joyce8/EMBER2024-capa huggingface dataset:
Function at 0x513c8c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffd88
mov ebx, eax
mov eax, esp
call fcn.00513290
push 0x20
lea edx, [ebx + 0x68]
lea eax, [esp + 4]
mov ecx, 0x1f
call fcn.005132c4
lea edx, [esp + 0x58]
mov eax, esp
call fcn.00513368
xor eax, eax
mov al, byte [ebx + 4]
cmp dword [eax*4 + 0x543390], 5
jle 0x513d68
mov esi, 0x32
mov eax, esp
call fcn.00513290
push 0x10
lea edx, [esp + 0x5c]
lea eax, [esp + 4]
mov ecx, 0xf
call fcn.005132c4
lea edx, [esp + 0x58]
mov eax, esp
call fcn.00513368
dec esi
jne 0x513cd4
lea edx, [ebx + 0x88]
lea eax, [ebx + 0xc]
mov ecx, 0x20
call fcn.004086c8
xor esi, esi
xor eax, eax
mov al, byte [ebx + 4]
mov edx, dword [eax*4 + 0x543390]
dec edx
test edx, edx
jl 0x513d37
inc edx
xor edi, edi
lea eax, [esp + 0x58]
mov ecx, esi
xor cl, byte [eax]
mov byte [ebx + edi + 0x4c], cl
inc edi
inc eax
dec edx
jne 0x513d2a
xor eax, eax
mov al, byte [ebx + 4]
mov ecx, dword [eax*4 + 0x543390]
lea edx, [ebx + 0x4c]
lea eax, [esp + 0x78]
call fcn.00513484
push 0x20
lea ecx, [ebx + 0xc]
lea edx, [ebx + 0xc]
lea eax, [esp + 0x7c]
call fcn.005133e8
inc esi
cmp esi, 0x14
jne 0x513d12
jmp 0x513da7
lea edx, [esp + 0x68]
lea eax, [esp + 0x58]
mov ecx, 0x10
call fcn.00402d84
xor eax, eax
mov al, byte [ebx + 4]
mov ecx, dword [eax*4 + 0x543390]
lea edx, [esp + 0x68]
lea eax, [esp + 0x78]
call fcn.00513484
push 0x20
lea ecx, [ebx + 0xc]
lea edx, [ebx + 0x88]
lea eax, [esp + 0x7c]
call fcn.005133e8
add esp, 0x278
pop edi
pop esi
pop ebx
ret

Function at 0x513db4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffd88
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 4]
mov eax, dword [eax*4 + 0x543390]
cmp eax, 5
jle 0x513e8e
mov eax, esp
call fcn.00513290
push 0x20
mov edx, 0x543398
lea eax, [esp + 4]
mov ecx, 0x1f
call fcn.005132c4
push 0x10
mov esi, dword [ebx + 8]
mov eax, esi
call fcn.00406774
mov ecx, eax
mov edx, esi
lea eax, [esp + 4]
call fcn.005132c4
lea edx, [esp + 0x58]
mov eax, esp
call fcn.00513368
lea edx, [ebx + 0x2c]
lea eax, [esp + 0x58]
mov ecx, 0x10
call fcn.00402d84
mov esi, 0x10
mov byte [ebx + esi + 0x2c], 0
inc esi
cmp esi, 0x20
jne 0x513e2a
xor esi, esi
xor eax, eax
mov al, byte [ebx + 4]
mov edx, dword [eax*4 + 0x543390]
dec edx
test edx, edx
jl 0x513e5c
inc edx
xor edi, edi
lea eax, [esp + 0x68]
mov ecx, esi
xor cl, byte [ebx + edi + 0x4c]
mov byte [eax], cl
inc edi
inc eax
dec edx
jne 0x513e4f
xor eax, eax
mov al, byte [ebx + 4]
mov ecx, dword [eax*4 + 0x543390]
lea edx, [esp + 0x68]
lea eax, [esp + 0x78]
call fcn.00513484
push 0x10
lea ecx, [ebx + 0x2c]
lea edx, [ebx + 0x2c]
lea eax, [esp + 0x7c]
call fcn.005133e8
inc esi
cmp esi, 0x14
jne 0x513e37
jmp 0x513eaf
mov ecx, eax
lea edx, [ebx + 0x4c]
lea eax, [esp + 0x78]
call fcn.00513484
push 0x20
lea ecx, [ebx + 0x2c]
mov edx, 0x543398
lea eax, [esp + 0x7c]
call fcn.005133e8
add esp, 0x278
pop edi
pop esi
pop ebx
ret
Function at 0x593c9b65
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x593c9b74
pop dword [ebp - 0x1c]
mov eax, 0x3a2164e6
sub eax, 0xe0e4c972
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x78feb52f
sub dword [ebp - 0x2c], 0x2aac6fe4
mov dword [ebp - 0x28], 0x9d6c22f4
sub dword [ebp - 0x28], 0x6b38d6af
mov dword [ebp - 0x24], 0xcf2731c4
add dword [ebp - 0x24], 0x7d25126a
mov dword [ebp - 0x20], 0x2a4c0f79
sub dword [ebp - 0x20], 0x2a4c0f79
lea eax, [ebp - 0x2c]
push eax
mov eax, 0xd5ee405f
sub eax, 0x7cb32ffb
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x706d58b5
sub dword [ebp - 0x2c], 0xfbfaef5f
mov dword [ebp - 0x28], 0x8e9afa9c
add dword [ebp - 0x28], 0xb2d166d9
mov dword [ebp - 0x24], 0xd846d858
add dword [ebp - 0x24], 0x8b289414
mov dword [ebp - 0x20], 0xdf4ac8eb
sub dword [ebp - 0x20], 0xdf4ac8eb
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3ba57
push 0
call eax
mov ecx, 0x84735a4b
add ecx, 0x7b8cf937
xor ebx, ebx
add ebx, eax
mov esi, 0x285b08af
add esi, 0x30e31751
add esi, dword [ebp - 0x1c]
mov edi, 0xd378579
add edi, 0x9d64b405
add dword [ebp - 0x18], 0xd1c2fb7d
mov edx, dword [esi]
add dword [ebp - 4], eax
add edx, edi
xor dword [ebp - 4], esi
mov dword [ebx], edx
xor dword [ebp - 4], 0xf7c12527
add ebx, 0x87e24379
sub ebx, 0x87e24375
add esi, 0xb32c4205
add esi, 0x4cd3bdff
loop 0x593c9c93
add eax, 0x92a408bc
add eax, 0x6d5d381f
mov ebx, eax
add eax, 0x9ec1d9b7
sub eax, 0x9ec1d9b2
mov ecx, 0x73753ccc
add ecx, 0xe5c5c334
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x401edc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_FindResourceW]
push str.FRAMEWORK
push 0x84
push dword [0x4472cc]
mov dword [ebp - 4], ecx
call edi
push eax
push dword [0x4472cc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edx, eax
mov ecx, 0x4472b8
call fcn.0040ef80
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [0x4472b8]
xor ecx, ecx
test eax, eax
je 0x401f3b
cmp word [eax], cx
jne 0x401f4a
mov edx, str.Recherche_et_installation_du_framework_WINDEV._r_nRemarque_:_Vous_devez_avoir_un_acc
mov ecx, 0x4472b8
call fcn.0040ef80
mov ecx, 0x4472c4
call fcn.0040ef3e
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.0041f716
lea ecx, [ebp - 0x210]
call fcn.0040be0b
push dword [ebp - 4]
lea eax, [ebp - 0x210]
push eax
call fcn.0041f738
add esp, 0x10
lea ecx, [ebp - 0x210]
call fcn.0040bc4c
push str.FRAMEWORK
test eax, eax
je 0x401f99
push 0x85
jmp 0x401f9e
push 0x86
push dword [0x4472cc]
call edi
push eax
push dword [0x4472cc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, 0x4472bc
mov edx, eax
mov ecx, edi
call fcn.0040ef80
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [0x4472bc]
test eax, eax
je 0x401fe1
xor ecx, ecx
cmp word [eax], cx
jne 0x402001
lea ecx, [ebp - 0x210]
call fcn.0040bc4c
mov ecx, edi
mov edx, 0x43a918
test eax, eax
jne 0x401ffc
mov edx, str.Cette_application_a_besoin_du_framework_WINDEV_pour_fonctionner._r_nIl_nest_pas_install
call fcn.0040ef80
pop edi
pop esi
leave
ret
Function at 0x405d6b
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a0c], 0
push esi
jne 0x405da2
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405d7c
mov dword [ecx*4 + 0x422a08], eax
inc ecx
cmp ecx, 0x100
jl 0x405d77
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405dd3
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a08]
xor eax, esi
inc ecx
dec edx
jne 0x405db5
pop edi
not eax
pop esi
ret 0xc

Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret
Function at 0x14011a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
lea ecx, [esi - 0x10000]
movzx eax, cx
mov edi, ecx
sub edi, eax
test eax, eax
cmove edi, ecx
cmp edi, ebx
jbe 0x1401268
nop dword [eax]
cmp edi, dword [section..data]
jb 0x14011e8
cmp edi, dword [0x4590004]
ja 0x14011e8
sub edi, 0x8000000
jmp 0x1401260
push 0x1c
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0
xorps xmm0, xmm0
push eax
push edi
movups xmmword [ebp - 0x1c], xmm0
movq qword [ebp - 0xc], xmm0
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
je 0x1401268
cmp dword [ebp - 0xc], 0x10000
jne 0x140124b
cmp dword [ebp - 0x10], 0x10000
jb 0x140124b
push 0x40
push 0x3000
push 0x10000
push edi
call sub.KERNEL32.dll_VirtualAlloc
test eax, eax
jne 0x140131a
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
je 0x1401268
sub edi, 0x10000
jmp 0x1401260
mov ecx, dword [ebp - 0x18]
add ecx, 0xffff0000
mov edi, ecx
movzx eax, di
sub edi, eax
test eax, eax
cmove edi, ecx
cmp edi, ebx
ja 0x14011d0
movzx eax, si
test eax, eax
je 0x1401277
sub esi, eax
add esi, 0x10000
mov edi, dword [ebp + 0x10]
cmp esi, edi
jae 0x1401318
cmp esi, dword [section..data]
jb 0x140129a
cmp esi, dword [0x4590004]
ja 0x140129a
add esi, 0x8000000
jmp 0x1401310
push 0x1c
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0
xorps xmm0, xmm0
push eax
push esi
movups xmmword [ebp - 0x1c], xmm0
movq qword [ebp - 0xc], xmm0
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
je 0x1401318
cmp dword [ebp - 0xc], 0x10000
mov ecx, dword [ebp - 0x10]
jne 0x14012fb
cmp ecx, 0x10000
jb 0x14012fb
push 0x40
push 0x3000
push 0x10000
push esi
call sub.KERNEL32.dll_VirtualAlloc
test eax, eax
jne 0x140131a
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
je 0x1401318
add esi, 0x10000
jmp 0x1401310
mov esi, dword [ebp - 0x1c]
add esi, ecx
movzx ecx, si
test ecx, ecx
je 0x1401310
mov eax, 0x10000
sub eax, ecx
add esi, eax
cmp esi, edi
jb 0x1401282
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1401640
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x458d578
push 0x1427170
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 8]
call sub.KERNEL32.dll_VirtualQuery
mov dword [ebp - 4], 0
mov eax, 0x5a4d
mov ecx, dword [ebp - 0x30]
cmp word [ecx], ax
jne 0x14016e3
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x14016e3
mov esi, dword [edx + ecx + 0xd8]
lea eax, [esi + ecx]
cmp dword [ebp + 0xc], eax
jb 0x14016e3
mov eax, dword [edx + ecx + 0xdc]
add eax, esi
add eax, ecx
cmp dword [ebp + 0xc], eax
jae 0x14016e3
mov dword [ebp - 4], 0xffffffff
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1401c40
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x45bc244], eax
je 0x1401c5c
mov eax, 0x10dd
mov esp, ebp
pop ebp
ret 8
mov eax, dword [0x45bc248]
test eax, eax
jne 0x1401d76
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jne 0x1401c7b
lea eax, [ebx + 0x57]
pop ebx
mov esp, ebp
pop ebp
ret 8
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x1401c98
cmp dword [edi], 0
jne 0x1401ca5
mov dword [0x45bc248], 6
mov dword [0x45bc24c], edi
pop edi
mov eax, 6
pop ebx
mov esp, ebp
pop ebp
ret 8
push esi
push 0x4580a35
push 0x18
call fcn.01424cb6
mov esi, eax
add esp, 8
test esi, esi
jne 0x1401cc3
lea ebx, [eax + 8]
jmp 0x1401d56
push 0
push dword [edi]
call fcn.01401bb0
push 0
push ebx
mov dword [ebp + 0xc], eax
call fcn.01401bb0
mov ebx, dword [ebp + 0xc]
mov edx, eax
movzx ecx, byte [ebx + 0x36]
mov eax, dword [ebx + 0x40]
sub eax, ecx
mov dword [ebp + 0xc], eax
test ecx, ecx
je 0x1401d48
cmp ecx, 0x1e
ja 0x1401d48
cmp dword [ebx + 0x44], edx
jne 0x1401d48
lea edx, [ebp - 4]
mov dword [ebp - 4], 0
push edx
push 0x40
push ecx
push eax
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x1401d17
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
jmp 0x1401d56
mov eax, dword [ebp + 0xc]
mov dword [esi + 0xc], eax
mov dword [esi + 8], edi
mov dword [esi + 0x10], ebx
mov dword [esi + 4], 1
mov eax, dword [ebp - 4]
mov dword [esi + 0x14], eax
mov eax, dword [0x45bc254]
mov dword [esi], eax
xor eax, eax
mov dword [0x45bc254], esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [0x45bc23c], 0
mov ebx, 9
jne 0x1401d60
mov dword [0x45bc248], ebx
test esi, esi
je 0x1401d6b
push 0x18
push esi
call fcn.01424ca8
add esp, 8
pop esi
mov dword [0x45bc24c], edi
mov eax, ebx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x1401d80
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x45bc244], 0
jne 0x1401df7
call sub.KERNEL32.dll_GetCurrentThreadId
mov ecx, eax
mov edx, 0x45bc244
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x1401df7
push esi
mov esi, dword [0x45bc234]
mov dword [0x45bc254], eax
mov dword [0x45bc250], eax
mov dword [0x45bc24c], eax
test esi, esi
je 0x1401ddc
nop dword [eax]
lea eax, [ebp - 4]
push eax
push 0x40
push 0x10000
push esi
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
je 0x1401de8
mov esi, dword [esi + 4]
test esi, esi
jne 0x1401dc0
xor eax, eax
mov dword [0x45bc248], eax
pop esi
mov esp, ebp
pop ebp
ret
call sub.KERNEL32.dll_GetLastError
mov dword [0x45bc248], eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x10dd
mov esp, ebp
pop ebp
ret
Function at 0x14065c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14065f7
mov eax, dword [ebp + 0xc]
mov dword [esi], eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1406720
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 4]
push edi
mov edi, dword [ebp + 8]
push eax
push 0x40
push esi
push edi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1406761
push esi
push dword [ebp + 0xc]
push edi
call fcn.01427290
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1406e80
Capabilities:
Access pe header
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push ebx
call fcn.01405200
add esp, 4
test eax, eax
je 0x1406ea9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call fcn.014054f0
add esp, 0xc
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push edi
push ebx
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
test eax, eax
je 0x1406f21
movzx esi, word [eax + 0x14]
xor ecx, ecx
movzx edi, word [eax + 6]
add esi, 0x18
add esi, eax
xor eax, eax
mov dword [ebp - 4], esi
cmp ax, di
jae 0x1406f21
mov ebx, dword [ebp + 0xc]
movzx edx, cx
lea eax, [edx + edx*4]
lea esi, [esi + eax*8]
mov eax, dword [esi]
cmp eax, dword [ebx]
jne 0x1406ee9
mov eax, dword [esi + 4]
cmp eax, dword [ebx + 4]
je 0x1406ef4
inc ecx
cmp cx, di
jae 0x1406f21
mov esi, dword [ebp - 4]
jmp 0x1406ed2
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp - 4]
test esi, esi
je 0x1406f10
lea eax, [edx + edx*4]
mov ecx, dword [edi + eax*8 + 0x10]
mov eax, dword [edi + eax*8 + 8]
cmp ecx, eax
cmovbe ecx, eax
mov dword [esi], ecx
lea eax, [edx + edx*4]
mov eax, dword [edi + eax*8 + 0xc]
add eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1407600
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.01424f70
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
lea eax, [ebp - 0x1000]
push 0xfff
push eax
call fcn.01403570
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.0142e0aa
mov eax, dword [0x45bdb7c]
add esp, 0x1c
mov byte [ebp - 1], 0
test eax, eax
je 0x1407656
mov eax, dword [eax + 0x50]
test eax, eax
je 0x1407656
push str.escape_n
call eax
add esp, 4
push 0x10
push str.Fatal_Error
lea eax, [ebp - 0x1000]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtTerminateProcess]
mov esp, ebp
pop ebp
ret

Function at 0x1409600
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1448420
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
mov eax, ecx
push esi
push edi
push 8
mov dword [ebp - 0x10], eax
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.01424fbe
mov esi, eax
add esp, 4
test esi, esi
je 0x140964f
push 1
mov dword [ebp - 4], 0
call fcn.01426320
add esp, 4
mov dword [esi + 4], eax
jmp 0x1409651
xor esi, esi
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov ecx, dword [ebp - 0xc]
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
pop edi
pop esi
mov dword [edx], 0
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x1409920
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x14484cf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push 0
mov dword [ebp - 0x10], esi
call fcn.01426113
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 6
test eax, eax
je 0x14099ab
push eax
push esi
call fcn.01426420
mov ecx, dword [ebp - 0xc]
add esp, 8
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push str.bad_locale_name
call fcn.01425bc5
int3
Function at 0x140a640
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov cl, byte [esi]
cmp cl, 0xe8
je 0x140a653
cmp cl, 0xe9
jne 0x140a6a5
mov eax, dword [ebp + 0x10]
push edi
add eax, esi
lea edi, [esi + 1]
add eax, dword [edi]
cmp eax, dword [0x45bcaf0]
jne 0x140a6a4
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0
push eax
push 0x40
push 4
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140a69c
mov eax, 0x140b610
sub eax, esi
sub eax, 5
mov dword [edi], eax
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0xc]
push 4
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp + 0x1c]
mov byte [eax], 1
mov cl, byte [esi]
pop edi
pop esi
cmp cl, 0xcc
je 0x140a6b6
cmp cl, 0x90
je 0x140a6b6
xor eax, eax
pop ebp
ret 0x18
mov eax, 1
pop ebp
ret 0x18

Function at 0x140b540
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 3
call fcn.0140e460
mov esi, eax
add esp, 4
test esi, esi
jne 0x140b55a
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0x20]
push 0x40
push dword [ebp + 0x10]
mov eax, dword [ecx]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x24]
push eax
mov dword [esi + 0x20], ecx
call fcn.014325e0
push 0x100
push dword [ebp + 0x14]
lea eax, [esi + 0x64]
mov byte [esi + 0x63], 0
push eax
call fcn.014325e0
mov eax, dword [ebp + 0x1c]
add esp, 0x18
mov byte [esi + 0x163], 0
mov dword [esi + 0x10], eax
cmp byte [0x45bcb39], 0
je 0x140b5bf
xor al, al
mov byte [esi + 4], al
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [esi + 0x20]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push edi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140b5f2
mov eax, dword [esi + 0xc]
mov dword [edi], eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 4
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esi + 0x10]
pop edi
test eax, eax
je 0x140b5ff
mov ecx, dword [esi + 8]
mov dword [eax], ecx
mov al, 1
mov byte [esi + 4], al
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x140b650
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [0x45bdb60]
push edi
test esi, esi
je 0x140b687
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0x3c]
sub eax, 2
je 0x140b677
sub eax, 1
je 0x140b677
sub eax, 1
jne 0x140b680
mov ecx, dword [esi + 0x38]
push edi
mov eax, dword [ecx]
call dword [eax + 0x14]
mov esi, dword [esi + 0x40]
test esi, esi
jne 0x140b665
mov esi, dword [0x45bcb24]
test esi, esi
je 0x140b779
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
nop dword [eax]
cmp byte [esi + 4], 0
mov ebx, dword [esi + 0x14]
mov dword [ebp - 0xc], ebx
je 0x140b75a
mov eax, dword [esi]
cmp eax, 1
jne 0x140b6d2
call fcn.01401d80
push dword [esi + 0xc]
lea eax, [esi + 0x18]
push eax
call fcn.01401c40
call fcn.01401e00
jmp 0x140b756
cmp eax, 2
jne 0x140b6dc
mov eax, dword [esi + 0x28]
jmp 0x140b6e4
cmp eax, 3
jne 0x140b713
mov eax, dword [esi + 0x20]
lea ecx, [ebp - 4]
mov dword [ebp - 0xc], eax
push ecx
push 0x40
push 4
push eax
mov dword [ebp - 4], 0
call edi
test eax, eax
je 0x140b756
mov ecx, dword [ebp - 0xc]
mov eax, dword [esi + 8]
mov dword [ecx], eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 4
push ecx
call edi
jmp 0x140b756
cmp eax, 4
jne 0x140b756
mov ebx, dword [esi + 0x1c]
lea ecx, [ebp - 4]
mov eax, dword [esi + 0x18]
push ecx
push 0x40
push ebx
push eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
call edi
test eax, eax
je 0x140b753
push ebx
lea eax, [esi + 0x20]
push eax
push dword [ebp - 8]
call fcn.01427290
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push dword [ebp - 8]
call edi
mov ebx, dword [ebp - 0xc]
mov byte [esi + 4], 0
push 0x164
push esi
call fcn.01424ca8
add esp, 8
mov esi, ebx
test ebx, ebx
jne 0x140b6a0
pop ebx
mov dword [0x45bcb24], esi
mov eax, dword [0x45bcad0]
pop edi
pop esi
test eax, eax
je 0x140b78a
mov dword [eax], 0
mov esp, ebp
pop ebp
ret