joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425000
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
movzx eax, al
movzx edx, byte [eax + str.cw]
mov eax, dword [ebp + 8]
mov byte [eax], dl
mov eax, dword [ebp + 8]
add eax, 4
movzx eax, byte [eax]
movzx eax, al
mov edx, dword [ebp + 8]
add edx, 4
movzx eax, byte [eax + str.cw]
mov byte [edx], al
mov eax, dword [ebp + 8]
add eax, 8
movzx eax, byte [eax]
movzx eax, al
mov edx, dword [ebp + 8]
add edx, 8
movzx eax, byte [eax + str.cw]
mov byte [edx], al
mov eax, dword [ebp + 8]
add eax, 0xc
movzx eax, byte [eax]
movzx eax, al
mov edx, dword [ebp + 8]
add edx, 0xc
movzx eax, byte [eax + str.cw]
mov byte [edx], al
mov eax, dword [ebp + 8]
add eax, 1
movzx eax, byte [eax]
movzx eax, al
movzx eax, byte [eax + str.cw]
mov byte [ebp - 1], al
mov eax, dword [ebp + 8]
add eax, 5
movzx eax, byte [eax]
movzx eax, al
mov edx, dword [ebp + 8]
add edx, 1
movzx eax, byte [eax + str.cw]
mov byte [edx], al
mov eax, dword [ebp + 8]
add eax, 9
movzx eax, byte [eax]
movzx eax, al
mov edx, dword [ebp + 8]
add edx, 5
movzx eax, byte [eax + str.cw]
mov byte [edx], al
mov eax, dword [ebp + 8]
add eax, 0xd
movzx eax, byte [eax]
movzx eax, al
mov edx, dword [ebp + 8]
add edx, 9
movzx eax, byte [eax + str.cw]
mov byte [edx], al
mov eax, dword [ebp + 8]
lea edx, [eax + 0xd]
movzx eax, byte [ebp - 1]
mov byte [edx], al
mov eax, dword [ebp + 8]
add eax, 2
movzx eax, byte [eax]
movzx eax, al
movzx eax, byte [eax + str.cw]
mov byte [ebp - 1], al
mov eax, dword [ebp + 8]
add eax, 0xa
movzx eax, byte [eax]
movzx eax, al
mov edx, dword [ebp + 8]
add edx, 2
movzx eax, byte [eax + str.cw]
mov byte [edx], al
mov eax, dword [ebp + 8]
lea edx, [eax + 0xa]
movzx eax, byte [ebp - 1]
mov byte [edx], al
mov eax, dword [ebp + 8]
add eax, 6
movzx eax, byte [eax]
movzx eax, al
movzx eax, byte [eax + str.cw]
mov byte [ebp - 1], al
mov eax, dword [ebp + 8]
add eax, 0xe
movzx eax, byte [eax]
movzx eax, al
mov edx, dword [ebp + 8]
add edx, 6
movzx eax, byte [eax + str.cw]
mov byte [edx], al
mov eax, dword [ebp + 8]
lea edx, [eax + 0xe]
movzx eax, byte [ebp - 1]
mov byte [edx], al
mov eax, dword [ebp + 8]
add eax, 0xf
movzx eax, byte [eax]
movzx eax, al
movzx eax, byte [eax + str.cw]
mov byte [ebp - 1], al
mov eax, dword [ebp + 8]
add eax, 0xb
movzx eax, byte [eax]
movzx eax, al
mov edx, dword [ebp + 8]
add edx, 0xf
movzx eax, byte [eax + str.cw]
mov byte [edx], al
mov eax, dword [ebp + 8]
add eax, 7
movzx eax, byte [eax]
movzx eax, al
mov edx, dword [ebp + 8]
add edx, 0xb
movzx eax, byte [eax + str.cw]
mov byte [edx], al
mov eax, dword [ebp + 8]
add eax, 3
movzx eax, byte [eax]
movzx eax, al
mov edx, dword [ebp + 8]
add edx, 7
movzx eax, byte [eax + str.cw]
mov byte [edx], al
mov eax, dword [ebp + 8]
lea edx, [eax + 3]
movzx eax, byte [ebp - 1]
mov byte [edx], al
nop
leave
ret
Function at 0x4251cf
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
movzx eax, al
movzx edx, byte [eax + 0x568ce0]
mov eax, dword [ebp + 8]
mov byte [eax], dl
mov eax, dword [ebp + 8]
add eax, 4
movzx eax, byte [eax]
movzx eax, al
mov edx, dword [ebp + 8]
add edx, 4
movzx eax, byte [eax + 0x568ce0]
mov byte [edx], al
mov eax, dword [ebp + 8]
add eax, 8
movzx eax, byte [eax]
movzx eax, al
mov edx, dword [ebp + 8]
add edx, 8
movzx eax, byte [eax + 0x568ce0]
mov byte [edx], al
mov eax, dword [ebp + 8]
add eax, 0xc
movzx eax, byte [eax]
movzx eax, al
mov edx, dword [ebp + 8]
add edx, 0xc
movzx eax, byte [eax + 0x568ce0]
mov byte [edx], al
mov eax, dword [ebp + 8]
add eax, 0xd
movzx eax, byte [eax]
movzx eax, al
movzx eax, byte [eax + 0x568ce0]
mov byte [ebp - 1], al
mov eax, dword [ebp + 8]
add eax, 9
movzx eax, byte [eax]
movzx eax, al
mov edx, dword [ebp + 8]
add edx, 0xd
movzx eax, byte [eax + 0x568ce0]
mov byte [edx], al
mov eax, dword [ebp + 8]
add eax, 5
movzx eax, byte [eax]
movzx eax, al
mov edx, dword [ebp + 8]
add edx, 9
movzx eax, byte [eax + 0x568ce0]
mov byte [edx], al
mov eax, dword [ebp + 8]
add eax, 1
movzx eax, byte [eax]
movzx eax, al
mov edx, dword [ebp + 8]
add edx, 5
movzx eax, byte [eax + 0x568ce0]
mov byte [edx], al
mov eax, dword [ebp + 8]
lea edx, [eax + 1]
movzx eax, byte [ebp - 1]
mov byte [edx], al
mov eax, dword [ebp + 8]
add eax, 2
movzx eax, byte [eax]
movzx eax, al
movzx eax, byte [eax + 0x568ce0]
mov byte [ebp - 1], al
mov eax, dword [ebp + 8]
add eax, 0xa
movzx eax, byte [eax]
movzx eax, al
mov edx, dword [ebp + 8]
add edx, 2
movzx eax, byte [eax + 0x568ce0]
mov byte [edx], al
mov eax, dword [ebp + 8]
lea edx, [eax + 0xa]
movzx eax, byte [ebp - 1]
mov byte [edx], al
mov eax, dword [ebp + 8]
add eax, 6
movzx eax, byte [eax]
movzx eax, al
movzx eax, byte [eax + 0x568ce0]
mov byte [ebp - 1], al
mov eax, dword [ebp + 8]
add eax, 0xe
movzx eax, byte [eax]
movzx eax, al
mov edx, dword [ebp + 8]
add edx, 6
movzx eax, byte [eax + 0x568ce0]
mov byte [edx], al
mov eax, dword [ebp + 8]
lea edx, [eax + 0xe]
movzx eax, byte [ebp - 1]
mov byte [edx], al
mov eax, dword [ebp + 8]
add eax, 3
movzx eax, byte [eax]
movzx eax, al
movzx eax, byte [eax + 0x568ce0]
mov byte [ebp - 1], al
mov eax, dword [ebp + 8]
add eax, 7
movzx eax, byte [eax]
movzx eax, al
mov edx, dword [ebp + 8]
add edx, 3
movzx eax, byte [eax + 0x568ce0]
mov byte [edx], al
mov eax, dword [ebp + 8]
add eax, 0xb
movzx eax, byte [eax]
movzx eax, al
mov edx, dword [ebp + 8]
add edx, 7
movzx eax, byte [eax + 0x568ce0]
mov byte [edx], al
mov eax, dword [ebp + 8]
add eax, 0xf
movzx eax, byte [eax]
movzx eax, al
mov edx, dword [ebp + 8]
add edx, 0xb
movzx eax, byte [eax + 0x568ce0]
mov byte [edx], al
mov eax, dword [ebp + 8]
lea edx, [eax + 0xf]
movzx eax, byte [ebp - 1]
mov byte [edx], al
nop
leave
ret
Function at 0x425ed9
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp + 8], 0x10
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov dword [ebp - 0x10], 4
cmp dword [ebp - 0x10], 0x2b
ja 0x426058
mov eax, dword [ebp - 0x10]
add eax, 0x3fffffff
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
movzx eax, byte [eax]
mov byte [ebp - 9], al
mov eax, dword [ebp - 0x10]
shl eax, 2
lea edx, [eax - 3]
mov eax, dword [ebp + 0xc]
add eax, edx
movzx eax, byte [eax]
mov byte [ebp - 0xa], al
mov eax, dword [ebp - 0x10]
shl eax, 2
lea edx, [eax - 2]
mov eax, dword [ebp + 0xc]
add eax, edx
movzx eax, byte [eax]
mov byte [ebp - 0xb], al
mov eax, dword [ebp - 0x10]
shl eax, 2
lea edx, [eax - 1]
mov eax, dword [ebp + 0xc]
add eax, edx
movzx eax, byte [eax]
mov byte [ebp - 0xc], al
mov eax, dword [ebp - 0x10]
and eax, 3
test eax, eax
jne 0x425fb8
movzx eax, byte [ebp - 0xc]
mov byte [ebp - 0x11], al
movzx eax, byte [ebp - 9]
movzx eax, byte [eax + str.cw]
mov byte [ebp - 0xc], al
movzx eax, byte [ebp - 0xa]
movzx edx, byte [eax + str.cw]
mov eax, dword [ebp - 0x10]
shr eax, 2
movzx eax, byte [eax + 0x5694e0]
xor eax, edx
mov byte [ebp - 9], al
movzx eax, byte [ebp - 0xb]
movzx eax, byte [eax + str.cw]
mov byte [ebp - 0xa], al
movzx eax, byte [ebp - 0x11]
movzx eax, byte [eax + str.cw]
mov byte [ebp - 0xb], al
mov eax, dword [ebp - 0x10]
add eax, 0x3ffffffc
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
movzx eax, byte [eax]
mov edx, dword [ebp - 0x10]
lea ecx, [edx*4]
mov edx, dword [ebp + 0xc]
add edx, ecx
xor al, byte [ebp - 9]
mov byte [edx], al
mov eax, dword [ebp - 0x10]
shl eax, 2
lea edx, [eax - 0xf]
mov eax, dword [ebp + 0xc]
add eax, edx
movzx eax, byte [eax]
mov edx, dword [ebp - 0x10]
shl edx, 2
lea ecx, [edx + 1]
mov edx, dword [ebp + 0xc]
add edx, ecx
xor al, byte [ebp - 0xa]
mov byte [edx], al
mov eax, dword [ebp - 0x10]
shl eax, 2
lea edx, [eax - 0xe]
mov eax, dword [ebp + 0xc]
add eax, edx
movzx eax, byte [eax]
mov edx, dword [ebp - 0x10]
shl edx, 2
lea ecx, [edx + 2]
mov edx, dword [ebp + 0xc]
add edx, ecx
xor al, byte [ebp - 0xb]
mov byte [edx], al
mov eax, dword [ebp - 0x10]
shl eax, 2
lea edx, [eax - 0xd]
mov eax, dword [ebp + 0xc]
add eax, edx
movzx eax, byte [eax]
mov edx, dword [ebp - 0x10]
shl edx, 2
lea ecx, [edx + 3]
mov edx, dword [ebp + 0xc]
add edx, ecx
xor al, byte [ebp - 0xc]
mov byte [edx], al
add dword [ebp - 0x10], 1
jmp 0x425f00
nop
leave
ret
Function at 0x4373cd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
movzx eax, al
cmp eax, 0x68
jg 0x4374d0
cmp eax, 0x64
jge 0x4374b8
cmp eax, 0x5b
jg 0x4374d0
cmp eax, 0x59
jge 0x43745e
cmp eax, 0x53
je 0x4374b8
cmp eax, 0x53
jg 0x4374d0
cmp eax, 5
jg 0x43741e
cmp eax, 4
jge 0x4374ad
jmp 0x4374d0
cmp eax, 0x19
jne 0x4374d0
cmp dword [ebp + 0x10], 0
jle 0x437458
mov eax, dword [ebp + 8]
add eax, 1
movzx eax, byte [eax]
movzx edx, al
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
xor eax, edx
and eax, dword [ebp + 0x10]
test eax, eax
je 0x437458
mov eax, dword [ebp + 8]
add eax, 1
movzx eax, byte [eax]
movzx edx, al
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
add dword [ebp + 8], 2
jmp 0x4374d5
cmp dword [ebp + 0x14], 0
jne 0x437469
mov eax, dword [ebp + 8]
jmp 0x4374da
mov eax, dword [ebp + 8]
add eax, 1
movzx eax, byte [eax]
movzx eax, al
shl eax, 8
mov edx, eax
mov eax, dword [ebp + 8]
add eax, 2
movzx eax, byte [eax]
movzx eax, al
or eax, edx
add dword [ebp + 8], eax
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
cmp al, 0x54
je 0x437469
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
movzx eax, al
movzx eax, byte [eax + 0x57dcc0]
movzx eax, al
add dword [ebp + 8], eax
jmp 0x4374d5
cmp dword [ebp + 0x14], 0
jne 0x4374b8
mov eax, dword [ebp + 8]
jmp 0x4374da
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
movzx eax, al
movzx eax, byte [eax + 0x57dcc0]
movzx eax, al
add dword [ebp + 8], eax
jmp 0x4374d5
mov eax, dword [ebp + 8]
jmp 0x4374da
jmp 0x4373d0
pop ebp
ret
Function at 0x490830
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.004abbe0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.004abbe0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x490890
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x8728a0]
test esi, esi
jle 0x4909b0
mov eax, dword [0x8728a4]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x4908c4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x490947
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x4908b0
mov dword [esp], ebx
call fcn.00491220
mov edi, eax
test eax, eax
je 0x4909d7
mov eax, dword [0x8728a4]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00491330
mov edx, dword [0x8728a4]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x4909b7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x490940
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x490950
add dword [0x8728a0], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x8728a4]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x490940
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00490830
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x4908ce
mov eax, dword [0x8728a4]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00490830
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00490830
lea esi, [esi]
nop
Function at 0x490e90
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x8728bc
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x8728b4]
sub esp, 4
test ebx, ebx
je 0x490ee5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x490ede
test esi, esi
je 0x490ede
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x490ec0
mov dword [esp], 0x8728bc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4917b0
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [0x8728b8]
test eax, eax
jne 0x490f10
ret
push ebx
sub esp, 0x18
mov dword [esp + 4], 0xc
mov dword [esp], 1
call sub.msvcrt.dll_calloc
mov ebx, eax
test eax, eax
je 0x490f70
mov eax, dword [esp + 0x20]
mov dword [esp], 0x8728bc
mov dword [ebx], eax
mov eax, dword [esp + 0x24]
mov dword [ebx + 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x8728b4]
mov dword [0x8728b4], ebx
sub esp, 4
mov dword [ebx + 8], eax
mov dword [esp], 0x8728bc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
sub esp, 4
add esp, 0x18
pop ebx
ret
or eax, 0xffffffff
jmp 0x490f6b
push esi
push ebx
sub esp, 4
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x4917e0
mov dword [esi], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
add esp, 4
pop ebx
pop esi
jmp 0x4abed0
add esp, 4
pop ebx
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esp + 8]
test eax, eax
jne 0x4abee0
xor eax, eax
ret
jmp 0x490f00

Function at 0x491820
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x491860
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x491888
xor eax, eax
add esp, 0x1c
ret
add esp, 0x1c
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x496350
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x12c
mov ebx, dword [esp + 0x140]
call sub.msvcrt.dll__errno
mov dword [eax], 0
test ebx, ebx
je 0x4964f0
cmp byte [ebx], 0
je 0x4964d0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
sub esp, 4
cmp eax, 0xffffffff
je 0x496508
test al, 0x10
je 0x4964d0
lea esi, [esp + 0x1c]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0x104
mov ebx, esi
mov dword [esp], esi
call sub.msvcrt.dll__fullpath
mov edx, dword [ebx]
add ebx, 4
lea eax, [edx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x4963b4
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea edx, [ebx + 2]
cmove ebx, edx
mov ecx, eax
add cl, al
sbb ebx, 3
sub ebx, esi
lea eax, [ebx + 0x233]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov ebp, eax
test eax, eax
je 0x49651a
lea edx, [eax + 0x22c]
lea eax, [ebx + 1]
cmp eax, 4
jb 0x496480
mov ecx, dword [esp + eax + 0x18]
mov edi, edx
mov dword [edx + eax - 4], ecx
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
cmp byte [ebp + 0x22c], 0
jne 0x4964a0
add ebx, edx
mov eax, 0x2a
lea edx, [ebp + 0x120]
mov ecx, 0x41
mov word [ebx], ax
mov edi, edx
xor eax, eax
mov dword [ebp + 0x224], 0xffffffff
mov dword [ebp + 0x228], 0
mov dword [ebp + 0x118], 0
mov dword [ebp + 0x11c], 0
rep stosd dword es:[edi], eax
add esp, 0x12c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
test eax, eax
je 0x49641d
movzx ecx, byte [esi]
mov byte [edx], cl
test al, 2
je 0x49641d
movzx ecx, word [esi + eax - 2]
mov word [edx + eax - 2], cx
jmp 0x49641d
movzx ecx, byte [ebp + ebx + 0x22b]
add ebx, edx
cmp cl, 0x5c
je 0x496428
cmp cl, 0x2f
je 0x496428
mov ecx, 0x5c
mov word [ebx], cx
lea ebx, [edx + eax]
jmp 0x496428
call sub.msvcrt.dll__errno
xor ebp, ebp
mov dword [eax], 0x14
add esp, 0x12c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
xor ebp, ebp
mov dword [eax], 0xe
jmp 0x496469
call sub.msvcrt.dll__errno
xor ebp, ebp
mov dword [eax], 2
jmp 0x496469
call sub.msvcrt.dll__errno
mov dword [eax], 0xc
jmp 0x496469
Function at 0x4b05a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ecx, 0x1a
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x80]
mov esi, 0x582711
push ebx
sub esp, 0x9c
mov eax, dword [str.not_enough_space_for_format_expansion__Please_submit_full_bug_report_at_https:__gcc.gnu.org_bugs__:_n]
mov dword [ebp - 0x81], eax
mov eax, dword [0x582775]
mov dword [ebp - 0x1c], eax
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp + 8]
lea eax, [edx + 0x84]
and eax, 0xfffffff0
call fcn.004914a0
mov ecx, 0x1a
sub esp, eax
lea esi, [ebp - 0x81]
mov dword [ebp - 0x8c], edx
lea ebx, [esp + 0x1b]
and ebx, 0xfffffff0
mov edi, ebx
lea eax, [ebx + 0x68]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 8]
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], ecx
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x8c]
mov byte [ebx + edx + 0x68], 0
mov dword [esp], ebx
call fcn.0055d128
nop
nop
nop
nop
nop
nop
nop
push edi
push esi
push ebx
sub esp, 0x20
cmp byte [0x57276c], 0
jne 0x4b06c6
mov byte [0x57276c], 1
call fcn.0055c0a0
test eax, eax
je 0x4b0694
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
sete al
mov dword [esp + 4], 0
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call fcn.00490430
mov dword [esp], 2
mov esi, dword [fcn.004abbe0]
mov edi, eax
call esi
mov dword [esp + 8], 0x30
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
call sub.msvcrt.dll_fwrite
mov edx, dword [esp + 0x1c]
mov dword [esp], 2
test edx, edx
je 0x4b0684
call esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x58237d
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x55d048
jmp 0x55d040
call esi
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
jmp 0x4b064a
mov dword [esp], 2
call dword [0x5715ac]
mov dword [esp + 8], 0x2d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
call sub.msvcrt.dll_fwrite
jmp 0x55d03b
mov dword [esp], 2
call dword [0x5715ac]
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_recursively_n
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x5089a0
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x1c
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
jmp 0x5089c3
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 4
jne 0x5089e1
mov ecx, ebx
call fcn.00508740
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.msvcrt.dll__read
mov ebp, eax
cmp eax, 0xffffffff
je 0x5089b8
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x40110c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x81a030]
jne 0x401116
repz ret
jmp fcn.00401d81

Function at 0x409ddd
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406a6e
and dword [ebp - 4], 0
cmp dword [0x81c898], 0
mov ebx, eax
jne 0x409e8e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x409f3f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x409f3f
push eax
call fcn.004069fc
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x81c898], eax
call esi
push eax
call fcn.004069fc
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x81c89c], eax
call esi
push eax
call fcn.004069fc
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x81c8a0], eax
call esi
push eax
call fcn.004069fc
pop ecx
mov dword [0x81c8a8], eax
test eax, eax
je 0x409e8e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004069fc
pop ecx
mov dword [0x81c8a4], eax
mov eax, dword [0x81c8a4]
cmp eax, ebx
je 0x409ee6
cmp dword [0x81c8a8], ebx
je 0x409ee6
push eax
call fcn.00406a77
push dword [0x81c8a8]
mov esi, eax
call fcn.00406a77
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x409ee6
test edi, edi
je 0x409ee6
call esi
test eax, eax
je 0x409edd
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409edd
test byte [ebp - 0xc], 1
jne 0x409ee6
or dword [ebp + 0x10], 0x200000
jmp 0x409f1f
mov eax, dword [0x81c89c]
cmp eax, ebx
je 0x409f1f
push eax
call fcn.00406a77
pop ecx
test eax, eax
je 0x409f1f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409f1f
mov eax, dword [0x81c8a0]
cmp eax, ebx
je 0x409f1f
push eax
call fcn.00406a77
pop ecx
test eax, eax
je 0x409f1f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x81c898]
call fcn.00406a77
pop ecx
test eax, eax
je 0x409f3f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x409f41
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40cc30
Capabilities:
Set console window title

Disassembly:
sub esp, 0x428
mov eax, dword [0x81a030]
xor eax, esp
mov dword [esp + 0x424], eax
mov eax, dword [0x2ed519c]
push ebx
mov ebx, dword [0x2ed4fe8]
push esi
mov esi, dword [0x81b050]
push edi
mov edi, eax
cmp eax, 0x930
jne 0x40cc71
push str.lefovuweceh
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov eax, dword [0x2ed519c]
mov dword [0x81c9f4], esi
cmp eax, 0x114e
jne 0x40cc9b
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
lea eax, [esp + 0x14]
push eax
push str.durinarusunavabaxomoyowev
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
mov eax, dword [0x2ed519c]
cmp eax, 0x2f
jne 0x40ccbd
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReadEventLogW]
call fcn.0040cba0
mov ecx, dword [esp + 0x430]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040110c
add esp, 0x428
ret