0x402350
mov eax, dword [0x40d070]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x402264
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x4022e7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x402250
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x402377
mov eax, dword [0x40d070]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x40d070]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x402357
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x4022e0
lea edx, [eax - 0x40]
and edx, 0xffffffbf
jne 0x4022f0
add dword [0x40d06c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x40d070]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4022e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, cs:[esi]
nop
xor esi, esi
jmp 0x40226e
mov eax, dword [0x40d070]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, cs:[esi]
nop
Function at 0x4028a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x40d088
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x40d080]
sub esp, 4
test ebx, ebx
je 0x4028f5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
mov esi, eax
sub esp, 4
call edi
test esi, esi
je 0x4028ee
test eax, eax
jne 0x4028ee
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4028d0
mov dword [esp], 0x40d088
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x402c30
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x402c55
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x402c60
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x402c55
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x402ca8
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x402c9e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x402caa
add ecx, 1
add eax, 0x28
cmp esi, ecx
jne 0x402c90
xor eax, eax
pop ebx
pop esi
ret