joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403b50
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x403b7e
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebx, ebx
je 0x403c1c
not eax
test bl, 1
jne 0x403b85
mov edx, ebx
cmp ebx, 1
jne 0x403bb6
jmp 0x403c1a
xor eax, eax
jmp 0x403c1c
lea edx, [ebx - 1]
movzx esi, byte [ecx]
mov edi, eax
shr edi, 4
xor eax, esi
and eax, 0xf
xor edi, dword [eax*4 + 0x43ea18]
inc ecx
mov eax, edi
shr eax, 4
shr esi, 4
and edi, 0xf
xor edi, esi
xor eax, dword [edi*4 + 0x43ea18]
cmp ebx, 1
je 0x403c1a
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [ecx + esi]
mov edi, eax
shr edi, 4
xor eax, ebx
and eax, 0xf
xor edi, dword [eax*4 + 0x43ea18]
mov eax, edi
shr eax, 4
shr ebx, 4
and edi, 0xf
xor edi, ebx
xor eax, dword [edi*4 + 0x43ea18]
movzx ebx, byte [ecx + esi + 1]
mov edi, eax
shr edi, 4
xor eax, ebx
and eax, 0xf
xor edi, dword [eax*4 + 0x43ea18]
mov eax, edi
shr eax, 4
shr ebx, 4
and edi, 0xf
xor edi, ebx
xor eax, dword [edi*4 + 0x43ea18]
add esi, 2
cmp edx, esi
jne 0x403bc0
not eax
pop esi
pop edi
pop ebx
ret
Function at 0x409aa0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.00409bc0
sub esp, 0x100
mov esi, esp
call fcn.0043a010
test al, 1
jne 0x409abf
jmp 0x409b85
call fcn.00432700
test al, 1
jne 0x409acd
jmp 0x409b80
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
cmp eax, 0
jl 0x409b7e
xor eax, eax
sub esp, 0x24
mov dword [esp], 0
mov dword [esp + 4], 0xffffffff
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
cmp eax, 0
jl 0x409b78
call fcn.0040ad10
test al, 1
jne 0x409b52
jmp 0x409b76
lea eax, str.system_or_character_via_spellings_glyphs_a_is_uses_that_in_their_modified_other_on_often_reflection_or_resemblance_on_it_leetspeak__used_similarity_internet._play_eleet_the_of_the_replacements_of_primarily_ways
sub esp, 8
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.00409ba0
add esp, 8
call fcn.0040f970
call fcn.0040ca50
jmp 0x409b76
jmp 0x409b78
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x409b80
call fcn.0043a410
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40c380
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov eax, dword [ebp + 8]
mov dword [esi + 0x5c], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0x3c
mov dword [esi + 0x2c], 0xffffffff
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x54], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0x4472f4]
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x40c42e
sar edx, 1
lea edi, [esi + 0x24]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x441d50]
xor eax, eax
jmp 0x40c9ce
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4146c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x518
push dword [ebp + 8]
call fcn.00402a80
add esp, 4
mov esi, eax
xor eax, eax
test esi, esi
sete al
xor ebx, ebx
jmp dword [eax*4 + 0x442b80]
Function at 0x416ce0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xd8
mov ebx, dword [ebp + 0xc]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax], 0
lea eax, [eax + 2]
jne 0x416d00
lea ecx, [ebx + eax]
add ecx, 0xfffffffe
add eax, ebx
mov edx, 1
sub edx, eax
and edx, ebx
mov esi, ebx
not esi
and esi, ecx
sub esi, edx
sar esi, 1
lea edi, [esp + 0x84]
push edi
push 0
push 0
push esi
push ebx
push 0
call dword [0x44862c]
mov ebx, dword [esp + 0x84]
test ebx, ebx
jns 0x416d4d
mov eax, 0xffffffff
jmp 0x416d50
lea eax, [ebx + ebx]
push eax
call fcn.00409230
add esp, 4
push edi
push ebx
mov dword [esp + 0x1c], eax
push eax
push esi
push dword [ebp + 0xc]
push 0
call dword [0x44862c]
mov dword [esp + 0x18], 0x13641172
mov dword [esp + 0x1c], 0x1f811d71
mov dword [esp + 0x20], 0x1b381982
mov dword [esp + 0x24], 0x76b0564
mov dword [esp + 0x28], 0x39d0194
mov dword [esp + 0x2c], 0xf9d0d69
mov dword [esp + 0x30], 0xb080998
lea eax, [esp + 0x34]
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3b], 0
mov dword [esp + 0x90], 0
mov ecx, dword [esp + 0x90]
cmp ecx, 0x26
ja 0x416e36
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 0x90]
mov edx, dword [esp + 0x90]
movzx edx, byte [esp + edx + 0x18]
lea esi, [ecx + 0x49b1bd83]
add ecx, 0x83
or ecx, esi
and ecx, edx
or esi, edx
sub esi, ecx
mov dword [esp + 0xac], esi
mov ecx, dword [esp + 0xac]
add cl, 0x6b
mov edx, dword [esp + 0x90]
mov byte [esp + edx + 0x18], cl
inc dword [esp + 0x90]
mov ecx, dword [esp + 0x90]
cmp ecx, 0x27
jb 0x416de0
lea edi, [esp + 0x90]
lea edx, [esp + 0x18]
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xac]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, dword [esp + 0x84]
mov ecx, eax
add ecx, 0xd
jns 0x416e6f
mov eax, 0xffffffff
jmp 0x416e74
add eax, eax
add eax, 0x1a
push eax
call fcn.00409230
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x14]
movzx ecx, word [eax]
mov eax, esi
test cx, cx
je 0x416eb1
mov eax, dword [esp + 0x14]
lea edx, [eax + 2]
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x416ea0
mov word [eax], 0
movzx ecx, word [esp + 0x90]
test cx, cx
je 0x416ee1
lea edx, [esp + 0x92]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x416ed0
mov word [eax], 0
lea eax, [esp + 0x48]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.0043c830
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4430e0]

Function at 0x417e70
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xd8
mov edi, dword [ebp + 8]
xor eax, eax
cmp dword [ebp + 0x10], 0
setne al
xor ecx, ecx
mov dword [esp], 0
xor ebx, ebx
jmp dword [eax*4 + 0x4431e0]
Function at 0x42f4a0
Capabilities:
Encode data using xor
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov eax, dword [ebp + 8]
mov byte [esp + 0xf], 0
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
cmp eax, 0
je 0x42f666
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
mov dword [esp + 0x48], eax
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
jmp 0x42f4ff
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], 0
setne al
jmp 0x42f50d
jmp 0x42f50f
test al, 1
jne 0x42f518
jmp 0x42f65a
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call fcn.0040ca30
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x3c]
cmp eax, 0
setne al
jmp 0x42f548
jmp 0x42f54a
test al, 1
jne 0x42f553
jmp 0x42f644
mov esi, dword [ebp + 8]
mov edi, dword [esp + 0x3c]
mov ebx, dword [esp + 0x40]
mov al, byte [esp + 0x14]
mov byte [esp + 0x1c], al
mov byte [esp + 0x20], 0x43
mov byte [esp + 0x21], 0xb9
mov byte [esp + 0x22], 0xa3
mov byte [esp + 0x23], 0xbb
mov byte [esp + 0x24], 0xa6
mov byte [esp + 0x25], 0xba
mov byte [esp + 0x26], 0xb7
mov byte [esp + 0x27], 0xa9
mov byte [esp + 0x28], 0xb8
mov byte [esp + 0x29], 0x67
mov byte [esp + 0x2a], 0xae
mov byte [esp + 0x2b], 0xab
mov byte [esp + 0x2c], 0xac
mov byte [esp + 0x2d], 0x11
mov dword [esp + 0x2e], 0
jmp 0x42f5b6
call fcn.00409bc0
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x10]
cmp eax, 0x12
jae 0x42f61b
jmp 0x42f5ce
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
movzx ecx, byte [esp + ecx + 0x20]
mov edx, eax
and edx, 0xecaa
xor eax, 0xecaa
lea eax, [eax + edx*2]
mov edx, eax
add edx, ecx
and eax, ecx
add eax, eax
sub edx, eax
mov dword [esp + 0x44], edx
mov eax, dword [esp + 0x44]
add al, 0x5a
mov ecx, dword [esp + 0x10]
mov byte [esp + ecx + 0x20], al
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
cmp eax, 0x12
jb 0x42f5ce
jmp 0x42f61b
jmp 0x42f61d
lea eax, [esp + 0x20]
mov ecx, esi
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], edi
call fcn.00409de0
sub esp, 0xc
and al, 1
jmp 0x42f63a
jmp 0x42f63c
jmp 0x42f63e
mov byte [esp + 0xf], al
jmp 0x42f644
mov eax, dword [esp + 0x18]
jmp 0x42f64a
jmp 0x42f64c
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
jmp 0x42f65a
jmp 0x42f65c
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x42f664
jmp 0x42f666
mov al, byte [esp + 0xf]
and al, 1
movzx eax, al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4340a0
Capabilities:
Encode data using xor
Hash data using sha1
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov ebp, dword [esp + 0x74]
mov eax, dword [esp + 0x70]
mov dword [esp + 0x14], 0xc3d2e1f0
mov dword [esp + 0x10], 0x10325476
mov dword [esp + 0xc], 0x98badcfe
mov dword [esp + 8], 0xefcdab89
mov dword [esp + 4], 0x67452301
cmp ebp, 0x40
jb 0x43415d
mov edi, ebp
shr edi, 6
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebp, eax
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebp + esi]
mov dword [esp + esi + 0x1c], eax
movzx ecx, byte [ebp + esi + 1]
shl ecx, 8
or ecx, eax
mov dword [esp + esi + 0x1c], ecx
movzx eax, byte [ebp + esi + 2]
shl eax, 0x10
or eax, ecx
mov dword [esp + esi + 0x1c], eax
movzx ecx, byte [ebp + esi + 3]
shl ecx, 0x18
or ecx, eax
mov dword [esp + esi + 0x1c], ecx
add esi, 4
cmp esi, 0x40
jne 0x434100
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 8]
push eax
call fcn.00437340
add esp, 8
inc ebx
lea eax, [esi + ebp]
cmp ebx, edi
jne 0x4340f0
add ebp, esi
mov eax, ebp
mov ebp, dword [esp + 0x74]
mov dword [esp + 0x58], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov ecx, ebp
and ecx, 0x3f
mov dword [esp], ecx
je 0x434254
mov ecx, ebp
and ecx, 1
xor edi, edi
cmp dword [esp], 1
je 0x43423d
mov dword [esp + 0x18], ecx
sub dword [esp], ecx
xor ebx, ebx
xor edi, edi
nop
movzx ebp, byte [eax + edi]
mov ecx, ebx
and cl, 0x10
shl ebp, cl
mov edx, edi
and edx, 0xfffffffc
xor ebp, dword [esp + edx + 0x1c]
mov dword [esp + edx + 0x1c], ebp
movzx esi, byte [eax + edi + 1]
or cl, 8
shl esi, cl
xor esi, ebp
mov dword [esp + edx + 0x1c], esi
add edi, 2
add ebx, 0x10
cmp dword [esp], edi
jne 0x434200
add eax, edi
mov ebp, dword [esp + 0x74]
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x434254
movzx eax, byte [eax]
lea ecx, [edi*8]
shl eax, cl
and edi, 0xfffffffc
xor dword [esp + edi + 0x1c], eax
lea ebx, [ebp*8]
mov ecx, ebx
and cl, 0x18
or cl, 7
mov eax, 1
shl eax, cl
mov ecx, ebp
and ecx, 0x3c
xor dword [esp + ecx + 0x1c], eax
mov esi, dword [esp + 0x78]
mov eax, ebp
not eax
test al, 0x38
jne 0x4342a5
lea edi, [esp + 0x1c]
lea eax, [esp + 4]
push edi
push eax
call fcn.00437340
add esp, 8
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
lea edi, [esp + 0x5c]
xor eax, eax
xor ecx, ecx
rep stosw word es:[edi], ax
mov dword [esp + 0x54], ebx
shr ebp, 0x1d
mov dword [esp + 0x58], ebp
lea eax, [esp + 0x1c]
lea ecx, [esp + 4]
push eax
push ecx
call fcn.00437340
add esp, 8
mov eax, dword [esp + 4]
mov dword [esi], eax
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov eax, dword [esp + 0xc]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x10]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x10], eax
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x435010
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
push edi
push esi
mov edx, 0xfffffffe
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
cmp word [ecx + edx + 2], 0
lea edx, [edx + 2]
jne 0x435020
test edx, edx
je 0x43509a
sar edx, 1
lea esi, [edx - 1]
mov edi, edx
and edi, 3
je 0x435052
nop
nop
nop
nop
nop
dec edx
movzx ebx, word [ecx]
add ecx, 2
xor ebx, eax
imul eax, ebx, 0x1000193
dec edi
jne 0x435040
cmp esi, 3
jb 0x43509a
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
movzx edi, word [ecx + esi*2]
xor edi, eax
imul eax, edi, 0x1000193
movzx edi, word [ecx + esi*2 + 2]
xor edi, eax
imul eax, edi, 0x1000193
movzx edi, word [ecx + esi*2 + 4]
xor edi, eax
imul eax, edi, 0x1000193
movzx edi, word [ecx + esi*2 + 6]
xor edi, eax
imul eax, edi, 0x1000193
add esi, 4
cmp edx, esi
jne 0x435060
pop esi
pop edi
pop ebx
ret
Function at 0x43a590
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x268
push dword [0x450648]
call fcn.0043afe0
add esp, 4
movzx eax, al
jmp dword [eax*4 + 0x446944]
Function at 0x43bbf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov ecx, dword [ebp + 8]
mov dword [esp + 8], 0x2b242556
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 8
ja 0x43bc84
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov eax, dword [esp]
movzx esi, byte [esp + eax + 8]
mov edi, 0x539a5fa
sub edi, edx
lea eax, [edx + esi]
add eax, 0xfac65a05
lea ebx, [edx + 5]
and ebx, esi
or edi, esi
add edi, edx
lea edx, [ebx + edi]
add edx, 0xfac65a06
mov esi, edx
xor esi, eax
not edx
and edx, eax
add edx, edx
sub edx, esi
mov dword [esp + 4], edx
mov eax, dword [esp + 4]
add al, 0xdd
mov edx, dword [esp]
mov byte [esp + edx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 9
jb 0x43bc30
mov eax, dword [esp + 8]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x447118]
mov edx, dword [eax + 0xc]
add edx, 0xc
xor eax, eax
mov esi, dword [0x447144]
mov edi, dword [edx]
xor ebx, ebx
cmp edi, edx
setne bl
jmp dword [ebx*4 + 0x447120]
xor ebx, ebx
cmp dword [edi + 0x18], ecx
sete bl
jmp dword [ebx*4 + 0x447128]
mov ebx, 1
jmp dword [ebx*4 + 0x447130]
mov eax, dword [edi + 0x28]
xor ebx, ebx
jmp dword [ebx*4 + 0x447130]
jmp esi
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
mov ecx, dword [0x447150]
nop
nop
jmp ecx
Function at 0x401570
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp dword [ebp + 8], 0
jne 0x401597
mov dword [0x404004], 0
mov dword [esp], str.c:_nmap_log.txt
mov eax, dword [sym.imp.KERNEL32.dll_DeleteFileA]
call eax
sub esp, 4
mov eax, dword [0x404004]
test eax, eax
je 0x401601
mov dword [esp + 8], 0x405034
mov dword [esp + 4], str.c:_nmap_log.txt
lea eax, [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll_fopen_s]
call eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x401601
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], edx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym.unk_85
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sym._fputc
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._fclose
nop
leave
ret
Function at 0x402450
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym.unk_85
call sym._abort
jmp sym.unk_36

Function at 0x4024b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x4063a0]
test esi, esi
jle 0x40259d
mov edi, dword [0x4063a4]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x4024e4
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x402596
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x4024d0
mov dword [esp], eax
mov esi, eax
call sym.unk_47
test eax, eax
mov edi, eax
je 0x4025da
mov esi, dword [0x4063a4]
lea ebx, [ebx + ebx*2]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call sym.unk_50
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x4063a4]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x4025ba
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x40258f
sub eax, 0x40
and eax, 0xffffffbf
je 0x40258f
mov eax, dword [esp + 0x20]
add ebx, dword [0x4063a4]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x4025a4
add dword [0x4063a0], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor ebx, ebx
jmp 0x4024ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call sym.unk_35
mov eax, dword [0x4063a4]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call sym.unk_35
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call sym.unk_35
lea esi, [esi]

Function at 0x402a70
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4063b8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4063b0]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x402ac5
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x402abe
test esi, esi
je 0x402abe
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402aa0
mov dword [esp], 0x4063b8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x1003f37
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x10043e8
call fcn.01004114
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x100690c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1003d4c
cmp eax, esi
jne 0x1003d3f
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x1003d4f
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1003d26
xor esi, esi
inc esi
mov eax, dword [0x1006908]
cmp eax, esi
jne 0x1003d62
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1003d9d
mov eax, dword [0x1006908]
test eax, eax
jne 0x1003d97
mov dword [0x1006908], esi
push 0x1001178
push 0x100116c
call fcn.01003ca3
pop ecx
pop ecx
test eax, eax
je 0x1003d9d
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x1003e67
mov dword [0x10052b8], esi
mov eax, dword [0x1006908]
cmp eax, esi
jne 0x1003dc1
push 0x1001168
push 0x1001160
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1006908], 2
cmp dword [ebp - 0x1c], ebx
jne 0x1003dce
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1006910], ebx
je 0x1003def
push 0x1006910
call fcn.01004089
pop ecx
test eax, eax
je 0x1003def
push ebx
push 2
push ebx
call dword [0x1006910]
push dword [0x10052a0]
push dword [0x10052a4]
push dword [0x100529c]
call fcn.01001d54
add esp, 0xc
mov dword [0x10052b4], eax
cmp dword [0x10052a8], ebx
jne 0x1003e4d
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x10052b8], ebx
jne 0x1003e5b
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x10052b4]
call fcn.01004159
ret
call fcn.01004261
jmp 0x1003d04

Function at 0x402a30
Capabilities:
Terminate process

Disassembly:
jmp 0x402a35
jmp fcn.00402a3a
Function at 0x6bb138
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0
jmp 0x6bb18c
pop word [esp]
jmp 0x6bb15e
pushal
mov dword [esp + 0xb], ebx
lea esp, [esp + 2]
mov dword [esp + 0x30], edi
lea esp, [esp + 0x30]
jmp 0x6bb186
pushfd
jmp 0x6bb005
neg si
jmp 0x6bb1e0
sub esp, 0xf
mov byte [esp + 2], al
rdtsc
lea esp, [esp + 3]
jmp 0x6bb437
je 0x6bb195
sub esp, 0xf
mov byte [esp + 2], al
jmp 0x6bb1ca