joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100075e0
Capabilities:
Encode data using xor

Disassembly:
adc edx, dword [esp + eax*4]
leave
lodsd eax, dword [esi]
jmp 0x100075f6
jg 0x10007666
fidivr dword [esi - 0x76910bb4]
lodsd eax, dword [esi]
xchg edx, eax
pop ecx
xor al, 0xd2
iretd
and al, 0x1a
in al, dx
mov ebp, 0x2b81db81
clc
test eax, 0xcbc397b2
in eax, 0x16
push ecx
adc bh, 0xa8
aaa
call dword [eax + 0x92a9361]
dec edi
jns 0x100076d7
xchg edi, eax
daa
nop
cmp dh, byte [esi + 0x19]
and esp, edi
pop edx
call 0xea8292fc
xor dword [esi + 0x7c], eax
cmp dh, 0x82
jecxz 0x10007693
pop es
hlt
rcr dword ds:[edi], cl
jg 0x10007693
add eax, 0xf0c511e5
invalid

Function at 0x1005510a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov esi, dword [ebx + 0x20]
add esi, edi
jmp 0x1000fbdf
pop edi
pop edx
jmp 0x100158eb
add eax, edi
movzx eax, word [eax]
jmp 0x1005ecd6
add eax, edi
pop esi
jmp 0x10002400
sub ecx, 1
mov eax, ecx
jmp 0x10019511
mov edi, dword [ebp + 8]
jmp 0x1005f884
cmp dword [ebp + 8], 0
je 0x1005a4b3
jmp 0x1000b651
xor ecx, ecx
jmp 0x10063492
push dword [ebx + 0x18]
pop dword [ebp - 0x108]
jmp 0x100010a9
pop ecx
pop ebx
jmp 0x1004b3fc
mov edi, dword [ebp + 0xc]
jmp 0x1005f884
push edi
push esi
jmp 0x1000efd8
xor eax, dword [ebp + 0x10]
test eax, eax
jmp 0x1006348c
call fcn.100519ed
xor eax, dword [ebp + 0xc]
jmp 0x100557f6
shl eax, 1
add eax, dword [ebx + 0x24]
jmp 0x10002d0f
test edx, edx
jne 0x10041340
jmp 0x100163f1
add esp, 0xfffffef4
push ebx
jmp 0x100596e1
sub eax, dword [ebp - 0x10c]
jmp 0x1005ecd9
jne 0x10041342
pop eax
jmp 0x10017f59
cmp dword [ebp + 0x14], 0
jne 0x1003fd11
jmp 0x10013823
jne 0x10036731
jmp 0x100674af
cmp al, 0x5b
jg 0x1005649d
jmp 0x1005649b
inc ecx
call fcn.100519ed
jmp 0x10016cec
push edi
lea edx, [ecx + 0x30]
jmp 0x1003aee6
add eax, edi
add esi, 4
jmp 0x10031ba7
push dword [edx]
pop edx
jmp 0x10021e92
inc ebx
test ax, ax
jmp 0x1002a6be
mov eax, dword [ebp + 0x10]
jmp 0x10029327
xor ebx, ebx
mov ax, word [edx + ebx*2]
jmp 0x10048b14
lea ebx, [ebx + 0x78]
mov eax, dword [ebx + 8]
or cl, ch
jl 0x10045bbe
add dword [eax], eax
jne 0x1005491c
jmp 0x100674af
cmp al, 0x40
jl 0x1005649d
jmp 0x10030f8d
leave
ret 0x10
mov eax, dword [esi]
or eax, eax
jmp 0x1002fd2c
push dword [ecx + 0xc]
pop ecx
jmp 0x10064d80
push ebp
mov ebp, esp
jmp 0x10028ae3
jne 0x1005ff24
mov edi, dword [ecx + 0x18]
jmp 0x1005f884
add al, 0x20
stosb byte es:[edi], al
jmp 0x1003ef8b
push ecx
push edx
jmp 0x10016c90
push dword [ebx + 0x10]
pop dword [ebp - 0x10c]
jmp 0x1002e37d
push dword fs:[0x30]
pop ecx
jmp 0x100550a6
shl eax, 2
add eax, dword [ebx + 0x1c]
jmp 0x100641aa
mov ebx, edi
add ebx, dword [ebx + 0x3c]
jmp 0x10045bfe
mov ecx, dword [ecx]
lea edi, [ebp - 0x104]
jmp 0x100334fc
mov ebx, dword [ebx]
add ebx, edi
jmp 0x1005a1e1
je 0x1000931f
cmp dword [ebp - 0x108], ecx
jmp 0x10048844
add eax, edi
mov eax, dword [eax]
jmp 0x100031ed
push dword [ecx + 0xc]
pop ecx
jmp 0x1005ff24
xor eax, eax
jmp 0x100031ef
Function at 0x10073cf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x178
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [ebp + 8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x10073d16
xor eax, eax
jmp 0x10073ebc
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
add edx, 0x78
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
mov dword [eax], 0
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 4], 8
mov edx, dword [ebp - 8]
mov byte [edx + 0x14], 0x21
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 0x14]
and ecx, 3
mov edx, dword [ebp - 0x10]
mov byte [edx + 5], cl
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + 5]
or ecx, 0x60
mov edx, dword [ebp - 0x10]
mov byte [edx + 5], cl
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.10073800
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov dword [edx + 0xc], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 0x10], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov dword [eax + 0x70], ecx
mov edx, dword [ebp - 8]
add edx, 0x78
mov eax, dword [ebp - 8]
mov dword [eax + 0x88], edx
mov ecx, dword [ebp - 8]
add ecx, 0x78
mov edx, dword [ebp - 8]
mov dword [edx + 0x8c], ecx
mov eax, dword [ebp - 8]
mov dword [eax + 0x40], 0
mov ecx, dword [ebp - 8]
mov dword [ecx + 8], 0
mov edx, dword [ebp - 8]
mov dword [edx + 4], 0
mov eax, dword [ebp - 8]
mov dword [eax], 0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x10]
mov dword [edx + 0x68], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x34], 0
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x3c], 0
mov edx, dword [ebp - 8]
mov dword [edx + 0x58], 0
mov eax, dword [ebp - 8]
mov byte [eax + 0x15], 0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov dword [ecx + 0x1c], edx
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0
mov ecx, dword [ebp - 8]
add ecx, 0x1c
mov edx, dword [ebp - 8]
mov dword [edx + 0x20], ecx
mov eax, dword [ebp - 8]
mov dword [eax + 0x24], 0
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x28], 0
mov edx, dword [ebp - 8]
mov dword [edx + 0x2c], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x30], 0
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x44], 0x178
mov edx, dword [ebp - 8]
mov dword [edx + 0x50], 0xc8
mov eax, dword [ebp - 8]
mov dword [eax + 0x54], 0xc8
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x4c], 0
mov dword [ebp - 4], 0
jmp 0x10073e7c
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 9
jge 0x10073e95
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [ecx + eax*4 + 0x98], 0
jmp 0x10073e73
push 0
push 0x10073c30
mov edx, dword [ebp - 0x10]
push edx
call fcn.1007d180
test eax, eax
je 0x10073eb9
mov eax, dword [ebp - 0x10]
push eax
call fcn.10073950
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 8
Function at 0x1007bda0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
movzx eax, byte [edx + 0x14]
xor eax, 3
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x1007be6a
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp + 0x10], ecx
test eax, eax
jbe 0x1007be6a
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 4]
cmp eax, 8
jne 0x1007be00
push 0xfffffffffffffffd
mov ecx, dword [ebp - 4]
add ecx, 0x68
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.1007bda0
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 5]
xor ecx, 3
and ecx, dword [ebp - 0xc]
je 0x1007be38
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 5]
and eax, 0xf8
mov ecx, dword [ebp - 8]
movzx edx, byte [ecx + 0x14]
and edx, 3
movzx ecx, dl
or eax, ecx
mov edx, dword [ebp - 4]
mov byte [edx + 5], al
mov eax, dword [ebp - 4]
mov dword [ebp + 0xc], eax
jmp 0x1007be65
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
cmp edx, dword [ecx + 0x1c]
jne 0x1007be58
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [eax + 0x1c], edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.1007bbc0
jmp 0x1007bdbc
mov eax, dword [ebp + 0xc]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1008c1d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0x88
cmp dword [ebp + 8], 0
je 0x1008c1fa
cmp dword [ebp + 0xc], 0x200
jae 0x1008c201
xor eax, eax
jmp 0x1008c357
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x1008c21c
xor eax, eax
jmp 0x1008c357
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x3c]
and ecx, 3
je 0x1008c22e
xor eax, eax
jmp 0x1008c357
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x3c], edx
jbe 0x1008c243
xor eax, eax
jmp 0x1008c357
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp dword [eax], 0x4550
je 0x1008c261
xor eax, eax
jmp 0x1008c357
mov ecx, dword [ebp - 4]
cmp dword [ecx], 0x4550
je 0x1008c273
xor eax, eax
jmp 0x1008c357
mov edx, dword [ebp - 4]
movzx eax, word [edx + 4]
test eax, eax
jne 0x1008c290
mov ecx, dword [ebp - 4]
movzx edx, word [ecx + 0x14]
test edx, edx
jne 0x1008c290
xor eax, eax
jmp 0x1008c357
mov eax, dword [ebp - 4]
movzx ecx, word [eax + 0x16]
and ecx, 2
jne 0x1008c2a3
xor eax, eax
jmp 0x1008c357
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x3c]
and eax, 0x1ff
je 0x1008c2c5
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ecx + 0x3c]
cmp eax, dword [edx + 0x38]
je 0x1008c2c5
xor eax, eax
jmp 0x1008c357
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x3c], 0
jne 0x1008c2d5
xor eax, eax
jmp 0x1008c357
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x38]
sub eax, 1
mov ecx, dword [ebp - 4]
and eax, dword [ecx + 0x38]
je 0x1008c2ea
xor eax, eax
jmp 0x1008c357
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x3c]
sub eax, 1
mov ecx, dword [ebp - 4]
and eax, dword [ecx + 0x3c]
je 0x1008c2ff
xor eax, eax
jmp 0x1008c357
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov ecx, dword [edx + 0x38]
cmp ecx, dword [eax + 0x3c]
jae 0x1008c311
xor eax, eax
jmp 0x1008c357
mov edx, dword [ebp - 4]
cmp dword [edx + 0x50], 0x77000000
jbe 0x1008c321
xor eax, eax
jmp 0x1008c357
mov eax, dword [ebp - 4]
movzx ecx, word [eax + 6]
cmp ecx, 0x60
jbe 0x1008c331
xor eax, eax
jmp 0x1008c357
mov edx, dword [ebp - 4]
movzx eax, word [edx + 0x18]
cmp eax, 0x10b
jne 0x1008c34e
mov ecx, dword [ebp - 4]
movzx edx, word [ecx + 4]
cmp edx, 0x14c
je 0x1008c352
xor eax, eax
jmp 0x1008c357
mov eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x10091660
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
jne 0x100916a6
cmp dword [ebp + 0xc], 0
jne 0x100916a6
jmp 0x10091747
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x100916c5
jmp 0x10091747
push 0
push 0
push 0
push 4
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x100916e6
jmp 0x10091747
push 0
push 0
push 0
push 2
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 8], 0
push 1
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.10091390
add esp, 0x10
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x1009172f
jmp 0x10091747
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [ecx], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 0x18], ecx
mov dword [ebp - 0x18], 1
cmp dword [ebp - 0x18], 0
jne 0x10091766
cmp dword [ebp + 8], 0
je 0x10091766
mov edx, dword [ebp + 8]
push edx
call fcn.10091620
add esp, 4
mov dword [ebp + 8], 0
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret
Function at 0x100968a0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0xffffffff
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x100968fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x100968eb
push 0x84000001
mov ecx, 0x100e441c
call fcn.1008a2a0
jmp 0x100968fa
push 0x84000002
mov ecx, 0x100e441c
call fcn.1008a2a0
jmp 0x1009693b
push 0
push 0
push 0
push 2
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
jne 0x1009693b
push 0x84000009
mov ecx, 0x100e441c
call fcn.1008a2a0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x10096b30
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0xffffffff
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x10096b79
push 0x84000002
mov ecx, 0x100e441c
call fcn.1008a2a0
jmp 0x10096be3
push 0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
jne 0x10096bc4
push 0x84000009
mov ecx, 0x100e441c
call fcn.1008a2a0
jmp 0x10096be3
push 0
push 0
push 0
push 4
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 8

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00401219
Function at 0x401670
Capabilities:
Parse pe header

Disassembly:
test eax, eax
je 0x401703
mov ecx, dword [eax + 0x20]
test ecx, ecx
je 0x401703
movzx eax, word [ecx]
mov edx, 0x5a4d
cmp ax, dx
je 0x4016a5
cwde
push eax
push str._t____DLL_has_invalid_DOS_header:_04x_n
call fcn.00403300
add esp, 8
mov eax, 3
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov ecx, dword [eax]
cmp ecx, 0x4550
je 0x4016c8
push ecx
push str._t____DLL_has_invalid_NT_Header_signature:_08x_n
call fcn.00403300
add esp, 8
mov eax, 3
ret
movzx eax, word [eax + 4]
mov ecx, 0x8664
cmp ax, cx
jne 0x4016dc
mov eax, 2
ret
mov edx, 0x14c
cmp ax, dx
jne 0x4016ec
mov eax, 1
ret
movzx eax, ax
push eax
push str._t____DLL_has_invalid_Machine_type:_04x_n
call fcn.00403300
add esp, 8
mov eax, 3
ret
push str._t____NULL_DLL_parameter_n
call fcn.00403300
add esp, 4
mov eax, 3
ret

Function at 0x403910
Capabilities:
Packed with generic packer

Disassembly:
cmp ecx, dword [0x40babc]
jne 0x40391a
repz ret
jmp fcn.00403ec6

Function at 0x403eb5
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x406428
call fcn.00404208
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x40c148
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x403cc7
cmp eax, esi
jne 0x403cba
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x403cca
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x403ca1
xor esi, esi
inc esi
mov eax, dword [0x40c144]
cmp eax, esi
jne 0x403cdd
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x403d18
mov eax, dword [0x40c144]
test eax, eax
jne 0x403d12
mov dword [0x40c144], esi
push 0x4051e8
push 0x4051dc
call fcn.00403c28
pop ecx
pop ecx
test eax, eax
je 0x403d18
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x403de2
mov dword [0x40be00], esi
mov eax, dword [0x40c144]
cmp eax, esi
jne 0x403d3c
push 0x4051d8
push 0x4051d0
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x40c144], 2
cmp dword [ebp - 0x1c], ebx
jne 0x403d49
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x40c14c], ebx
je 0x403d6a
push 0x40c14c
call fcn.004040f6
pop ecx
test eax, eax
je 0x403d6a
push ebx
push 2
push ebx
call dword [0x40c14c]
push dword [0x40bde8]
push dword [0x40bdec]
push dword [0x40bde4]
call fcn.004015b0
add esp, 0xc
mov dword [0x40bdfc], eax
cmp dword [0x40bdf0], ebx
jne 0x403dc8
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x40be00], ebx
jne 0x403dd6
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x40bdfc]
call fcn.0040424d
ret
call fcn.00404334
jmp 0x403c7f
Function at 0x404080
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x404093
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x40408f
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret

Function at 0x4040b0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x4040ef
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x4040e5
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x4040f1
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x4040d5
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40eb04
Capabilities:
Resolve function by parsing pe exports

Disassembly:
ret
mov eax, dword [ebx + 0x3c]
mov edx, dword [eax + ebx + 0x78]
jmp 0x412b94
nop
xchg dword [esp], eax
clc
or esp, esp
sub dword [esp], eax
nop
cld
stc
movzx eax, byte [edi]
wait
cmc
not eax
not eax
inc edi
jmp 0x40eba7
sub dword [esp], eax
nop
pop eax
cmp byte [edi], 0
not al
not al
jne 0x412bac
jmp 0x412b5b
nop
xor eax, 0x91783d69
cmp eax, dword [esp + 4]
jne 0x412c93
jmp 0x412c20
mov ch, 0x6d
lea edx, [edx + ebx]
mov esi, dword [edx + 0x20]
add esi, ebx
jmp 0x412c90
wait
je 0x40eb03
xor eax, eax
push eax
shl eax, 4
jmp 0x40eb8b
mov esi, dword [edx + 0x24]
cmp eax, edi
mov edi, dword [edx + 0x1c]
or edx, edx
not dl
add esi, ebx
add edi, ebx
jmp 0x412c6b
and edx, 0xa6a63dd7
test edx, 0x6211c190
lea edx, [edi - 0x3d305b3a]
mov eax, dword [esi + ecx*2]
and eax, 0xffff
cmc
mov esi, dword [edi + eax*4]
add esi, ebx
cld
cdq
ret 4
or ecx, 0xffffffff
lodsd eax, dword [esi]
dec bh
inc bh
xor bh, al
xor bh, al
test edi, 0x9d082abb
inc ecx
lea edi, [eax + ebx]
cmp ecx, dword [edx + 0x18]
jmp 0x412ba3
Function at 0x403c50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x406d70
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov ecx, edi
push 0
call fcn.0042fece
mov dword [edi + 4], 0
mov byte [edi + 8], 0
mov dword [edi + 0xc], 0
mov byte [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov word [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov word [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov byte [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov byte [edi + 0x30], 0
test esi, esi
mov dword [ebp - 0x20], edi
je 0x403cff
mov dword [ebp - 0x10], 0
push esi
push edi
call fcn.0042fff6
add esp, 8
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp - 0x20]
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov dword [ebp - 0x10], 0
push str.bad_locale_name
call fcn.0042fc3a
add esp, 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebp
sub esp, 8
add ebp, 0xc
mov eax, dword [ebp - 0x20]
mov esi, eax
mov eax, dword [eax + 0x2c]
test eax, eax
je 0x403d3c
push eax
call fcn.0043c3b0
add esp, 4
mov eax, esi
mov dword [esi + 0x2c], 0
mov eax, dword [esi + 0x24]
test eax, eax
je 0x403d55
push eax
call fcn.0043c3b0
add esp, 4
mov eax, esi
mov dword [esi + 0x24], 0
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x403d6e
push eax
call fcn.0043c3b0
add esp, 4
mov eax, esi
mov dword [esi + 0x1c], 0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x403d87
push eax
call fcn.0043c3b0
add esp, 4
mov eax, esi
mov dword [esi + 0x14], 0
mov eax, dword [esi + 0xc]
test eax, eax
je 0x403da0
push eax
call fcn.0043c3b0
add esp, 4
mov eax, esi
mov dword [esi + 0xc], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x403db9
push eax
call fcn.0043c3b0
add esp, 4
mov ecx, esi
mov dword [esi + 4], 0
call fcn.0042feff
add esp, 8
pop ebp
ret
Function at 0x408b50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x10e0
call fcn.00430b00
mov esi, esp
mov dword [esi + 0x10c8], ebp
mov dword [esi + 0x10cc], esp
mov dword [esi + 0x10d8], 0xffffffff
lea eax, [esi + 0x10d0]
mov dword [esi + 0x10d4], 0x40afd0
mov ecx, dword fs:[0]
mov dword [esi + 0x10d0], ecx
mov dword fs:[0], eax
lea ecx, [esi + 0x18]
push 1
call fcn.00408cd0
mov edi, esi
mov ecx, edi
push 2
call fcn.0042fece
mov byte [0x4636d0], 0
mov ecx, edi
call fcn.0042feff
push 0
call fcn.00434f52
add esp, 4
push eax
call fcn.0043aa87
add esp, 4
push 0x8000
push eax
call fcn.0043b573
add esp, 8
lea edi, [esi + 0xc8]
nop
nop
nop
nop
nop
nop
nop
nop
push 0
call fcn.00434f52
add esp, 4
push eax
push 0x1000
push 1
push edi
call fcn.0043c1ad
add esp, 0x10
test eax, eax
je 0x408c2f
mov dword [esi + 0x10d8], 0
push eax
push edi
lea eax, [esi + 0x28]
push eax
call fcn.0040a540
lea edi, [esi + 0xc8]
add esp, 0xc
jmp 0x408bf0
push 0
call fcn.00434f52
add esp, 4
push eax
call fcn.0043b9c9
add esp, 4
mov dword [esi + 0x10d8], 0
test eax, eax
jne 0x408c7a
lea ecx, [esi + 0x18]
push dword [ebp + 8]
call fcn.00408ee0
lea ecx, [esi + 0x18]
call fcn.00409030
mov eax, dword [esi + 0x10d0]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.0043a9d7
lea ecx, [esi + 4]
push str.Error_occurred_while_reading_stdin
push 0x463310
push dword [eax]
call fcn.00403030
push 0x461384
lea eax, [esi + 4]
push eax
call fcn.00431bc3
add esp, 8
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebp
sub esp, 0x10
lea esi, [ebp - 0x10dc]
mov ebp, dword [esi + 0x10c8]
lea ecx, [esi + 0x18]
call fcn.00409030
add esp, 0x10
pop ebp
ret