joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4055b4
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.00405872
test bl, 8
mov dword [ebp - 0xc], eax
je 0x4055f3
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x7a1fc8], eax
jmp 0x40577d
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x40560d
test eax, eax
je 0x40572b
test bl, 2
je 0x40572b
mov esi, 0x79f540
push edi
push esi
call fcn.00405cf4
cmp dword [ebp + 8], 0
je 0x40562c
push str..
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x405632
push edi
call fcn.004057cb
cmp byte [edi], 0
jne 0x405640
cmp byte [0x79f540], 0x5c
jne 0x40564b
push 0x409014
push edi
call sub.KERNEL32.dll_lstrcatA
push edi
call sub.KERNEL32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x14c]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x405721
lea eax, [ebp - 0x120]
push 0x3f
push eax
lea esi, [ebp - 0x120]
call fcn.004057af
cmp byte [eax], 0
je 0x405691
cmp byte [ebp - 0x1c], 0
je 0x405691
lea esi, [ebp - 0x1c]
cmp byte [esi], 0x2e
jne 0x4056a7
mov al, byte [esi + 1]
test al, al
je 0x405700
cmp al, 0x2e
jne 0x4056a7
cmp byte [esi + 2], 0
je 0x405700
push esi
push ebx
call fcn.00405cf4
test byte [ebp - 0x14c], 0x10
je 0x4056cc
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405700
push dword [ebp + 0xc]
push edi
call fcn.004055b4
jmp 0x405700
push dword [ebp - 4]
push edi
call fcn.0040556c
test eax, eax
jne 0x4056f8
cmp dword [ebp - 4], eax
je 0x4056f0
push edi
push 0xfffffffffffffff1
call fcn.00404fdf
push 0
push edi
call fcn.00405ba8
jmp 0x405700
inc dword [0x7a1fc8]
jmp 0x405700
push edi
push 0xfffffffffffffff2
call fcn.00404fdf
lea eax, [ebp - 0x14c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40566f
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x40572b
and byte [ebx - 1], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x40577d
cmp dword [ebp - 0xc], esi
jne 0x40573f
inc dword [0x7a1fc8]
jmp 0x40577d
push edi
call fcn.00405ff8
test eax, eax
je 0x40577d
push edi
call fcn.00405784
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.0040556c
test eax, eax
jne 0x405775
cmp dword [ebp - 4], esi
je 0x405737
push edi
push 0xfffffffffffffff1
call fcn.00404fdf
push esi
push edi
call fcn.00405ba8
jmp 0x40577d
push edi
push 0xffffffffffffffe5
call fcn.00404fdf
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x405872
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x79f940
push esi
call fcn.00405cf4
push esi
call fcn.0040581d
mov edi, eax
test edi, edi
jne 0x405893
xor eax, eax
jmp 0x4058e5
push edi
call fcn.00405f5f
test byte [0x7a1f58], 0x80
je 0x4058ac
mov al, byte [edi]
test al, al
je 0x40588f
cmp al, 0x5c
je 0x40588f
sub edi, esi
jmp 0x4058c4
call fcn.00405ff8
test eax, eax
je 0x4058be
test byte [eax], 0x10
je 0x40588f
push esi
call fcn.004057cb
push esi
call sub.KERNEL32.dll_lstrlenA
cmp eax, edi
push esi
jg 0x4058b0
call fcn.00405784
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405960
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40597f
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, esi
pop esi
ret 4

Function at 0x405985
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x4059b4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
mov eax, dword [0x40939c]
dec edi
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x4059f9
test edi, edi
jne 0x4059bf
and byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x4059f3
Function at 0x405a2c
Capabilities:
Get file size
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, 0x7a02c8
push 0x4093b8
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [esp + 0x1c]
mov ebp, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test esi, esi
mov ebx, 0x400
je 0x405a7b
push 1
push 0
push esi
call fcn.00405985
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push edi
push esi
call ebp
test eax, eax
je 0x405ba2
cmp eax, ebx
jg 0x405ba2
mov esi, 0x7a06c8
push ebx
push esi
push dword [esp + 0x20]
call ebp
test eax, eax
je 0x405ba2
cmp eax, ebx
jg 0x405ba2
push esi
push edi
push str._s_s_r_n
push 0x79fec8
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x7a1f50]
add esp, 0x10
push dword [eax + 0x128]
push esi
call fcn.00405d16
push 4
push 0xc0000000
push esi
call fcn.00405985
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x1c], ebp
je 0x405ba2
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x405b9b
push edi
push esi
push ebp
call fcn.004059fd
test eax, eax
je 0x405b9b
push str._Rename__r_n
push esi
call fcn.004058ea
test eax, eax
jne 0x405b31
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add edi, 0xa
jmp 0x405b66
add eax, 0xa
push 0x4093a0
push eax
call fcn.004058ea
mov ebp, eax
test ebp, ebp
je 0x405b62
lea ecx, [esi + edi]
lea eax, [ecx + ebx]
jmp 0x405b53
mov dl, byte [ecx]
mov byte [eax], dl
dec eax
dec ecx
cmp ecx, ebp
ja 0x405b4d
sub ebp, esi
inc ebp
mov eax, ebp
mov ebp, dword [esp + 0x1c]
jmp 0x405b68
mov ebp, dword [esp + 0x1c]
mov eax, edi
push ebx
add eax, esi
push 0x79fec8
push eax
call fcn.00405940
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0x10]
push 0
add edi, ebx
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x405bdb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0x18]
push esi
push eax
mov eax, dword [ebp + 0x18]
xor ebx, ebx
neg eax
sbb eax, eax
mov esi, dword [ebp + 0x14]
and eax, 0x100
or eax, 0x20019
mov byte [esi], bl
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405c4c
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0x400
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405c3b
cmp dword [ebp + 0x14], 1
je 0x405c3d
cmp dword [ebp + 0x14], 2
je 0x405c3d
mov byte [esi], bl
push dword [ebp + 0x18]
mov byte [esi + 0x3ff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x406091
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x7a0acc], 0
push esi
jne 0x4060c8
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4060a2
mov dword [ecx*4 + 0x7a0ac8], eax
inc ecx
cmp ecx, 0x100
jl 0x40609d
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4060f9
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x7a0ac8]
xor eax, esi
inc ecx
dec edx
jne 0x4060db
pop edi
not eax
pop esi
ret 0xc

Function at 0x503b8c
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x503376
mov dword [0x50521c], 2
jmp 0x503bbc
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x50408c
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c8f
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503cbc
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c8f
mov eax, dword [0x505250]
jmp 0x503cc9
call 0x502c0d
ret
Function at 0x402c3e
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor ecx, ecx
push 8
mov eax, ecx
pop edx
test al, 1
je 0x402c52
shr eax, 1
xor eax, 0xedb88320
jmp 0x402c54
shr eax, 1
dec edx
jne 0x402c45
mov dword [ecx*4 + 0x4141c0], eax
mov dword [ecx*4 + 0x4161c0], eax
inc ecx
cmp ecx, 0x100
jb 0x402c40
push ebx
push esi
push edi
mov ecx, 0x4145c0
mov edi, 0x101
mov eax, dword [ecx - 0x400]
push 7
mov edx, ecx
pop esi
movzx ebx, al
shr eax, 8
xor eax, dword [ebx*4 + 0x4141c0]
mov dword [edx], eax
add edx, 0x400
dec esi
jne 0x402c86
add ecx, 4
dec edi
jne 0x402c7b
pop edi
pop esi
pop ebx
ret

Function at 0x402ca8
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x4161c4], 0
jne 0x402cb6
call fcn.00402c3e
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
test esi, esi
jbe 0x402ce3
test cl, 7
je 0x402ce3
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4141c0]
dec esi
inc ecx
jmp 0x402cc4
cmp esi, 8
jb 0x402d76
mov edi, esi
shr edi, 3
push ebx
xor eax, dword [ecx]
sub esi, 8
mov ebx, eax
shr ebx, 0x10
movzx ebx, bl
mov edx, eax
shr edx, 0x18
mov edx, dword [edx*4 + 0x4151c0]
xor edx, dword [ebx*4 + 0x4155c0]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor edx, dword [ebx*4 + 0x4159c0]
movzx ebx, byte [ecx + 6]
xor edx, dword [ebx*4 + 0x4145c0]
movzx ebx, byte [ecx + 5]
xor edx, dword [ebx*4 + 0x4149c0]
movzx ebx, byte [ecx + 4]
xor edx, dword [ebx*4 + 0x414dc0]
movzx ebx, byte [ecx + 7]
xor edx, dword [ebx*4 + 0x4141c0]
movzx eax, al
xor edx, dword [eax*4 + 0x415dc0]
add ecx, 8
dec edi
mov eax, edx
jne 0x402cf2
pop ebx
jmp 0x402d76
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4141c0]
dec esi
inc ecx
test esi, esi
ja 0x402d62
pop edi
pop esi
ret 0xc
Function at 0x40cf32
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret 4
Function at 0x1001be86
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x1001be95
pop dword [ebp - 0x30]
mov eax, 0xc642e09f
sub eax, 0xb641220a
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x1e400c8a
sub dword [ebp - 0x40], 0xcfedc73f
mov dword [ebp - 0x3c], 0xfae850da
add dword [ebp - 0x3c], 0x374afb6b
mov dword [ebp - 0x38], 0x8c93c4b7
add dword [ebp - 0x38], 0xbfb87f77
mov dword [ebp - 0x34], 0xd8b84f3d
sub dword [ebp - 0x34], 0xd8b84f3d
lea eax, [ebp - 0x40]
push eax
mov eax, 0x5a4c0455
sub eax, 0x4a47f37d
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x249c4e48
sub dword [ebp - 0x40], 0xb029e4f2
mov dword [ebp - 0x3c], 0x7bd324ab
add dword [ebp - 0x3c], 0xc5993cca
mov dword [ebp - 0x38], 0x7a3b9476
sub dword [ebp - 0x38], 0x16cc280a
mov dword [ebp - 0x34], 0xaadd1896
add dword [ebp - 0x34], 0x5522e76a
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x718f8d54
add eax, 0x9e748324
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x4c038
push 0
call eax
mov ecx, 0x10866712
add ecx, 0xef79daa9
mov ebx, eax
mov esi, 0xa58b51e2
add esi, 0x6a79981e
add esi, dword [ebp - 0x30]
mov edx, 0xaa77f264
sub edx, 0xf7b87a5c
xor dword [ebp - 0xc], 0xb7dd5d18
mov edi, dword [esi]
xor dword [ebp - 0x28], esi
sub edi, edx
sub dword [ebp - 0x14], ecx
mov dword [ebx], edi
sub dword [ebp - 0x18], ebx
add ebx, 0x3c7da523
add ebx, 0xc3825ae1
add esi, 0xbcc13591
add esi, 0x433eca73
loop 0x1001bfb7
add eax, 0xf9bf
mov ebx, eax
add eax, 0xb886cfca
add eax, 0x4779303b
mov ecx, 0x109d40ea
sub ecx, 0x9d40ea
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x1003f584
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1004acd0]
jne 0x1003f58e
repz ret
jmp fcn.1003fc70

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x415060], 1
mov dword [0x41505c], 1
mov dword [0x415058], 1
jne 0x401056
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010b0
mov dword [0x415014], eax
mov eax, dword [0x41506c]
test eax, eax
je 0x4010a0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x415080]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x415068]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x410018], 1
je 0x4010e0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x401070
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x4010f8
cmp dx, 0x20b
jne 0x401056
cmp dword [ecx + 0x84], 0xe
jbe 0x401056
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401056
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401056
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401056

Function at 0x4016cf
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 0x31], 0x44434241
mov dword [ebp - 0x2d], 0x48474645
mov dword [ebp - 0x29], 0x4c4b4a49
mov dword [ebp - 0x25], 0x504f4e4d
mov dword [ebp - 0x21], 0x54535251
mov dword [ebp - 0x1d], 0x58575655
mov dword [ebp - 0x19], 0x31305a59
mov dword [ebp - 0x15], 0x35343332
mov dword [ebp - 0x11], 0x39383736
mov byte [ebp - 0xd], 0
mov dword [ebp - 0xc], 0
jmp 0x401755
call sym._rand
mov ecx, eax
mov edx, 0x38e38e39
mov eax, ecx
mul edx
shr edx, 3
mov eax, edx
shl eax, 3
add eax, edx
shl eax, 2
sub ecx, eax
mov edx, ecx
movzx eax, byte [ebp + edx - 0x31]
lea ecx, [ebp - 0x42]
mov edx, dword [ebp - 0xc]
add edx, ecx
mov byte [edx], al
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0xf
jle 0x401721
mov byte [ebp - 0x32], 0
lea eax, [ebp - 0x42]
mov dword [esp + 4], eax
mov dword [esp], str.Your_gift_card_code:__s_n
call sym._printf
nop
leave
ret

Function at 0x401b50
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]
Function at 0x401bb0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x415074]
test esi, esi
jle 0x401cd0
mov eax, dword [0x415078]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x401be4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x401c67
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x401bd0
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x401cf7
mov eax, dword [0x415078]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x415078]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401cd7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x401c60
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x401c70
add dword [0x415074], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x415078]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401c60
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x401bee
mov eax, dword [0x415078]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
nop

Function at 0x402210
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x415090
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x415088]
sub esp, 4
test ebx, ebx
je 0x402265
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40225e
test esi, esi
je 0x40225e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402240
mov dword [esp], 0x415090
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4025a0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x4025c5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x4025d0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x4025c5
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x402618
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x40260e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40261a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x402600
xor eax, eax
pop ebx
pop esi
ret
Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx