joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406451
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x238
mov eax, 0x40e9c3
call fcn.0040d3d4
mov dword [ebp - 0x21c], ecx
movzx eax, word [ebp + 8]
xor edi, edi
mov esi, dword [0x4166f0]
inc edi
push 0xf0
push eax
push esi
call dword [sym.imp.kernel32.dll_FindResourceW]
test eax, eax
je 0x4065c3
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
je 0x4065c3
push eax
call dword [sym.imp.kernel32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4065c3
movzx eax, word [esi]
xor ecx, ecx
cmp cx, ax
je 0x4065c3
mov ecx, dword [esi + 4]
mov ebx, eax
movzx eax, word [esi + 2]
add esi, 8
mov dword [ebp - 0x220], ecx
mov ecx, 0x403
cmp cx, ax
jne 0x40653b
push 3
lea eax, [ebp - 0x110]
push esi
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x114], eax
call main
push dword [ebp - 0x114]
mov eax, dword [ebp - 0x21c]
and dword [ebp - 4], 0
push 0
push 0x143
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
lea eax, [ebp - 0x110]
cmove edi, ecx
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x114], eax
je 0x4065b1
push dword [ebp - 0x114]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
jmp 0x4065b1
mov ecx, 0x1234
cmp cx, ax
jne 0x4065b1
or dword [ebp - 0x240], 0xffffffff
lea eax, [ebp - 0x214]
push 3
push esi
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x244], 1
mov dword [ebp - 0x218], eax
call main
mov eax, dword [ebp - 0x218]
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x23c], eax
cmp eax, ecx
je 0x40658e
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
lea eax, [ebp - 0x244]
push eax
mov eax, dword [ebp - 0x21c]
push 0
push 0x40b
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
cmp eax, 0xffffffff
je 0x4065c1
add esi, dword [ebp - 0x220]
test edi, edi
jne 0x4064a9
jmp 0x4065c3
xor edi, edi
mov eax, edi
call fcn.0040d38f
ret 4

Function at 0x4094e3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x4094f2
pop dword [ebp - 0x1c]
mov eax, 0x4094f2
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x36622
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0x701f49e3
add ecx, 0x8fe0f643
xor esi, esi
add esi, eax
mov edx, 0x8cfa34c2
sub edx, 0x8cb88ac2
add edx, dword [ebp - 0x1c]
mov edi, 0x45ef3262
sub edi, 0x1abc942a
add dword [ebp - 0x10], 0x4201f52a
mov ebx, dword [edx]
xor ebx, edi
mov dword [ebp - 0x10], 0xa91442f9
mov dword [esi], ebx
mov dword [ebp - 0x14], 0xb276f842
add esi, 0xe79b04e
add esi, 0xf1864fb6
add edx, 4
loop 0x409549
add eax, 0x79511647
sub eax, 0x795022dc
xor ebx, ebx
add ebx, eax
add eax, 0xb79d5a9c
sub eax, 0xb79d5a97
mov ecx, 0x400000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x40b280
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a2276
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4cb450]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], 0x4b0cc8
call fcn.00482897
push 4
mov dword [ebp - 4], 0
call fcn.004835e7
mov edi, eax
add esp, 4
mov dword [ebp - 0x18], edi
mov byte [ebp - 4], 1
test edi, edi
je 0x40b307
call fcn.004825bc
mov dword [edi], eax
call fcn.004822fd
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.00482166
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x40b2fd
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.0048218e
jmp 0x40b309
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x451480
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
movzx ebx, byte [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 4]
push edi
mov edi, dword [ebp + 0xc]
push ebx
mov dword [edi + 4], eax
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 8]
lea ecx, [edi + 8]
push ecx
push edx
push eax
call dword [sym.imp.libcef.dll_cef_string_utf16_set]
mov edx, dword [esi + 0x18]
mov eax, dword [esi + 0x14]
push ebx
lea ecx, [edi + 0x14]
push ecx
push edx
push eax
call dword [sym.imp.libcef.dll_cef_string_utf16_set]
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x20]
push ebx
lea ecx, [edi + 0x20]
push ecx
push edx
push eax
call dword [sym.imp.libcef.dll_cef_string_utf16_set]
mov edx, dword [esi + 0x30]
mov eax, dword [esi + 0x2c]
push ebx
lea ecx, [edi + 0x2c]
push ecx
push edx
push eax
call dword [sym.imp.libcef.dll_cef_string_utf16_set]
mov edx, dword [esi + 0x3c]
mov eax, dword [esi + 0x38]
add esp, 0x40
push ebx
lea ecx, [edi + 0x38]
push ecx
push edx
push eax
call dword [sym.imp.libcef.dll_cef_string_utf16_set]
mov edx, dword [esi + 0x48]
mov eax, dword [esi + 0x44]
push ebx
lea ecx, [edi + 0x44]
push ecx
push edx
push eax
call dword [sym.imp.libcef.dll_cef_string_utf16_set]
mov ecx, dword [esi + 0x50]
mov dword [edi + 0x50], ecx
mov edx, dword [esi + 0x54]
mov dword [edi + 0x54], edx
mov eax, dword [esi + 0x58]
mov dword [edi + 0x58], eax
mov ecx, dword [esi + 0x5c]
push ebx
mov dword [edi + 0x5c], ecx
mov eax, dword [esi + 0x64]
mov ecx, dword [esi + 0x60]
lea edx, [edi + 0x60]
push edx
push eax
push ecx
call dword [sym.imp.libcef.dll_cef_string_utf16_set]
mov edx, dword [esi + 0x6c]
mov dword [edi + 0x6c], edx
mov eax, dword [esi + 0x70]
mov dword [edi + 0x70], eax
mov ecx, dword [esi + 0x74]
mov dword [edi + 0x74], ecx
mov edx, dword [esi + 0x78]
mov dword [edi + 0x78], edx
mov eax, dword [esi + 0x7c]
mov dword [edi + 0x7c], eax
mov ecx, dword [esi + 0x80]
mov dword [edi + 0x80], ecx
mov edx, dword [esi + 0x84]
mov dword [edi + 0x84], edx
mov eax, dword [esi + 0x88]
mov dword [edi + 0x88], eax
mov ecx, dword [esi + 0x8c]
mov dword [edi + 0x8c], ecx
mov edx, dword [esi + 0x90]
mov dword [edi + 0x90], edx
mov eax, dword [esi + 0x94]
mov dword [edi + 0x94], eax
mov ecx, dword [esi + 0x98]
mov dword [edi + 0x98], ecx
mov edx, dword [esi + 0x9c]
mov dword [edi + 0x9c], edx
mov eax, dword [esi + 0xa0]
mov dword [edi + 0xa0], eax
mov ecx, dword [esi + 0xa4]
mov dword [edi + 0xa4], ecx
mov edx, dword [esi + 0xa8]
mov dword [edi + 0xa8], edx
mov eax, dword [esi + 0xac]
mov dword [edi + 0xac], eax
mov ecx, dword [esi + 0xb0]
mov dword [edi + 0xb0], ecx
mov edx, dword [esi + 0xb4]
mov dword [edi + 0xb4], edx
mov eax, dword [esi + 0xb8]
mov dword [edi + 0xb8], eax
mov ecx, dword [esi + 0xc0]
mov edx, dword [esi + 0xbc]
push ebx
add edi, 0xbc
push edi
push ecx
push edx
call dword [sym.imp.libcef.dll_cef_string_utf16_set]
add esp, 0x40
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x483ae4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4cb450]
jne 0x483aee
repz ret
jmp fcn.0048867c
Function at 0x492317
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4cb450]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00488068
and dword [ebp - 0x14], 0
cmp dword [0x4cd620], 0
mov dword [ebp - 0x18], eax
jne 0x4923ca
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x492472
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x492472
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4cd620], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4cd624], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4cd628], eax
call edi
push eax
call esi
mov dword [0x4cd630], eax
test eax, eax
je 0x4923ca
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4cd62c], eax
mov eax, dword [0x4cd62c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x492423
cmp dword [0x4cd630], ecx
je 0x492423
push eax
call esi
push dword [0x4cd630]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x492423
test ebx, ebx
je 0x492423
call edi
test eax, eax
je 0x49241a
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x49241a
test byte [ebp - 8], 1
jne 0x492423
or dword [ebp + 0x10], 0x200000
jmp 0x492456
mov eax, dword [0x4cd624]
cmp eax, dword [ebp - 0x18]
je 0x492456
push eax
call esi
test eax, eax
je 0x492456
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x492456
mov eax, dword [0x4cd628]
cmp eax, dword [ebp - 0x18]
je 0x492456
push eax
call esi
test eax, eax
je 0x492456
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4cd620]
call esi
test eax, eax
je 0x492472
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x492474
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00483ae4
leave
ret
Function at 0x9f6058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.009f61a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x9f607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9f606a
add dl, dl
jne 0x9f6089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9f60dc
xor eax, eax
add dl, dl
jne 0x9f6096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9f617d
add dl, dl
jne 0x9f60a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9f60b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9f60bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9f60c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9f60d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x9f6075
mov eax, 1
add dl, dl
jne 0x9f60ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9f60f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9f60e1
sub eax, ebx
mov ebx, 1
jne 0x9f6128
mov ecx, 1
add dl, dl
jne 0x9f610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9f6119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9f6105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9f6075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x9f613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9f614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9f6136
cmp eax, 0x7d00
jae 0x9f616d
cmp eax, 0x500
jb 0x9f6168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9f6075
cmp eax, 0x7f
ja 0x9f6170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9f6075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x9f619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x9f6075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0xe0301a0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
sub esp, 4
push ebx
mov eax, dword [ecx]
mov dx, ax
push esi
test dx, dx
push edi
mov dword [esp + 0xc], eax
push ebp
mov cx, word [esp + 0x12]
jne 0xe0301cb
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
xor si, si
mov eax, dword [esp + 0x18]
mov ax, word [eax + 0x3310]
mov word [esp + 0x10], ax
cmp ax, si
je 0xe030257
movzx edi, si
mov eax, edi
lea ebx, [edi + edi*4]
lea edi, [ebx + ebx*8]
sub edi, eax
mov eax, dword [esp + 0x18]
mov ebx, dword [eax + 0x3314]
mov edi, dword [edi + ebx + 0x14]
mov bx, word [edi + 6]
add edi, 0xc
mov ax, bx
dec bx
test ax, ax
je 0xe03024e
test cx, cx
je 0xe03021a
cmp word [edi + 0xc], cx
jne 0xe030227
cmp word [edi + 8], dx
jne 0xe030227
cmp word [edi + 0xa], 8
je 0xe030261
xor eax, eax
mov ax, word [edi + 2]
mov ebp, eax
shl eax, 3
sub eax, ebp
mov bp, bx
add eax, eax
dec bx
add eax, 0x26
add edi, eax
mov eax, edi
neg eax
and eax, 3
add edi, eax
test bp, bp
jne 0xe03020f
inc si
cmp si, word [esp + 0x10]
jb 0xe0301e3
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov ax, word [edi + 0x12]
and ax, 2
cmp ax, 1
sbb eax, eax
inc eax
je 0xe030259
test cx, cx
jne 0xe030259
mov dx, word [edi + 0xc]
mov ecx, dword [esp + 0x1c]
mov word [ecx + 2], dx
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0xe032830
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sbb bh, bh
jne 0xe032848
call fcn.0e031f4d
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.0e031f98
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0e031f4d
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], pe_nt_image_headers32
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.0e031f98
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0e031f4d
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.0e031f88
add dword [esi + ebx*8 - 0x335a7fed], esi
cli
invalid
Function at 0xe032c80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jne 0xe032e0e
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.0e031f98
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0e031f4d
add esp, 0xc
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x6a0], 0x8b
or byte [ebp - 0x69f], 0xff
mov byte [ebp - 0x69e], 0x55
mov byte [ebp - 0x69d], 0x8b
mov byte [ebp - 0x69c], 0xec
lea eax, [ebp - 0x694]
push eax
push 5
lea eax, [ebp - 0x6a0]
push eax
invalid
mov ch, 0xc4
cld
Function at 0xe03ee30
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
call fcn.0e03eec0
mov dword [0xe0506a0], 1
cmp dword [esp + 0x10], 0
mov ebx, dword [esp + 0x14]
mov byte [0xe05069c], bl
jne 0xe03ee91
cmp dword [0xe0537b8], 0
je 0xe03ee7f
mov esi, dword [0xe0537b4]
sub esi, 4
cmp esi, dword [0xe0537b8]
jb 0xe03ee7f
mov eax, dword [esi]
test eax, eax
je 0xe03ee74
call eax
sub esi, 4
cmp esi, dword [0xe0537b8]
jae 0xe03ee6c
push 0xe04e01c
push 0xe04e014
call fcn.0e03eee0
add esp, 8
push 0xe04e024
push 0xe04e020
call fcn.0e03eee0
add esp, 8
test ebx, ebx
je 0xe03eeaf
call fcn.0e03eed0
pop esi
pop ebx
ret
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0xe03ef00
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push esi
call fcn.0e040ff0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0xe0506a4], eax
cmp eax, 0xffffffff
jne 0xe03ef1a
xor eax, eax
pop esi
ret
push 0x74
push 1
call fcn.0e042eb0
add esp, 8
mov esi, eax
test esi, esi
je 0xe03ef5c
push esi
mov eax, dword [0xe0506a4]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0xe03ef5c
push esi
call fcn.0e03ef90
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi], eax
mov eax, 1
mov dword [esi + 4], 0xffffffff
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0xe03efb0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0xe0506a4]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0xe03f013
push 0x74
push 1
call fcn.0e042eb0
add esp, 8
mov edi, eax
test edi, edi
je 0xe03f009
push edi
mov eax, dword [0xe0506a4]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0xe03f009
push edi
call fcn.0e03ef90
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [edi], eax
mov dword [edi + 4], 0xffffffff
jmp 0xe03f013
push 0x10
call fcn.0e03ce70
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop esi
ret
Function at 0xe03f9c0
Capabilities:
Query environment variable

Disassembly:
sub esp, 4
cmp dword [0xe0508f4], 0
push ebx
push esi
push edi
push ebp
jne 0xe03fa10
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
call esi
mov edi, eax
test edi, edi
je 0xe03f9ee
mov dword [0xe0508f4], 1
mov ebx, dword [esp + 0x10]
jmp 0xe03fa1e
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
je 0xe03fa06
mov dword [0xe0508f4], 2
jmp 0xe03fa1e
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
cmp dword [0xe0508f4], 1
jne 0xe03facd
test edi, edi
jne 0xe03fa41
call esi
mov edi, eax
test edi, edi
jne 0xe03fa41
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp word [edi], 0
mov esi, edi
je 0xe03fa5b
add esi, 2
cmp word [esi], 0
jne 0xe03fa49
add esi, 2
cmp word [esi], 0
jne 0xe03fa49
sub esi, edi
push 0
sar esi, 1
push 0
inc esi
push 0
push 0
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebp, eax
test ebp, ebp
je 0xe03fabc
push ebp
call fcn.0e042e30
add esp, 4
mov ebx, eax
test ebx, ebx
je 0xe03fabc
push 0
push 0
push ebp
push ebx
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0xe03faab
push ebx
call fcn.0e042f10
add esp, 4
xor ebx, ebx
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [0xe0508f4], 2
jne 0xe03fb51
test ebx, ebx
jne 0xe03faf0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
jne 0xe03faf0
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov ebp, ebx
cmp byte [ebx], 0
je 0xe03fb05
inc ebp
cmp byte [ebp], 0
jne 0xe03faf7
inc ebp
cmp byte [ebp], 0
jne 0xe03faf7
sub ebp, ebx
inc ebp
push ebp
call fcn.0e042e30
mov dword [esp + 0x14], eax
add esp, 4
test eax, eax
jne 0xe03fb2a
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov edi, dword [esp + 0x10]
mov esi, ebx
mov ecx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0xe03fbb0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1a8
xor eax, eax
mov ecx, 0xe050b60
push ebx
mov edx, dword [esp + 0x1b0]
push esi
push edi
push ebp
cmp dword [ecx], edx
je 0xe03fbd8
add ecx, 8
inc eax
cmp ecx, 0xe050be8
jb 0xe03fbc8
cmp dword [eax*8 + 0xe050b60], edx
lea ebx, [eax*8]
jne 0xe03fd93
cmp dword [0xe0502f0], 1
je 0xe03fd58
cmp dword [0xe0502f0], 0
jne 0xe03fc0f
cmp dword [0xe0502f4], 1
je 0xe03fd58
cmp edx, 0xfc
je 0xe03fd93
lea eax, [esp + 0xb4]
push 0x104
push eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
call ebp
test eax, eax
jne 0xe03fc4c
mov esi, str._program_name_unknown_
lea edi, [esp + 0xb4]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ebp, [esp + 0xb4]
lea edi, [esp + 0xb4]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
cmp ecx, 0x3c
jbe 0xe03fc90
lea edi, [esp + 0xb4]
mov ecx, 0xffffffff
sub eax, eax
push 3
repne scasb al, byte es:[edi]
not ecx
lea ebp, [esp + ecx + 0x7c]
push 0xe050c34
push ebp
call fcn.0e042fd0
add esp, 0xc
mov esi, str.Runtime_Error__n_nProgram:
lea edi, [esp + 0x14]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, ebp
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0xe050c14
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebx + 0xe050b64]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
lea edi, [esp + 0x14]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x12010
and ecx, 3
push str.Microsoft_Visual_C_Runtime_Library
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x1c]
push eax
call fcn.0e042f30
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a8
ret
mov eax, dword [0xe0536b0]
mov esi, dword [eax + 0x48]
cmp esi, 0xffffffff
jne 0xe03fd6f
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
mov edx, dword [ebx + 0xe050b64]
push 0
lea eax, [esp + 0x14]
mov edi, edx
push eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a8
ret