joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40aa5b
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x41a004]
xor eax, esp
mov dword [esp + 0x38], eax
push esi
mov esi, dword [ebp + 8]
push 0x4074dc
push 0x4074f8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40aa95
push 0x800
call eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [esp + 0xc]
call fcn.00409cb0
push esi
lea ecx, [esp + 0x24]
call fcn.0040921b
lea ecx, [esp + 0x20]
call fcn.004095c7
mov esi, eax
test esi, esi
jns 0x40aae9
lea ecx, [esp + 8]
call fcn.0040a9d0
test al, al
je 0x40ab33
cmp esi, 0x80040b00
jne 0x40ab33
lea ecx, [esp + 0x20]
call fcn.00409683
mov esi, eax
test esi, esi
js 0x40ab33
mov esi, 0x80040b02
jmp 0x40ab33
cmp dword [esp + 0x1c], 8
lea esi, [esp + 8]
jb 0x40aaf8
mov esi, dword [esp + 8]
push 0x406f80
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x40ab2b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
je 0x40ab24
jle 0x40ab33
movzx esi, si
or esi, 0x80070000
jmp 0x40ab33
mov esi, 0x80004005
jmp 0x40ab33
push dword [ebp + 0x14]
push esi
call eax
mov esi, eax
lea ecx, [esp + 0x20]
call fcn.004092b7
lea ecx, [esp + 8]
call fcn.00409da9
mov ecx, dword [esp + 0x3c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0040b187
mov esp, ebp
pop ebp
ret 0x10

Function at 0x40f290
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ebp
aam 0x50
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [di - 0x27], 0x44

Function at 0x40f2a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [di - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
fld qword [edx - 0x3a]
inc ebp
fimul word [ecx - 0x3a]
inc ebp
fistp word [ecx - 0x3a]
inc ebp
loopne 0x40f30b
dec edx
Function at 0x40f531
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
or al, 0x66
cmp eax, dword [edi + 6]
jne 0x40f547
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x40f565
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
mov ch, 0x54
invalid
invalid
push dword [ebx]
ror byte [ecx - 0x3e7443bb], cl
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x40f5c3
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x40f5aa
or byte [eax + ecx], 1
or al, 8
add dword [ecx], edi
pop ebp
or byte [esp + eax - 0x80], dh
or al, 8
add bh, byte [ecx]
pop ebp
adc byte [ebp + eax + 3], dh
enter 0x980, 4
cmp dword [ebp + 8], ebx
je 0x40f5b3
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x40f5bd
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x40f59f
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x40f529
mov dword [ebp + 8], esi
xor edi, edi

Function at 0x40f5a7
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
or al, 0x66
cmp eax, dword [edi + 6]
jne 0x40f547
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x40f565
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
mov ch, 0x54
invalid
invalid
push dword [ebx]
ror byte [ecx - 0x3e7443bb], cl
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x40f5c3
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x40f5aa
or byte [eax + ecx], 1
or al, 8
add dword [ecx], edi
pop ebp
or byte [esp + eax - 0x80], dh
or al, 8
add bh, byte [ecx]
pop ebp
adc byte [ebp + eax + 3], dh
enter 0x980, 4
cmp dword [ebp + 8], ebx
je 0x40f5b3
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x40f5bd
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x40f59f
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x40f529
mov dword [ebp + 8], esi
xor edi, edi
Function at 0x40fd4a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.0040ee4e
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
invalid
invalid

Function at 0x410a04
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
mov byte [ebp - 0x78a], 0xa0
and byte [ebp - 0x789], 0
mov byte [ebp - 0x788], 3
mov byte [ebp - 0x787], 0x3b
mov byte [ebp - 0x786], 0x33
mov byte [ebp - 0x785], 0x3c
mov byte [ebp - 0x784], 0x30
mov byte [ebp - 0x783], 0x3a
mov byte [ebp - 0x782], 0x2d
mov byte [ebp - 0x781], 0x71
mov byte [ebp - 0x780], 0x3b
mov byte [ebp - 0x77f], 0x33
mov byte [ebp - 0x77e], 0x33
mov byte [ebp - 0x77d], 0x5f
push 0xc
lea eax, [ebp - 0x78c]
push eax
call fcn.0040ee80
pop ecx
push eax
mov eax, dword [ebp - 0x28]
lea eax, [ebp + eax - 0x12c]
push eax
call fcn.0040ede1
add esp, 0xc
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x3a0], eax
jmp 0x410de8
mov eax, dword [ebp - 0x6fc]
inc eax
mov dword [ebp - 0x6fc], eax
and dword [ebp - 0x37c], 0
call fcn.0040ee70
ret
Function at 0x401c90
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x248
call dword [0x4185ac]
mov dword [esp + 4], 0x417000
mov dword [esp], eax
call dword [0x4185b8]
sub esp, 8
lea esi, [esi]
lea esi, [esi]
mov dword [esp + 4], 0
mov dword [esp], 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
sub esp, 8
mov edi, eax
test eax, eax
je 0x401df0
mov dword [ebp - 0x238], 0x22c
lea ebx, [ebp - 0x238]
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.kernel32.dll_Process32FirstW
sub esp, 8
test eax, eax
je 0x401e50
mov dword [ebp - 0x23c], 0
jmp 0x401d2f
mov dword [esp + 4], ebx
mov dword [esp], edi
call sub.kernel32.dll_Process32NextW
sub esp, 8
test eax, eax
je 0x401dd0
mov eax, dword [ebp - 0x230]
mov edx, dword fs:[0x18]
cmp dword [edx + 0x20], eax
je 0x401d18
cmp eax, dword [section..bss]
je 0x401d18
mov dword [esp + 4], str.winewrapper
lea esi, [ebp - 0x214]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_wcsstr]
test eax, eax
jne 0x401d18
test byte [section..data], 8
jne 0x401e10
mov eax, dword [ebp - 0x230]
mov dword [esp + 4], 0
mov dword [esp], 1
mov dword [esp + 8], eax
call dword [sym.imp.kernelbase.dll_OpenProcess]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x401d18
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_TerminateProcess]
sub esp, 8
cmp eax, 1
sbb dword [ebp - 0x23c], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.kernelbase.dll_CloseHandle]
sub esp, 4
jmp 0x401d18
mov dword [esp], edi
call dword [sym.imp.kernelbase.dll_CloseHandle]
mov ecx, dword [ebp - 0x23c]
sub esp, 4
test ecx, ecx
jne 0x401cc0
lea esi, [esi]
mov eax, dword [section..bss]
test eax, eax
je 0x401e00
mov edx, dword [ebp + 8]
test edx, edx
jne 0x401e5e
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, esi
call fcn.00401360
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x230]
mov dword [esp + 0xc], str.killing_process__04lx__s_n
mov dword [esp + 8], str.kill_processes
mov dword [esp + 4], 0x409000
mov dword [esp + 0x10], eax
mov dword [esp], 3
call fcn.004016d0
jmp 0x401d71
mov dword [esp], edi
call dword [sym.imp.kernelbase.dll_CloseHandle]
sub esp, 4
jmp 0x401df0
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 1
call dword [sym.imp.kernelbase.dll_OpenProcess]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x401e00
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_TerminateProcess]
sub esp, 8
mov dword [esp], ebx
call dword [sym.imp.kernelbase.dll_CloseHandle]
sub esp, 4
jmp 0x401e00

Function at 0x4025a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], ecx
lea ecx, [ebp - 4]
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
sub esp, 0x18
leave
ret
Function at 0x4025e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
sub esp, 0x18
cmp word [ecx], 0
je 0x402638
mov eax, ecx
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x4025f8
sub eax, ecx
add eax, 2
mov dword [esp], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], edx
call dword [sym.imp.advapi32.dll_RegSetValueExW]
mov ebx, dword [ebp - 4]
sub esp, 0x18
leave
ret
mov eax, 2
jmp 0x402606

Function at 0x402710
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
sub esp, 4
mov dword [esp], str.Usage:_wineboot__options__n
call fcn.004026f0
mov dword [esp], str.Options__n
call fcn.004026f0
mov dword [esp], str._____h___help_________Display_this_help_message_n
call fcn.004026f0
mov dword [esp], str._____e___end_session__End_the_current_session_cleanly_n
call fcn.004026f0
mov dword [esp], str._____f___force________Force_exit_for_processes_that_dont_exit_cleanly_n
call fcn.004026f0
mov dword [esp], str._____i___init_________Perform_initialization_for_first_Wine_instance_n
call fcn.004026f0
mov dword [esp], str._____k___kill_________Kill_running_processes_without_any_cleanup_n
call fcn.004026f0
mov dword [esp], str._____r___restart______Restart_only__dont_do_normal_startup_operations_n
call fcn.004026f0
mov dword [esp], str._____s___shutdown_____Shutdown_only__dont_reboot_n
call fcn.004026f0
mov dword [esp], str._____u___update_______Update_the_wineprefix_directory_n
call fcn.004026f0
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_exit]
lea esi, [esi]
Function at 0x404500
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sub.ucrtbase.dll__configure_narrow_argv
call sub.ucrtbase.dll__initialize_narrow_environment
call 0x404570
mov esi, dword [eax]
call sub.ucrtbase.dll___p___argv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_narrow_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.004049e0
mov dword [esp], eax
call sub.ucrtbase.dll_exit
nop
nop
nop
jmp dword [sym.imp.ucrtbase.dll___p___argc]
Function at 0x40a820
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
jmp 0x40a83a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40a841
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40a830
mov eax, 1
add ebx, ebx
jne 0x40a853
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40a848
jne 0x40a864
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40a848
xor ecx, ecx
sub eax, 3
jb 0x40a878
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40a8ea
mov ebp, eax
add ebx, ebx
jne 0x40a883
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40a890
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40a8b4
inc ecx
add ebx, ebx
jne 0x40a8a0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40a895
jne 0x40a8b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40a895
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40a8d4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40a8c5
jmp 0x40a836
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40a8d4
add edi, ecx
jmp 0x40a836
pop esi
mov edi, esi
mov ecx, 0x51
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40a8f2
cmp byte [edi], 0
jne 0x40a8f2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40a8f7
lea edi, [esi + 0x8000]
mov eax, dword [edi]
or eax, eax
je 0x40a966
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xa0b4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xa12c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40a924
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xa130]
or eax, eax
je 0x40a960
mov dword [ebx], eax
add ebx, 4
jmp 0x40a941
call dword [esi + 0xa140]
mov ebp, dword [esi + 0xa134]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40a99a
sub esp, 0xffffff80
jmp 0x40213c
Function at 0x401370
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_narrow_argv
call sym.__initialize_narrow_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___argv
mov edi, dword [eax]
call sym.__get_initial_narrow_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call dbg.main
mov dword [esp], eax
call sym._exit

Function at 0x401470
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x4014cd
cmp byte [esi + ebx - 1], 0xa
je 0x40149f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov edx, 0x4040a4
lock xchg dword [edx], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x401ae0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0xf0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call dbg.__wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x401ca8
mov edi, dword [0x4040a4]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], edi
je 0x401bc8
test byte [0x402028], 8
jne 0x401c50
lea ebx, [esp + 0x28]
mov edi, ebx
test byte [0x402038], 8
jne 0x401c18
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x401b6a
cmp esi, 3
jbe 0x401bd0
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x401b7b
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x403124]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x401b6a
mov dword [esp], 0x402038
call dbg.__wine_dbg_get_channel_flags
test al, 8
je 0x401b41
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call dbg.sprintf
add edi, eax
jmp 0x401b41
mov dword [esp], 0x402028
call dbg.__wine_dbg_get_channel_flags
test al, 8
je 0x401b2e
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [esp + 0x28]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x401b34
mov eax, 0xffffffff
jmp 0x401bc8
Function at 0x4096e0
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409794
jmp 0x409789
cmp dword [esi + 0x10], 0x1000
jne 0x409775
test byte [esi + 0x15], 1
jne 0x409775
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409734
cmp eax, 2
je 0x409734
cmp eax, 0x10
je 0x409734
cmp eax, 0x20
jne 0x409749
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409749
mov bl, 1
xor ebp, ebp
jmp 0x40975a
mov eax, dword [esi]
add eax, ebp
call fcn.004096d8
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x40974d
test bl, bl
je 0x409775
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409794
mov eax, dword [esi + 4]
cmp eax, edi
je 0x40970c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x10002fc0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x10002ffe
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x10002ff6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x10003000
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x10002fe6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x100030d0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x100030e6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x10003101
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
Function at 0x406621
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40c3c8
cmp edx, dword [eax]
je 0x406643
add eax, 8
inc ecx
cmp eax, 0x40c458
jl 0x406634
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40c3c8]
jne 0x406771
mov eax, dword [0x40cf18]
cmp eax, 1
je 0x40674b
test eax, eax
jne 0x406674
cmp dword [0x40c204], 1
je 0x40674b
cmp edx, 0xfc
je 0x406771
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4066ab
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00402a10
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00402990
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4066ee
lea eax, [ebp - 0x1a4]
push eax
call fcn.00402990
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40a5cc
push edi
call fcn.00407a20
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00402a10
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00402a20
lea eax, [ebp - 0xa0]
push 0x40a5ac
push eax
call fcn.00402a20
push dword [esi + 0x40c3cc]
lea eax, [ebp - 0xa0]
push eax
call fcn.00402a20
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00407991
add esp, 0x2c
pop edi
jmp 0x406771
lea eax, [ebp + 8]
lea esi, [esi + 0x40c3cc]
push 0
push eax
push dword [esi]
call fcn.00402990
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e072
nop
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
mov esi, 0x50806831
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e060
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x42e0d2
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x2418162a
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
popal
jmp 0x401219