joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc02326
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.00c02282
adc bl, byte [ebx + 0x249d6e0b]
js 0xc0224b
popfd
and al, 0x78
cld
xchg edx, eax
cmc
add al, 0xc5
dec ecx
call 0x8e9dc464
and al, 4
lea esp, [esp + 4]
dec edi
neg ax
jno 0xc02242
jo 0xc02242
mov edx, edi
inc ax
jp 0xc02287
jnp 0xc02287
mov ecx, dword [esp]
bt edx, ebx
jbe 0xc0228f
clc
jmp 0xc022c4
lea esp, [esp + 4]
neg edi
jmp 0xc0226c
clc
mov cl, 0x23
sub esp, 0x12
lea esp, [esp + 2]
call fcn.00c022d3
mov byte [0x28d9be28], al
out dx, al
lds esi, [edi + ecx + 0x31]
rdtsc
lea esp, [esp + 2]
jmp 0xc02258
lea esp, [esp + 0x10]
add edi, 0x4f908356
rdtsc
jmp 0xc0239b
mov cl, 0x23
sub esp, 0x12
lea esp, [esp + 2]
jmp 0xc022ae
push word [esp + 2]
jae 0xc022a6
rdtsc
lea esp, [esp + 2]
jmp 0xc02258
mov byte [esp + 2], dh
xchg dl, ch
jmp 0xc022f9
jmp 0xc02421
mov ax, word [esp]
add edi, dword [esi]
mov ax, 0x5f40
sub esp, 1
js 0xc02384
neg eax
lea esp, [esp + 1]
jmp 0xc023ec
neg eax
lea esp, [esp + 1]
jmp 0xc023ec

Function at 0xc04942
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 4], edi
cmp ecx, 0x9f750992
jmp 0xc04988
inc ecx
call fcn.00c04972

Function at 0xc06797
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 3]
jmp 0xc067d8
push dword [esp + 6]
mov dword [esp + 8], eax
push esi
mov byte [esp], cl
mov word [esp], sp
call fcn.00c06de8
scasb al, byte es:[edi]
push esi
mov byte [esp], cl
mov word [esp], sp
jmp 0xc067e4
jl 0xc067a1
push dword [esp + 6]
mov dword [esp + 8], eax
jmp 0xc067c2
pop word [esp]
jmp 0xc06c0a
mov dword [esp + 8], ecx
call fcn.00c06d5c
xor byte [edx + ebp + 0x267dbc4d], dh
mov eax, dword [reloc.MSVCRT.dll_strncpy]
push 0xe21770e2
and al, 0xa3
fisub dword [ebp - 0x43]
cld
wait
xor dword [edi - 7], ebp
wait
ret
push word [esp]
jp 0xc067ed
mov dword [esp + 8], ecx
jmp 0xc067f1

Function at 0xc06cba
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xc06d0f
mov dword [esp + 4], esi
call fcn.00c06ce7
jmp 0xc06cf8
mov edi, dword [esp + 0x2c]
not ebx
pushal
lea edx, [eax*4]
jmp 0xc06d3e
mov cl, dh
lea eax, [ebx + 0x67]
jmp 0xc06cc7
lea esp, [esp]
push bp
pop word [esp + 4]
pop word [esp + 2]
lea esp, [esp + 2]
mov dword [esp + 8], ebp
jmp 0xc06cbc
setp dh
jmp 0xc06d7e
lea esi, [esp + 0x20]
xor ebp, 0xd9834b4d
js 0xc06d28
setp dh
bts ebp, edi
jmp 0xc06d81
xchg edx, eax
lea ecx, [ebx + ebp]
add bh, cl
jae fcn.00c06da9
jb fcn.00c06da9
lcall 0x1fd4, 0x16fb9c0e
xchg cx, ax
adc byte [ebx - 0x7e0254f1], dl
in al, dx
mov al, byte [0x8b000000]
in al, dx
bts ebp, edi
sub esp, 0xa0
mov ebp, esp
jmp 0xc06d68

Function at 0xc06ce7
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0bf3454
jmp 0xc06cc5
lea esp, [esp + 3]
lea esp, [esp + 1]
mov dword [esp], edi
pushfd
jmp 0xc05fdf

Function at 0xc0743a
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 0xc], edi
mov dx, word [esp]
sub esp, 0xf
lea eax, [esi - 0x6a]
rdtsc
lea esp, [esp + 3]
jmp 0xc07424

Function at 0xc085b8
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [edx + edx]
xchg dword [esp], ebx
call fcn.00c08577
Function at 0xc11bd5
Capabilities:
Encode data using xor

Disassembly:
lea ecx, [edx*4]
jmp 0xc11c0c
mov byte [esp + 2], bh
mov ebp, dword [esp + 0x18]
lea esp, [esp + 0x1c]
jmp 0xbf677a
mov dword [esp], ecx
push dword [esp + 3]
xchg dword [esp + 3], ebp
mov ecx, dword [esp + 0x10]
push edi
xchg word [esp + 1], bp
jmp 0xc11bf6
Function at 0xc26cb6
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xc26c92
lea esp, [esp + 4]
xor dl, 5
mov ah, byte [esp]
xor al, ch
je 0xc26c47
clc
push ebx
lea eax, [ecx + edi]
jmp 0xc26c7c
jmp 0xc26c5d
sub bl, dl
jmp 0xc275e2
clc
push ebx
lea eax, [ecx + edi]
call 0xc26c9d
fist word [edx + 0x66]
bts eax, eax
pop ax
xchg word [esp], ax
not ax
jmp 0xc26cd6
mov word [esp + 1], si
clc
jns 0xc26c7a
js 0xc26c5d
lea esp, [esp + 3]
lea esi, [esi - 0x20]
jmp 0xc26ce7
lea esp, [esp + 2]
xchg dword [esp], esi
dec ah
sub esp, 0xf
call 0xc26cc0
mov eax, dword [esp]
rol ax, cl
mov ax, word [esp]
mov ax, 0x1a24
lea eax, [ebx*4]
xchg dword [esp + 0x10], esi
jmp 0xc27aed
push ax
setge al
sub esp, 0x1a
pop word [esp + 0x11]
jmp 0xc26d65
mov al, 0x84
neg ax
jbe 0xc26d1c
push ax
jmp 0xc26d41
setge al
sub esp, 0x1a
pop word [esp + 0x11]
push dword [esp + 0xe]
jmp 0xc26d69
lea esp, [esp + 1]
inc edi
xchg al, dh
rdtsc
jmp 0xc26d32
push dword [esp + 0xe]
pop ax
lea esp, [esp + 0x1c]
neg cl
jmp 0xc26d77
mov dx, 0x316f
mov ah, byte [esp]
rdtsc
sub esp, 0x19
jae 0xc2703a
jb 0xc26f4c
dec ebx
loop 0xc26df8
mov ax, 0xe1d
pop word [esp + 5]
mov eax, 0x8f660e1d
inc esp
and al, 5
jmp 0xc26d5a
dec dh
call 0xc26dca
setge byte [0x7f67a754]
out dx, al
jl 0xc26dc8
div byte [ebx + ebp*2]
add edx, dword [ebx + reloc.MSVCRT.dll_strncpy]
lea esp, [esp + 0x18]
sub cl, 0xa1
bsr edx, esp
jp 0xc26d9c
dec dh
call fcn.00c26f0a
int1
add cl, dh
mov dx, word [esp]
dec ax
inc dx
bt edx, edx
stc
jmp 0xc26e1a
cld
mov al, 0x2b
mov ebx, 0xd6982dde
dec esp
ret 0x54a5
rdtsc
lea edx, [ebx*4]
xchg dx, ax
jmp 0xc26e9e
xchg dword [esp], eax
bsf dx, dx
push esi
call 0xc26e28
mov dword [esp + 3], edi
lea eax, [eax + 0x3d]
rcr dx, 6
jmp 0xc26e64
jp 0xc26e8d
bswap edx
xchg dx, ax
jmp 0xc26e09
mov dx, si
mov dx, 0x36a4
mov dl, bl
mov dh, ch
xchg dword [esp + 8], eax
mov al, 0x6b
call fcn.00c26e4e
rcr byte [edx + esi*8 - 0x6b], 0x64
sal byte [esi], cl
test eax, 0x1fab5839
push 0xca3f58ca
dec ebp
jmp 0xc26e9d
bswap edx
xchg dx, ax
rdtsc
lea edx, [ebx*4]
xchg dx, ax
ret 0x13e9
jmp 0xc26db6
pop edx
lea esp, [esp + 1]
jmp 0xc2704b
mov byte [esp + 0xb], ah
lea eax, [ebp*4]
push ebp
jmp 0xc26ed5
mov byte [esp + 0xb], ah
lea eax, [ebp*4]
push ebp
pop edx
lea esp, [esp + 1]
rol cl, 0
sbb edx, 0x783a6e71
jmp 0xc26e45
sub esp, 0x13
jnp 0xc26d91
mov ax, 0xe1d
pop word [esp + 5]
lea esp, [esp + 1]
jmp 0xc26d5e
sbb ax, sp
push esi
lea eax, reloc.MSVCRT.dll_strncpy
lea eax, [esp + edi]
push dword [esp + 0x14]
ret 0x18

Function at 0xc2c083
Capabilities:
Execute anti-debugging instructions

Disassembly:
jne 0xc2c0e9
xchg edi, eax
fisttp dword [ebx + reloc.MSVCRT.dll_strncpy]
std
dec dword [edx + edx*4]
inc edx
sbb ch, byte [eax]
mov ecx, 0x6cc68c95
lahf
xor ebp, dword [edx]
inc ebp
hlt
Function at 0x1080c70
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
mov edi, 0x5d8544d6
pop ax
setnp dh
jmp 0x1080c9f
xchg edi, eax
xchg al, ah
rcl edx, cl
setae dh
pop edx
lea edi, [eax*4]
jmp 0x1080e0d
mov word [esp + 2], bp
lea esp, [esp + 5]
mov dh, byte [esp + 6]
mov dword [esp + 0xc], eax
sub esp, 0x18
sub eax, edi
jmp 0x1080d05
mov dl, bl
pop edi
push eax
mov ax, word [esp + 2]
xchg edi, eax
mov edx, 0x2abb88f4
jmp 0x1080cd6
sub edx, 0x6e67ef49
rdtsc
cld
mov di, 0x735f
push word [esp + 0x24]
mov byte [esp + 0x10], dl
jmp 0x1080dcc
mov dword [esp + 6], esp
lea edx, [esp + ebp]
lea edi, reloc.MSVCRT.dll_strncpy
push dword [esp + 8]
lea esp, [esp + 0xb]
lea edx, reloc.MSVCRT.dll_strncpy
jmp 0x1080cf4
rdtsc
neg al
lea eax, [ecx + ebx]
pushal
dec dl
mov al, byte [esp + 0x11]
jmp 0x1080d28
pushal
call fcn.01080db2
retf 0xc650
mov edx, dword [esp + 0x18]
call fcn.01080d6b
mov ah, 0x9b
add esp, 0x23
xchg dword [esp], edi
btr edi, esi
xchg dword [esp], edi
neg eax
jmp 0x1080d7e
pop edi
xchg word [esp + 0xa], di
mov byte [esp + 1], bl
pop ax
bsf dx, di
clc
jmp 0x1080d97
xchg edx, eax
bts eax, esp
adc edx, 0xf62b4f84
lea edi, [esp + eax]
neg al
mov dl, cl
jmp 0x1080d5b

Function at 0x10812c9
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [esp + edx]
lea eax, [edx*4]
xchg ebp, eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax - 0x3fc5f44], bh
mov eax, 0xfc03a0bc
jmp 0x10812df
lea edx, reloc.MSVCRT.dll_strncpy
mov ah, dh
pop word [esp + 3]
add esp, 0x1a
mov dx, word [esp]
jmp 0x10812b3
mov word [esp], bp
mov word [esp], si
mov di, 0xdb0d
bswap edx
pop dx
not dx
jmp 0x1081e0f
mov dh, byte [esp + 4]
add esp, 6
cld
clc
stc
mov edx, dword [esp]
call fcn.01081363
lds edx, [esi - 0x3c]
mov dword [reloc.MSVCRT.dll_strncpy], eax
pop ebx
int 0x6c
std
insb byte es:[edi], dx
loop 0x10812b8
je 0x10812ba
stc
fdivr dword [ebx]
mov ax, 0xa1ea
mov edi, 0xd17a0f2b
rdtsc
setl al
cld
mov dword [esp + 1], ecx
jmp 0x1081311
add esp, 0
rdtsc
shl eax, 3
push edi
push dword [esp]
not dh
jmp 0x1081338
bsf edx, eax
mov di, 0xdc0
mov dh, byte [esp]
bswap edi
lea esp, [esp + 1]
not dx
jmp 0x108137b
bt eax, esp
lea edi, reloc.MSVCRT.dll_strncpy
cmc
btr eax, edx
lea edi, [edx + esi]
and eax, eax
jmp 0x10813c7
push bp
bswap eax
std
and edi, 0x8b6c5046
mov di, word [esp]
mov di, bp
jmp 0x108181b
Function at 0x1081505
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dx, word [esp + 7]
rdtsc
jmp 0x1081512
bt edx, ecx
xchg dword [esp + 3], edi
mov dx, word [esp + 2]
clc
dec al
xchg dl, dh
jmp 0x1081546

Function at 0x1082dd6
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec ch
mov byte [esp + 8], al
mov dx, word [esp + 8]
not ch
jmp 0x1082e22
lea edi, [edx + edi]
lea esp, [esp + 2]
xchg si, di
push word [esp + 9]
jmp 0x1082dc0
xchg ecx, esi
sub esp, 4
and esi, ebx
stc
xchg dword [esp + 5], edx
inc dl
jmp 0x1082e74
mov word [esp + 5], si
bsr bp, si
rcl ch, 5
cld
push dword [esp + 2]
jmp 0x1082e0c
cmp cl, bh
xchg word [esp + 0x10], si
add esp, 0x15
xchg si, cx
cld
mov edi, ebx
jmp 0x1082e48

Function at 0x108303a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cx, 0xa595
sub esp, 1
mov si, word [esp + 6]
jmp 0x1083060
pop dword [esp + 3]
cmc
bswap esi
push dword [esp + 1]
mov bp, 0x8f70
mov dx, di
jmp 0x1082ffe
mov dx, 0x3cbe
xchg byte [esp + 8], al
std
mov di, word [esp + 2]
jmp 0x1083014
xchg word [esp], di
xchg dx, di
mov eax, dword [esp + 6]
mov al, 0xad
xchg ebx, esi
jmp 0x108308a
lea ebp, [ecx*4]
lea edx, [eax + edi]
mov dword [esp + 0xf], edx
mov al, 0x51
dec ebx
pop edi
jmp 0x108304a
lea edi, [eax + 0xad]
pop dword [esp + 8]
rdtsc
pop dword [esp + 8]
jmp 0x108309e
dec si
mov dl, byte [esp + 0x11]
xchg ecx, edi
cmc
mov esi, 0x9cdcde74
xchg dword [esp + 1], edx
jmp 0x1083074
mov dh, byte [esp + 9]
add esp, 0xb
not ah
lea esi, reloc.MSVCRT.dll_strncpy
bt esi, ebx
mov bh, byte [esp]
jmp 0x10830cb

Function at 0x10835c5
Capabilities:
Access peb ldr_data
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
call fcn.0108302d
mov dword [esp + 0x24], edi
lea esp, [esp + 0x24]
jmp 0x1083604
mov eax, dword [eax]
jmp 0x1083628
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x10835ee
mov eax, dword [eax + 8]
push eax
jmp 0x1083028

Function at 0x10835e4
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
mov dword [esp + 4], esi
pushal
call fcn.010835c5
Function at 0x10011aa0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
inc ebp
into
jl 0x1001190a
inc ebp
iretd
jo 0x1001190e
inc ebp
rcl byte [ebx]
call fcn.10011612
or al, 0x64
sub edx, ebx
lea eax, [ebp - 0x40]
push eax
call fcn.10011622
push eax
push esi
push dword [ebp + 8]
call fcn.100115d7
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.10011612
xor esp, edi
dec esp
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], bl
push eax
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.10011622
push eax
push esi
push dword [ebp + 8]
call fcn.100115d7
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.10011622
push eax
push esi
push dword [ebp + 8]
call fcn.100115d7
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.10011622
push eax
push esi
push dword [ebp + 8]
call fcn.100115d7
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.10011612
add dword [eax - 0x21], ecx
sub dword [eax - 0x8363], ecx
dec dword [eax - 0x8263]
inc esi
invalid
test dword [esi - 1], edi
invalid
inc ebp
into
jl 0x1001190a
inc ebp
iretd
Function at 0x10011d60
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x10011ce9
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x10011d07
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x10011d65
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x10011d4c
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x10011d55
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x10011d5f
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x10011d41
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x10011ccb
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x10011db2
dec eax
je 0x10011da9
sub eax, 3
je 0x10011da0
mov dword [ebp - 4], 0x40
jmp 0x10011dcf
mov dword [ebp - 4], 4
jmp 0x10011db5
mov dword [ebp - 4], 0x20
jmp 0x10011db5
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x10011e01
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x10011d81
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.10011612
mov cl, bl
sbb bl, 0xff
jne 0x10011e0c
push 1
push esi
call edi
mov eax, esi
jmp 0x10011e0d
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
rcr byte [edi + 0x5e], 0x5b
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10013620
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp ah, 0xff
inc dword [ebx - 0x37f43]
invalid
Function at 0x401a50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401a69
xor eax, eax
jmp 0x401b25
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x14], eax
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp - 0x14]
lea ecx, [eax + edx + 0x78]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
add eax, dword [edx]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
add edx, dword [ecx + 0x20]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
add ecx, dword [eax + 0x1c]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x24], eax
mov dword [ebp - 8], 0
jmp 0x401ace
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
cmp eax, dword [edx + 0x18]
jae 0x401b23
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x20], eax
push 0x29c9f694
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x20]
push edx
call fcn.00401cc0
add esp, 0xc
cmp eax, dword [ebp + 0x10]
jne 0x401b21
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 4]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
jmp 0x401b25
jmp 0x401ac5
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x402470
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword fs:[0x30]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0xc]
add edx, 0x14
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
jmp 0x40249d
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 8]
je 0x4024e8
mov edx, dword [ebp - 4]
sub edx, 8
mov dword [ebp - 0xc], edx
mov eax, 8
shl eax, 0
mov ecx, dword [ebp - 0xc]
lea edx, [ecx + eax + 0x24]
mov dword [ebp - 0x14], edx
push 0x5c79b787
push 0xed9563aa
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
push ecx
call fcn.00403450
add esp, 0xc
cmp eax, dword [ebp + 8]
jne 0x4024e6
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x18]
jmp 0x4024ea
jmp 0x402495
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x402580
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
add edx, 0x14
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
sub ecx, 8
mov dword [ebp - 0xc], ecx
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0xc]
lea edx, [ecx + eax + 0x24]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov esp, ebp
pop ebp
ret
Function at 0x403310
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x403329
xor eax, eax
jmp 0x4033c7
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x14], eax
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp - 0x14]
lea ecx, [eax + edx + 0x78]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
add eax, dword [edx]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
add edx, dword [ecx + 0x20]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
add ecx, dword [eax + 0x1c]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x20], eax
mov dword [ebp - 8], 0
jmp 0x40338e
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
cmp eax, dword [edx + 0x18]
jae 0x4033c5
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x20]
movzx eax, word [edx + ecx*2]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 4]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
jmp 0x4033c7
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x402a21
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
push dword [0x405980]
call fcn.00402b80
mov ebp, eax
or ebx, 0xffffffff
xor eax, eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, dword [esp + 0x1c]
movzx edx, word [eax]
test dx, dx
je 0x402b21
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0x20
mov dword [esp + 0x14], 0x22
cmp dx, word [esp + 0x10]
jne 0x402a77
push 0x20
pop edx
add eax, 2
cmp word [eax], dx
je 0x402a6f
movzx edx, word [eax]
mov dword [esp + 0x1c], 1
cmp dx, word [esp + 0x14]
jne 0x402ab7
add eax, 2
mov esi, eax
movzx ecx, word [eax]
test cx, cx
je 0x402af9
push 0x22
pop edx
cmp cx, dx
je 0x402aa9
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x402a99
xor ecx, ecx
cmp word [eax], cx
je 0x402af9
mov ecx, eax
add eax, 2
jmp 0x402afb
test dx, dx
je 0x402b01
push 0x20
mov esi, eax
pop ecx
cmp dx, cx
je 0x402aa9
add eax, 2
push 0x22
pop edx
cmp word [eax], dx
jne 0x402aef
add eax, 2
movzx ecx, word [eax]
test cx, cx
je 0x402af9
cmp cx, dx
je 0x402aec
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x402adc
push 0x20
pop ecx
movzx edx, word [eax]
test dx, dx
jne 0x402ac1
jmp 0x402aa9
mov ecx, eax
mov edx, dword [esp + 0x1c]
jmp 0x402b03
xor edx, edx
cmp dword [ebp], ebx
jne 0x402b0c
test edi, edi
jne 0x402b29
test edx, edx
je 0x402b11
inc ebx
xor edx, edx
mov esi, edx
movzx edx, word [eax]
test dx, dx
jne 0x402a65
test edi, edi
jne 0x402b3a
mov eax, ebx
jmp 0x402b3e
test esi, esi
je 0x402b3a
sub ecx, esi
mov eax, esi
sar ecx, 1
mov dword [edi], ecx
inc dword [ebp]
jmp 0x402b3e
xor ecx, ecx
mov dword [edi], ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret

Function at 0x402f2e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x402f3f
mov esi, 0x404020
xor ebx, ebx
lea eax, [ebp + 8]
push ebx
push eax
push esi
call sub.MSVCRT.dll_wcslen
pop ecx
push eax
push esi
push dword [0x4059c4]
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
test eax, eax
lea eax, [ebp + 8]
push ebx
push eax
je 0x402f79
push 1
push 0x404024
push dword [0x4059c4]
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
jmp 0x402fa6
push esi
call sub.MSVCRT.dll_wcslen
pop ecx
add eax, eax
push eax
push esi
push dword [0x4059c4]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
call esi
push ebx
lea eax, [ebp + 8]
push eax
push 2
push 0x404024
push dword [0x4059c4]
call esi
pop esi
pop ebx
pop ebp
ret 4