joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435fe0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret

Function at 0x436c10
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x37cc
call fcn.00433c00
mov eax, dword [0x448050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
mov dword [ebp - 0x37cc], ebx
mov dword [ebp - 0x37c4], ebx
mov edi, edi
mov eax, dword [ebp - 0x37c4]
push eax
lea ecx, [ebp - 0x104]
push str..PhysicalDrive_d
push ecx
call fcn.004264f7
add esp, 0xc
push ebx
push ebx
push 3
push ebx
push 3
push ebx
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x436e0e
xor eax, eax
mov dword [ebp - 0x37c0], eax
mov dword [ebp - 0x37bc], eax
push 0x2710
mov dword [ebp - 0x37b8], eax
lea eax, [ebp - 0x2fe4]
push ebx
push eax
mov dword [ebp - 0x37c8], ebx
mov dword [ebp - 0x37c0], ebx
mov dword [ebp - 0x37bc], ebx
call fcn.00427020
add esp, 0xc
push ebx
lea ecx, [ebp - 0x37c8]
push ecx
push 0x2710
lea edx, [ebp - 0x2fe4]
push edx
push 0xc
lea eax, [ebp - 0x37c0]
push eax
push 0x2d1400
push esi
call edi
test eax, eax
je 0x436e01
mov edx, dword [ebp - 0x2fd8]
lea ecx, [ebp - 0x33cc]
push ecx
push ebx
push edx
lea eax, [ebp - 0x2fe4]
push eax
call fcn.00436b00
mov edx, dword [ebp - 0x2fd4]
lea ecx, [ebp - 0x8d4]
push ecx
push ebx
push edx
lea eax, [ebp - 0x2fe4]
push eax
call fcn.00436b00
mov edx, dword [ebp - 0x2fd0]
lea ecx, [ebp - 0x37b4]
push ecx
push ebx
push edx
lea eax, [ebp - 0x2fe4]
push eax
call fcn.00436b00
mov edx, dword [ebp - 0x2fcc]
lea ecx, [ebp - 0x4ec]
push ecx
push 1
push edx
lea eax, [ebp - 0x2fe4]
push eax
call fcn.00436b00
add esp, 0x40
cmp byte [0x44b870], bl
jne 0x436dcc
movsx ecx, byte [ebp - 0x4ec]
push ecx
call fcn.0042592e
add esp, 4
test eax, eax
jne 0x436d83
movsx edx, byte [ebp - 0x4d9]
push edx
call fcn.0042592e
add esp, 4
test eax, eax
je 0x436dcc
xor eax, eax
jmp 0x436d90
mov cl, byte [ebp + eax - 0x4ec]
mov byte [eax + 0x44b870], cl
inc eax
cmp cl, bl
jne 0x436d90
xor eax, eax
jmp 0x436db0
mov cl, byte [ebp + eax - 0x8d4]
mov byte [eax + 0x44bc70], cl
inc eax
cmp cl, bl
jne 0x436db0
mov dword [ebp - 0x37cc], 1
push 0x2710
lea eax, [ebp - 0x2fe4]
push ebx
push eax
call fcn.00427020
add esp, 0xc
push ebx
lea ecx, [ebp - 0x37c8]
push ecx
push 0x2710
lea edx, [ebp - 0x2fe4]
push edx
push ebx
push ebx
push 0x700a0
push esi
call edi
jmp 0x436e07
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp - 0x37c4]
inc eax
mov dword [ebp - 0x37c4], eax
cmp eax, 8
jl 0x436c40
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x37cc]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00424761
mov esp, ebp
pop ebp
ret
Function at 0x437620
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x448050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x94
xor esi, esi
lea eax, [ebp - 0x98]
push esi
push eax
mov byte [0x44b870], 0
call fcn.00427020
add esp, 0xc
lea ecx, [ebp - 0x98]
push ecx
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x437694
call fcn.00437080
test eax, eax
jne 0x4376b2
call fcn.004374a0
test eax, eax
jne 0x4376b2
call fcn.00436c10
test eax, eax
jne 0x4376b2
call fcn.00437230
jmp 0x4376b2
push edi
xor edi, edi
test esi, esi
jne 0x4376b1
cmp byte [0x44b870], 0
jne 0x4376b1
call fcn.00437390
inc edi
mov esi, eax
cmp edi, 0xa
jl 0x437697
pop edi
cmp byte [0x44b870], 0
jle 0x4376e8
push 4
mov esi, 0x44b870
push str.WD_W
push esi
call fcn.00425bfe
add esp, 0xc
test eax, eax
jne 0x4376e0
mov esi, 0x44b875
lea esp, [esp]
cmp byte [esi], 0
je 0x4376e8
inc esi
jne 0x4376e0
push str.IBM_
push 0x44bc70
call fcn.004266e0
add esp, 8
pop esi
test eax, eax
jne 0x43773d
push str.MAXTOR
push 0x44bc70
call fcn.004266e0
add esp, 8
test eax, eax
jne 0x43773d
push str.Maxtor
push 0x44bc70
call fcn.004266e0
add esp, 8
test eax, eax
jne 0x43773d
push str.WDC
push 0x44bc70
call fcn.004266e0
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x44b870
call fcn.00424761
mov esp, ebp
pop ebp
ret
Function at 0x408957
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4085d8
call fcn.0040898b
sub esi, 0x2f77f8f2
push ebx
pop ebx
xor dword [ecx], eax
inc ecx
sub esp, 4
mov dword [esp], esi
pop ebx
cmp ecx, edx
jne fcn.00408957
add ebx, ebx
ret

Function at 0x1000125c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0xc], 0
call sub.KERNEL32.DLL_GetEnvironmentStringsA
mov ebx, eax
mov dword [ebp - 0x10], ebx
jmp 0x10001299
cmp byte [ebx], 0x3d
je 0x10001285
inc dword [ebp - 0xc]
mov edi, ebx
xor eax, eax
stc
sbb ecx, ecx
repne scasb al, byte es:[edi]
neg ecx
lea eax, [ecx - 2]
mov edi, eax
inc edi
lea ebx, [ebx + edi]
cmp byte [ebx], 0
jne 0x10001278
mov edi, dword [ebp - 0xc]
inc edi
lea edi, [edi*4]
mov dword [ebp - 0x14], edi
push dword [ebp - 0x14]
call sub.CRTDLL.DLL_malloc
pop ecx
mov dword [ebp - 8], eax
mov dword [0x10003010], eax
cmp dword [ebp - 8], 0
jne 0x100012cc
xor eax, eax
jmp 0x10001342
mov ebx, dword [ebp - 0x10]
jmp 0x10001325
mov edi, ebx
xor eax, eax
stc
sbb ecx, ecx
repne scasb al, byte es:[edi]
neg ecx
lea eax, [ecx - 2]
mov edi, eax
inc edi
mov dword [ebp - 4], edi
cmp byte [ebx], 0x3d
je 0x1000131f
push dword [ebp - 4]
call sub.CRTDLL.DLL_malloc
pop ecx
mov esi, dword [ebp - 8]
mov dword [esi], eax
or eax, eax
jne 0x10001308
jmp 0x10001342
push ebx
mov edi, dword [ebp - 8]
push dword [edi]
call sub.CRTDLL.DLL_strcpy
add esp, 8
add dword [ebp - 8], 4
mov edx, dword [ebp - 4]
lea ebx, [ebx + edx]
cmp byte [ebx], 0
jne 0x100012d1
mov edx, dword [ebp - 8]
mov dword [edx], 0
mov eax, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0xda3058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xda31a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xda307e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xda306a
add dl, dl
jne 0xda3089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xda30dc
xor eax, eax
add dl, dl
jne 0xda3096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xda317d
add dl, dl
jne 0xda30a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xda30b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xda30bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xda30c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xda30d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xda3075
mov eax, 1
add dl, dl
jne 0xda30ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xda30f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xda30e1
sub eax, ebx
mov ebx, 1
jne 0xda3128
mov ecx, 1
add dl, dl
jne 0xda310e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xda3119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xda3105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xda3075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xda313f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xda314a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xda3136
cmp eax, 0x7d00
jae 0xda316d
cmp eax, 0x500
jb 0xda3168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xda3075
cmp eax, 0x7f
ja 0xda3170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xda3075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xda319e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xda3075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x429cf0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x10000]
push edi
or ebp, 0xffffffff
jmp 0x429d12
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x429d19
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x429d08
mov eax, 1
add ebx, ebx
jne 0x429d2b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x429d20
jne 0x429d3c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x429d20
xor ecx, ecx
sub eax, 3
jb 0x429d50
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x429dc2
mov ebp, eax
add ebx, ebx
jne 0x429d5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x429d68
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x429d8c
inc ecx
add ebx, ebx
jne 0x429d78
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x429d6d
jne 0x429d89
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x429d6d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x429dac
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x429d9d
jmp 0x429d0e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x429dac
add edi, ecx
jmp 0x429d0e
pop esi
mov edi, esi
mov ecx, 0x73
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x429dca
cmp byte [edi], 1
jne 0x429dca
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x429dcf
lea edi, [esi + 0x27000]
mov eax, dword [edi]
or eax, eax
je 0x429e3e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2ea78]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2eb54]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x429dfc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2eb5c]
or eax, eax
je 0x429e38
mov dword [ebx], eax
add ebx, 4
jmp 0x429e19
call dword [esi + 0x2eb58]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x429e6f
cmp al, 0xef
ja 0x429e62
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x429e44
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x429e51
mov ebp, dword [esi + 0x2eb60]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x429ea3
sub esp, 0xffffff80
jmp 0x4017ed
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x413054], 1
mov dword [0x413050], 1
mov dword [0x41304c], 1
jne 0x401056
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010b0
mov dword [0x41300c], eax
mov eax, dword [0x413060]
test eax, eax
je 0x4010a0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x413074]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x41305c]
mov dword [eax], edx
call sym.__setargv
cmp dword [0x40f018], 1
je 0x4010e0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x401070
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x4010f8
cmp dx, 0x20b
jne 0x401056
cmp dword [ecx + 0x84], 0xe
jbe 0x401056
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401056
mov dword [esp], sym.__matherr
call sym.___mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401056
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401056

Function at 0x401599
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
add esp, 0xffffff80
call sym.___main
mov dword [esp + 0x7c], 1
jmp 0x4016e9
mov dword [esp], str.Morpion_Games_by_Gabriel_n_n__1___Play_With_Friends___n__2___Play_With_Robots___n__3___Leave_Games___n
call sym._printf
mov dword [esp], str.___Enter_your_choice:
call sym._printf
lea eax, [esp + 0x78]
mov dword [esp + 4], eax
mov dword [esp], 0x4100c5
call sym._scanf
mov eax, dword [esp + 0x78]
cmp eax, 1
jne 0x401683
mov dword [esp], 0x4100c8
call sym._system
mov dword [esp], str.Morpion_Games_by_Gabriel_n_n__1___Play_With_Friends___n__2___Play_With_Robots___n__3___Leave_Games___n
call sym._printf
mov dword [esp], str.___Enter_name_of_first_player:
call sym._printf
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp], 0x4100ec
call sym._scanf
mov dword [esp], 0x4100c8
call sym._system
mov dword [esp], str.Morpion_Games_by_Gabriel_n_n__1___Play_With_Friends___n__2___Play_With_Robots___n__3___Leave_Games___n
call sym._printf
mov dword [esp], str.___Enter_name_of_second_player:
call sym._printf
lea eax, [esp + 0x46]
mov dword [esp + 4], eax
mov dword [esp], 0x4100ec
call sym._scanf
movzx eax, byte [esp + 0x46]
movsx edx, al
movzx eax, byte [esp + 0x14]
movsx eax, al
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._morpionTwoPlayers
mov dword [esp + 0x7c], 0
jmp 0x4016e9
mov eax, dword [esp + 0x78]
cmp eax, 2
jne 0x4016a2
mov dword [esp], 0x4100c8
call sym._system
mov dword [esp + 0x7c], 0
jmp 0x4016e9
mov eax, dword [esp + 0x78]
cmp eax, 3
jne 0x4016c1
mov dword [esp], str.Thanks_for_having_download_this_game__good_bye___n
call sym._printf
mov dword [esp + 0x7c], 0
jmp 0x4016e9
mov dword [esp], str.Interact_with_enter_for_return_at_option_...
call sym._printf
nop
call sym._getchar
cmp eax, 0xa
jne 0x4016ce
call sym._getchar
mov dword [esp], 0x4100c8
call sym._system
cmp dword [esp + 0x7c], 1
je 0x4015b4
mov eax, 0
leave
ret
Function at 0x401960
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call sym.___acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call sym.___acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x4019c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x413068]
test esi, esi
jle 0x401ae0
mov eax, dword [0x41306c]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x4019f4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x401a77
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x4019e0
mov dword [esp], ebx
call sym.___mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x401b07
mov eax, dword [0x41306c]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call sym.__GetPEImageBase
mov edx, dword [0x41306c]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401ae7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x401a70
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x401a80
add dword [0x413068], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x41306c]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401a70
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call sym.___report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x4019fe
mov eax, dword [0x41306c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call sym.___report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call sym.___report_error
lea esi, [esi]
nop
Function at 0x402020
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x413084
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x41307c]
sub esp, 4
test ebx, ebx
je 0x402075
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40206e
test esi, esi
je 0x40206e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402050
mov dword [esp], 0x413084
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4022a0
Capabilities:
Parse pe header
Terminate process

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_exit]

Function at 0x4023d0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x4023f5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x402400
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x4023f5
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x402448
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x40243e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40244a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x402430
xor eax, eax
pop ebx
pop esi
ret
Function at 0x40d908
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret 4

Function at 0x4a5270
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.Fox_
lea edi, [esi - 0xa0000]
push edi
jmp 0x4a528a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4a5291
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a5280
mov eax, 1
add ebx, ebx
jne 0x4a52a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4a52b4
jne 0x4a52d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a52d3
dec eax
add ebx, ebx
jne 0x4a52c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4a5298
add ebx, ebx
jne 0x4a52cf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4a5325
xor ecx, ecx
sub eax, 3
jb 0x4a52eb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4a535a
sar eax, 1
mov ebp, eax
jmp 0x4a52f6
add ebx, ebx
jne 0x4a52f6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a52c4
inc ecx
add ebx, ebx
jne 0x4a5304
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a52c4
add ebx, ebx
jne 0x4a5311
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4a5306
jne 0x4a5322
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4a5306
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4a5344
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4a5336
jmp 0x4a5286
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4a5344
add edi, ecx
jmp 0x4a5286
pop esi
mov edi, esi
mov ecx, 0x234
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4a5362
cmp byte [edi], 1
jne 0x4a5362
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4a5367
lea edi, [esi + 0xa3000]
mov eax, dword [edi]
or eax, eax
je 0x4a53df
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xa9ac4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xa9b78]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4a5394
mov ecx, edi
jns 0x4a53c3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xa9b7c]
or eax, eax
je 0x4a53d9
mov dword [ebx], eax
add ebx, 4
jmp 0x4a53b1
call dword [esi + 0xa9b8c]
mov ebp, dword [esi + 0xa9b80]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4a5413
sub esp, 0xffffff80
jmp 0x403325
Function at 0x42e001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..rdata
nop
nop
mov ebx, 0x407ef8
mov ecx, 0xcd00cf6
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x5ac45ea1
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
jmp 0x401219