joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410e10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x413560
lea ecx, [ebp - 0x18]
mov edx, dword fs:[0]
cmp eax, 3
mov dword [ebp - 0x18], edx
mov dword fs:[0], ecx
je 0x410e4e
test eax, eax
jne 0x410fca
mov ebx, dword [0x42b184]
test ebx, ebx
je 0x410fca
mov dword [ebp - 0x20], 0
jmp 0x410e77
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x410ea8
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x41101b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x410e70
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x410e70
test byte [ebp - 0x20], 1
je 0x410fca
mov ebx, dword [0x42b184]
test ebx, ebx
je 0x410fca
mov dword [ebp - 0x20], 0
jmp 0x410ed7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x410f08
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x41101b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x410ed0
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x410ed0
test byte [ebp - 0x20], 1
je 0x410fca
mov ebx, dword [0x42b184]
test ebx, ebx
je 0x410fca
mov dword [ebp - 0x20], 0
jmp 0x410f37
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x410f68
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x41101b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x410f30
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x410f30
test byte [ebp - 0x20], 1
je 0x410fca
mov ebx, dword [0x42b184]
test ebx, ebx
je 0x410fca
mov dword [ebp - 0x20], 0
jmp 0x410f97
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x410fc4
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x41101b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x410f90
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x410f90
test byte [ebp - 0x20], 1
jne 0x410fe4
movzx eax, byte [0x427a40]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov ebx, dword [0x42b184]
jmp 0x410fef
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x410fca
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x41101b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x410fec
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
jmp 0x410fec
mov dword [ebp - 0x10], 0
push 0x425118
push 0x2b
push 0x423490
call fcn.004220e0
add esp, 0xc
ud2
Function at 0x412040
Capabilities:
Resolve dns

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1b4
mov eax, dword [esp + 0x1cc]
mov esi, dword [esp + 0x1c8]
mov edi, dword [eax]
mov ebp, dword [eax + 4]
movzx ebx, word [eax + 8]
mov eax, dword [0x42b17c]
cmp eax, 3
jne 0x41212b
cmp ebp, 0x17f
ja 0x41213c
mov dword [esp + 4], ebx
lea ebx, [esp + 0x34]
push ebp
push edi
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov byte [esp + ebp + 0x34], 0
inc ebp
lea eax, [esp + 8]
push ebp
push ebx
push eax
call fcn.0041b610
add esp, 0xc
cmp dword [esp + 8], 0
je 0x4120c6
mov eax, dword [0x424290]
mov ecx, dword [0x424294]
mov dword [esi + 8], ecx
mov dword [esi + 4], eax
mov dword [esi], 1
jmp 0x41214a
mov eax, dword [esp + 0xc]
xorps xmm0, xmm0
mov ecx, esp
mov dword [esp], 0
lea edx, [esp + 0x14]
movups xmmword [esp + 0x14], xmm0
movups xmmword [esp + 0x24], xmm0
mov dword [esp + 0x1c], 1
push ecx
push edx
push 0
push eax
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x412114
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 1
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov dword [esi], ecx
jmp 0x41214a
mov eax, dword [esp]
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov eax, dword [esp + 4]
mov word [esi + 0xc], ax
xor eax, eax
mov dword [esi], eax
jmp 0x41214a
call fcn.00421690
cmp ebp, 0x17f
jbe 0x41207b
mov ecx, esi
mov edx, edi
push ebx
push ebp
call fcn.00421730
add esp, 8
mov eax, esi
add esp, 0x1b4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x412c50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x42b038]
mov esi, ecx
test eax, eax
je 0x412c76
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x412c8f
cmp dword [eax + 4], 0
je 0x412c8f
add eax, 8
pop esi
pop edi
ret
push 0x42b038
call fcn.00421910
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
ja 0x412c6a
mov eax, dword [0x42b038]
test eax, eax
je 0x412d26
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x412d43
mov edi, eax
test eax, eax
jne 0x412cef
movzx eax, byte [0x42b0f9]
push 4
push 0x10
call fcn.00403410
add esp, 8
test eax, eax
je 0x412d57
mov dword [eax], 0x42b038
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x42b038]
test eax, eax
je 0x412d48
dec eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
je 0x412d0f
mov eax, dword [esi]
xor ecx, ecx
mov edx, 0
mov dword [esi], 0
cmp eax, 1
jne 0x412d13
mov ecx, dword [esi + 4]
mov edx, dword [esi + 8]
jmp 0x412d13
xor ecx, ecx
xor edx, edx
mov dword [edi + 4], 1
mov dword [edi + 8], ecx
lea eax, [edi + 8]
mov byte [edi + 0xc], dl
pop esi
pop edi
ret
push 0x42b038
call fcn.00421910
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x412cad
xor eax, eax
pop esi
pop edi
ret
push 0x42b038
call fcn.00421910
add esp, 4
jmp 0x412ce7
push 0x10
push 4
call fcn.00421fa0
add esp, 8
ud2
Function at 0x412d70
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4135f0
mov esi, ecx
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [0x42b048]
test eax, eax
je 0x412dc5
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x412dde
cmp dword [eax + 4], 0
mov ebx, eax
je 0x412dde
add ebx, 8
jmp 0x412ea8
push 0x42b048
call fcn.00421910
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
ja 0x412db5
mov eax, dword [0x42b048]
test eax, eax
je 0x412e89
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x412ea6
mov edi, eax
test eax, eax
jne 0x412e42
movzx eax, byte [0x42b0f9]
push 4
push 0x10
call fcn.00403410
add esp, 8
test eax, eax
je 0x412ecd
mov dword [eax], 0x42b048
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x42b048]
test eax, eax
je 0x412ebb
dec eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
je 0x412e5c
mov eax, dword [esi]
mov dword [esi], 0
test eax, eax
mov edx, eax
je 0x412e60
mov eax, dword [esi + 4]
mov edx, dword [esi + 8]
jmp 0x412e60
xor eax, eax
xor edx, edx
mov ecx, dword [edi + 0xc]
cmp dword [edi + 4], 0
lea ebx, [edi + 8]
mov dword [edi + 4], 1
mov dword [edi + 8], eax
mov dword [edi + 0xc], edx
je 0x412ea8
test ecx, ecx
je 0x412ea8
lock dec dword [ecx]
jne 0x412ea8
call fcn.00404f80
jmp 0x412ea8
push 0x42b048
call fcn.00421910
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x412dfc
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x42b048
call fcn.00421910
add esp, 4
jmp 0x412e3a
mov dword [ebp - 0x10], 0
push 0x10
push 4
call fcn.00421fa0
add esp, 8
ud2
Function at 0x412f10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x42b058]
mov esi, ecx
test eax, eax
je 0x412f36
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x412f4f
cmp byte [eax + 4], 0
je 0x412f4f
add eax, 5
pop esi
pop edi
ret
push 0x42b058
call fcn.00421910
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
ja 0x412f2a
mov eax, dword [0x42b058]
test eax, eax
je 0x412fc2
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x412fdb
mov edi, eax
test eax, eax
jne 0x412fa0
movzx eax, byte [0x42b0f9]
push 4
push 8
call fcn.00403410
add esp, 8
test eax, eax
je 0x412fef
mov dword [eax], 0x42b058
mov byte [eax + 4], 0
mov edi, eax
mov eax, dword [0x42b058]
test eax, eax
je 0x412fe0
dec eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test esi, esi
je 0x412fb5
cmp byte [esi], 0
mov byte [esi], 0
movzx eax, byte [esi + 1]
cmove eax, ecx
mov ecx, eax
mov byte [edi + 4], 1
lea eax, [edi + 5]
mov byte [edi + 5], cl
pop esi
pop edi
ret
push 0x42b058
call fcn.00421910
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x412f65
xor eax, eax
pop esi
pop edi
ret
push 0x42b058
call fcn.00421910
add esp, 4
jmp 0x412f98
push 8
push 4
call fcn.00421fa0
add esp, 8
ud2
Function at 0x413000
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x413600
mov esi, ecx
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [0x42b068]
test eax, eax
je 0x413055
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x41306e
cmp dword [eax + 4], 0
mov ebx, eax
je 0x41306e
add ebx, 8
jmp 0x41312a
push 0x42b068
call fcn.00421910
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
ja 0x413045
mov eax, dword [0x42b068]
test eax, eax
je 0x41310b
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x413128
mov edi, eax
test eax, eax
jne 0x4130ce
movzx eax, byte [0x42b0f9]
push 4
push 0xc
call fcn.00403410
add esp, 8
test eax, eax
je 0x41314f
mov dword [eax], 0x42b068
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x42b068]
test eax, eax
je 0x41313d
dec eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
je 0x4130e3
mov eax, dword [esi]
mov dword [esi], 0
test eax, eax
je 0x4130e5
mov eax, dword [esi + 4]
jmp 0x4130e5
xor eax, eax
mov ecx, dword [edi + 8]
cmp dword [edi + 4], 0
lea ebx, [edi + 8]
mov dword [edi + 4], 1
mov dword [edi + 8], eax
je 0x41312a
test ecx, ecx
je 0x41312a
lock dec dword [ecx]
jne 0x41312a
call fcn.00404fe0
jmp 0x41312a
push 0x42b068
call fcn.00421910
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x41308c
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x42b068
call fcn.00421910
add esp, 4
jmp 0x4130c6
mov dword [ebp - 0x10], 0
push 0xc
push 4
call fcn.00421fa0
add esp, 8
ud2
Function at 0x41f270
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x41f2c8
mov esi, dword [esp + 0x18]
lea edi, [edx + eax*2]
xor ebx, ebx
movzx eax, byte [edx + 1]
cmp byte [edx], ch
lea edx, [edx + 2]
lea ebp, [ebx + eax]
jne 0x41f2c0
cmp ebp, ebx
jb 0x41f342
cmp ebp, dword [esp + 0x1c]
ja 0x41f353
add ebx, esi
nop word [eax + eax]
test eax, eax
je 0x41f2c2
dec eax
cmp byte [ebx], cl
lea ebx, [ebx + 1]
jne 0x41f2b0
jmp 0x41f31f
ja 0x41f2c8
cmp edx, edi
mov ebx, ebp
jne 0x41f285
mov edx, dword [esp + 0x24]
test edx, edx
je 0x41f323
mov esi, dword [esp + 0x20]
movzx ecx, cx
mov al, 1
add edx, esi
nop dword [eax + eax]
movzx ebx, byte [esi]
lea edi, [esi + 1]
test bl, bl
js 0x41f300
mov esi, edi
sub ecx, ebx
jns 0x41f317
jmp 0x41f325
cmp edi, edx
je 0x41f32c
movzx edi, byte [esi + 1]
and ebx, 0x7f
add esi, 2
shl ebx, 8
or ebx, edi
sub ecx, ebx
js 0x41f325
xor al, 1
cmp esi, edx
jne 0x41f2e0
jmp 0x41f325
xor eax, eax
jmp 0x41f325
mov al, 1
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x426dc4
push 0x2b
push str.called__Option::unwrap____on_a__None__valuefrom_str_radix_int:_must_lie_in_the_range___2__36_____found
call fcn.004220e0
add esp, 0xc
ud2
push 0x426db4
push ebp
push ebx
call fcn.004224e0
add esp, 0xc
ud2
push 0x426db4
push dword [esp + 0x20]
push ebp
call fcn.00422470
add esp, 0xc
ud2

Function at 0x420ca7
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x420ce6
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x420ce6
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x420ce6
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x420ce6
cmp dword [ecx + 0x74], 0xe
jbe 0x420ce6
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x421730
Capabilities:
Resolve dns

Disassembly:
push ebx
push edi
push esi
sub esp, 0x34
mov esi, ecx
lea eax, [esp + 4]
push dword [esp + 0x44]
push edx
push eax
call fcn.0041a4c0
add esp, 0xc
mov eax, dword [esp + 4]
test eax, eax
je 0x421782
mov ecx, dword [0x424290]
mov edx, dword [0x424294]
mov dword [esi + 4], ecx
mov ecx, dword [esp + 8]
mov dword [esi + 8], edx
mov dword [esi], 1
test ecx, ecx
je 0x4217e5
push 1
push ecx
push eax
call fcn.00403420
add esp, 0x40
pop esi
pop edi
pop ebx
ret
mov edi, dword [esp + 8]
mov ebx, dword [esp + 0xc]
xorps xmm0, xmm0
mov eax, esp
mov dword [esp], 0
lea ecx, [esp + 0x14]
movups xmmword [esp + 0x14], xmm0
movups xmmword [esp + 0x24], xmm0
mov dword [esp + 0x1c], 1
push eax
push ecx
push 0
push edi
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x4217ec
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov eax, 1
test ebx, ebx
mov dword [esi], eax
mov byte [edi], 0
je 0x4217e5
push 1
push ebx
push edi
call fcn.00403420
add esp, 0xc
add esp, 0x34
pop esi
pop edi
pop ebx
ret
mov ecx, dword [esp]
movzx eax, word [esp + 0x48]
mov dword [esi + 4], ecx
mov dword [esi + 8], ecx
mov word [esi + 0xc], ax
xor eax, eax
test ebx, ebx
mov dword [esi], eax
mov byte [edi], 0
jne 0x4217d9
jmp 0x4217e5
Function at 0x421910
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x30]
cmp dword [edi + 4], 0
je 0x42198a
lea ebx, [edi + 0xc]
mov dword [esp + 4], 0
lea eax, [esp + 4]
push 0
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_InitOnceBeginInitialize]
cmp eax, 1
mov dword [esp], eax
jne 0x4219c5
cmp dword [esp + 4], 0
je 0x4219ac
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x4219e8
mov esi, eax
inc eax
mov dword [edi], eax
mov eax, dword [0x42b184]
nop word [eax + eax]
mov dword [edi + 8], eax
lock cmpxchg dword [0x42b184], edi
jne 0x421970
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_InitOnceComplete]
jmp 0x4219bc
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esp], eax
je 0x421a2f
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [edi], ecx
jne 0x4219b0
mov esi, dword [esp]
jmp 0x4219bc
mov esi, dword [edi]
jmp 0x4219bb
mov esi, eax
push dword [esp]
call dword [sym.imp.KERNEL32.dll_TlsFree]
dec esi
mov eax, esi
add esp, 0x20
pop esi
pop edi
pop ebx
ret
mov dword [esp + 8], 0
lea eax, [esp + 8]
mov ecx, esp
mov edx, 0x425094
push 0x4250c8
push eax
call fcn.00421290
add esp, 8
ud2
push 0
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_InitOnceComplete]
mov dword [esp + 8], 0x4250ec
mov dword [esp + 0xc], 1
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], 0x4234c0
mov dword [esp + 0x14], 0
lea eax, [esp + 8]
push 0x4250f4
push eax
call fcn.00422020
add esp, 8
ud2
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0x4250ec
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 0x4234c0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.004212f0
ud2
Function at 0x422200
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
push esi
sub esp, 0x68
movzx eax, byte [esp + 0x78]
mov esi, dword [esp + 0x84]
mov ebx, dword [esp + 0x7c]
mov ecx, dword [esp + 0x8c]
mov edx, dword [esp + 0x88]
mov edi, dword [esp + 0x80]
test eax, eax
mov dword [esp + 8], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edi
mov dword [esp + 0x14], edx
je 0x422251
cmp eax, 1
jne 0x4222c8
mov dword [esp], 0x4267e9
jmp 0x422258
mov dword [esp], 0x4267eb
mov edx, 2
mov eax, dword [esp + 0x90]
cmp dword [ecx], 0
mov dword [esp + 4], edx
jne 0x4222e4
mov ecx, esp
lea edx, [esp + 8]
lea esi, [esp + 0x10]
mov dword [esp + 0x38], 0x42684c
mov dword [esp + 0x3c], 4
mov dword [esp + 0x48], 0
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], 0x4202b0
mov dword [esp + 0x20], edx
lea edx, [esp + 0x18]
mov dword [esp + 0x24], 0x420230
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 0x420230
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], 3
jmp 0x42236a
mov edx, 7
mov dword [esp], 0x4267e2
mov eax, dword [esp + 0x90]
cmp dword [ecx], 0
mov dword [esp + 4], edx
je 0x42226d
movsd xmm0, qword [ecx + 0x10]
movsd xmm2, qword [ecx]
movsd xmm1, qword [ecx + 8]
mov edx, esp
lea esi, [esp + 8]
mov dword [esp + 0x38], 0x426828
mov dword [esp + 0x3c], 4
mov dword [esp + 0x48], 0
mov dword [esp + 0x18], edx
lea edx, [esp + 0x10]
mov dword [esp + 0x1c], 0x4202b0
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], 0x420230
lea esi, [esp + 0x50]
mov dword [esp + 0x28], edx
lea edx, [esp + 0x18]
mov dword [esp + 0x2c], 0x420230
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 0x41ce70
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], 4
movsd qword [esp + 0x60], xmm0
movsd qword [esp + 0x58], xmm1
movsd qword [esp + 0x50], xmm2
lea ecx, [esp + 0x38]
push eax
push ecx
call fcn.00422020
add esp, 8
ud2
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x438c98
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov esi, 0x438a14
add edi, 0xbeb7b33a
call fcn.00438cc0
sub edi, ebx
xor dword [ecx], esi
dec edi
mov ebx, ebx
and edi, ebx
inc ecx
mov edi, 0x343d187b
cmp ecx, eax
jne fcn.00438c98
mov ebx, ebx
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x431072
mov ebx, 0x40915c
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x17941017
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x431060
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4310d2
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x3fa729b9
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x40171a
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x7c
mov dword [ebp - 0x54], sym.___gxx_personality_sj0
mov dword [ebp - 0x50], 0x487cda
lea eax, [ebp - 0x4c]
lea ebx, [ebp - 0x18]
mov dword [eax], ebx
mov edx, 0x401873
mov dword [eax + 4], edx
mov dword [eax + 8], esp
lea eax, [ebp - 0x6c]
mov dword [esp], eax
call dbg._Unwind_SjLj_Register
mov eax, dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 0x68], 0xffffffff
call eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.show
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
mov eax, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
call eax
mov edx, eax
lea eax, [ebp - 0x34]
mov dword [esp + 4], eax
mov dword [esp], edx
mov eax, dword [sym.imp.SHELL32.DLL_CommandLineToArgvW]
call eax
sub esp, 8
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x4017c7
mov dword [esp + 4], 4
mov dword [esp], 0
call sym._calloc
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
jmp 0x401859
mov dword [ebp - 0x1c], 0
jmp 0x40184a
mov eax, dword [ebp - 0x1c]
lea edx, [eax*4]
mov eax, dword [ebp - 0x28]
add eax, edx
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x29]
mov ecx, eax
call fcn.00449ec0
mov eax, dword [ebp - 0x1c]
lea edx, [eax*4]
mov eax, dword [ebp - 0x20]
add eax, edx
mov edx, dword [eax]
lea eax, [ebp - 0x30]
lea ecx, [ebp - 0x29]
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [ebp - 0x68], 1
mov ecx, eax
call method.std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___.basic_string_wchar_t_const__std::allocator_wchar_t__const_
sub esp, 8
lea eax, [ebp - 0x30]
mov dword [esp], eax
mov dword [ebp - 0x68], 2
call sym.wstringToChar_std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t____
mov esi, dword [ebp - 0x70]
mov dword [esi], eax
lea eax, [ebp - 0x30]
mov ecx, eax
call fcn.0044c440
lea eax, [ebp - 0x29]
mov ecx, eax
call sym.std::allocator_wchar_t_::allocator__
add dword [ebp - 0x1c], 1
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x1c], eax
jl 0x4017d0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x70], eax
jmp 0x4018ab
lea eax, [ebp - 0x6c]
mov dword [esp], eax
call sym.__Unwind_SjLj_Unregister
mov eax, dword [ebp - 0x70]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret