joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419bc0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
mov eax, dword [edi]
cmp eax, 0x270
jne 0x419c1e
lea edx, [edi + 8]
mov esi, eax
nop dword [eax]
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x419be0
mov eax, dword [edi]
jmp 0x419d09
cmp eax, 0x4e0
jb 0x419d09
mov eax, dword [edi + 0x9c4]
push ebx
lea ebx, [edi + 0x9c4]
mov edi, 0xe3
nop dword [eax + eax]
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x419c40
mov ebx, dword [ebp - 4]
mov edi, 0x18c
add ebx, 0xd50
mov eax, dword [ebx]
nop dword [eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x419c90
mov edi, dword [ebp - 4]
pop ebx
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41f960
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x41f9c1
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x41f9a4
cmp edi, 2
jb 0x41f9a4
cmp byte [esi], cl
jne 0x41f9a4
cmp byte [esi + 1], cl
jne 0x41f9a4
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x461140]
jmp 0x41f975
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x461140]
test edi, edi
jne 0x41f975
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x41f9f0
cmp cl, 0x23
jne 0x41f9d7
cmp byte [esi], cl
jne 0x41f9d7
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x461140]
test cl, cl
jne 0x41f9c8
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x41fb00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x41fb14
mov dword [ebx], 0
mov edx, 0x4667a4
call fcn.0041fa00
mov esi, eax
test esi, esi
je 0x41fc02
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call edi
add esp, 4
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x41fbf8
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x41fbf8
push esi
call edi
mov edi, eax
add esp, 4
mov dword [ebp + 8], edi
cmp edi, 0xffffffff
je 0x41fbf8
push 0
push dword [ebp - 4]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x41fbf8
mov eax, dword [0x46dd3c]
test eax, eax
je 0x41fb8c
inc dword [eax + 0x36c]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
je 0x41fbf8
push esi
push dword [ebp + 8]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp + 8]
je 0x41fbdd
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x46dd3c]
add esp, 4
test eax, eax
je 0x41fbca
dec dword [eax + 0x36c]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test ebx, ebx
je 0x41fbef
mov eax, dword [ebp + 8]
mov dword [ebx], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x421d10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x46c00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0xc4]
lea edx, [ebp - 8]
push ebx
mov ebx, dword [ecx + 0xcc]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
mov dword [ebp - 8], edi
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x461140]
sub esi, 1
jne 0x421d43
mov eax, dword [0x46dd3c]
not ebx
cmp dword [eax + 0x1be0], ebx
jne 0x421d72
mov dword [eax + 0x1be4], ebx
cmp dword [eax + 0x1c1c], ebx
jne 0x421d81
mov byte [eax + 0x1c20], 1
cmp dword [eax + 0x1bc8], ebx
jne 0x421d9a
push ecx
push edi
mov edx, 4
mov ecx, ebx
call fcn.004326b0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045a66e
mov esp, ebp
pop ebp
ret 4

Function at 0x421db0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x46c00c]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov edx, ecx
push esi
push edi
lea esi, [ebp - 0x18]
mov edi, 0x10
movss xmm1, dword [edx + 0xe0]
movss xmm0, dword [eax]
movss xmm2, dword [edx + 0xe4]
subss xmm0, xmm1
mov ecx, dword [edx + 0xc4]
movss dword [ebp - 0x18], xmm0
movss xmm0, dword [eax + 4]
subss xmm0, xmm2
movss dword [ebp - 0x14], xmm0
movss xmm0, dword [eax + 8]
subss xmm0, xmm1
movss dword [ebp - 0x10], xmm0
movss xmm0, dword [eax + 0xc]
mov eax, dword [edx + 0xcc]
subss xmm0, xmm2
mov edx, dword [eax + ecx*4 - 4]
movss dword [ebp - 0xc], xmm0
not edx
nop dword [eax + eax]
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x461140]
sub edi, 1
jne 0x421e30
mov eax, dword [0x46dd3c]
not edx
cmp dword [eax + 0x1be0], edx
jne 0x421e5f
mov dword [eax + 0x1be4], edx
cmp dword [eax + 0x1c1c], edx
jne 0x421e6e
mov byte [eax + 0x1c20], 1
mov ecx, dword [ebp - 8]
mov eax, edx
pop edi
xor ecx, ebp
pop esi
call fcn.0045a66e
mov esp, ebp
pop ebp
ret 4
Function at 0x426460
Capabilities:
Hash data with crc32

Disassembly:
mov eax, ecx
or ecx, 0xffffffff
push ebx
push esi
mov bl, byte [eax]
lea esi, [eax + 1]
test bl, bl
je 0x42649d
push edi
or edi, 0xffffffff
cmp bl, 0x23
jne 0x426483
cmp byte [esi], bl
jne 0x426483
cmp byte [esi + 1], bl
cmove ecx, edi
movzx edx, cl
movzx eax, bl
mov bl, byte [esi]
xor edx, eax
shr ecx, 8
inc esi
xor ecx, dword [edx*4 + 0x461140]
test bl, bl
jne 0x426474
pop edi
pop esi
not ecx
pop ebx
jmp fcn.00426400

Function at 0x42ba70
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x46c00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x46dd3c]
lea edx, [ebp - 8]
push ebx
push esi
push edi
mov edi, dword [eax + 0x1ba8]
mov esi, 4
mov eax, dword [edi + 0xc4]
add edi, 0xc4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
mov ebx, dword [edi + 8]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x461140]
sub esi, 1
jne 0x42bab1
mov eax, dword [0x46dd3c]
not ebx
cmp dword [eax + 0x1bc8], ebx
jne 0x42baeb
push ecx
push dword [ebp - 0xc]
lea edx, [esi + 4]
mov ecx, ebx
call fcn.004326b0
add esp, 8
mov ecx, dword [edi + 4]
mov esi, dword [edi]
cmp esi, ecx
jne 0x42bb16
inc esi
test ecx, ecx
je 0x42bb04
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x42bb09
mov eax, 8
cmp eax, esi
mov ecx, edi
cmovg esi, eax
push esi
call fcn.004330a0
mov ecx, dword [edi]
mov eax, dword [edi + 8]
mov dword [eax + ecx*4], ebx
inc dword [edi]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045a66e
mov esp, ebp
pop ebp
ret
Function at 0x4317a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x2fa8], 0
lea esi, [edi + 0x2fac]
je 0x431822
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x4317dc
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.00433370
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.004201b0
mov edx, dword [esi]
mov ecx, 0x46dd38
push dword [edi + 0x2fa8]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x2fb4]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.004201b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43b030
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43b06a
mov eax, dword [0x46dd3c]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x43b05d
dec dword [eax + 0x36c]
push ecx
call edi
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x43b09b
mov eax, dword [0x46dd3c]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x43b08e
dec dword [eax + 0x36c]
push ecx
call edi
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x43b0cc
mov eax, dword [0x46dd3c]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x43b0bf
dec dword [eax + 0x36c]
push ecx
call edi
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x43b119
mov eax, dword [0x46dd3c]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x43b10c
dec dword [eax + 0x36c]
push ecx
call edi
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x43b14a
mov eax, dword [0x46dd3c]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x43b13d
dec dword [eax + 0x36c]
push ecx
call edi
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x43b17b
mov eax, dword [0x46dd3c]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x43b16e
dec dword [eax + 0x36c]
push ecx
call edi
add esp, 4
mov dword [esi + 0x5c], 0
pop edi
lea ecx, [esi + 0x78]
pop esi
jmp fcn.0043dcd0
Function at 0x4566f0
Capabilities:
Hash data with crc32

Disassembly:
test dword [ecx + 0xc], 0x100000
push ebx
push esi
push edi
mov ebx, edx
je 0x456761
mov cl, byte [ebx]
lea esi, [ebx + 1]
or eax, 0xffffffff
test cl, cl
je 0x456738
or edi, 0xffffffff
nop dword [eax]
cmp cl, 0x23
jne 0x45671f
cmp byte [esi], cl
jne 0x45671f
cmp byte [esi + 1], cl
cmove eax, edi
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x461140]
test cl, cl
jne 0x456710
mov ecx, dword [0x46dd3c]
not eax
cmp dword [ecx + 0x1be0], eax
jne 0x45674e
mov dword [ecx + 0x1be4], eax
cmp dword [ecx + 0x1c1c], eax
jne 0x4567c3
mov byte [ecx + 0x1c20], 1
pop edi
pop esi
pop ebx
ret
mov edi, dword [0x46dd3c]
xor edx, edx
mov eax, dword [edi + 0x1ba8]
mov ecx, dword [eax + 0xc4]
mov eax, dword [eax + 0xcc]
push dword [eax + ecx*4 - 4]
mov ecx, ebx
call fcn.0041f960
mov esi, eax
add esp, 4
cmp dword [edi + 0x1be0], esi
jne 0x456799
mov dword [edi + 0x1be4], esi
cmp dword [edi + 0x1c1c], esi
jne 0x4567a8
mov byte [edi + 0x1c20], 1
cmp dword [edi + 0x1bc8], esi
jne 0x4567c1
push ecx
push ebx
mov edx, 0xb
mov ecx, esi
call fcn.004326b0
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x45b3d0
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x45b40f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x45b40f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x45b40f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x45b40f
cmp dword [ecx + 0x74], 0xe
jbe 0x45b40f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x409908
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x424070]
jne 0x409912
repz ret
jmp fcn.0041156c

Function at 0x412dde
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x412ded
pop dword [ebp - 0x24]
mov eax, 0xf099ca69
sub eax, 0xf0589c7c
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x8cd3e184
add dword [ebp - 0x34], 0xc17e63c7
mov dword [ebp - 0x30], 0xbbd2a59a
add dword [ebp - 0x30], 0x7660a6ab
mov dword [ebp - 0x2c], 0x59104f70
sub dword [ebp - 0x2c], 0xcc40b42
mov dword [ebp - 0x28], 0x591f89c1
add dword [ebp - 0x28], 0xa6e0763f
lea eax, [ebp - 0x34]
push eax
mov eax, 0x1ec8e7e0
sub eax, 0x1e872790
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xb9c71a45
sub dword [ebp - 0x34], 0x4554b0ef
mov dword [ebp - 0x30], 0xda68db3b
sub dword [ebp - 0x30], 0x98fc79c6
mov dword [ebp - 0x2c], 0x1199fe43
sub dword [ebp - 0x2c], 0xae2a91d7
mov dword [ebp - 0x28], 0x6519cdaa
add dword [ebp - 0x28], 0x9ae63256
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0xd79e269b
sub eax, 0xd75c664f
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3f2a0
push 0
call eax
mov ecx, 0x2b101a1f
sub ecx, 0x2b0fc4f9
xor edx, edx
add edx, eax
mov esi, 0x140c09a5
add esi, 0xec37205b
add esi, dword [ebp - 0x24]
mov ebx, 0x8ace440e
sub ebx, 0x6d5f0005
xor dword [ebp - 0x10], 0x786c665b
mov edi, dword [esi]
add edi, ebx
sub dword [ebp - 0x1c], 0x14a32583
mov dword [edx], edi
xor dword [ebp - 0x18], eax
add edx, 0xe3038a31
add edx, 0x1cfc75d3
add esi, 4
loop 0x412f11
add eax, 0x7d56a195
sub eax, 0x7d555a2a
mov ebx, eax
add eax, 0xfcffaa14
sub eax, 0xfcffaa0f
mov ecx, 0x485bbc36
add ecx, 0xb7e443ca
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x401648
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x40
call dbg.__main
mov dword [esp], 0x411044
call sym._system
mov dword [esp + 0x32], 0x6972614d
mov word [esp + 0x36], 0x61
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
jmp 0x4016d6
mov dword [esp], str.Introduce_un_nombre:
call sym._printf
lea eax, [esp + 0x1e]
mov dword [esp + 4], eax
mov dword [esp], 0x41105e
call sym._scanf
lea eax, [esp + 0x32]
mov dword [esp + 4], eax
lea eax, [esp + 0x1e]
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x4016c5
mov dword [esp + 0x38], 1
jmp 0x4016dd
mov dword [esp], str.Nombre_incorrecto._Intntalo_de_nuevo._n
call sym._printf
add dword [esp + 0x3c], 1
cmp dword [esp + 0x3c], 2
jle 0x401683
cmp dword [esp + 0x38], 0
je 0x4016f2
mov dword [esp], str.Bien_hecho__n
call sym._printf
jmp 0x4016fe
mov dword [esp], str.Has_fallado._n
call sym._printf
mov eax, 0
leave
ret

Function at 0x401980
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]
Function at 0x4019e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x414078]
test esi, esi
jle 0x401b00
mov eax, dword [0x41407c]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x401a14
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x401a97
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x401a00
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x401b27
mov eax, dword [0x41407c]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x41407c]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401b07
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x401a90
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x401aa0
add dword [0x414078], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x41407c]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401a90
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x401a1e
mov eax, dword [0x41407c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
nop

Function at 0x401fe0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x414094
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x41408c]
sub esp, 4
test ebx, ebx
je 0x402035
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40202e
test esi, esi
je 0x40202e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402010
mov dword [esp], 0x414094
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402360
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x402385
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x402390
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x402385
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test esi, esi
je 0x4023d8
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x4023ce
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x4023da
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x4023c0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x431420
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1f000]
mov dword [edi + 0x28d2c], 0x61b2d55c
push edi
or ebp, 0xffffffff
jmp 0x43144a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x431451
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x431440
mov eax, 1
add ebx, ebx
jne 0x431463
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x431458
jne 0x431474
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x431458
xor ecx, ecx
sub eax, 3
jb 0x431488
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4314fa
mov ebp, eax
add ebx, ebx
jne 0x431493
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4314a0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4314c4
inc ecx
add ebx, ebx
jne 0x4314b0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4314a5
jne 0x4314c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4314a5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4314e4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4314d5
jmp 0x431446
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4314e4
add edi, ecx
jmp 0x431446
pop esi
mov edi, esi
mov ecx, 0xbbc
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x431502
cmp byte [edi], 7
jne 0x431502
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x431507
lea edi, [esi + 0x2f000]
mov eax, dword [edi]
or eax, eax
je 0x431576
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x34434]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x344c0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x431534
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x344c4]
or eax, eax
je 0x431570
mov dword [ebx], eax
add ebx, 4
jmp 0x431551
call dword [esi + 0x344d4]
mov ebp, dword [esi + 0x344c8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4315aa
sub esp, 0xffffff80
jmp 0x415493
Function at 0x1005c13a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10094144]
jne 0x1005c144
repz ret
jmp fcn.1005c74e

Function at 0x10018e04
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x10018e13
pop dword [ebp - 0x40]
mov eax, 0x61df4cab
sub eax, 0x51ddbe98
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x3f8c7
push 0
mov eax, 0xb8db312c
sub eax, 0xa8d7d050
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0x445d
mov ebx, eax
mov esi, 0x1003be00
add esi, dword [ebp - 0x40]
mov edi, 0x18e9a0c1
xor dword [ebp - 0x2c], 0x7b169af4
mov edx, dword [esi]
mov dword [ebp - 0x30], 0xcb7d5288
sub edx, edi
xor dword [ebp - 0x10], eax
mov dword [ebx], edx
sub dword [ebp - 0x14], 0x909cf67a
add ebx, 0x84c52e17
add ebx, 0x7b3ad1ed
add esi, 0xb2cf6ef1
add esi, 0x4d309113
loop 0x10018e60
add eax, 0xc23ba511
sub eax, 0xc23aa0ca
xor ebx, ebx
add ebx, eax
add eax, 0xea5afd8c
add eax, 0x15a50279
mov ecx, 0x10000000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x100289d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x100330b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10035b0c]
test dword [ebp + 8], eax
je 0x10028a7a
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x808]
push eax
call fcn.10018e04
xor eax, eax
add esp, 0xc
mov word [ebp - 8], ax
mov eax, dword [0x10035b08]
test eax, eax
je 0x10028a6d
lea ecx, [ebp - 0x808]
push ecx
push eax
call fcn.10018e04
mov eax, dword [0x100330ac]
pop ecx
pop ecx
test eax, eax
jle 0x10028a7a
push esi
mov esi, dword [0x10035b10]
push edi
mov edi, dword [0x10035b14]
cdq
push edx
push eax
push edi
push esi
call fcn.10029420
add esi, 1
mov dword [0x10035b10], esi
adc edi, 0
or eax, edx
mov dword [0x10035b14], edi
pop edi
pop esi
jne 0x10028a7a
push dword [0x10035b08]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
pop ecx
jmp 0x10028a7a
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10028d50
leave
ret