joyce8/EMBER2024-capa huggingface dataset:
Function at 0x582d92
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
call fcn.0058d4be
mov esi, dword [eax + 0xc]
push 5
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
je 0x582dc3
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov edi, eax
push esi
mov ecx, ebx
push dword [esp + 0x18]
push edi
call fcn.00582dd6
pop edi
pop esi
pop ebx
ret 8

Function at 0x5843aa
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x5843e2
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.005823a6
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0058237e
jmp 0x5843ee
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x585c9a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x585cdc
call fcn.0058d4be
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
cmp eax, edi
je 0x585cdc
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
cmp eax, edi
jne 0x585cd3
xor eax, eax
jmp 0x585ce4
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00585cea
pop edi
pop esi
pop ebx
ret 4

Function at 0x58d9ee
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x58da1c
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
test eax, eax
je 0x58da3a
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0058d954
jmp 0x58da3a
mov eax, dword [esi + 0x14]
test eax, eax
je 0x58da3a
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0058d954
test edi, edi
mov eax, edi
jne 0x58da24
pop edi
push ebx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x94f5d8
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 0xc]
mov esi, 0xff
sub esp, 0xe
lea esp, [esp + 2]
jmp 0x94f5ab
setnp bl
push word [esp + 1]
lea esp, [esp + 2]
jmp 0x94f5c1

Function at 0x950161
Capabilities:
Encrypt data using aes

Disassembly:
inc bl
xchg bl, bh
neg edi
jmp 0x950153
push dword [esp + 2]
lea esp, [esp + 8]
cmp eax, 1
pushal
lea esp, [esp + 0x15]
jmp 0x950129
pushal
call fcn.009500ed
lea ecx, [eax - 1]
mov dx, word [esp]
jmp 0x950193
movzx ebx, byte [esi + 0x11]
cmc
mov di, bx
call 0x950161
scasd eax, dword es:[edi]
lea esp, [esp + 1]
lea esp, [esp + 3]
jmp 0x9501ec
lea esp, [esp + 4]
mov ecx, 0xff
jmp 0x94fdc7
mov dword [ebp - 4], ecx
mov edi, dword [esp]
sub bl, ah
push esp
jmp 0x950177
lea edi, reloc.WINMM.dll_midiStreamOut
bsf di, si
rcl dh, 3
lea edx, reloc.WINMM.dll_midiStreamOut
mov edx, dword [esi]
jmp 0x950219
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
sub dh, dh
mov di, word [esp]
add esi, 0x10
jmp 0x9501c1
bswap edi
mov edi, edx
push esp
call fcn.009501fe

Function at 0x950275
Capabilities:
Encrypt data using aes

Disassembly:
stc
cmc
lea esp, [esp + 0x18]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
pushal
jmp 0x95027e
clc
lea esp, [esp + 3]
and ebx, ecx
jmp 0x950254
seto bl
btc ebx, edx
push esp
lea esp, [esp + 0x24]
movzx ebx, byte [esi + 2]
jmp 0x9502ac

Function at 0x95051f
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push esp
mov word [esp], di
jmp 0x950561
and edx, ecx
stc
sub esp, 0
jmp 0x950509
mov edx, dword [esi + 8]
pushal
pop word [esp + 0x15]
push esp
lea esp, [esp + 2]
jmp 0x95068a
lea esp, [esp + 0x3c]
xor edi, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
seto dh
jmp 0x950548
mov dword [esi + 4], edi
bsf di, ax

Function at 0x9506bc
Capabilities:
Encrypt data using aes

Disassembly:
sub esp, 0x18
lea esp, [esp + 0x15]
lea esp, [esp + 3]
jmp 0x95077d
mov edx, dword [esi + 0xc]
push edx
add esp, 3
lea esp, [esp + 1]
jmp 0x950766
and edx, ecx
lea esp, [esp + 0x1c]
xor edi, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
jmp 0x9506f7
lea esp, [esp + 2]
mov edx, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
sub esp, 0x10
push word [esp + 5]
push word [esp + 5]
jmp 0x950715
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
bsf di, ax
jmp 0x9507b3
mov dword [esi + 8], edi
sub di, 0x890a
inc di
clc
jmp 0x95074c
and edx, ecx
push edx
push esp
pop word [esp + 1]
clc
jmp 0x950732
mov edi, edx
sub esp, 0x10
shr edi, 0x18
call fcn.00950789
and ebx, ecx
lea esp, [esp + 0x44]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
not bl
jmp 0x950808
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamOut]
pushal
clc
jmp 0x9507c0
clc
sub esp, 0x12
push esp
lea esp, [esp + 2]
and edi, ecx
jmp 0x9507dd
mov ebx, 0xe85ce0fc
mov bl, bh
movzx ebx, byte [esi + 0xe]
cmc
call 0x95081a
cmp ah, byte [esi - 1]
je 0x950842
add ebp, ebx
and edx, dword [esi]
xchg ebp, eax
add eax, 0x802a9f6c
push es
xchg esp, eax
push cs
mov esp, 0x61691e37
lea ebp, [ebp*4]
lea ebp, reloc.WINMM.dll_midiStreamOut
mov edi, dword [ebp]
pop ebp
jmp 0x9507fb
Function at 0x9508ba
Capabilities:
Encrypt data using aes

Disassembly:
push dword [esp + 2]
lea esp, [esp + 2]
jmp 0x9508e5
lea esp, [esp + 0xc]
xor edi, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
pushal
call fcn.009508c4

Function at 0xa49b7e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], di
mov dword [esp + 0x1b], eax
mov dword [esp + 0x13], eax
mov byte [esp + 0x1b], ch
push word [esp + 0xd]
lea esp, [esp + 2]
jmp 0xa49bbb
call 0xa49b7e
push ebx
popal
outsb dx, byte gs:[esi]
imul ebp, dword [bp + 0x65], 0x69685320
insb byte es:[edi], dx
outsb dx, byte gs:[esi]
and byte [esi + 0x32], dh
xor dword cs:[esi], ebp
cmp dword [esi], ebp
xor byte [eax], al
pushfd
clc
pushal
push dword [esp + 8]
jmp 0xa49b3c
setae dh
cpuid
lea edi, [eax + 0xe9]
not ecx
sub esp, 0x10
pop dword [esp + 2]
jmp 0xa49bfe
lea esp, [esp + 0x24]
pushal
mov ax, word [esp]
lea ebp, [ebp + 0x3f]
mov edx, ecx
clc
jmp 0xa49b93
mov di, 0x4cd5
pop di
neg bh
inc dl
mov edi, 0x1863ced8
jmp 0xa49c3a
mov dl, dh
lea ebp, [esi*4]
bswap eax
rdtsc
xchg byte [esp + 2], dl
mov byte [esp + 7], ah
jmp 0xa49bcc
xchg word [esp + 5], bx
rdtsc
lea ebp, [esi*4]
mov ax, word [esp]
mov al, ah
xchg word [esp + 7], cx
jmp 0xa49be3
neg dh
xchg ecx, eax
mov byte [esp + 4], bh
mov dl, dh
lea ebp, [ecx - 0xd3]
not si
jmp 0xa49c53
lea esi, [eax*4]
btr ecx, esp
not bx
xchg word [esp + 5], dx
mov dword [esp + 3], eax
cld
jmp 0xa49c19
inc si
mov byte [esp + 3], ah
pop dword [esp]
mov bl, bh
push esp
pop edx
jmp 0xa49ca4
xchg ecx, eax
add esp, 0
mov di, word [esp]
inc dl
call fcn.00a49cea
invalid
add esp, 5
mov bl, 0x38
mov ecx, 0xedd5800
mov eax, dword [esp]
rdtsc
cld
jmp 0xa49c84
Function at 0xa4a2d2
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
xor edx, esi
rdtsc
xchg byte [esp + 0xe], bl

Function at 0xa4a39e
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ebx, [ebx*4]
push edx
sub esp, 6
btr ebx, edx
popal
jmp 0xa4a407
rdtsc
cpuid
mov cx, bx
jmp 0xa4a388
btr ecx, esp
bsr cx, bp
mov dl, dh
lea esi, [edx + ebx]
mov ax, sp
cpuid
jmp 0xa4a443
bsr di, cx
mov dx, di
mov bx, 0x8583
push dword [esp]
setl dh
xchg byte [esp + 2], bl
jmp 0xa4a3c8
pop bx
xchg byte [esp + 0xa], dl
add al, dh
mov byte [esp + 1], bh
push word [esp + 9]
lea esp, [esp]
jmp 0xa4a3df
mov bx, 0x7b55
xchg bh, cl
pop bp
mov dl, 0x54
popal
mov bl, 0x58
jmp 0xa4a46b
add al, dh
bswap esi
sub bx, 0x8908
mov dl, 0x4c
mov al, ah
jmp 0xa4a453
pop si
mov esi, eax
mov bl, bh
sub esp, 0x1c
push dword [esp + 0x24]
push edx
jmp 0xa4a41d
lea eax, reloc.WINMM.dll_midiStreamOut
xchg dword [esp + 2], esi
push dword [esp + 0xf]
push dword [esp + 0x10]
jmp 0xa4a59e
mov ebx, esi
mov edi, 0x5720b3e4
stc
mov edi, 0x6beea52c
mov cx, word [esp + 9]
cld
jmp 0xa4a42c
mov word [esp], bx
xchg dh, al
mov ebx, 0x5dffda3e
bsr cx, cx
call fcn.00a4a4ce
jb 0xa4a48b
xchg dword [edx - 0x70], esi
div dword [edi - 0x19]
xor byte [ecx - 0x6a], 0xea
add eax, 0x59cea7b4
mov bp, word [esp + 0xb]
pop dword [esp]
cmc
sub esp, 0x10
pop dword [esp + 0x1b]
xchg ch, dl
jmp 0xa4a494
lea ebp, [edx + edx]
rdtsc
and dx, 0x982a
bswap ebp
mov byte [esp + 0x1b], ah
xor dx, 0x33c
jmp 0xa4a4ba
lea ebp, reloc.WINMM.dll_midiStreamOut
push dword [esp + 0x14]
mov dword [esp + 0x19], esi
mov esi, eax
mov cl, 0x12
mov di, 0xd26f
jmp 0xa4a4f7
btr edi, edx
mov word [esp + 0x14], bx
lea edx, [edx*4]
rdtsc
neg ebp
xchg ch, dl
jmp 0xa4a55a
Function at 0xa4a6f8
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp + 8], al
lea edx, [ecx + edi]
jmp 0xa4a678
mov al, 0xf6
mov dh, byte [esp + 6]
pop cx
bswap ebp
bswap ebp
bswap ebp
jmp 0xa4a6d7
mov cx, 0x3f1d
mov byte [esp], bh
push edx
xchg byte [esp], cl
xchg dh, al
pop ebp
jmp 0xa4a7bb
mov byte [esp], ah
xchg cx, ax
lea esp, [esp]
and cl, bh
lea edi, reloc.WINMM.dll_midiStreamOut
jmp 0xa4a6a0
pop dword [esp]
clc
xchg byte [esp + 2], dl
pop ebx
pop ax
bswap ecx
jmp 0xa4a6bc
xchg word [esp], dx
xchg word [esp], ax
mov word [esp], di
call 0xa4a6f8
add dword [ebx - reloc.WINMM.dll_midiStreamOut], eax
xchg bx, bp
jmp 0xa4a73c
mov word [esp], dx
cpuid
mov eax, ecx
mov byte [esp + 1], ch
neg si
inc cl
jmp 0xa4a6e6
mov word [esp + 4], di
pop bp
lea edi, [edx + esi]
rdtsc
push word [esp + 4]
jmp 0xa4a74b
setae bh
rcl bx, cl
stc
rdtsc
xchg dword [esp], edx
cld
jmp 0xa4a724
bsf bp, ax
add esp, 5
pushal
mov dword [esp + 0xd], eax
neg cx
jmp 0xa4a791
mov ecx, dword [esp + 4]
bsf dx, ax
xchg dh, al
mov bh, byte [esp + 2]
pop bp
mov ecx, 0x3d90280e
jmp 0xa4a711
sub si, 0xfd0
mov byte [esp + 9], ah
add esp, 0xf
mov dx, 0x2421
jmp 0xa4a808
pop dword [esp + 8]
mov word [esp + 6], sp
setbe bh
add esi, ebp
setae bh
push word [esp + 0x19]
jmp 0xa4a77a
xchg ch, dl
mov si, 0xeeeb
push edx
neg bx
mov bx, word [esp]
btc ecx, edi
jmp 0xa4a763
clc
sub esp, 0x1a
mov word [esp + 2], di
pop dword [esp + 0x1b]
mov byte [esp + 0x23], ah
bsf di, si
jmp 0xa4a81b
add ebx, ebp
bsf di, ax
mov dword [esp + 9], eax
not cx
mov al, 0xee
mov esi, ecx
jmp 0xa4a7ce
mov ebp, 0x7f7837da
push word [esp + 5]
xor edi, esi
rdtsc
cpuid
xchg edx, eax
jmp 0xa4a7eb
pop edi
pop ecx
xor dx, 0x2e84
lea eax, reloc.WINMM.dll_midiStreamOut
mov dl, dh
jmp 0xa4a97c
mov bx, 0x6a25
setge bh
neg bh
push esp
mov ah, byte [esp + 1]
mov si, di
jmp 0xa4a92b
lea esp, [esp + 0x42]
cmc
lea edx, [ebp*4]
rcl dx, cl
xchg ecx, eax
jmp 0xa4a853
bswap esi
mov bx, 0x829d
sub esp, 0xa
sub esp, 0x14
pushal
push edx
jmp 0xa4a86d
mov bp, word [esp + 2]
mov eax, ecx
sub esp, 0x10
pop bp
pop dword [esp + 8]
mov dword [esp + 5], ebp
call fcn.00a4a894
add esp, 2
mov eax, dword [esp]
pushal
rdtsc
neg cx
xchg ah, bl
jmp 0xa4a959
mov edi, dword [esp + 3]
mov bx, di
xchg bx, ax
push dword [esp + 2]
pop cx
mov dword [esp], ecx
jmp 0xa4a8ad
neg ah
xchg word [esp + 0xc], bp
mov dl, dh
mov edx, 0xa4a903e0
cld
jmp 0xa4a9de
mov di, 0x392d
push dword [esp + 1]
xchg dword [esp + 0x18], edx
mov si, word [esp + 2]
push word [esp + 0x17]
push word [esp + 0x1d]
jmp 0xa4a943
je 0xa4a997
sbb eax, 0xc455cdeb
ja 0xa4a9d8
test eax, 0x10ec83c8
sub esp, 0x10
sub esp, 0x14
lea esp, [esp + 0x45]
xchg si, bx
mov ecx, 0xee59fae0
lea ecx, [edi*4]
jmp 0xa4a884
invalid
cpuid
cpuid
push word [esp + 0x15]
sub edi, eax
neg edi
mov cx, word [esp + 0x19]
call fcn.00a4a9f9
or eax, 0x967b1c8e
jo 0xa4a971
and esi, dword [ebx - reloc.WINMM.dll_midiStreamOut]
adc dword [eax - reloc.WINMM.dll_midiStreamOut], edx
push es
ret 0x11e6
add esp, 6
xchg dword [esp + 0x1a], ebp
shr bh, 3
push word [esp + 7]
mov ah, byte [esp + 0x17]
lea edi, reloc.WINMM.dll_midiStreamOut
jmp 0xa4a9b6
Function at 0xa4a9f9
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xa4ab45
mov bl, bh
neg esi
mov edi, dword [esp + 0x18]
pop si
rdtsc
push word [esp + 0x17]
jmp 0xa4aaf9
rdtsc
push word [esp + 5]
lea edx, [edx*4]
pop si
jmp 0xa4aa9d
cpuid
add esp, 0x2d
mov bp, 0xf599
push dword [esp + 2]
push dword [esp + 3]
jmp 0xa4aa38
sub esp, 6
xchg byte [esp + 0x2a], dl
xchg word [esp + 3], cx
mov bl, bh
sub esp, 4
mov byte [esp + 0x18], dh
jmp 0xa4aa4f
lea ebp, [ecx + edi]
cmc
neg eax
pop bx
mov dword [esp + 0x13], eax
rdtsc
jmp 0xa4aad5
bswap esi
not dx
xchg word [esp + 0xb], si
bsr bp, cx
mov dl, dh
sub esp, 8
jmp 0xa4aa7e
inc bl
xchg cx, bp
setbe bh
mov bp, 0x2ff7
mov dword [esp + 0x1b], eax
xchg dword [esp], eax
jmp 0xa4aa67
bsr cx, bp
call fcn.00a4ab2e
mov byte [esp + 3], dh
push word [esp + 0x15]
mov bh, byte [esp + 0x18]
push esp
cpuid
sub esp, 0x18
jmp 0xa4ab11
bsf cx, ax
xchg si, bp
xchg word [esp + 0x10], si
add esp, 0xb
push word [esp + 0x1f]
not ebx
jmp 0xa4aac0
xchg bh, cl
mov bx, 0x9603
push dword [esp + 0x16]
lea esp, [esp + 0x41]
sub esp, 6
clc
jmp 0xa4ada9
stc
sub esp, 0xc
neg ax
setle ah
mov cl, ch
xchg ecx, eax
jmp 0xa4a9fe
lea edx, [edi*4]
rcr bh, 3
mov cl, ch
mov al, 0x16
push word [esp + 1]
cld
jmp 0xa4abcb
inc dl
inc al
and esi, ecx
inc al
push esp
lea esp, [esp + 3]
jmp 0xa4ab57
mov cx, dx
xchg byte [esp], bl
mov bl, 0x38
mov ebp, esi
mov al, 0xd6
neg dx
jmp 0xa4ab72
mov edx, dword [esp]
mov byte [esp], ch
mov cx, 0x28cd
mov edi, 0x558749b6
xchg byte [esp], bl
xor ax, 0xca4
jmp 0xa4ab8f
bsr dx, bp
lea esp, [esp + 3]
xchg bh, cl
mov dh, byte [esp]
jmp 0xa4ac4c
rdtsc
mov ebp, 0x2904f132
and cl, bh
mov byte [esp], dh
mov byte [esp], ah
xchg bh, cl
jmp 0xa4abb3
mov si, word [esp]
lea esp, [esp + 1]
xchg dh, al
cpuid
rol dx, cl
mov bl, bh
jmp 0xa4abe1
lea esi, [ecx - 0xfb]
setnp bh
not ecx
xchg ebx, ecx
setl dh
call fcn.00a4ac31
mov edi, 0x34c5a22c
invalid
mov edi, 0xf9657cfa
mov byte [esp], ah
rdtsc
shr bh, 3
mov dh, byte [esp + 1]
bswap ebp
jmp 0xa4ac03
xchg cx, ax
mov dx, 0x1cf1
mov al, 0xce
cld
mov cl, ch
lea edx, [ebx + ebx]
jmp 0xa4ac75
mov edx, 0xb5ffcfca
lea edx, [esi*4]
xchg dh, al
add esp, 3
lea esp, [esp + 1]
cld
jmp 0xa4ad62

Function at 0xa4ab2e
Capabilities:
Execute anti-debugging instructions

Disassembly:
btc ecx, edi
mov bp, di
xchg byte [esp + 6], dl
mov dword [esp + 3], eax
mov cl, ch
jmp 0xa4aade

Function at 0xa4af20
Capabilities:
Parse pe header

Disassembly:
mov word [esp], sp
pop word [esp]
jmp 0xa4af5e
lea esp, [esp + 1]
call fcn.00a4af40
mov byte [esp + 9], bh
mov dword [esp], ecx
lea esp, [esp + 3]
mov dword [esp + 0x64], ebp
pushal
call fcn.00a4afb7
rcr dword [edi - 0x31], cl
stosb byte es:[edi], al
pop ecx
test dword [ebx], edi
mov al, 0x26
inc ecx
mov al, 0x17
sub eax, 0x1960f3c

Function at 0xa4af40
Capabilities:
Parse pe header

Disassembly:
mov dword [esp], ebp
mov dword [esp], esi
push edx
push word [esp + 6]
mov word [esp + 4], dx
jmp 0xa4af67
Function at 0xa4afbd
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
push word [esp + 1]
pop dword [esp]
jmp 0xa4afcb
push dword [esp + 3]
lea esp, [esp + 7]
mov word [esp], bx
lea esp, [esp + 1]
lea esp, [esp + 1]
jmp 0xa4c6a4
call 0xa4b0a7
pop eax
xor ax, ax
jmp 0xa4b023
push eax
jmp 0xa4b0a2
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0xa4b908
mov dword [esp + 0x6c], edi
lea esp, [esp + 0x6c]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0xa4bbbc
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x407060], 1
mov dword [0x40705c], 1
mov dword [0x407058], 1
jne 0x401056
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010b0
mov dword [0x407014], eax
mov eax, dword [0x40706c]
test eax, eax
je 0x4010a0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x407080]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x407068]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x40401c], 1
je 0x4010e0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x401070
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x4010f8
cmp dx, 0x20b
jne 0x401056
cmp dword [ecx + 0x84], 0xe
jbe 0x401056
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401056
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401056
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401056

Function at 0x401880
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]
Function at 0x4018e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x407074]
test esi, esi
jle 0x401a00
mov eax, dword [0x407078]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x401914
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x401997
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x401900
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x401a27
mov eax, dword [0x407078]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x407078]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401a07
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x401990
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x4019a0
add dword [0x407074], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x407078]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401990
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x40191e
mov eax, dword [0x407078]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
nop

Function at 0x401ec0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x407090
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x407088]
sub esp, 4
test ebx, ebx
je 0x401f15
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x401f0e
test esi, esi
je 0x401f0e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401ef0
mov dword [esp], 0x407090
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402240
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x402265
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x402270
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x402265
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test esi, esi
je 0x4022b8
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x4022ae
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x4022ba
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x4022a0
xor eax, eax
pop ebx
pop esi
ret

Function at 0x402b80
Capabilities:
Resume thread
Suspend thread

Disassembly:
push esi
mov esi, eax
push ebx
sub esp, 0x2e4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
sub esp, 4
mov ebx, eax
cmp eax, 0xffffffff
je 0x402bd4
lea eax, [esp + 0x14]
mov dword [esp], esi
mov ebx, 0xffffffff
mov dword [esp + 0x14], 0x10003
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
sub esp, 8
test eax, eax
mov dword [esp], esi
cmovne ebx, dword [esp + 0xcc]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
sub esp, 4
add esp, 0x2e4
mov eax, ebx
pop ebx
pop esi
ret
Function at 0x402c40
Capabilities:
Create thread

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [esp + 0x60]
mov ebx, dword [esp + 0x50]
cmp esi, 0x10000
ja 0x402e38
mov eax, dword [ebx + 4]
test eax, eax
je 0x402ca1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], eax
mov eax, dword [ebx + 8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
mov eax, dword [ebx + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 0x10
mov dword [esp], eax
call edi
mov eax, dword [ebx + 4]
sub esp, 4
mov dword [esp], eax
call edi
sub esp, 4
mov eax, dword [ebx]
test eax, eax
je 0x402cb3
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
xor eax, eax
test esi, esi
jne 0x402cc8
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x58]
mov dword [esp + 4], 0
xor edi, edi
mov dword [esp + 8], eax
mov eax, dword [esp + 0x54]
mov dword [esp], eax
call sym._memset
lea ecx, [ebx + 4]
mov edx, ebx
mov dword [ebx], 0
and ecx, 0xfffffffc
mov dword [ebx + 0x18], 0
xor eax, eax
sub edx, ecx
add edx, 0x1c
and edx, 0xfffffffc
mov dword [ecx + eax], edi
add eax, 4
cmp eax, edx
jb 0x402d05
mov eax, dword [esp + 0x54]
xor edx, edx
mov dword [esp + 8], esi
mov dword [esp + 0xc], 0
mov dword [0x4070d0], eax
mov eax, dword [esp + 0x5c]
mov dword [0x4070d4], eax
mov eax, dword [esp + 0x58]
shr eax, 1
shld edx, eax, 0x10
shl eax, 0x10
mov dword [esp], eax
mov dword [esp + 4], edx
call dbg.__udivdi3
mov ecx, dword [esp + 0x5c]
mov dword [0x4070dc], esi
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ecx + eax*2]
mov dword [0x4070d8], eax
call ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov esi, eax
call ebp
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
sub esp, 0x1c
test eax, eax
je 0x402e4d
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebx + 8], eax
sub esp, 0x10
test eax, eax
je 0x402e96
lea eax, [esp + 0x2c]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], ebx
mov dword [esp + 8], dbg.profthr_func
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebx + 4], eax
sub esp, 0x18
test eax, eax
je 0x402e62
mov dword [esp + 4], 0xf
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor eax, eax
sub esp, 8
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
call sym.__errno
mov dword [eax], 0x16
mov eax, 0xffffffff
jmp 0x402cb9
call sym.__errno
mov dword [eax], 3
mov eax, 0xffffffff
jmp 0x402cb9
mov eax, dword [ebx]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp], eax
call esi
push eax
mov eax, dword [ebx + 8]
mov dword [esp], eax
call esi
mov dword [ebx], 0
sub esp, 4
call sym.__errno
mov dword [eax], 0xb
mov eax, 0xffffffff
jmp 0x402cb9
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x402e78