joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc71930
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0xcf16ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x60], 0
xor eax, eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x60]
push ecx
push 0
lea edx, [ebp - 0x20]
push edx
mov ecx, dword [ebp + 8]
call fcn.00c68bb0
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00c3d370
add esp, 8
mov ecx, eax
call fcn.00ad4c40
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x65], al
lea ecx, [ebp - 0x3c]
call fcn.00ad4e90
lea ecx, [ebp - 0x20]
call fcn.00b90ca0
movzx ecx, byte [ebp - 0x65]
test ecx, ecx
je 0xc719b6
xor al, al
jmp 0xc719de
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
je 0xc719d4
cmp dword [ebp - 0x64], 3
je 0xc719d4
mov dword [ebp - 0x70], 0
jmp 0xc719db
mov dword [ebp - 0x70], 1
mov al, byte [ebp - 0x70]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00c18a41
mov esp, ebp
pop ebp
ret 4

Function at 0xc719f0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0xcf16ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x7c], ecx
push 1
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00c68bb0
push eax
lea ecx, [ebp - 0x3c]
push ecx
call fcn.00c3d370
add esp, 8
mov ecx, eax
call fcn.00ad4c40
push eax
lea edx, [ebp - 0x58]
push edx
mov ecx, dword [ebp + 8]
call fcn.00c68bb0
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.00c3d370
add esp, 8
mov ecx, eax
call fcn.00ad4c40
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x75], al
lea ecx, [ebp - 0x74]
call fcn.00ad4e90
lea ecx, [ebp - 0x58]
call fcn.00b90ca0
lea ecx, [ebp - 0x3c]
call fcn.00ad4e90
lea ecx, [ebp - 0x20]
call fcn.00b90ca0
mov al, byte [ebp - 0x75]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00c18a41
mov esp, ebp
pop ebp
ret 8
Function at 0xc71a90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0xcf16ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], ecx
lea eax, [ebp - 0x250]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0xc71ac6
xor al, al
jmp 0xc71b56
call fcn.00c72470
movzx ecx, al
test ecx, ecx
jne 0xc71af3
push 0x105
lea edx, [ebp - 0x250]
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
jne 0xc71af3
xor al, al
jmp 0xc71b56
lea ecx, [ebp - 0x250]
push ecx
call fcn.00c72450
add esp, 4
push eax
lea edx, [ebp - 0x250]
push edx
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp + 8]
call fcn.00c68bb0
push eax
lea ecx, [ebp - 0x3c]
push ecx
call fcn.00c3d370
add esp, 8
mov ecx, eax
call fcn.00ad4c40
push eax
call fcn.00c724b0
add esp, 0xc
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0x251], al
lea ecx, [ebp - 0x3c]
call fcn.00ad4e90
lea ecx, [ebp - 0x20]
call fcn.00b90ca0
mov al, byte [ebp - 0x251]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00c18a41
mov esp, ebp
pop ebp
ret 4
Function at 0xc71d80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0xcf16ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x274], ecx
movzx eax, byte [ebp + 0xc]
neg eax
sbb eax, eax
and eax, 0xfffffff9
add eax, 0x23
mov dword [ebp - 0x5c], eax
push 1
mov ecx, dword [ebp - 0x5c]
push ecx
lea edx, [ebp - 0x270]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0xc71dca
xor al, al
jmp 0xc71f7a
call fcn.00c72470
movzx eax, al
test eax, eax
jne 0xc71dfa
push 0x105
lea ecx, [ebp - 0x270]
push ecx
lea edx, [ebp - 0x270]
push edx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
jne 0xc71dfa
xor al, al
jmp 0xc71f7a
push 0xffffffffffffffff
push 0xc9ea6c
push 0x105
lea eax, [ebp - 0x270]
push eax
call fcn.00c72570
add esp, 0x10
mov dword [ebp - 0x60], eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x274]
add ecx, 4
push ecx
lea edx, [ebp - 0x20]
push edx
call fcn.00c3d370
add esp, 8
mov ecx, eax
call fcn.00ad4c40
push eax
mov eax, 0x105
sub eax, dword [ebp - 0x60]
push eax
mov ecx, dword [ebp - 0x60]
lea edx, [ebp + ecx*2 - 0x270]
push edx
call fcn.00c72500
add esp, 0x10
add eax, dword [ebp - 0x60]
mov dword [ebp - 0x60], eax
lea ecx, [ebp - 0x20]
call fcn.00ad4e90
cmp dword [ebp - 0x60], 0
jbe 0xc71ea1
mov eax, dword [ebp - 0x60]
movzx ecx, word [ebp + eax*2 - 0x272]
cmp ecx, 0x5c
je 0xc71ea1
push 0xffffffffffffffff
push 0xc9eb0c
mov edx, 0x105
sub edx, dword [ebp - 0x60]
push edx
mov eax, dword [ebp - 0x60]
lea ecx, [ebp + eax*2 - 0x270]
push ecx
call fcn.00c72500
add esp, 0x10
add eax, dword [ebp - 0x60]
mov dword [ebp - 0x60], eax
push 0xffffffffffffffff
mov edx, dword [ebp - 0x274]
add edx, 0x20
push edx
lea eax, [ebp - 0x3c]
push eax
call fcn.00c3d370
add esp, 8
mov ecx, eax
call fcn.00ad4c40
push eax
mov ecx, 0x105
sub ecx, dword [ebp - 0x60]
push ecx
mov edx, dword [ebp - 0x60]
lea eax, [ebp + edx*2 - 0x270]
push eax
call fcn.00c72500
add esp, 0x10
add eax, dword [ebp - 0x60]
mov dword [ebp - 0x60], eax
lea ecx, [ebp - 0x3c]
call fcn.00ad4e90
cmp dword [ebp - 0x60], 0
jbe 0xc71f2a
mov ecx, dword [ebp - 0x60]
movzx edx, word [ebp + ecx*2 - 0x272]
cmp edx, 0x5c
je 0xc71f2a
push 0xffffffffffffffff
push 0xc9ebbc
mov eax, 0x105
sub eax, dword [ebp - 0x60]
push eax
mov ecx, dword [ebp - 0x60]
lea edx, [ebp + ecx*2 - 0x270]
push edx
call fcn.00c72500
add esp, 0x10
add eax, dword [ebp - 0x60]
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0x104
jb 0xc71f37
xor al, al
jmp 0xc71f7a
mov ecx, dword [ebp + 8]
call fcn.00c68b20
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x58]
push ecx
call fcn.00c6a380
add esp, 8
push eax
mov ecx, dword [ebp + 8]
call fcn.00c68f80
lea ecx, [ebp - 0x58]
call fcn.00b90ca0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x274]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x274]
mov eax, dword [edx + 0x20]
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00c18a41
mov esp, ebp
pop ebp
ret 8
Function at 0xc72000
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0xcf16ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x23c], ecx
cmp dword [ebp + 0xc], 0
jne 0xc72026
xor al, al
jmp 0xc7223c
lea ecx, [ebp - 0x218]
call fcn.00ad50e0
mov dword [ebp - 0x1fc], 0
push 4
lea eax, [ebp - 0x224]
push eax
mov ecx, dword [ebp + 8]
call fcn.00c69310
movzx ecx, al
test ecx, ecx
je 0xc720a1
lea edx, [ebp - 0x224]
push edx
lea ecx, [ebp - 0x20]
call fcn.00ad6550
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x3c]
push ecx
call fcn.00c3d370
add esp, 8
push eax
lea ecx, [ebp - 0x218]
call fcn.00adfd10
lea ecx, [ebp - 0x3c]
call fcn.00ad4e90
lea ecx, [ebp - 0x20]
call fcn.00b90ca0
lea ecx, [ebp - 0x218]
call fcn.00ad4c40
mov dword [ebp - 0x1fc], eax
jmp 0xc72108
push 0xc9ec5c
push 2
push 0
lea edx, [ebp - 0x74]
push edx
lea eax, [ebp - 0x58]
push eax
mov ecx, dword [ebp + 8]
call fcn.00c68e60
mov ecx, eax
call fcn.00adb350
push eax
call fcn.00ade3d0
add esp, 8
mov byte [ebp - 0x231], al
lea ecx, [ebp - 0x74]
call fcn.00b90ca0
lea ecx, [ebp - 0x58]
call fcn.00b90ca0
movzx ecx, byte [ebp - 0x231]
test ecx, ecx
je 0xc72108
mov byte [ebp - 0x232], 0
lea ecx, [ebp - 0x218]
call fcn.00ad4e90
mov al, byte [ebp - 0x232]
jmp 0xc7223c
mov edx, dword [ebp - 0x1fc]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x228]
and eax, 4
jne 0xc72131
mov ecx, dword [ebp - 0x228]
and ecx, 0
je 0xc7219b
xor edx, edx
je 0xc7217e
lea eax, [ebp - 0x224]
push eax
push str._remove_or_unknown_drive
push 0
push 0
push 0
push 1
push 0
push 0
lea ecx, [ebp - 0x138]
call fcn.00c44170
mov ecx, eax
call fcn.00c3f550
push eax
call fcn.00ad16a0
add esp, 8
push eax
call fcn.00ad16a0
add esp, 8
lea ecx, [ebp - 0x138]
call fcn.00c44580
jmp 0xc72131
mov byte [ebp - 0x233], 0
lea ecx, [ebp - 0x218]
call fcn.00ad4e90
mov al, byte [ebp - 0x233]
jmp 0xc7223c
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x230]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x1fc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0xc721da
mov byte [ebp - 0x234], 1
lea ecx, [ebp - 0x218]
call fcn.00ad4e90
mov al, byte [ebp - 0x234]
jmp 0xc7223c
xor edx, edx
je 0xc72217
push str._GetDiskFreeSpaceEx_returns_error
push 0
push 0
push 0
push 1
push 0
push 0
lea ecx, [ebp - 0x1f8]
call fcn.00c44170
mov ecx, eax
call fcn.00c3f550
push eax
call fcn.00ad16a0
add esp, 8
lea ecx, [ebp - 0x1f8]
call fcn.00c44580
jmp 0xc721da
mov byte [ebp - 0x235], 0
lea ecx, [ebp - 0x218]
call fcn.00ad4e90
mov al, byte [ebp - 0x235]
jmp 0xc7223c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00c18a41
mov esp, ebp
pop ebp
ret 8
Function at 0xc72250
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
mov eax, dword [0xcf16ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x154], ecx
lea ecx, [ebp - 0x140]
call fcn.00c689b0
mov dword [ebp - 0x148], 0
push 0
lea ecx, [ebp - 0x144]
call fcn.00c5b8e0
lea ecx, [ebp - 0x144]
call fcn.00c3da50
push eax
mov eax, dword [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0
jne 0xc72328
xor ecx, ecx
je 0xc722fb
push str.::GetCurrentDirectory___failed
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 2
push 4
push 0x1c0
push str.P:p_agentshpam2.eem_recipes201152726_base_branchesinputtools_win_release_branchgoogleclient_third_partylibjingle_files_talk_basewin32filesystem.cc
lea ecx, [ebp - 0xc8]
call fcn.00c44170
mov ecx, eax
call fcn.00c3f550
push eax
call fcn.00ad16a0
add esp, 8
lea ecx, [ebp - 0xc8]
call fcn.00c44580
jmp 0xc722b3
lea edx, [ebp - 0x140]
push edx
mov ecx, dword [ebp + 8]
call fcn.00c72400
lea ecx, [ebp - 0x144]
call fcn.00c724d0
lea ecx, [ebp - 0x140]
call fcn.00c5f370
mov eax, dword [ebp + 8]
jmp 0xc723e2
mov eax, dword [ebp - 0x14c]
cmp eax, dword [ebp - 0x148]
jg 0xc72338
jmp 0xc72388
xor ecx, ecx
mov eax, dword [ebp - 0x14c]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00c17a7c
add esp, 4
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x150]
push eax
lea ecx, [ebp - 0x144]
call fcn.00c3da10
mov ecx, dword [ebp - 0x14c]
mov dword [ebp - 0x148], ecx
mov edx, 1
test edx, edx
jne 0xc7228b
lea ecx, [ebp - 0x144]
call fcn.00c3da50
push eax
lea eax, [ebp - 0xe4]
push eax
call fcn.00c6a380
add esp, 8
push eax
lea ecx, [ebp - 0x140]
call fcn.00c68f80
lea ecx, [ebp - 0xe4]
call fcn.00b90ca0
lea ecx, [ebp - 0x140]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00c72400
lea ecx, [ebp - 0x144]
call fcn.00c724d0
lea ecx, [ebp - 0x140]
call fcn.00c5f370
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00c18a41
mov esp, ebp
pop ebp
ret 4

Function at 0xc73a45
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0xc73a6c
call fcn.00c1aeef
mov dword [eax], esi
call fcn.00c1aedc
push 0x16
pop esi
mov dword [eax], esi
call fcn.00c18cab
mov eax, esi
jmp 0xc73ac1
test dword [ebp + 0xc], 0xfffffff9
jne 0xc73a52
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0xc73a99
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00c1af02
pop ecx
call fcn.00c1aedc
mov eax, dword [eax]
jmp 0xc73ac1
test al, 0x10
jne 0xc73abf
test al, 1
je 0xc73abf
test byte [ebp + 0xc], 2
je 0xc73abf
call fcn.00c1aeef
mov dword [eax], 5
call fcn.00c1aedc
mov dword [eax], 0xd
jmp 0xc73a90
xor eax, eax
pop esi
pop ebp
ret
Function at 0x431002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x431072
mov ebx, 0x40915c
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x1fca1f1a
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x431060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x4310d2
nop
nop
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x636551df
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4310c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x432fc0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc30
mov eax, dword [0x437008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc10], eax
cmp ebx, 0x182
jne 0x432ff5
lea ecx, [ebp - 0xc30]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
jmp 0x43301f
cmp ebx, 0x19f
jne 0x43301f
push str.nehadanifowanositiwepogihawiwam_kojujobofoliv_mayihiyonatadihaxawodirifuf_gitupal
push str.vilijafoxo_vijifewirecekaruludugugadularewu
push str.nicolicetihutamuto_wafasegixa_nanudavanajazabarerehu_teyexahemadusixadoxirocoluci_vetefewodipeyevehoc
push str.loxudusupexalojabedok_tayuzuxodatalahefe_hof_pelozemobodofeh_guyecakarulegixahujutababizah
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push edi
xor edi, edi
test ebx, ebx
jle 0x4330cf
push esi
jmp 0x433030
lea esi, [ebp - 0xc0c]
mov dword [ebp - 0xc08], 5
mov dword [ebp - 0xc0c], 0
call fcn.00432fb0
mov eax, dword [ebp - 0xc0c]
add eax, 0x46
mov dword [ebp - 0xc08], eax
sub dword [ebp - 0xc08], 0x46
mov dl, byte [ebp - 0xc08]
mov eax, dword [ebp - 0xc10]
xor byte [eax + edi], dl
cmp ebx, 0xf
jne 0x4330c5
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaAvailableMemoryNode]
lea eax, [ebp - 0xc14]
push eax
lea ecx, [ebp - 0x404]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
push str.nacuroyayo
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenJobObjectW]
push 0
lea edx, [ebp - 0xc04]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
inc edi
cmp edi, ebx
jl 0x433030
pop esi
pop edi
cmp ebx, 0x2d
jne 0x4330e9
mov dword [0x2b370a0], 0xa62e7790
mov dword [0x2b370a4], 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401000
mov esp, ebp
pop ebp
ret

Function at 0x433100
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x437008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x2b36f6c]
push ebx
push esi
mov esi, dword [0x2b36db4]
mov ebx, eax
cmp eax, 0x5dd
jne 0x43313a
push 0
lea eax, [ebp - 0x804]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov eax, dword [0x437ef0]
call fcn.00432f80
cmp dword [0x2b36f6c], 0x2f
jne 0x433155
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push esi
call fcn.00432fc0
add esp, 4
cmp dword [0x2b36f6c], 0x568
pop esi
pop ebx
jne 0x43317c
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaHighestNodeNumber]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401000
mov esp, ebp
pop ebp
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00401219
Function at 0x6d16dcb0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov dword [esp], 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.6d16ebb0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
lea esi, [esi]

Function at 0x6d16dd10
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x6d187050]
test esi, esi
jle 0x6d16de30
mov eax, dword [0x6d187054]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x6d16dd44
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x6d16ddc7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x6d16dd30
mov dword [esp], ebx
call fcn.6d16e510
mov edi, eax
test eax, eax
je 0x6d16de57
mov eax, dword [0x6d187054]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.6d16e650
mov edx, dword [0x6d187054]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x6d16de37
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x6d16ddc0
lea edx, [eax - 0x40]
and edx, 0xffffffbf
jne 0x6d16ddd0
add dword [0x6d187050], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x6d187054]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x6d16ddc0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.6d16dcb0
lea esi, cs:[esi]
nop
xor esi, esi
jmp 0x6d16dd4e
mov eax, dword [0x6d187054]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.6d16dcb0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.6d16dcb0
lea esi, cs:[esi]
nop
Function at 0x6d16e180
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x6d187060
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x6d187058]
sub esp, 4
test ebx, ebx
je 0x6d16e1d5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
mov esi, eax
sub esp, 4
call edi
test esi, esi
je 0x6d16e1ce
test eax, eax
jne 0x6d16e1ce
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6d16e1b0
mov dword [esp], 0x6d187060
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6d16e510
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x6d100000], 0x5a4d
jne 0x6d16e535
mov ecx, dword [0x6d10003c]
cmp dword [ecx + 0x6d100000], 0x4550
lea edx, [ecx + 0x6d100000]
je 0x6d16e540
ret
cmp word [ecx + 0x6d100018], 0x10b
jne 0x6d16e535
push esi
push ebx
mov ebx, dword [esp + 0xc]
movzx eax, word [ecx + 0x6d100014]
movzx esi, word [ecx + 0x6d100006]
sub ebx, 0x6d100000
lea eax, [edx + eax + 0x18]
test si, si
je 0x6d16e588
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x6d16e57e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x6d16e58a
add ecx, 1
add eax, 0x28
cmp esi, ecx
jne 0x6d16e570
xor eax, eax
pop ebx
pop esi
ret
Function at 0x402b3c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404414
test esi, esi
jne 0x402b72
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404504
jmp 0x402b90
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004029f0
mov edi, eax
test esi, esi
je 0x402b90
cmp dword [ebx], 0
je 0x402b90
dec esi
jmp 0x402b79
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403434
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x52c020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4034cc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4034ac
xor eax, eax
push ebp
push 0x4034a5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4034e8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4034ac
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x52c020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x52c020], ax
mov esp, ebp
pop ebp
ret

Function at 0x4041f4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x54004c], 0
je 0x404255
cmp word [0x540220], 0xd7b2
jne 0x40421d
cmp dword [0x540228], 0
jbe 0x40421d
mov eax, 0x54021c
call dword [0x540238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x52c074
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40427c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x52c030], 0
jne 0x404271
push 0
push 0x52c06c
push 0x52c074
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4043c8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.0040273c
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x54004d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404390
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc