joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409675
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004067d5
and dword [ebp - 4], 0
cmp dword [0x429400], 0
mov ebx, eax
jne 0x409726
push 0x401b58
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4097d7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401b4c
push edi
call esi
test eax, eax
je 0x4097d7
push eax
call fcn.00406763
mov dword [esp], 0x401b3c
push edi
mov dword [0x429400], eax
call esi
push eax
call fcn.00406763
mov dword [esp], 0x401b28
push edi
mov dword [0x429404], eax
call esi
push eax
call fcn.00406763
mov dword [esp], 0x401b0c
push edi
mov dword [0x429408], eax
call esi
push eax
call fcn.00406763
pop ecx
mov dword [0x429410], eax
test eax, eax
je 0x409726
push 0x401af4
push edi
call esi
push eax
call fcn.00406763
pop ecx
mov dword [0x42940c], eax
mov eax, dword [0x42940c]
cmp eax, ebx
je 0x40977e
cmp dword [0x429410], ebx
je 0x40977e
push eax
call fcn.004067de
push dword [0x429410]
mov esi, eax
call fcn.004067de
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40977e
test edi, edi
je 0x40977e
call esi
test eax, eax
je 0x409775
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409775
test byte [ebp - 0xc], 1
jne 0x40977e
or dword [ebp + 0x10], 0x200000
jmp 0x4097b7
mov eax, dword [0x429404]
cmp eax, ebx
je 0x4097b7
push eax
call fcn.004067de
pop ecx
test eax, eax
je 0x4097b7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4097b7
mov eax, dword [0x429408]
cmp eax, ebx
je 0x4097b7
push eax
call fcn.004067de
pop ecx
test eax, eax
je 0x4097b7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x429400]
call fcn.004067de
pop ecx
test eax, eax
je 0x4097d7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4097d9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4012ba
Capabilities:
Hide graphical window

Disassembly:
push ebp
push 0x10000
push 0x1000
push 1
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [0x404014], eax
push 0x64
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, 0x30
push eax
mov dword [eax], ecx
add eax, 0x4c
mov ebp, eax
mov eax, 0x400000
mov dword [0x404010], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x44], 0x401198
mov dword [ebp - 0x24], str.resiliency
call dword [sym.imp.USER32.dll_RegisterClassExA]
xor eax, eax
push eax
push dword [0x404010]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.abasement
push str.resiliency
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x404018], eax
push eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401384
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x40136b
mov eax, dword [0x404014]
push eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
pop ebp
ret 0x10
Function at 0x406de0
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80
push eax
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_SetWindowLongA
push 5
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x40226a
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push edi
mov byte [ebp - 0x104], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 4], 0
mov eax, 0x4021d6
sub eax, 0x401cf5
mov dword [ebp - 4], eax
push 8
push 0x408008
lea ecx, [ebp - 0x104]
push ecx
call fcn.00406350
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
push 0x401cf5
lea eax, [ebp - 0x104]
push eax
call fcn.00406464
add esp, 0xc
push 0x100
push 0
lea ecx, [ebp - 0x104]
push ecx
call fcn.00406890
add esp, 0xc
call fcn.00401d3d
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x406464
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
jmp 0x40648a
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp + 0x10]
jge 0x40654c
mov edx, dword [ebp - 0xc]
add edx, 1
and edx, 0x800000ff
jns 0x4064ac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
xor ecx, ecx
mov cl, byte [eax]
mov edx, dword [ebp - 0x10]
add edx, ecx
and edx, 0x800000ff
jns 0x4064ce
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
mov cl, byte [eax]
mov byte [ebp - 4], cl
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x10]
mov cl, byte [eax]
mov byte [edx], cl
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x10]
mov al, byte [ebp - 4]
mov byte [edx], al
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x10]
xor ecx, ecx
mov cl, byte [eax]
add edx, ecx
and edx, 0x800000ff
jns 0x40651d
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
mov al, byte [edx]
mov byte [ebp - 4], al
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x14]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp - 4]
and eax, 0xff
xor edx, eax
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x14]
mov byte [ecx], dl
jmp 0x406481
mov esp, ebp
pop ebp
ret

Function at 0x4022e0
Capabilities:
Terminate process

Disassembly:
mov edx, eax
push dword [0x40374f]
call dword [sym.imp.pdh.dll_PdhCloseQuery]
mov eax, 5
add eax, 5
inc eax
xor edi, edi
xor esi, esi
test eax, 0xb
jne 0x40230e
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]
mov edx, eax
mov dword [0x401775], eax
ret
Function at 0x401450
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
push dword [esp + 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x40147a
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x14]
test eax, eax
mov dword [ecx], eax
jne 0x40147e
xor eax, eax
pop esi
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x10]
push 1
mov dword [ecx], eax
pop eax
pop esi
ret

Function at 0x401499
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push edi
xor edi, edi
push edi
push 1
push edi
lea eax, [ebp - 4]
push edi
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x4014da
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x4014ed
push 8
push 1
push edi
lea eax, [ebp - 4]
push edi
push eax
call esi
test eax, eax
je 0x4014ed
lea eax, [ebp - 8]
push eax
push 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x4014f1
xor eax, eax
jmp 0x401503
cmp dword [ebp - 4], edi
je 0x401500
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret

Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret
Function at 0x4028a2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x4028b1
pop dword [ebp - 0x30]
mov eax, 0xbecd6bc1
add eax, 0x4172bcf0
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x1c2e4e8d
sub dword [ebp - 0x40], 0xcddc0942
mov dword [ebp - 0x3c], 0x56329689
sub dword [ebp - 0x3c], 0x23ff4a44
mov dword [ebp - 0x38], 0xed9fa962
add dword [ebp - 0x38], 0x5eac9acc
mov dword [ebp - 0x34], 0xa8b7bd05
add dword [ebp - 0x34], 0x574842fb
lea eax, [ebp - 0x40]
push eax
mov eax, 0xf3eb9010
add eax, 0xc54e00c
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x3ab5cac
sub dword [ebp - 0x40], 0x8f38f356
mov dword [ebp - 0x3c], 0x5d340239
add dword [ebp - 0x3c], 0xe4385f3c
mov dword [ebp - 0x38], 0xddc77231
add dword [ebp - 0x38], 0x85a7fa3b
mov dword [ebp - 0x34], 0xf8474e19
sub dword [ebp - 0x34], 0xf8474e19
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3e04c
push 0
call eax
mov ecx, 0x1aac9c7
add ecx, 0xfe55976f
mov edx, eax
mov esi, 0x40c800
add esi, dword [ebp - 0x30]
mov ebx, 0x3269c37e
add ebx, 0x548cfb24
xor dword [ebp - 0x1c], esi
mov edi, dword [esi]
add edi, ebx
add dword [ebp - 0x24], ebx
mov dword [edx], edi
add dword [ebp - 0x14], 0x52428abd
add edx, 4
add esi, 0xde6bfc10
sub esi, 0xde6bfc0c
loop 0x4029c8
add eax, 0xac2e2566
sub eax, 0xac2cadbb
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x76a8c526
sub ecx, 0x7668c526
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x4045aa
Capabilities:
Check if file exists

Disassembly:
push 0x1c
mov eax, 0x4068f8
call fcn.0040545b
cmp dword [0x40a010], 0
mov esi, dword [ebp + 8]
jne 0x4045c9
mov al, 1
jmp 0x404692
test esi, esi
je 0x404690
xor ebx, ebx
cmp word [esi], bx
je 0x404690
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x404690
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x404690
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.004028a2
pop ecx
pop ecx
mov esi, dword [0x40a010]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x404684
lea eax, [ebp - 0x28]
push eax
call fcn.004028a2
pop ecx
test al, al
jne 0x404684
cmp dword [ebp - 0x18], esi
jbe 0x404684
cmp dword [0x40a014], 8
lea eax, [ebp - 0x28]
mov ecx, section..data
cmovae ecx, dword [section..data]
cmp dword [ebp - 0x14], 8
push esi
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x404684
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test eax, eax
je 0x404684
push 0x407628
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
xor edx, edx
movzx ebx, bl
inc edx
test eax, eax
pop ecx
pop ecx
cmovne ebx, edx
lea ecx, [ebp - 0x28]
call fcn.00401780
mov al, bl
jmp 0x404692
xor al, al
call fcn.00405416
ret
Function at 0x401750
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ch, 0x45
mov ecx, dword cs:[0xfec0c8]
push eax
add ecx, 0xffffff8a
push 0x40d274
push ecx
call dword [sym.imp.MSVCRT.dll_fprintf]
and al, bh
add al, byte [ecx]
add esp, 0x47
test eax, eax
add dword [edi], ecx
push eax
push 0x40d209
jnp 0x401795
inc edx
inc eax
add byte [ebx + 0x16a08c4], al
call dword [sym.imp.MSVCRT.dll_exit]
nop
push ebp
mov ebp, esp
sub esp, 0xb8
jb 0x401813
mov eax, 0x72000000
js 0x40179e
add al, byte [ecx]
inc ecx
add byte [ebp + 0x404ca1f9], al
inc ecx
add byte [esp + edx - 0x1d], dh
inc eax
test ecx, edi
mov eax, dword [0x41404c]
je 0x4017bb
jecxz 0x4017e9
or al, byte [ecx]
push eax
adc bl, byte [esi + 0x66a80087]
mov esp, 0x4102740d
add bl, ch
adc al, 0x8b
adc eax, 0x411800
jmp 0x4017cf
mov edx, dword [0x411800]
dec ebp
push eax
call fcn.00405850
or ax, 0x17f4
inc ecx
add byte [ebx + 0x411808], ah
mov dword [0x411808], eax
mov eax, dword [0x336b88]
std
push esi
mov edi, dword [eax - 0x31bf3e9c]
fisttp qword [ecx + 0x410bbd0d]
add byte [ebp + 0x107557c0], al
rcl byte [edi + 0x75], 0x10
mov ebp, dword [edx + 0x411800]
push edx
push 0x402a98
call esi
mov eax, dword [0xc8410278]
add esp, 8
test eax, eax
je 0x401803
int1
je 0x40180c
inc ecx
add byte [eax + 0x68], dl
inc eax
cmp al, 0x41
in eax, dx
push eax
push 0xed413c40
push 0xdf4784
call esi
test byte [edi - 0x21], al
add bh, bh
salc
add dword [esi + 0xc], 0xffffffa1
adc al, 0xd0
test al, 0x14
xor dword [ebx + 0x7dd4ddb8], 0xb80a7500
jl 0x4017b9
add dword [eax], 0x50
push 0xdd40d464
int1
salc
mov ecx, dword [sym.imp.MSVCRT.dll__iob]
or dword [ebx], 0xffffffde
push ecx
mov ebx, 0x40c1547c
add byte [ebx + 0x158b0cc4], al
sbb al, dl
inc eax
add byte [ebx + 0x40c15835], cl
add byte [eax + 0x60], ch
or byte [eax], al
add byte [edx - 1], dl
salc
mov dword [0x410bb0], eax
mov eax, dword [0x40d005]
push 0x20
iretd
Function at 0x408b40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor edi, edi
mov esi, dword [edx + 0x28]
movzx ecx, word [edx + 0x26]
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x408b46
sub al, 0x20
ror edi, 0xd
add edi, eax
dec ecx
jne 0x408b3d
push edx
mov edx, dword [edx + 0x10]
mov eax, dword [edx + 0x3c]
push edi
add eax, edx
mov eax, dword [eax + 0x78]
test eax, eax
je 0x408bab
add eax, edx
push eax
mov ebx, dword [eax + 0x20]
add ebx, edx
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x408baa
dec ecx
xor edi, edi
mov esi, dword [ebx + ecx*4]
add esi, edx
xor eax, eax
ror edi, 0xd
lodsb al, byte [esi]
add edi, eax
cmp al, ah
jne 0x408b76
add edi, dword [ebp - 8]
cmp edi, dword [ebp + 0x24]
jne 0x408b6a
pop eax
mov ebx, dword [eax + 0x24]
add ebx, edx
mov cx, word [ebx + ecx*2]
mov ebx, dword [eax + 0x1c]
add ebx, edx
mov eax, dword [ebx + ecx*4]
add eax, edx
mov dword [esp + 0x24], eax
pop ebx
pop ebx
popal
pop ecx
pop edx
push ecx
jmp eax
pop eax
pop edi
pop edx
mov edx, dword [edx]
jmp 0x408b34
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x416666
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x416675
pop dword [ebp - 0x38]
mov eax, 0x6c46bb22
sub eax, 0x6c0554ad
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xb6531ca1
sub dword [ebp - 0x48], 0x6800d756
mov dword [ebp - 0x44], 0x15684adc
sub dword [ebp - 0x44], 0xe334fe97
mov dword [ebp - 0x40], 0x2cf2a78
sub dword [ebp - 0x40], 0xb682e64a
mov dword [ebp - 0x3c], 0xa46965d4
sub dword [ebp - 0x3c], 0xa46965d4
lea eax, [ebp - 0x48]
push eax
mov eax, 0xd3e8fec1
add eax, 0x2c5931b3
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0xd537ecae
add dword [ebp - 0x48], 0x9f3a7ca8
mov dword [ebp - 0x44], 0x828515ee
sub dword [ebp - 0x44], 0x4118b479
mov dword [ebp - 0x40], 0x98f6a24e
add dword [ebp - 0x40], 0xca78ca1e
mov dword [ebp - 0x3c], 0x28a4100c
sub dword [ebp - 0x3c], 0x28a4100c
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0xe8b732b
sub eax, 0xe494207
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3d819
push 0
call eax
mov ecx, 0x7739f55d
add ecx, 0x88c651e7
xor esi, esi
add esi, eax
mov edi, 0x1a0f46bc
add edi, 0xe633fd44
add edi, dword [ebp - 0x38]
mov edx, 0x34e50641
add edx, 0x33fba570
xor dword [ebp - 0x30], eax
mov ebx, dword [edi]
sub dword [ebp - 0x34], esi
sub ebx, edx
add dword [ebp - 0x14], 0xc80156d7
mov dword [esi], ebx
mov dword [ebp - 0x10], 0x46d445c8
add esi, 0x4eee56e9
sub esi, 0x4eee56e5
add edi, 0x23415f82
sub edi, 0x23415f7e
loop 0x416799
add eax, 0x243a5356
sub eax, 0x24394373
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x40725c], 1
mov dword [0x407258], 1
mov dword [0x407254], 1
jne 0x401056
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010b0
mov dword [0x40700c], eax
mov eax, dword [0x407268]
test eax, eax
je 0x4010a0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x40727c]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x407264]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x404030], 1
je 0x4010e0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x401070
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x4010f8
cmp dx, 0x20b
jne 0x401056
cmp dword [ecx + 0x84], 0xe
jbe 0x401056
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401056
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401056
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401056

Function at 0x401770
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]
Function at 0x4017d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x407270]
test esi, esi
jle 0x4018f0
mov eax, dword [0x407274]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x401804
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x401887
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x4017f0
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x401917
mov eax, dword [0x407274]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x407274]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x4018f7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x401880
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x401890
add dword [0x407270], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x407274]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401880
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x40180e
mov eax, dword [0x407274]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
nop

Function at 0x401e30
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x40728c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x407284]
sub esp, 4
test ebx, ebx
je 0x401e85
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x401e7e
test esi, esi
je 0x401e7e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401e60
mov dword [esp], 0x40728c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4021c0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x4021e5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x4021f0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x4021e5
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x402238
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x40222e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40223a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x402220
xor eax, eax
pop ebx
pop esi
ret