joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402ff0
Capabilities:
Modify service
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x42100c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [0x4224dc], eax
test eax, eax
jne 0x403080
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenSCManager_failed_w_err_0x_08lx_n
push 0x42260c
call fcn.00404cf0
mov esi, dword [0x42260c]
add esp, 8
mov ebx, esp
mov dword [ebp - 0xc], ebx
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [esi - 4], 0
mov ecx, eax
lea eax, [esi - 4]
jl 0x403062
cmp ecx, dword [esi - 0x10]
jne 0x403062
lea edi, [esi - 0x10]
lock inc dword [eax]
jmp 0x403152
mov eax, dword [ecx]
push 1
push dword [esi - 0xc]
call dword [eax]
mov edi, eax
test edi, edi
je 0x4031a2
mov ecx, dword [esi - 0xc]
mov dword [edi + 4], ecx
jmp 0x403141
push 0xf01ff
push 0x41eb6c
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [0x4224d8], eax
test eax, eax
jne 0x4030ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenService_failed_w_err_0x_08lx_n
jmp 0x403027
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0x41ebd4
push ecx
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
test eax, eax
jns 0x4030d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ChangeServiceConfig2_failed_w_err_0x_08lx_n
jmp 0x403027
push 0
push 0
push dword [0x4224d8]
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jns 0x40315f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.StartService_failed_w_err_0x_08lx_n
push 0x42260c
call fcn.00404cf0
mov esi, dword [0x42260c]
add esp, 8
mov ebx, esp
mov dword [ebp - 0xc], ebx
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [esi - 4], 0
mov ecx, eax
lea eax, [esi - 4]
jl 0x40312c
cmp ecx, dword [esi - 0x10]
jne 0x40312c
lea edi, [esi - 0x10]
lock inc dword [eax]
jmp 0x403152
mov eax, dword [ecx]
push 1
push dword [esi - 0xc]
call dword [eax]
mov edi, eax
test edi, edi
je 0x4031a2
mov eax, dword [esi - 0xc]
mov dword [edi + 4], eax
mov edx, dword [esi - 0xc]
lea ecx, [edi + 0x10]
inc edx
push edx
push esi
call fcn.00404b50
add esp, 8
lea eax, [edi + 0x10]
mov dword [ebx], eax
call fcn.00401710
add esp, 4
mov eax, dword [0x4224dc]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
je 0x40317b
push eax
call esi
mov dword [0x4224dc], 0
mov eax, dword [0x4224d8]
test eax, eax
je 0x403191
push eax
call esi
mov dword [0x4224d8], 0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004052ed
mov esp, ebp
pop ebp
ret
call fcn.004048e0
int3
Function at 0x404da0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x404df9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x404df9
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x404de8
cmp esi, edx
jae 0x404df9
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x404dd6
cmp esi, edx
jae 0x404df9
cmp word [esi], 0
je 0x404df9
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x40c42b
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0040d83e

Function at 0x40d344
Capabilities:
Contain obfuscated stackstrings

Disassembly:
ror byte [ebx + 0x318b0441], 1
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x40d354
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x40d345
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.0040d100
sbb byte [edi + 0x458d3235], dh
test al, 0x50
call fcn.0040d110
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.0040d0c5
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x40d3ee
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
ror byte [eax + 0x45c6c15d], 0xc2
in al, dx

Function at 0x40d3fa
Capabilities:
Contain obfuscated stackstrings

Disassembly:
ror byte [eax + 0x45c6c15d], 0xc2
in al, dx
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.0040d100
out dx, al
lodsd eax, dword [esi]
cmpsd dword [esi], dword es:[edi]
lcall 0xc5e8, 0x50c0458d
cld
invalid
Function at 0x40d7f4
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x40d7d7
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x40d7f5
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
invalid
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x40d853
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x40d83a
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x40d843
invalid
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x40d84d
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x40d82f
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x40d7b9
mov dword [ebp + 8], esi
xor edi, edi

Function at 0x40d80e
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x40d7d7
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x40d7f5
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
invalid
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x40d853
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x40d83a
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x40d843
invalid
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x40d84d
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x40d82f
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x40d7b9
mov dword [ebp + 8], esi
xor edi, edi

Function at 0x40d83e
Capabilities:
Inspect section memory permissions

Disassembly:
add al, 0x80
or al, 8
add bh, byte [ecx]
pop ebp
adc byte [ebp + eax + 3], dh
enter 0x980, 4

Function at 0x40ecb7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [ebx]
mov byte [ebp - 0x785], 0x3c
mov byte [ebp - 0x784], 0x30
mov byte [ebp - 0x783], 0x3a
mov byte [ebp - 0x782], 0x2d
mov byte [ebp - 0x781], 0x71
mov byte [ebp - 0x780], 0x3b
mov byte [ebp - 0x77f], 0x33
Function at 0x40edf3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax], al
add byte [eax - 0x7ab5b], al
inc dword [eax]
and byte [ebp - 0x7ab], 0
mov byte [ebp - 0x7aa], 0xed
and byte [ebp - 0x7a9], 0
mov byte [ebp - 0x7a8], 0x4e
mov byte [ebp - 0x7a7], 0x55
mov byte [ebp - 0x7a6], 0x56
mov byte [ebp - 0x7a5], 0x7e
mov byte [ebp - 0x7a4], 0x21
mov byte [ebp - 0x7a3], 0x20
mov byte [ebp - 0x7a2], 0x3c
mov byte [ebp - 0x7a1], 0x76
mov byte [ebp - 0x7a0], 0x7e
mov byte [ebp - 0x79f], 0x7e
mov byte [ebp - 0x79e], 0x12
push 0xb
lea eax, [ebp - 0x7ac]
push eax
call fcn.0040d110
pop ecx
push eax
mov eax, dword [ebp - 0x338]
lea eax, [ebp + eax - 0x230]
push eax
call fcn.0040d071
add esp, 0xc
jmp 0x40f078

Function at 0x10018c71
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x10018c80
pop dword [ebp - 0x24]
mov eax, 0x10018c80
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x3e970
push 0
mov eax, 0x5dc47c2b
add eax, 0xb23ee4b1
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0xb5264964
sub ecx, 0xb52608b3
mov esi, eax
mov edi, 0x8fe35a96
add edi, 0x8020636a
add edi, dword [ebp - 0x24]
mov ebx, 0x78c41193
sub ebx, 0x9701eccb
xor dword [ebp - 0x1c], 0x505e92ad
mov edx, dword [edi]
add dword [ebp - 4], eax
xor edx, ebx
add dword [ebp - 0x10], 0xe2ea5f1f
mov dword [esi], edx
add dword [ebp - 8], 0xa7517726
add esi, 4
add edi, 0xb506d71a
add edi, 0x4af928ea
loop 0x10018cda
add eax, 0x1960b9ad
sub eax, 0x195fc416
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x100289d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x100330b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10035b0c]
test dword [ebp + 8], eax
je 0x10028a7a
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x808]
push eax
call fcn.10018c71
xor eax, eax
add esp, 0xc
mov word [ebp - 8], ax
mov eax, dword [0x10035b08]
test eax, eax
je 0x10028a6d
lea ecx, [ebp - 0x808]
push ecx
push eax
call fcn.10018c71
mov eax, dword [0x100330ac]
pop ecx
pop ecx
test eax, eax
jle 0x10028a7a
push esi
mov esi, dword [0x10035b10]
push edi
mov edi, dword [0x10035b14]
cdq
push edx
push eax
push edi
push esi
call fcn.10029420
add esi, 1
mov dword [0x10035b10], esi
adc edi, 0
or eax, edx
mov dword [0x10035b14], edi
pop edi
pop esi
jne 0x10028a7a
push dword [0x10035b08]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
pop ecx
jmp 0x10028a7a
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10028d50
leave
ret
Function at 0x5f50be
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d8
push edi
push esi
and dword [ebp - 0x28], 0
push ebx
push ebp
push 0
call dword [sym.imp.MSVCRT.dll__commit]
add esp, 4
inc eax
jne entry0
mov dword [ebp - 0xc], 0xffffffff
lea ecx, [ebp - 0xc]
push ecx
push ecx
call dword [sym.imp.DNSAPI.dll_DnsValidateName_W]
xor ebx, ebx
sub ebx, eax
mov ecx, 0xffffffa9
mov dword [ebp - 0x18], ebx
xor dword [ebp - 0x18], ecx
jne entry0
xor ebx, ebx
mov dword [ebp - 4], ebx
push ebx
popfd
sub ecx, ecx
add ecx, 0x5d2454
neg ecx
sub ebx, ecx
add ebx, dword [ebp - 0x18]
mov dword [ebp - 0xc], ebx
mov edi, ebp
mov esi, 0x1a8
neg esi
add edi, esi
mov dword [ebp - 0x10], edi
xor esi, esi
add esi, section..data
mov dword [ebp - 0x28], 0
xor dword [ebp - 0x28], esi
mov edi, dword [ebp - 0x10]
sub edi, 0xfffffff0
mov dword [ebp - 0x1c], edi
sub dword [ebp - 4], 0x30
not dword [ebp - 4]
sub dword [ebp - 4], 0xffffffff
push dword [ebp - 0x28]
push dword [ebp - 4]
push dword [ebp - 0xc]
lea edi, [ebp - 0x1a8]
push edi
call fcn.005f5000
mov edi, dword [ebp - 0x10]
mov edi, dword [edi + 4]
mov esi, dword [ebp - 0x10]
add edi, dword [esi]
mov dword [ebp - 0x24], edi
mov edi, 0x40
push edi
and dword [ebp - 0x18], 0
push 0x3000
push dword [ebp - 0x24]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
mov dword [ebp - 0x20], 0x400000
and dword [ebp - 0x1ac], 0
jmp 0x5f51b6
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
mov ebx, dword [ebp - 0x1c]
add ebx, 8
mov dword [ebp - 0x1c], ebx
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp - 0x1ac]
mov esi, dword [eax + 8]
cmp edi, esi
jae 0x5f51f2
push dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
push dword [edx + 4]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
add ecx, dword [edx]
push ecx
mov edi, dword [ebp - 8]
add edi, dword [ebp - 0x18]
push edi
call fcn.005f5233
mov ebx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x18]
add edi, dword [ebx + 4]
mov dword [ebp - 0x18], edi
jmp 0x5f51a0
mov eax, dword [ebp - 0x20]
push eax
mov edx, dword [ebp - 8]
mov edi, GetACP
add edx, edi
mov dword [ebp - 0x14], edx
push dword [ebp - 0x19c]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
add edx, dword [eax + 4]
push edx
mov edx, dword [ebp - 0x14]
push edx
push 0x58000000
mov eax, dword [ebp - 0x14]
push eax
ret 4
Function at 0x40396c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
nop
lea eax, [ebp - 0x44]
push eax
call sub.kernel32.dll_GetStartupInfoA
mov eax, dword [ebp - 0x18]
and eax, 1
cmp eax, 0
je 0x40399a
movzx eax, word [ebp - 0x14]
mov dword [ebp - 0x50], eax
jmp 0x4039a2
mov eax, 0xa
mov dword [ebp - 0x50], eax
mov eax, 0
mov dword [ebp - 0x48], eax
call sub.kernel32.dll_GetCommandLineA
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 8]
cmp eax, 0
je 0x4039d1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0x4c]
push eax
call sub.msvcrt.dll_strstr
add esp, 8
mov dword [ebp - 0x48], eax
mov eax, 0
mov ecx, dword [ebp - 0x48]
cmp eax, ecx
jne 0x4039f7
mov eax, 0x404268
push eax
call sub.msvcrt.dll__strdup
add esp, 4
mov dword [ebp - 0x48], eax
jmp 0x403a20
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x4c]
cmp eax, ecx
jbe 0x403a20
mov eax, dword [ebp - 0x48]
add eax, 0xffffffff
movsx ecx, byte [eax]
cmp ecx, 0x22
jne 0x403a20
mov eax, dword [ebp - 0x48]
add eax, 0xffffffff
mov dword [ebp - 0x48], eax
mov eax, 0x30000
push eax
mov eax, 0x10000
push eax
call sub.msvcrt.dll__controlfp
add esp, 8
mov eax, 0
push eax
call sub.kernel32.dll_GetModuleHandleA
mov ecx, dword [ebp - 0x50]
push ecx
mov ecx, dword [ebp - 0x48]
push ecx
mov ecx, 0
push ecx
push eax
call fcn.004027d8
leave
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x46d054], 1
mov dword [0x46d050], 1
mov dword [0x46d04c], 1
jne 0x401056
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010b0
mov dword [0x46d00c], eax
mov eax, dword [0x46d060]
test eax, eax
je 0x4010a0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x46d074]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x46d05c]
mov dword [eax], edx
call sym.__setargv
cmp dword [0x455ad4], 1
je 0x4010e0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x401070
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x4010f8
cmp dx, 0x20b
jne 0x401056
cmp dword [ecx + 0x84], 0xe
jbe 0x401056
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401056
mov dword [esp], sym.__matherr
call sym.___mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401056
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401056

Function at 0x401c66
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
or edx, 0xab
neg eax
bswap esi
rcr ebx, 0x26
not edi
bswap eax
and edx, 0xd7
add edi, 0x47
rcl edx, 0x62
sub esi, 0x34
dec eax
mov edi, 0xa7
bswap esi
ror eax, 0x18
dec eax
not eax
dec edi
bswap edx
rcl esi, 0x81
neg edx
inc ebx
rol eax, 0x10
sbb eax, 4
imul edx
and edx, 0xce
rol edx, 0xa8
neg ebx
and edx, 0x8b
and eax, 0x55
imul edx
dec edi
imul esi
neg edx
bswap edi
rcr edi, 0xe3
rcl edi, 0x2d
neg ebx
not ebx
and eax, 0x5e
add esi, 0xb9
sbb ebx, 0xbb
and edi, 0x3a
bswap ebx
not ebx
inc esi
ror eax, 0x22
not eax
ror esi, 0x82
inc eax
rcl edi, 0x50
neg eax
mov eax, 0xdc
inc ebx
rcl esi, 0x9a
dec edx
and edx, 0x82
or eax, 0xa9
rcl edx, 0xb2
or ebx, 0xea
or ebx, 0xbf
and ebx, 0x91
bswap esi
sbb eax, 0x1c
rol edi, 0xa8
neg ebx
ror eax, 0x6f
sbb eax, 0x45
inc esi
sub ebx, 0xe4
inc esi
rcr eax, 0x48
rcr ebx, 0xe1
rol esi, 0x40
mov esi, 0xaa
rol edx, 0x5d
dec esi
neg eax
inc eax
not esi
rcr ebx, 0x18
rol eax, 0x1d
sub esi, 0x68
neg edi
not esi
dec ebx
inc edx
mov ebx, 0x1e
sub eax, 0xc8
dec ebx
rol ebx, 0xad
bswap esi
rol ebx, 0xf3
mov edx, 0x62
or ebx, 0x62
bswap eax
neg edx
not ebx
neg edx
sub ebx, 0xbb
not esi
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call eax
sub esp, 0x10
nop
leave
ret
Function at 0x405310
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call sym.___acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call sym.___acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x405370
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x46d068]
test esi, esi
jle 0x405490
mov eax, dword [0x46d06c]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x4053a4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x405427
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x405390
mov dword [esp], ebx
call sym.___mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x4054b7
mov eax, dword [0x46d06c]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call sym.__GetPEImageBase
mov edx, dword [0x46d06c]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x405497
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x405420
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x405430
add dword [0x46d068], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x46d06c]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x405420
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call sym.___report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x4053ae
mov eax, dword [0x46d06c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call sym.___report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call sym.___report_error
lea esi, [esi]
nop
Function at 0x4059d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x46d084
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x46d07c]
sub esp, 4
test ebx, ebx
je 0x405a25
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x405a1e
test esi, esi
je 0x405a1e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x405a00
mov dword [esp], 0x46d084
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x405d60
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x405d85
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x405d90
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x405d85
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x405dd8
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x405dce
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x405dda
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x405dc0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
mov eax, 0x1014
push ebp
mov ebp, esp
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
or eax, 0xffffffff
mov dword [0x415c84], 9
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
mov dword [ebp - 8], eax
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
mov ecx, 0x1000
xor eax, eax
lea edx, [ebp - 0x1010]
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
mov edi, eax
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
mov eax, esi
sub eax, edi
test eax, eax
mov esi, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40701c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x407028
push 0x407024
push 0x407020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x407028]
push dword [0x407024]
push dword [0x407020]
mov dword [0x407014], esp
call fcn.004014e0
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret
Function at 0x419220
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43717c]
jne 0x41922a
repz ret
jmp fcn.00423c10