joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4aa884
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004046f0
xor eax, eax
push ebp
push 0x4aa97b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x23456789
push 0x34567890
lea eax, [ebp - 8]
push eax
mov ecx, 0x12345678
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004aa7e4
lea eax, [ebp - 0xc]
call fcn.00404240
lea eax, [ebp - 0x10]
call fcn.00404240
mov eax, dword [ebp - 8]
call fcn.00404500
mov esi, eax
test esi, esi
jle 0x4aa91b
mov ebx, 1
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
movzx eax, byte [eax + ebx - 1]
shl eax, 8
xor eax, 7
or eax, 5
call fcn.00408ab4
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
call fcn.00404508
inc ebx
dec esi
jne 0x4aa8f3
xor ebx, ebx
mov eax, dword [ebp - 0xc]
call fcn.00404500
mov ecx, 0xc
cdq
idiv ecx
mov esi, eax
lea eax, [ebp - 0x18]
push eax
mov edx, esi
imul edx, ebx
mov ecx, 1
mov eax, dword [ebp - 0xc]
call fcn.00404760
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x10]
call fcn.00404508
inc ebx
cmp ebx, 0xc
jne 0x4aa91d
mov eax, edi
mov edx, dword [ebp - 0x10]
call fcn.00404294
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aa982
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00404264
ret

Function at 0x4ababc
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.00407294
ret

Function at 0x4ad284
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push ecx
mov esi, ecx
mov ebx, edx
shl ebx, 2
add ebx, eax
mov eax, ebx
call fcn.00405730
test eax, eax
je 0x4ad2c4
push esp
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
mov dword [ebx], esi
push esp
mov eax, dword [esp + 4]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
push 4
push ebx
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
pop edx
pop esi
pop ebx
ret

Function at 0x4ad38c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, ecx
mov edi, edx
mov ebx, eax
push esp
push 0x40
push esi
push ebx
call sub.kernel32.dll_VirtualProtect
mov edx, ebx
mov eax, edi
mov ecx, esi
call fcn.004029cc
push esp
mov eax, dword [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_VirtualProtect
push esi
push ebx
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4ad8dc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov dword [esp + 4], edx
mov dword [esp], eax
lea ebp, [esp + 0x10]
mov eax, dword [0x4c8020]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x4ad91f
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [0x4c8020]
call fcn.004186e0
mov ebx, eax
mov eax, dword [esp]
cmp eax, dword [ebx]
jne 0x4ad91b
mov eax, dword [ebx + 4]
jmp 0x4ad9e5
inc edi
dec esi
jne 0x4ad8fe
mov edi, dword [esp]
mov ebx, edi
xor esi, esi
mov edx, ebp
mov eax, ebx
call fcn.004ad584
test al, al
jne 0x4ad937
mov byte [ebp], 1
xor eax, eax
mov al, byte [ebp]
add esi, eax
xor eax, eax
mov al, byte [ebp]
add ebx, eax
cmp esi, 5
jb 0x4ad926
mov edx, esi
mov eax, edi
call fcn.004ad6bc
add eax, 5
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
call fcn.004027d0
mov ebp, eax
mov eax, 0x14
call fcn.004027d0
mov ebx, eax
mov eax, dword [esp]
mov dword [ebx], eax
mov dword [ebx + 4], ebp
mov eax, dword [esp + 8]
mov dword [ebx + 8], eax
mov dword [ebx + 0x10], esi
mov eax, esi
call fcn.004027d0
mov dword [ebx + 0xc], eax
mov edx, dword [ebx + 0xc]
mov eax, edi
mov ecx, esi
call fcn.004029cc
mov edx, ebx
mov eax, dword [0x4c8020]
call fcn.00418584
lea eax, [esp + 0xc]
push eax
push 0x40
mov eax, dword [esp + 0x10]
push eax
push ebp
call sub.kernel32.dll_VirtualProtect
mov edx, ebp
mov eax, edi
mov ecx, esi
call fcn.004029cc
mov ecx, esi
mov edx, edi
mov eax, ebp
call fcn.004ad758
lea edx, [esi + edi]
lea eax, [esi + ebp]
call fcn.004ad3cc
mov edx, dword [esp + 4]
mov eax, edi
call fcn.004ad3cc
mov eax, ebp
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4adc44
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
mov ebx, eax
xor esi, esi
mov edx, 0x40
mov eax, ebx
call fcn.004ad234
test al, al
je 0x4adc88
mov eax, ebx
cmp word [eax], 0x5a4d
jne 0x4adc88
cmp dword [eax + 0x3c], 0
je 0x4adc88
mov esi, dword [eax + 0x3c]
add esi, ebx
mov edx, 0xf8
mov eax, esi
call fcn.004ad234
test al, al
je 0x4adc86
cmp dword [esi], 0x4550
je 0x4adc88
xor esi, esi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x4b2160
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push esp
push 0x104
call sub.kernel32.dll_GetTempPathA
mov edx, ebx
mov eax, esp
call fcn.004095a4
add esp, 0x108
pop ebx
ret

Function at 0x4b2188
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.004095a4
add esp, 0x108
pop ebx
ret
Function at 0x4b21b4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov word [ebp - 6], dx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004046f0
xor eax, eax
push ebp
push 0x4b222c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00404294
mov eax, dword [ebp - 4]
call fcn.00404500
mov esi, eax
test esi, esi
jle 0x4b2216
mov ebx, 1
mov eax, edi
call fcn.00404758
movzx edx, word [ebp - 6]
shr edx, 8
mov ecx, dword [ebp - 4]
xor dl, byte [ecx + ebx - 1]
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x4b21f9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b2233
lea eax, [ebp - 4]
call fcn.00404240
ret

Function at 0x4b2714
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b27c4
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xc8
mov eax, ebx
call fcn.00404240
mov eax, dword [ebp - 8]
call fcn.004027d0
mov dword [ebp - 4], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00407294
xor eax, eax
push ebp
push 0x4b27a7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x4b2791
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00404438
lea edx, [ebp - 0xc]
mov eax, dword [ebx]
call fcn.0040884c
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00404294
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b27ae
mov eax, dword [ebp - 4]
call fcn.004027f0
ret
Function at 0x4b27d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 0x148], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b2985
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
call fcn.004b2714
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [0x4c8054], 1
je 0x4b295a
xor edx, edx
mov eax, 2
call fcn.00487a44
mov esi, eax
mov dword [ebp - 0x144], 0x128
lea edx, [ebp - 0x144]
mov eax, esi
call fcn.00487a64
jmp 0x4b294c
push 1
call sub.kernel32.dll_Sleep_1
cmp dword [0x4c8054], 1
je 0x4b2954
call sub.kernel32.dll_GetCurrentProcessId
cmp eax, dword [ebp - 0x13c]
jne 0x4b2882
lea edx, [ebp - 0x144]
mov eax, esi
call fcn.00487a84
jmp 0x4b294c
lea eax, [ebp - 0x148]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.004044b0
mov eax, dword [ebp - 0x148]
lea edx, [ebp - 0xc]
call fcn.0040926c
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.004044b0
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.004b261c
cmp bl, al
jne 0x4b293f
test bl, bl
jne 0x4b2920
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0x13c]
call fcn.004b246c
test al, al
je 0x4b2911
lea edx, [ebp - 0x14c]
mov eax, dword [ebp - 0x18]
call fcn.0040884c
mov edx, dword [ebp - 0x14c]
mov eax, dword [ebp - 0x1c]
call fcn.0040464c
je 0x4b2920
lea edx, [ebp - 0x144]
mov eax, esi
call fcn.00487a84
jmp 0x4b294c
lea edx, [ebp - 0x144]
mov eax, esi
call fcn.00487a84
jmp 0x4b294c
push 0
mov eax, dword [ebp - 0x13c]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
push 0xa
call sub.kernel32.dll_Sleep_1
lea edx, [ebp - 0x144]
mov eax, esi
call fcn.00487a84
test eax, eax
jne 0x4b284f
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b298c
lea eax, [ebp - 0x14c]
mov edx, 2
call fcn.00404264
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00404264
ret

Function at 0x4b3310
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov word [ebp - 6], dx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004046f0
xor eax, eax
push ebp
push 0x4b3388
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00404294
mov eax, dword [ebp - 4]
call fcn.00404500
mov esi, eax
test esi, esi
jle 0x4b3372
mov ebx, 1
mov eax, edi
call fcn.00404758
movzx edx, word [ebp - 6]
shr edx, 8
mov ecx, dword [ebp - 4]
xor dl, byte [ecx + ebx - 1]
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x4b3355
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b338f
lea eax, [ebp - 4]
call fcn.00404240
ret
Function at 0x4b5754
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4b5901
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 4]
mov edx, 8
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 4]
mov edx, 0x4b5918
call fcn.0040464c
je 0x4b58e6
mov eax, dword [ebp - 4]
mov edx, 0x4b5924
call fcn.0040464c
jne 0x4b57dc
push 1
push 0
push 0
lea ecx, [ebp - 8]
mov edx, 9
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 8]
call fcn.00404700
push eax
push 0x4b5928
mov eax, esi
call fcn.00442350
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4b58e6
mov eax, dword [ebp - 4]
mov edx, 0x4b5938
call fcn.0040464c
jne 0x4b5807
lea ecx, [ebp - 0xc]
mov edx, 0xa
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0xc]
call fcn.0042d6d8
jmp 0x4b58e6
mov eax, dword [ebp - 4]
mov edx, 0x4b5944
call fcn.0040464c
jne 0x4b5862
lea ecx, [ebp - 0x10]
mov edx, 0xa
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x10]
call fcn.0042d6d8
push 1
push 0
push 0
lea ecx, [ebp - 0x14]
mov edx, 9
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x14]
call fcn.00404700
push eax
push 0x4b5928
mov eax, esi
call fcn.00442350
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4b58e6
mov eax, dword [ebp - 4]
mov edx, 0x4b5950
call fcn.0040464c
jne 0x4b58e6
push 4
lea ecx, [ebp - 0x18]
mov edx, 0xa
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x18]
call fcn.00404700
push eax
lea edx, [ebp - 0x1c]
mov eax, dword [0x4c4a1c]
mov eax, dword [eax]
call fcn.0045af30
mov eax, dword [ebp - 0x1c]
call fcn.00404700
mov ecx, eax
mov eax, dword [0x4c4a1c]
mov eax, dword [eax]
pop edx
call fcn.0045b51c
cmp eax, 6
jne 0x4b58e6
push 1
push 0
push 0
lea ecx, [ebp - 0x20]
mov edx, 9
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x20]
call fcn.00404700
push eax
push 0x4b5928
mov eax, esi
call fcn.00442350
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b5908
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.00404264
ret

Function at 0x4b661c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov word [ebp - 6], dx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004046f0
xor eax, eax
push ebp
push 0x4b6694
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00404294
mov eax, dword [ebp - 4]
call fcn.00404500
mov esi, eax
test esi, esi
jle 0x4b667e
mov ebx, 1
mov eax, edi
call fcn.00404758
movzx edx, word [ebp - 6]
shr edx, 8
mov ecx, dword [ebp - 4]
xor dl, byte [ecx + ebx - 1]
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x4b6661
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b669b
lea eax, [ebp - 4]
call fcn.00404240
ret
Function at 0x4b84b4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov word [ebp - 6], dx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004046f0
xor eax, eax
push ebp
push 0x4b852c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00404294
mov eax, dword [ebp - 4]
call fcn.00404500
mov esi, eax
test esi, esi
jle 0x4b8516
mov ebx, 1
mov eax, edi
call fcn.00404758
movzx edx, word [ebp - 6]
shr edx, 8
mov ecx, dword [ebp - 4]
xor dl, byte [ecx + ebx - 1]
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x4b84f9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b8533
lea eax, [ebp - 4]
call fcn.00404240
ret
Function at 0x401310
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x4a000c]
mov dword [eax], 0
jmp fcn.00401120
Function at 0x40a5a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
cmp eax, 3
ja case.default.0x40a5b1
jmp dword [eax*4 + 0x4aa244]
cmp dword [0x505320], 0
je 0x40a6b3
push 0x505324
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x50533c]
test edi, edi
je 0x40a6a8
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40a5fb
mov edi, dword [edi + 8]
test edi, edi
je 0x40a6a8
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x40a5f0
test esi, esi
je 0x40a5f0
mov ecx, dword [edi + 4]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
jmp 0x40a5f0
cmp dword [0x505320], 0
jne 0x40a630
push 0x505324
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x505320], 1
jmp case.default.0x40a5b1
call fcn.00401570
jmp case.default.0x40a5b1
cmp dword [0x505320], 0
je case.default.0x40a5b1
push 0x505324
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x50533c]
test edi, edi
je 0x40a703
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40a687
mov edi, dword [edi + 8]
test edi, edi
je 0x40a703
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x40a680
test esi, esi
je 0x40a680
mov ecx, dword [edi + 4]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
jmp 0x40a680
push 0x505324
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x505320]
cmp eax, 1
jne case.default.0x40a5b1
mov eax, dword [0x50533c]
test eax, eax
je 0x40a6e2
nop word cs:[eax + eax]
mov esi, dword [eax + 8]
push eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
mov eax, esi
test esi, esi
jne 0x40a6d0
mov dword [0x50533c], 0
mov dword [0x505320], 0
push 0x505324
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
jmp case.default.0x40a5b1
push 0x505324
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x40a860
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push edi
push esi
mov esi, dword [0x4a0004]
movzx ecx, word [esi]
xor eax, eax
cmp ecx, 0x5a4d
jne 0x40a8c6
mov ecx, dword [esi + 0x3c]
cmp dword [esi + ecx], 0x4550
jne 0x40a8c6
add esi, ecx
movzx ecx, word [esi + 0x18]
cmp ecx, 0x10b
jne 0x40a8c6
movzx ecx, word [esi + 6]
test ecx, ecx
je 0x40a8c6
mov edx, dword [esp + 0xc]
sub edx, dword [0x4a0004]
movzx edi, word [esi + 0x14]
add esi, edi
add esi, 0x18
jmp 0x40a8b6
add esi, 0x28
dec ecx
je 0x40a8c6
mov edi, dword [esi + 0xc]
cmp edi, edx
ja 0x40a8b0
add edi, dword [esi + 8]
cmp edi, edx
jbe 0x40a8b0
mov eax, esi
pop esi
pop edi
ret
Function at 0x40ec54
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
jne 0x40ec61
xor eax, eax
pop esi
mov eax, dword [esi + 0x3c]
push ebx
push ebp
push edi
mov ebx, dword [eax + esi + 0x78]
xor edi, edi
add ebx, esi
mov ebp, dword [ebx + 0x20]
add ebp, esi
cmp dword [ebx + 0x18], edi
jbe 0x40ec95
mov eax, dword [ebp + edi*4]
push dword [esp + 0x18]
add eax, esi
push eax
call fcn.0040ece3
pop ecx
pop ecx
test al, al
jne 0x40ec9c
inc edi
cmp edi, dword [ebx + 0x18]
jb 0x40ec79
xor eax, eax
pop edi
pop ebp
pop ebx
pop esi
ret
mov eax, dword [ebx + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + esi]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + esi]
add eax, esi
jmp 0x40ec97

Function at 0x40ecb3
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
push esi
mov esi, dword [eax + 0xc]
add esi, 0xc
mov esi, dword [esi]
cmp dword [esi + 0x30], 0
je 0x40ecc0
cmp dword [esp + 8], 0
je 0x40ecde
push dword [esi + 0x30]
call fcn.0040ed80
pop ecx
cmp dword [esp + 8], eax
jne 0x40ecc0
mov eax, dword [esi + 0x18]
pop esi
ret

Function at 0x413c20
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [esp + 0x18]
push 8
push str.percent_
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strnicmp]
add esp, 0xc
test eax, eax
je 0x413c41
xor eax, eax
jmp 0x413c9d
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
add ebx, 8
push 0x4aa907
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
je 0x413c8a
push 0x4aa939
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
jne 0x413c3d
push ebp
push esi
call fcn.00419040
add esp, 8
cmp eax, 0x65
jae 0x413ca2
mov byte [edi + 1], al
jmp 0x413c9b
push ebp
push esi
call fcn.00419040
add esp, 8
cmp eax, 0x65
jae 0x413ca2
mov byte [edi], al
mov al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push esi
push 0x4aa90d
push eax
call fcn.00413cd0
add esp, 0xc
push 0x1e0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3
Function at 0x413cf0
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov esi, dword [esp + 0x18]
push str.percent
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
je 0x413d19
test eax, eax
sete al
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x413e0e
mov edx, dword [ecx]
mov ebx, edx
not ebx
test bl, 7
jne 0x413e0e
mov esi, dword [ecx + 4]
shld esi, edx, 0x18
je 0x413d0c
mov dword [esp], eax
add ecx, 0x10
mov eax, 0x65657267
mov ebp, esi
mov edi, ecx
jmp 0x413d58
add edi, edx
add edi, 0x10
dec ebp
je 0x413da5
cmp dword [edi + 1], 5
jne 0x413d70
mov edx, dword [edi + 8]
mov ebx, dword [edx]
xor ebx, eax
movzx edx, byte [edx + 4]
xor edx, 0x6e
or edx, ebx
je 0x413d84
mov ebx, dword [edi + 0x10]
not ebx
mov edx, 0x10
test bl, 6
jne 0x413d50
mov edx, dword [edi + 0x18]
jmp 0x413d50
mov eax, 0xf7
and eax, dword [edi + 0x10]
xor ebx, ebx
cmp eax, 4
jne 0x413d9f
mov ebx, dword [edi + 0x18]
cmp ebx, 0x65
jae 0x413e32
mov eax, dword [esp + 0x20]
mov byte [eax], bl
mov edi, 0x6c6c6579
mov eax, dword [esp]
jmp 0x413dbc
add ecx, edx
add ecx, 0x10
dec esi
je 0x413d0c
cmp dword [ecx + 1], 6
jne 0x413dd7
mov ebx, dword [ecx + 8]
mov edx, dword [ebx]
xor edx, edi
movzx ebx, word [ebx + 4]
xor ebx, 0x776f
or ebx, edx
je 0x413deb
mov ebx, dword [ecx + 0x10]
not ebx
mov edx, 0x10
test bl, 6
jne 0x413db0
mov edx, dword [ecx + 0x18]
jmp 0x413db0
mov edx, 0xf7
and edx, dword [ecx + 0x10]
xor ebx, ebx
cmp edx, 4
jne 0x413e02
mov ebx, dword [ecx + 0x18]
cmp ebx, 0x65
jae 0x413e49
mov ecx, dword [esp + 0x20]
mov byte [ecx + 1], bl
jmp 0x413d0c
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push esi
push str.Error:_usage:__s_must_be_an_object_n
push eax
call fcn.00413cd0
add esp, 0xc
push 0x1e0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push 1
push 0x36
push str.Error:_usage:_percent.green_must_be_between_0_and_100_n
jmp 0x413e5e
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push 1
push 0x37
push str.Error:_usage:_percent.yellow_must_be_between_0_and_100_n
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
push 0x1e0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit

Function at 0x4173d0
Capabilities:
Write file on windows

Disassembly:
cmp byte [0x505228], 0
je 0x4173f6
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push 1
push 5
push str.e__7h
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
cmp byte [0x505229], 0
je 0x41741c
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push 1
push 6
push str.e__25h
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
add esp, 4
ret
Function at 0x417440
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push eax
xor eax, eax
cmp dword [0x5076ec], 0
sete al
xor ecx, ecx
cmp byte [0x506391], 0
cmovne eax, ecx
cmp byte [0x506393], 0
mov edx, 0
cmovne edx, eax
mov byte [0x505228], dl
cmp byte [0x506394], 0
cmove eax, ecx
mov byte [0x505229], al
movzx ebx, byte [0x50640c]
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
test bl, bl
je 0x41749b
push 0
push 4
jmp 0x4174a2
push 0x1000
push 0
push 0
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_setvbuf
add esp, 0x10
push 1
push 0x4173c0
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
mov dword [esp], 0
mov eax, esp
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov eax, dword [esp]
or eax, 5
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
push 0xfde9
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
cmp byte [0x506391], 0
jne 0x41751d
cmp dword [0x5076ec], 0
jne 0x41751d
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push 1
push 4
push 0x4aac0a
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
cmp byte [0x505229], 0
je 0x417543
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push 1
push 6
push str.e__25l
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
cmp byte [0x505228], 0
je 0x417569
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push 1
push 5
push str.e__7l
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
call fcn.00423e50
add esp, 4
pop esi
pop ebx
ret