joyce8/EMBER2024-capa huggingface dataset:
Function at 0x496ae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47262f
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x4a2008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x13c], edx
mov eax, ecx
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x134], eax
mov esi, dword [ebp + 8]
mov edi, esi
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], 0
cmp dword [esi + 0x14], 0x10
mov ecx, dword [esi + 0x10]
mov dword [ebp - 0x138], ecx
jb 0x496b47
mov edi, dword [esi]
cmp dword [edx + 0x14], 0x10
mov ecx, dword [edx + 0x10]
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], edx
jb 0x496b64
mov ecx, dword [edx]
mov dword [ebp - 0x130], ecx
cmp dword [edx + 0x10], 0
jbe 0x496bcd
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.004dfab0
mov ecx, dword [ebp - 0x138]
add esp, 0xc
add ecx, edi
cmp edi, ecx
je 0x496ba0
nop dword [eax]
movzx eax, byte [edi]
inc edi
mov byte [ebp + eax - 0x128], 1
cmp edi, ecx
jne 0x496b90
mov edx, dword [ebp - 0x130]
mov edi, edx
mov ecx, dword [ebp - 0x134]
add ecx, edx
cmp edx, ecx
jae 0x496bc7
movzx eax, byte [edi]
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x496c21
inc edi
cmp edi, ecx
jb 0x496bb4
mov eax, dword [ebp - 0x12c]
xorps xmm0, xmm0
mov ecx, eax
push 0
movups xmmword [eax], xmm0
push 0x491667
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
call fcn.004ca450
mov dword [ebp - 4], 0
mov dword [ebp - 0x140], 1
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004de32c
mov esp, ebp
pop ebp
ret
sub edi, edx
cmp edi, 0xffffffff
je 0x496bc7
cmp dword [esi + 0x14], 0x10
jb 0x496c30
mov esi, dword [esi]
mov ecx, dword [ebp - 0x13c]
mov dword [ebp - 0x130], ecx
cmp dword [ecx + 0x14], 0x10
jb 0x496c4a
mov eax, dword [ecx]
mov dword [ebp - 0x130], eax
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.004dfab0
mov ecx, dword [ebp - 0x138]
add esp, 0xc
add ecx, esi
cmp esi, ecx
je 0x496c80
nop dword [eax]
movzx eax, byte [esi]
inc esi
mov byte [ebp + eax - 0x128], 1
cmp esi, ecx
jne 0x496c70
mov eax, dword [ebp - 0x134]
or ecx, 0xffffffff
mov edx, dword [ebp - 0x130]
dec eax
cmp eax, ecx
cmovb ecx, eax
movzx eax, byte [ecx + edx]
add ecx, edx
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x496cbe
cmp ecx, edx
je 0x496d35
movzx eax, byte [ecx - 1]
dec ecx
mov al, byte [ebp + eax - 0x128]
test al, al
jne 0x496ca6
sub ecx, edx
sub ecx, edi
lea eax, [ebp - 0x28]
inc ecx
push ecx
mov ecx, dword [ebp - 0x13c]
push edi
push eax
call fcn.004b5a20
mov dword [ebp - 4], 1
xorps xmm0, xmm0
mov esi, dword [ebp - 0x12c]
mov dword [ebp - 0x140], 1
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
movups xmm0, xmmword [ebp - 0x28]
mov dword [esi + 0x14], 0
mov byte [ebp - 0x28], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x18]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.004ca580
mov eax, esi
jmp 0x496c06
or ecx, 0xffffffff
jmp 0x496cc0
Function at 0x496f60
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.004ca450
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x497083
push ecx
lea ecx, [esi + 0x18]
call fcn.004b6780
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x49709a
push ecx
lea ecx, [esi + 0x24]
call fcn.004b6690
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4b32a0
Capabilities:
Encode data using xor

Disassembly:
rcl byte [0x6c6f3758]
salc
jne 0x4b3229
leave
add ch, byte [edi]
or al, 0xd9
mov bh, 0xc6
push es
into
sub dword [edi + 0x20534beb], edi
invalid
dec ebx
push ebx
and dh, al
cmpsd dword [esi], dword es:[edi]
salc
mov dl, 0xcc
iretd
cmp byte [ecx], 8
jbe 0x4b3213
lds ebx, [edi]
test al, 0x9c
jns 0x4b32b3
push esp
adc eax, 0x9fe68f96
cli
inc ebx
sub dword [edx - 0x2b], esi
out dx, eax
out dx, al
xchg ebx, eax
aad 0x59
pop eax
push eax
sbb ebx, dword [edi - 0x1a]
invalid
and al, 0xea
push eax
xlatb
cmp al, 0xa4
mov dword [edx + 0x29332013], 0xf5922fe1
push ebx
out dx, eax
xchg bh, cl
push es
wait
mov byte [0xc7d9e6fe], al
invalid
sbb eax, 0x15b7ab2a
cmp byte [ebp + 0xc7fce9a], bh
xchg byte [ecx], bl
jns 0x4b3239
out 0x6f, al
pop ss
cwde
nop
loope 0x4b32ba
jp 0x4b329b
sahf
push 0xffffffffffffffcf
push ss
jle 0x4b32cf
push ecx
pop ss
or byte [eax + 0x21323e0b], ah
xor ah, byte ds:[ecx]
dec esi
movsb byte es:[edi], byte [esi]
mov dword [0xc0694f3c], eax
mov ss, edx
xchg edi, eax
sahf
fild qword [ebp + 0x436eee33]
out dx, al
outsb dx, byte [esi]
inc ebx
xor eax, 0xa634784
fsubr qword [edx + 0x754b6ac5]
jle 0x4b32be
mov cl, 0xba
sti
jno 0x4b3272
jmp 0xfab6d554
Function at 0x4e03c0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005138b0
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4e04e3
push ecx
lea ecx, [esi + 0x18]
call fcn.004ffbe0
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4e04fa
push ecx
lea ecx, [esi + 0x24]
call int.004ffaf0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4fecf0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x5a0039e3
xchg esi, eax
jno 0x4fed08
adc eax, 0x2a2a6a71
dec esp
mov ebp, 0x35abbbec
iretd
invalid
Function at 0x52f164
Capabilities:
Encode data using xor

Disassembly:
cmp dl, byte [ebx - 0x4f657c86]
adc dl, byte [eax + 0x56a672bd]
xchg edx, eax
ja 0x52f1e3
xchg dword [edi + 0x28], edx
adc al, 0x84
std
xchg bh, cl
xor ecx, dword [ecx]
das
int 0x2e
pop ds
inc esp
or dword [eax - 0xbfe9039], esp
inc ebx
push ds
cmp ecx, 0xa40c27b3
dec esi
invalid
dec ecx
mov eax, ds
xor ecx, esi
push ebx
lock add dword [esi - 0x61c0d139], 0x23
bound esp, qword [edx + 0x26]
aas
mov byte [0xc4cd7750], al
shl dh, cl
lahf
inc eax
add byte [0xeaec2a1b], bh
push edi
js 0x52f280
and dx, word [eax - 0x47]
pop esp
xchg edx, eax
add esp, dword [ebx - 0x29]
jp 0x52f216
pushal
daa
mov esi, 0x224557d9
salc
push edi
inc ebp
and dl, dh
and byte [esi + 0x5e], 0x6f
insd dword es:[edi], dx
ljmp 0x6f3b
out 0xd5, al
ficomp word [edi - 3]
jecxz 0x52f2ec
xchg edi, eax
mov edx, 0x69e8707a
or esi, dword [ebx + 0x2f4ffc4c]
mov ah, 0xc6
insb byte es:[edi], dx
pop ebx
jmp 0x17af49f
mov dl, 0x28
mov ah, byte [edx]
xor eax, 0x632b73e8
pop eax
add eax, 0x3d946c59
ja 0x52f35c
enter 0x541a, 0xffffffffffffffa7
sal byte [0xb9e03b97], 1
inc esi
sal byte [esi - 0x70db497d], cl
sahf
mov edi, 0xc9334471
leave
xor bh, byte [ecx + 0x63e704e]
ja 0x52f313
inc esi
and ebx, ecx
bnd ja 0x52f33f
xor ch, byte [eax + ecx]
inc ecx
sub dh, dl
mov esp, edi
xor eax, 0xddec82a7
pop ss
push ds
sub bh, bl
mov edx, 0x122ad001
pop ss
lds ebp, [edx - 0x21]
add ah, byte [esi - 0x41]
sbb esp, edx
push esi
ret
xor byte [esi + 0x7e], ch
je 0x52f3c8
invalid
invalid
mov ch, 0x57
inc ebp
pop es
and ecx, dword [ebp + 0x3c]
dec eax
xor edx, dword [eax]
loop 0x52f44a
jg 0x52f38c
nop
mov ch, dl
invalid
Function at 0x5bd300
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005f07f0
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x5bd423
push ecx
lea ecx, [esi + 0x18]
call fcn.005dcb20
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x5bd43a
push ecx
lea ecx, [esi + 0x24]
call int.005dca30
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x606990
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00639e80
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x606ab3
push ecx
lea ecx, [esi + 0x18]
call 0x6261b0
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x606aca
push ecx
lea ecx, [esi + 0x24]
call fcn.006260c0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x624ef0
Capabilities:
Encode data using xor

Disassembly:
movsd dword es:[edi], dword [esi]
retf 0xe512
cmp dword [esp + 0x57], 0xffffffd4
jbe 0x624f65
push 0x1d6189fa
daa
out 0xb7, al
xlatb
jno 0x624eb8
xchg cl, bl
pop ebx
stosb byte es:[edi], al
mov ebx, 0x77a73fae
sub ah, byte [esi - 0x57]
add dword [edx - 0x4375040d], esp
out 0xea, eax
mov dword [0xa0d9e751], eax
stc
mov edi, 0x3a8cad83
push ecx
add dword [eax + 0x117e3d5f], ebx
xor al, 0xec
clc
sub dh, ch
stosb byte es:[edi], al
out dx, eax
sub al, 0xa7
jbe 0x624f1a
mov al, byte [0xad83bff9]
invalid
cmpsb byte [esi], byte es:[edi]
xchg edi, eax
stosb byte es:[edi], al
xlatb
pop es
xchg esi, eax
sbb dword [edi + 0x61], ecx
jg 0x624f5f
push 0xffffffffffffffbd
xchg ebp, eax
sub al, 0x67
js 0x624f4c
jl 0x624ef7
inc esp
lcall 0x874f, 0x779124eb
pop ebp
xchg ebp, eax
ja 0x624f9d
xchg dword [ebp - 0x6b], ebx
invalid
mov eax, dword [0xd4b30b59]
sub esp, esi
lahf
mov gs, word [ebx]
pop ecx
test al, 0xbd
imul edi, dword [edx - 0x3a00b09b], 0x8ec614c7
test dword [ebp + 0x668080a9], ebx
sbb ecx, dword [esi + 0x28d57a6e]
mov edi, 0x4d896c4b
adc eax, 0xed50876d
jbe 0x624fe2
hlt
mov edx, 0xc5ff4f65
invalid
salc
xor al, 0x99
fimul dword [ecx]
sub cl, cl
fxch st(1)
xchg ebx, eax
xor esi, esi
push esp
or dh, byte [ebp + edx*2 + 0x63]
push ecx
lodsb al, byte [esi]
push ebp
arpl word [ecx - 0x54], dx
dec ebx
pushal
push ebx
and eax, 0x36a84659
push 0x3c
out 0x64, al
cmpsb byte [esi], byte es:[edi]
push edx
inc esi
cmp dword [eax - 0x48], ebp
dec ebp
jo 0x624f6d
invalid
xlatb
mov ebx, 0xc1b967a1
cli
sbb byte [edi], dh
into
aaa
sbb cl, cl
sub byte [esi - 0x60c04078], ah
add bh, ch
mov dl, 0xbd
fldlg2
adc ecx, eax
dec edx
aaa
in eax, dx
cmp al, byte [esp + eax + 7]
and byte [ebp + 0x5e], dh
mov ah, 0x2d
das
push esp
xchg esi, eax
mov eax, dword [0xaafae82a]
insb byte es:[edi], dx
dec ecx
int1
mov word [eax + ecx*4], fs
push edi
invalid
Function at 0x64d9cd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6563b0
cmp edx, dword [eax]
je 0x64d9ef
add eax, 8
inc ecx
cmp eax, 0x656440
jl 0x64d9e0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6563b0]
jne 0x64db1d
mov eax, dword [0xa59d10]
cmp eax, 1
je 0x64daf7
test eax, eax
jne 0x64da20
cmp dword [0x6562d8], 1
je 0x64daf7
cmp edx, 0xfc
je 0x64db1d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x64da57
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0064e3b0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0064e840
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x64da9a
lea eax, [ebp - 0x1a4]
push eax
call fcn.0064e840
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x652b4c
push edi
call fcn.00650710
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0064e3b0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0064e3c0
lea eax, [ebp - 0xa0]
push 0x652b2c
push eax
call fcn.0064e3c0
push dword [esi + 0x6563b4]
lea eax, [ebp - 0xa0]
push eax
call fcn.0064e3c0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00650684
add esp, 0x2c
pop edi
jmp 0x64db1d
lea eax, [ebp + 8]
lea esi, [esi + 0x6563b4]
push 0
push eax
push dword [esi]
call fcn.0064e840
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401cf0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40803c]
sub esp, 4
test ebx, ebx
je 0x401d3b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401d34
test esi, esi
je 0x401d34
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401d10
mov dword [esp], 0x408044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x401f20
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
lea esi, [esp + 0x24]
lea ebx, [eax + 0x40]
mov dword [esp + 4], 1
mov dword [esp + 0xc], ebx
mov dword [esp], str.Mingw_runtime_failure:_n
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x401f70
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, edx
push esi
mov esi, ecx
push ebx
mov ebx, eax
sub esp, 0x3c
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402044
mov eax, dword [esp + 0x28]
cmp eax, 0x40
je 0x401fae
cmp eax, 4
jne 0x401fd0
test esi, esi
je 0x401fc2
xor eax, eax
movzx ecx, byte [edi + eax]
mov byte [ebx + eax], cl
add eax, 1
cmp eax, esi
jb 0x401fb4
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x20]
lea ebp, [esp + 0x10]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov ecx, dword [esp + 0x28]
test esi, esi
je 0x40200f
xor edx, edx
movzx eax, byte [edi + edx]
mov byte [ebx + edx], al
add edx, 1
cmp edx, esi
jb 0x402001
cmp ecx, 0x40
je 0x401fc2
cmp ecx, 4
je 0x401fc2
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00401f20
lea esi, [esi]
Function at 0x40418c
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [0x4188d4], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
push esi
jne 0x4041d0
call ebx
test eax, eax
jns 0x4041c6
push 0x401578
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x40156c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x4188d0], eax
mov dword [0x4188d4], 1
mov eax, dword [0x4188d0]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
je 0x4041ec
push dword [ebp + 0x10]
push eax
call esi
test eax, eax
mov dword [ebp - 4], eax
jne 0x40421c
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [edi]
test eax, eax
jne 0x404212
call ebx
test eax, eax
mov eax, dword [ebp + 8]
jns 0x404206
push dword [eax + 8]
call dword [eax]
jmp 0x40420c
push dword [eax + 0xc]
call dword [eax + 4]
test eax, eax
je 0x40421b
mov dword [edi], eax
push dword [ebp + 0x10]
push eax
call esi
mov dword [ebp - 4], eax
pop edi
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 0xc

Function at 0x404ef6
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push edi
push 0xd
mov edx, ecx
pop ecx
xor eax, eax
lea edi, [ebp - 0x34]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x34]
push eax
push 0
push 0x104b
push dword [edx + 4]
mov dword [ebp - 0x34], 4
call dword [sym.imp.USER32.dll_SendMessageW]
neg eax
sbb eax, eax
and eax, dword [ebp - 0x14]
pop edi
leave
ret 4

Function at 0x404f84
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
mov esi, ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x404fcf
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 0xc]
mov dword [ebp + 8], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [esi + 4]
call fcn.0040445d
test eax, eax
je 0x404fcf
push 1
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp + 8]
call fcn.00404433
jmp 0x404fd1
xor eax, eax
pop esi
leave
ret 8
Function at 0x40616d
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x414621
call fcn.00414430
sub esp, 0x3c
push ebx
push esi
mov esi, ecx
and dword [ebp - 4], 0
push 0x1c
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x10], eax
test eax, eax
mov byte [ebp - 4], 1
je 0x4061a0
mov ecx, eax
call fcn.00404299
mov ebx, eax
jmp 0x4061a2
xor ebx, ebx
test ebx, ebx
mov byte [ebp - 4], 0
mov dword [ebp - 0x10], ebx
jne 0x4061b2
or esi, 0xffffffff
jmp 0x40620f
push edi
lea eax, [ebp + 8]
push eax
mov ecx, ebx
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int______thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::operator_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int___const__]
lea ecx, [esi + 0x30]
mov eax, dword [ecx + 4]
lea edx, [ebp - 0x10]
push edx
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00405921
push 0xd
pop ecx
xor eax, eax
push eax
push eax
push 0x1004
push dword [esi + 4]
lea edi, [ebp - 0x48]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x48], 4
call edi
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0x104d
push dword [esi + 4]
mov dword [ebp - 0x28], ebx
call edi
mov esi, eax
pop edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::destructor_void_]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10