joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41af20
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x41af48
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x41b040
add esp, 0x14
pop ebx
pop esi
ret 0xc
cmp eax, 1
je 0x41b010
cmp eax, 3
jne 0x41af39
mov eax, dword [0x432124]
cmp eax, 0xffffffff
je 0x41af39
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x41af39
test byte [eax + 0x20], 0x30
je 0x41b070
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x41af8b
call fcn.0041ac50
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x41afbd
mov dword [esp], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x41afaf
mov dword [esp], eax
call esi
sub esp, 4
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call fcn.0041a200
lea eax, [ebx + 0x38]
mov dword [esp], eax
call fcn.0041e260
cmp eax, 1
je 0x41b13e
mov eax, dword [ebx + 0xb0]
mov dword [ebx + 0x38], 0xffffffff
test eax, eax
je 0x41b132
mov eax, dword [0x432124]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
jmp 0x41af39
mov eax, dword [0x44bacc]
test eax, eax
je 0x41b05c
mov dword [esp + 4], 0x41a3b0
mov dword [esp], 1
call eax
mov dword [0x44bad0], eax
add esp, 0x14
pop ebx
pop esi
ret 0xc
mov eax, dword [0x44bad0]
test eax, eax
je 0x41af39
mov edx, dword [0x44bac8]
test edx, edx
je 0x41b05c
mov dword [esp], eax
call edx
mov dword [0x44bad0], 0
add esp, 0x14
pop ebx
pop esi
ret 0xc
mov edx, dword [ebx + 0x68]
mov eax, dword [eax + 0x18]
test edx, edx
jne 0x41b0e4
test eax, eax
je 0x41b08a
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebx + 0xb4]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x68], 1
test eax, eax
je 0x41b0a7
call fcn.0041ac50
test byte [ebx + 0x24], 4
je 0x41b122
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x41afbd
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx + 0x1c]
sub esp, 4
mov dword [ebx + 0x14], 0
mov dword [esp], eax
call fcn.0041a200
lea eax, [ebx + 0x38]
jmp 0x41afcb
test eax, eax
je 0x41b122
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx + 0x1c]
sub esp, 4
mov dword [ebx + 0x18], 0
mov dword [esp], eax
call fcn.0041a200
lea eax, [ebx + 0x38]
mov dword [esp], eax
call fcn.0041e260
cmp eax, 1
je 0x41b13e
mov dword [ebx + 0x38], 0xffffffff
jmp 0x41af39
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call fcn.0041a200
lea eax, [ebx + 0x38]
jmp 0x41b109
mov eax, ebx
call fcn.0041a880
jmp 0x41aff1
call fcn.0041a650
lea esi, cs:[esi]
lea esi, cs:[esi]
Function at 0x41b410
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [0x44b0f8]
mov dword [esp + 0x2c], esi
mov esi, dword [esp + 0x54]
mov ebx, dword [esp + 0x50]
mov eax, dword [ebx]
test esi, esi
je 0x41b550
cmp eax, 1
je 0x41b46e
mov eax, ebx
call fcn.0041a440
lea edi, [eax + 4]
mov dword [esp + 0x1c], eax
mov dword [esp], edi
call fcn.00419d30
mov ebp, dword [ebx]
test ebp, ebp
je 0x41b490
cmp ebp, 1
jne 0x41b520
mov dword [esp], edi
call fcn.0041a060
mov eax, dword [esp + 0x1c]
call fcn.0041a6d0
xor eax, eax
mov edx, dword [esp + 0x2c]
sub edx, dword [0x44b0f8]
jne 0x41b59a
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x20], 0x41a790
mov dword [esp + 0x24], eax
call fcn.0041aa40
mov eax, dword [0x432124]
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x41b588
mov eax, dword [eax + 0xc]
mov dword [esp + 0x28], eax
lock or dword [esp], 0
call fcn.0041aa40
mov eax, dword [0x432124]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x41b570
lea ecx, [esp + 0x20]
mov dword [eax + 0xc], ecx
lock or dword [esp], 0
call esi
call fcn.0041aa40
mov eax, dword [0x432124]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x41b560
mov edx, dword [esp + 0x28]
mov dword [eax + 0xc], edx
mov dword [ebx], 1
jmp 0x41b45d
mov dword [esp], 2
call dword [0x43210c]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], ebx
mov dword [esp + 4], str._once__p_is__ld_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x41b45d
mov eax, 0x16
jmp 0x41b470
call fcn.0041aaf0
test eax, eax
jne 0x41b50a
jmp 0x4317ff
call fcn.0041aaf0
test eax, eax
jne 0x41b4e6
jmp 0x4317f4
call fcn.0041aaf0
test eax, eax
jne 0x41b4c0
jmp 0x4317ed
call fcn.00413890
nop
mov eax, dword [pe_dos_header]
ud2
lea eax, [esp + 0x20]
mov dword [0], eax
ud2
mov eax, dword [esp + 0x28]
mov dword [0], eax
ud2

Function at 0x41b7e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.0041aa40
mov eax, dword [0x432124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x41b858
lea ebp, [ebx + 0x38]
xor edi, edi
mov dword [esp], ebp
call fcn.0041e270
mov eax, dword [ebx + 0x28]
cmp dword [esp + 0x30], eax
jae 0x41b834
mov eax, dword [ebx + 0x30]
mov edx, dword [esp + 0x30]
cmp byte [eax + edx], 0
je 0x41b834
mov eax, dword [ebx + 0x2c]
mov edi, dword [eax + edx*4]
mov dword [esp], ebp
call fcn.0041e2c0
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0041aaf0
mov ebx, eax
jmp 0x41b80b
Function at 0x41b870
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [esp + 0x40]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
call fcn.0041aa40
mov eax, dword [0x432124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x41b988
lea edi, [ebx + 0x38]
mov dword [esp], edi
call fcn.0041e270
mov edx, dword [ebx + 0x2c]
cmp esi, dword [ebx + 0x28]
jb 0x41b954
lea ebp, [esi + 1]
mov dword [esp], edx
lea eax, [ebp*4]
mov dword [esp + 4], eax
call sub.msvcrt.dll_realloc
test eax, eax
je 0x41b994
mov dword [esp + 0x1c], eax
mov dword [esp + 4], ebp
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
call sub.msvcrt.dll_realloc
mov edx, dword [esp + 0x1c]
test eax, eax
mov dword [esp + 0x18], eax
je 0x41b994
mov ecx, dword [ebx + 0x28]
mov eax, ebp
mov dword [esp + 4], 0
mov dword [esp + 0x1c], edx
sub eax, ecx
lea ecx, [edx + ecx*4]
shl eax, 2
mov dword [esp], ecx
mov dword [esp + 8], eax
call sub.msvcrt.dll_memset
mov eax, dword [ebx + 0x28]
mov edx, dword [esp + 0x18]
mov ecx, ebp
mov dword [esp + 4], 0
sub ecx, eax
add eax, edx
mov dword [esp + 8], ecx
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov dword [ebx + 0x28], ebp
mov dword [ebx + 0x2c], edx
mov dword [ebx + 0x30], eax
mov eax, dword [esp + 0x44]
mov dword [edx + esi*4], eax
mov eax, dword [ebx + 0x30]
mov byte [eax + esi], 1
mov dword [esp], edi
call fcn.0041e2c0
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
sub esp, 4
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0041aaf0
mov ebx, eax
jmp 0x41b8a5
mov dword [esp], edi
call fcn.0041e2c0
mov eax, 0xc
jmp 0x41b97c

Function at 0x41ba30
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.0041aa40
mov eax, dword [0x432124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x41ba58
mov eax, dword [eax + 0x18]
add esp, 0x1c
ret
call fcn.0041aaf0
test eax, eax
jne 0x41ba4d
add esp, 0x1c
ret

Function at 0x41bac0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.0041aa40
mov eax, dword [0x432124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x41bae8
add eax, 0xc
add esp, 0x1c
ret
call fcn.0041aaf0
test eax, eax
jne 0x41badd
jmp 0x41bae0
Function at 0x41bb20
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call fcn.0041ac20
mov dword [eax + 4], esi
mov ebx, eax
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x41bb42
call fcn.0041ac50
test byte [ebx + 0x20], 0x30
jne 0x41bb5c
add ebx, 0x70
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_longjmp]
mov eax, dword [0x432124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
push edx
test eax, eax
je 0x41bb9d
cmp dword [ebx + 0x14], 0
mov eax, dword [eax + 0x18]
je 0x41bbdd
mov dword [ebx + 0x68], 1
mov esi, dword [ebx + 4]
test eax, eax
je 0x41bb92
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
xor eax, eax
mov dword [ebx + 0x18], eax
test byte [ebx + 0x24], 4
jne 0x41bba6
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
push ecx
mov dword [ebx + 0x14], eax
mov eax, ebx
call fcn.0041aa20
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [0x432124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edx
push edx
jmp 0x41bb9d
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x41bbf1
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
xor eax, eax
mov esi, dword [ebx + 4]
mov dword [ebx + 0x18], eax
jmp 0x41bbbe

Function at 0x41bc00
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x44bafc]
test eax, eax
jne 0x41bc10
xor eax, eax
ret
sub esp, 0x1c
call fcn.0041aa40
mov eax, dword [0x432124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x41bc50
mov edx, dword [eax + 0x10]
test edx, edx
jle 0x41bc40
xor eax, eax
add esp, 0x1c
ret
test byte [eax + 0x20], 3
je 0x41bc34
mov eax, dword [eax + 0x24]
and eax, 1
jmp 0x41bc36
call fcn.0041aaf0
test eax, eax
je 0x41bc34
jmp 0x41bc2d

Function at 0x41bc60
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.0041aa40
mov eax, dword [0x432124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x41bca0
mov edx, dword [esp + 0x20]
test edx, edx
jle 0x41bc90
lock add dword [eax + 0x10], 1
add esp, 0x1c
ret
lock sub dword [eax + 0x10], 1
add esp, 0x1c
ret
call fcn.0041aaf0
test eax, eax
jne 0x41bc7d
add esp, 0x1c
ret
Function at 0x41bda0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call fcn.0041aa40
mov eax, dword [0x432124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x41be10
test byte [ebx + 0x20], 0xc
jne 0x41bdd0
mov eax, dword [0x44bafc]
test eax, eax
jne 0x41bde0
add esp, 0x14
pop ebx
pop esi
ret
lea esi, [ebx + 0x1c]
mov dword [esp], esi
call fcn.00419d30
movzx eax, byte [ebx + 0x20]
test al, 3
je 0x41be02
mov edx, dword [ebx + 0x24]
test dl, 1
je 0x41be02
mov ecx, dword [ebx + 0x10]
test ecx, ecx
jle 0x41be21
mov dword [esp], esi
call fcn.0041a060
add esp, 0x14
pop ebx
pop esi
ret
call fcn.0041aaf0
mov ebx, eax
test eax, eax
jne 0x41bdc1
add esp, 0x14
pop ebx
pop esi
ret
and eax, 0xfffffff3
and edx, 0xfffffffe
or eax, 4
mov dword [ebx + 0x24], edx
mov byte [ebx + 0x20], al
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x41be41
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push eax
mov dword [esp], esi
call fcn.0041a060
call fcn.0041bcb0
nop
push esi
push ebx
sub esp, 0x14
mov eax, dword [esp + 0x20]
test eax, eax
je 0x41bec0
mov dword [esp], eax
call fcn.0041d1d0
xor ecx, ecx
mov ebx, edx
mov edx, 0xffffffff
cmp edx, eax
sbb ecx, ebx
cmovae edx, eax
mov ebx, edx
call fcn.0041aa40
mov eax, dword [0x432124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
test eax, eax
je 0x41bf10
test ebx, ebx
je 0x41beda
call fcn.0041bda0
mov eax, dword [esi + 0x18]
test eax, eax
je 0x41bf00
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.0041d2e0
call fcn.0041bda0
add esp, 0x14
xor eax, eax
pop ebx
pop esi
ret
call fcn.0041aa40
mov eax, dword [0x432124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x41bf20
call fcn.0041bda0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
call fcn.0041bda0
add esp, 0x14
xor eax, eax
pop ebx
pop esi
ret
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
jmp 0x41beaf
call fcn.0041aaf0
mov esi, eax
jmp 0x41be93
call fcn.0041aaf0
jmp 0x41beda
Function at 0x430330
Capabilities:
Query environment variable

Disassembly:
push edi
sub esp, 0x18
mov eax, dword [esp + 0x20]
lea edi, [eax + 0x60]
mov dword [esp], edi
call sub.msvcrt.dll_malloc
test eax, eax
je 0x42f7d2
mov edx, eax
lea edi, [edx + 4]
mov ecx, edx
xor eax, eax
mov dword [edx], 0
and edi, 0xfffffffc
mov dword [edx + 0x5c], 0
sub ecx, edi
add ecx, 0x60
shr ecx, 2
rep stosd dword es:[edi], eax
add esp, 0x18
lea eax, [edx + 0x60]
pop edi
ret
mov eax, edi
call fcn.00421650
mov edx, eax
test eax, eax
je 0x430318
jmp 0x42f7a9
call fcn.00430694
nop
nop
nop
call fcn.00430694
nop
nop
nop
nop
nop
nop
nop
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [0x44b0f8]
mov dword [esp + 0x2c], eax
xor eax, eax
mov dword [esp + 4], 0
mov dword [esp], 0x432188
call fcn.0041a1b0
mov dword [esp], str.GLIBCXX_TUNABLES
mov dword [0x43218c], 0
mov dword [0x432190], 0
mov dword [0x432194], 0
call sub.msvcrt.dll_getenv
mov dword [esp + 0x14], 8
mov dword [esp + 0x18], str.obj_size
mov ebx, eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 9
mov dword [esp + 0x24], str.obj_count
mov dword [esp + 0x28], 0x40
test eax, eax
jne 0x4303d6
jmp 0x4304a7
mov dword [esp], ebx
mov dword [esp + 4], 0x3a
call sub.msvcrt.dll_strchr
mov ebx, eax
test eax, eax
je 0x430450
xor eax, eax
cmp byte [ebx], 0x3a
sete al
add ebx, eax
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
xor eax, 0x62696c67
xor edx, 0x2e787863
or eax, edx
jne 0x4303c0
mov eax, dword [ebx + 7]
mov edx, dword [ebx + 0xb]
xor eax, 0x5f68652e
xor edx, 0x6c6f6f70
or eax, edx
jne 0x4303c0
cmp byte [ebx + 0xf], 0x2e
jne 0x4303c0
add ebx, 0x10
lea esi, [esp + 0x14]
lea ebp, [esp + 0x2c]
mov edi, dword [esi]
test edi, edi
je 0x430437
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
mov eax, dword [esi + 4]
mov dword [esp], eax
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x430441
cmp byte [ebx + edi], 0x3d
je 0x4304d5
add esi, 0xc
cmp ebp, esi
jne 0x43041a
jmp 0x4303c0
mov eax, dword [esp + 0x28]
mov edx, 0x100
mov ecx, 6
cmp eax, edx
cmovle edx, eax
mov eax, dword [esp + 0x1c]
test eax, eax
cmove eax, ecx
add eax, 0x2c
imul eax, edx
lea ebx, [eax*4]
mov dword [0x432194], ebx
test ebx, ebx
jne 0x4304b6
mov dword [esp], 0x4302a0
call fcn.00401400
mov eax, dword [esp + 0x2c]
sub eax, dword [0x44b0f8]
jne 0x430520
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [0x432194], 0x3200
mov ebx, 0x3200
mov dword [esp], ebx
call sub.msvcrt.dll_malloc
mov dword [0x432190], eax
test eax, eax
je 0x430513
xor edx, edx
mov dword [0x43218c], eax
mov dword [eax], ebx
mov dword [eax + 4], edx
jmp 0x430483
lea eax, [esp + 0x10]
xor ebp, ebp
mov dword [esp + 4], eax
lea eax, [ebx + edi + 1]
mov dword [esp + 8], ebp
mov dword [esp], eax
call sub.msvcrt.dll_strtoul
mov ebx, dword [esp + 0x10]
movzx edx, byte [ebx]
cmp dl, 0x3a
je 0x430503
test dl, dl
jne 0x4303c0
test eax, eax
js 0x4303c0
mov dword [esi + 8], eax
jmp 0x4303c0
xor ecx, ecx
mov dword [0x432194], ecx
jmp 0x430483
call fcn.00413890
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
call fcn.00430694
nop
nop
nop
call fcn.00430694
nop
nop
nop
Function at 0x401000
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ebp, esp
add esp, 0xfffffffc
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x40338c], eax
mov eax, dword [ebp + 4]
mov dword [0x403210], eax
xor eax, eax
mov ecx, 0x16
push eax
dec ecx
jne 0x401020
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [ebp - 0x5c]
push ecx
mov eax, 0x30
mov dword [ecx], eax
mov eax, dword [0x403210]
mov dword [ebp - 0x48], eax
mov eax, 0x4016c9
mov dword [ebp - 0x54], eax
mov ecx, str.Hello
mov dword [ebp - 0x34], ecx
call dword [sym.imp.USER32.dll_RegisterClassExA]
xor ecx, ecx
push ecx
push dword [0x403210]
push ecx
push ecx
push 0x12e
push 0x7a
push 0x34c
push 0x2aa
push 0x40000
lea eax, str.lukifas
push eax
mov eax, str.Hello
push eax
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4033d8], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x4033d8]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor ebx, ebx
lea edi, [ebp - 0x50]
jmp 0x4010bc
push edi
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.USER32.dll_GetMessageA]
test al, al
jne 0x4010b5
mov esp, ebp
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x42e030
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x401c66
pop dword [ebp - 0x24]
mov eax, 0x401c66
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xe54369f0
add dword [ebp - 0x34], 0x690edb5b
mov dword [ebp - 0x30], 0x3a9ad273
add dword [ebp - 0x30], 0xf79879d2
mov dword [ebp - 0x2c], 0xb4369a
sub dword [ebp - 0x2c], 0xb467f26c
mov dword [ebp - 0x28], 0x5129e28c
sub dword [ebp - 0x28], 0x5129e28c
lea eax, [ebp - 0x34]
push eax
mov eax, 0xce6c719a
add eax, 0x31d3beba
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x7b7cd437
sub dword [ebp - 0x34], 0x70a6ae1
mov dword [ebp - 0x30], 0x4dddfa27
add dword [ebp - 0x30], 0xf38e674e
mov dword [ebp - 0x2c], 0xfdf639c6
sub dword [ebp - 0x2c], 0x9a86cd5a
mov dword [ebp - 0x28], 0xba605478
sub dword [ebp - 0x28], 0xba605478
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x39106
push 0
call eax
mov ecx, 0x526aa840
sub ecx, 0x526a55eb
xor ebx, ebx
add ebx, eax
mov esi, 0x407000
add esi, dword [ebp - 0x24]
mov edx, 0xf43e81c5
xor dword [ebp - 0xc], 0x54fd0750
mov edi, dword [esi]
sub dword [ebp - 0x1c], edi
add edi, edx
xor dword [ebp - 0x10], esi
mov dword [ebx], edi
xor dword [ebp - 0x14], 0x3e549a5d
add ebx, 0xf5f3e30e
sub ebx, 0xf5f3e30a
add esi, 4
loop 0x401d74
add eax, 0xb8af47e4
add eax, 0x4751f443
mov ebx, eax
add eax, 0x86b9ed07
sub eax, 0x86b9ed02
mov ecx, 0x400000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret

Function at 0xfeb034
Capabilities:
Encode data using xor

Disassembly:
jmp 0xfeb03e
pushal
call 0xfeb044
pop ebp
sub ebp, 0x10
sub ebp, 0xbeb034
jmp 0xfeb05a
mov eax, 0xbeb034
add eax, ebp
add eax, 0x4c
mov ecx, 0x5cd
mov edx, 0xc6936345
xor byte [eax], dl
inc eax
dec ecx
jne 0xfeb071
jmp 0xfeb084
into
mov dh, cl
int3
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
mov eax, esi
sub eax, edi
mov esi, eax
test eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.DLL_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..data
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x6df14d9f
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x70517dfb
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219