joyce8/EMBER2024-capa huggingface dataset:
Function at 0x460980
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x4609b3
push esi
call fcn.0046ecc0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x4609ac
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x460a39
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x460a22
mov eax, dword [esi + 8]
test eax, eax
je 0x4609d7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x460a1e
cmp eax, 2
je 0x460a22
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4609ca
cmp eax, 3
je 0x4609fd
cmp eax, 1
jne 0x4609ca
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x4609ca
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x4609ca
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00460a60
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x460a48
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00460a60
add esp, 4
pop esi
ret

Function at 0x4612d0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x4612f1
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x4612f1
mov eax, dword [eax + 0x44]
test eax, eax
je 0x4612f1
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x48ecdf
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x48ed17
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0048cd6c
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0048cd44
jmp 0x48ed23
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4903d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x490412
call fcn.00495e8e
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x490412
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x490409
xor eax, eax
jmp 0x49041a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00490420
pop edi
pop esi
pop ebx
ret 4
Function at 0x4963be
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4963ec
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x49640a
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00496324
jmp 0x49640a
mov eax, dword [esi + 0x14]
test eax, eax
je 0x49640a
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00496324
test edi, edi
mov eax, edi
jne 0x4963f4
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x406863
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x460114], 0
jne 0x4068a1
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406877
mov dword [ecx*4 + 0x460110], eax
inc ecx
cmp ecx, 0x100
jl 0x406872
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x4068ce
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x460110]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4068af
not eax
pop ebp
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x44bcc0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4d3a5b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x5f278c]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x44bdf8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x44bd26
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004c869d
xor eax, eax
jmp 0x44be6f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.004c87da
push esi
lea ecx, [esp + 0xc]
call fcn.004c8a69
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push 0x5e2dd0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x44be4d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.0044bc50
test eax, eax
jne 0x44be4d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.0044bc50
test eax, eax
jne 0x44be4d
lea eax, [esp + 0x14]
push 0x5e2dac
push eax
call fcn.004b9420
mov esi, eax
add esp, 8
test esi, esi
jne 0x44be2c
lea ecx, [esp + 0x14]
push 0x5e2da8
push ecx
call fcn.004b93a0
mov esi, eax
add esp, 8
test esi, esi
jne 0x44be2c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x44be2f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.004c878a
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x44bd3e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004c869d
xor eax, eax
jmp 0x44be6f
mov byte [esi], 0
push 0x5e2da4
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.004c869d
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x113d058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x113d1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x113d07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x113d06a
add dl, dl
jne 0x113d089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x113d0dc
xor eax, eax
add dl, dl
jne 0x113d096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x113d17d
add dl, dl
jne 0x113d0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x113d0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x113d0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x113d0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x113d0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x113d075
mov eax, 1
add dl, dl
jne 0x113d0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x113d0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x113d0e1
sub eax, ebx
mov ebx, 1
jne 0x113d128
mov ecx, 1
add dl, dl
jne 0x113d10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x113d119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x113d105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x113d075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x113d13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x113d14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x113d136
cmp eax, 0x7d00
jae 0x113d16d
cmp eax, 0x500
jb 0x113d168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x113d075
cmp eax, 0x7f
ja 0x113d170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x113d075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x113d19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x113d075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0xda2058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00da21a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xda207e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xda206a
add dl, dl
jne 0xda2089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xda20dc
xor eax, eax
add dl, dl
jne 0xda2096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xda217d
add dl, dl
jne 0xda20a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xda20b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xda20bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xda20c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xda20d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xda2075
mov eax, 1
add dl, dl
jne 0xda20ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xda20f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xda20e1
sub eax, ebx
mov ebx, 1
jne 0xda2128
mov ecx, 1
add dl, dl
jne 0xda210e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xda2119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xda2105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xda2075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xda213f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xda214a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xda2136
cmp eax, 0x7d00
jae 0xda216d
cmp eax, 0x500
jb 0xda2168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xda2075
cmp eax, 0x7f
ja 0xda2170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xda2075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xda219e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xda2075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x603820
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x599015
lea edi, [esi - 0x198015]
push edi
or ebp, 0xffffffff
jmp 0x603842
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x603849
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x603838
mov eax, 1
add ebx, ebx
jne 0x60385b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x60386c
jne 0x60388b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x60388b
dec eax
add ebx, ebx
jne 0x603878
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x603850
add ebx, ebx
jne 0x603887
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x6038dd
xor ecx, ecx
sub eax, 3
jb 0x6038a3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x603912
sar eax, 1
mov ebp, eax
jmp 0x6038ae
add ebx, ebx
jne 0x6038ae
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x60387c
inc ecx
add ebx, ebx
jne 0x6038bc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x60387c
add ebx, ebx
jne 0x6038c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x6038be
jne 0x6038da
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x6038be
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x6038fc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x6038ee
jmp 0x60383e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x6038fc
add edi, ecx
jmp 0x60383e
pop esi
mov edi, esi
mov ecx, 0xf20
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x60391a
cmp byte [edi], 9
jne 0x60391a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x60391f
lea edi, [esi + 0x201000]
mov eax, dword [edi]
or eax, eax
je 0x603997
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x20a36c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x20a3a8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x60394c
mov ecx, edi
jns 0x60397b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x20a3ac]
or eax, eax
je 0x603991
mov dword [ebx], eax
add ebx, 4
jmp 0x603969
call dword [esi + 0x20a3bc]
mov ebp, dword [esi + 0x20a3b0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x6039cb
sub esp, 0xffffff80
jmp 0x40f0dc
Function at 0xf780b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00f78200
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xf780d6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xf780c2
add dl, dl
jne 0xf780e1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xf78134
xor eax, eax
add dl, dl
jne 0xf780ee
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xf781d5
add dl, dl
jne 0xf780fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf78108
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf78113
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf7811e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xf7812a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xf780cd
mov eax, 1
add dl, dl
jne 0xf78142
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf7814d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xf78139
sub eax, ebx
mov ebx, 1
jne 0xf78180
mov ecx, 1
add dl, dl
jne 0xf78166
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xf78171
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xf7815d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xf780cd
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xf78197
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xf781a2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xf7818e
cmp eax, 0x7d00
jae 0xf781c5
cmp eax, 0x500
jb 0xf781c0
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xf780cd
cmp eax, 0x7f
ja 0xf781c8
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xf780cd
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xf781f6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xf780cd
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401d80
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x407048
call sym._EnterCriticalSection_4
mov ebx, dword [0x407040]
sub esp, 4
test ebx, ebx
je 0x401dcb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401dc4
test esi, esi
je 0x401dc4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401da0
mov dword [esp], 0x407048
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x401fb0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x402000
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x4020d8
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40203e
cmp eax, 4
jne 0x402060
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40204e
cmp edx, 4
je 0x40204e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00401fb0
Function at 0x40795a
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x40be00
call fcn.00407964
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x40dbf0
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x4076fe
cmp eax, esi
jne 0x4076f1
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x407701
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4076d8
xor esi, esi
inc esi
mov eax, dword [0x40dbec]
cmp eax, esi
jne 0x407714
push 0x1f
call sub.MSVCR90.dll__amsg_exit
pop ecx
jmp 0x407743
mov eax, dword [0x40dbec]
test eax, eax
jne 0x40773d
mov dword [0x40dbec], esi
push 0x40a298
push 0x40a28c
call sub.MSVCR90.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x407743
jmp 0x407867
mov dword [0x40d3ec], esi
mov eax, dword [0x40dbec]
cmp eax, esi
jne 0x407767
push 0x40a288
push 0x40a274
call sub.MSVCR90.dll__initterm
pop ecx
pop ecx
mov dword [0x40dbec], 2
cmp dword [ebp - 0x20], ebx
jne 0x407774
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x40dbf4], ebx
je 0x407795
push 0x40dbf4
call fcn.00407c40
pop ecx
test eax, eax
je 0x407795
push ebx
push 2
push ebx
call dword [0x40dbf4]
mov eax, dword [sym.imp.MSVCR90.dll__wcmdln]
cmp dword [eax], ebx
je 0x407867
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
ja 0x4077ff
cmp cx, bx
je 0x4077ba
cmp dword [ebp - 0x1c], ebx
jne 0x4077ff
movzx ecx, word [eax]
cmp cx, bx
je 0x4077cf
cmp cx, 0x20
ja 0x4077cf
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x4077ba
test byte [ebp - 0x40], 1
je 0x4077db
movzx ecx, word [ebp - 0x3c]
jmp 0x4077de
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x400000
call main
mov dword [0x40d3e8], eax
cmp dword [0x40d3dc], ebx
jne 0x407844
push eax
call dword [sym.imp.MSVCR90.dll_exit]
cmp cx, 0x22
jne 0x407810
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
inc eax
inc eax
jmp 0x4077a4
cmp dword [0x40d3ec], ebx
jne 0x407852
call dword [sym.imp.MSVCR90.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x40d3e8]
jmp 0x407873
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.004079a9
ret
call fcn.00560000
jmp 0x40769b
Function at 0x4010a0
Capabilities:
Terminate process

Disassembly:
push esi
push edi
call fcn.00401e40
call fcn.00401ef0
mov esi, eax
push esi
call fcn.00401e10
push 0
push eax
push esi
mov dword [eax + 0xc], fcn.00401ca0
call fcn.004023e0
mov edi, dword [esp + 0xc]
cmp edi, 2
jl 0x401104
push dword [esp + 0x10]
push edi
push esi
call fcn.00401150
add esp, 0xc
push esi
call fcn.00401df0
test eax, eax
js 0x401109
push dword [esp + 0x10]
push edi
push esi
call fcn.004013d0
add esp, 0xc
push esi
call fcn.00402270
push esi
call fcn.00403080
pop edi
xor eax, eax
pop esi
ret
call fcn.00401970
push str.config_error__n
call fcn.00401120
add esp, 4
push 1
call fcn.00423abc
int3