joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401040
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [0x408670]
mov byte [esp + 3], 0
test eax, eax
je 0x401089
lea ecx, [esp + 4]
push 0
push ecx
lea edx, [esp + 0xb]
push 1
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [0x408670]
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, dword [0x408670]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x408670], 0
add esp, 8
ret
Function at 0x443d25
Capabilities:
Enumerate devices by category

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
push esi
call dword [0x498204]
mov eax, dword [esp + 0x20]
push eax
call 0x3da3a0
mov ebx, eax
mov eax, dword [esi + 0x2c]
xor ebp, ebp
add esp, 4
cmp eax, ebp
mov dword [esp + 0x18], ebx
jne 0x443dbc
mov eax, dword [esi + 0x18]
lea edi, [esi + 0x18]
cmp eax, ebp
je 0x443d5e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [edi], ebp
push ebp
call dword [0x498420]
lea edx, [esp + 0x20]
mov dword [esp + 0x20], ebp
push edx
push 0x49ae40
push 1
push ebp
push 0x49aa28
call dword [0x498428]
test eax, eax
jne 0x443da0
mov eax, dword [esp + 0x20]
push ebp
push edi
push 0x49aa18
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov eax, dword [esp + 0x20]
push eax
mov edx, dword [eax]
call dword [edx + 8]
push ebp
push 0x4a8ac8
call 0x3da3a0
add esp, 4
mov ecx, esi
push eax
call fcn.00443cb0
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ebp
mov edi, dword [esi + 0x20]
mov eax, dword [esi + 0x1c]
cmp edi, eax
jge 0x443ed2
mov ecx, dword [esi + 0x2c]
dec ecx
cmp ebx, ecx
jle 0x443ed2
cmp edi, eax
mov dword [esp + 0x14], edi
jge 0x443ed2
mov ecx, dword [esi + 0x20]
lea edx, [esp + 0x10]
inc ecx
push edx
mov dword [esi + 0x20], ecx
push edi
mov ecx, esi
mov dword [esp + 0x28], ebp
mov dword [esp + 0x18], ebp
call fcn.00443cb0
cmp eax, edi
jne 0x443e18
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x20]
push edx
push 0x49aef0
mov ecx, dword [eax]
push ebp
push ebp
push eax
call dword [ecx + 0x20]
cmp dword [esp + 0x20], ebp
je 0x443eaf
mov eax, dword [esi + 0x28]
lea edi, [esi + 0x28]
cmp eax, ebp
je 0x443e34
mov edi, eax
mov eax, dword [edi]
cmp eax, ebp
jne 0x443e2c
mov eax, dword [esi + 0x2c]
push 0xa
push eax
call fcn.00406dd0
push 0xa0
mov ebx, eax
call 0x3dc550
add esp, 0xc
cmp eax, ebp
je 0x443e5c
push ebx
mov ecx, eax
call fcn.00430010
mov ebp, eax
push ebx
mov ecx, 0x4afb50
call 0x3dc1f0
push 0x3c
call 0x3dc550
add esp, 4
test eax, eax
je 0x443e88
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 0x24]
push ecx
push ebp
push edx
mov ecx, eax
call fcn.004432c0
jmp 0x443e8a
xor eax, eax
push eax
mov ecx, ebp
mov dword [edi], eax
call fcn.004300e0
mov edi, dword [esi + 0x2c]
mov eax, dword [esp + 0x20]
inc edi
push eax
mov dword [esi + 0x2c], edi
mov ecx, dword [eax]
call dword [ecx + 8]
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
xor ebp, ebp
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x443ebd
mov edx, dword [eax]
push eax
call dword [edx + 8]
cmp ebx, dword [esi + 0x2c]
jl 0x443ed2
mov eax, dword [esi + 0x1c]
inc edi
cmp edi, eax
mov dword [esp + 0x14], edi
jl 0x443de2
push esi
call dword [0x498208]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
Function at 0x45dcd0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov eax, ecx
mov ebx, dword [esp + 0x10]
cdq
and edx, 7
push ebp
add eax, edx
and ecx, 7
sar eax, 3
push esi
mov esi, dword [esp + 0x10]
test eax, eax
mov ebp, ecx
jle 0x45dd1b
push edi
mov edi, eax
push 8
mov ecx, esi
call fcn.00458570
xor ecx, ecx
and eax, 0xff
mov cl, bh
xor edx, edx
xor eax, ecx
mov dh, bl
mov ebx, dword [eax*4 + 0x4a0084]
xor ebx, edx
dec edi
jne 0x45dcf6
pop edi
test ebp, ebp
jle 0x45dd47
push 1
mov ecx, esi
call fcn.00458570
mov ecx, ebx
and ebx, 0x7fff
shr ecx, 0xf
and ecx, 1
xor eax, ecx
shl ebx, 1
test eax, eax
je 0x45dd44
xor ebx, 0x8005
dec ebp
jne 0x45dd1f
pop esi
mov eax, ebx
pop ebp
pop ebx
ret
Function at 0x46b780
Capabilities:
Parse pe header

Disassembly:
push edi
add dword [ecx + 1], ebx
pop ebx
add dword [ebp + 1], ebx
pop edi
add dword [ecx + 1], esp
arpl word [ecx], ax
add dword gs:[edi + 1], esp
imul eax, dword [ecx], 0x16d016b
outsd dx, dword [esi]
add dword [ecx + 1], esi
jae 0x46b77f
jne 0x46b781
add dword [edi + 1], esi
add dword [edx + 1], edi

Function at 0x4918e0
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov edi, 0x2d156910
movsb byte es:[edi], byte [esi]
test eax, 0x3d6ccb1b
out 7, eax
movsb byte es:[edi], byte [esi]
cli
into
movsd dword es:[edi], dword [esi]
xchg dword [ecx], esi
cmp eax, 0xea9e090b
xor dword [0xea9e090b], edi
push 0xee10ae57
adc dh, ch
aaa
call 0x4dc95577
cli
pop es
jne 0x49183d
cmp eax, 0x7fa4d80
or byte [ebp - 6], 7
outsd dx, dword [esi]
je 0x4917fa
aaa
mov ebp, 0xe5093af9
jno 0x4917f1
mov edx, dword [ebp - 0x22fa2cc5]
lodsd eax, dword [esi]
pop es
cli
pop eax
adc esi, dword [esi]
wait
push ecx
push ecx
into
cmp ebx, dword [ebp - 0x4bb4c66b]
mov esi, 0x7250efe1
mov bl, 0xea
shr esi, cl
std
ja 0x4917ff
push eax
jb 0x4917de
ljmp 0x9cce:0x77fdeed3
pushfd
std
salc
arpl di, cx
mov edi, 0xf2d728e3
jle 0x49181d
fisttp word [eax + 0x79]
mov ebp, 0xc73bfdee
dec eax
jns 0x4917fe
out dx, al
std
cmp eax, edi
imul ebp, eax, 0xffffffbc
test byte [eax], al
int 0xd2
xchg dword [edx - 0x62cd5053], edx
popfd
aaa
aaa
lahf
sub edi, ecx
xchg ebp, eax
insd dword es:[edi], dx
rol byte [eax - 0x29], cl
lea edi, [esi]
aas
jno 0x49185e
sub edi, 0x31
xlatb
ja 0x491800
sub ebx, ecx
fld qword [ecx + 0x5a]
in eax, dx
invalid
cmc
and al, 0x3a
je 0x491828
dec esi
pop ss
imul eax, esi, 0x5f72f7e8
dec edx
inc ecx
imul edx, dword [eax + 0x3c], 0x18927ee5
rcl byte [ebx], cl
mov ecx, 0x8d5c30ee
fistp qword [edi - 0x7eba13ae]
push es
fadd qword [ebx]
pop ecx
push 0xe
lcall 0xd26c, 0xb660580a
sbb byte [ebx + 0x51], 1
jbe 0x491851
sti
dec edx
xchg edi, eax
push 0x3b
sti
dec esi
out dx, eax
xor al, 0xd9
mov es, word [ebp + 0x7d9b1779]
insd dword es:[edi], dx
mov ebx, 0x53868ca
xchg ecx, eax
loopne 0x4918db
invalid
xor dword [ebp + 0x76371321], ebx
xchg esi, eax
jbe 0x491878
mov dl, 5
enter 0x7a03, 0xfffffffffffffff5
lodsb al, byte [esi]
adc cl, byte [0x71f2aaa1]
fistp word [eax + 0x6b]
cmc
jnp 0x491954
jmp 0x4918b1
add dl, al
xchg esp, eax
inc ebx
mov ah, 0xbd
call 0xd4ac5d51
adc byte [ebx - 0x144171d6], 0x73
invalid
Function at 0x40e1f0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x483184]
sub esp, 0x10
test eax, eax
push ebx
push esi
push edi
mov esi, ecx
jne 0x40e20c
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret 4
mov eax, dword [esi + 8]
test eax, eax
je 0x40e21a
mov ecx, esi
call fcn.0040e340
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x1c]
push 6
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x10], 6
je 0x40e245
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret 4
mov dl, byte [esp + 0x18]
mov cl, byte [esp + 0x17]
mov al, byte [esp + 0x16]
mov byte [esi + 6], dl
movzx dx, byte [esp + 0x15]
mov byte [esi + 5], cl
mov byte [esi + 4], al
movzx cx, byte [esp + 0x14]
mov al, byte [esp + 0x19]
inc ecx
mov byte [esi + 7], al
lea eax, [edx + 1]
mov word [esi], cx
mov word [esi + 2], ax
and ecx, 0xffff
and eax, 0xffff
imul eax, ecx
test cl, 1
mov ebx, eax
mov dword [esi + 0xc], 2
jne 0x40e2a2
mov edx, dword [esi + 0xc]
shr ecx, 1
inc edx
test cl, 1
mov dword [esi + 0xc], edx
je 0x40e294
lea eax, [ebx*4]
push eax
call fcn.00429f70
add esp, 4
mov dword [esi + 8], eax
test eax, eax
jne 0x40e2c2
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
test ebx, ebx
je 0x40e31d
xor edi, edi
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x10]
push 0
push ecx
lea edx, [esp + 0x16]
push 2
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ax, word [esp + 0xe]
mov edx, dword [0x483184]
movsx ecx, ah
imul ecx, dword [edx]
mov edx, dword [esi + 8]
movsx eax, al
add ecx, eax
mov dword [edi + edx], ecx
mov eax, dword [0x48310c]
cmp eax, 0x10
jne 0x40e30e
mov eax, dword [esi + 8]
add eax, edi
shl dword [eax], 1
cmp dword [esp + 0x10], 2
jne 0x40e32b
dec ebx
add edi, 4
test ebx, ebx
jne 0x40e2c8
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x10
ret 4
mov ecx, esi
call fcn.0040e340
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret 4
Function at 0x415830
Capabilities:
Terminate thread

Disassembly:
mov al, byte [0x483818]
test al, al
je 0x415871
mov eax, dword [0x48377c]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x483770]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [0x483754]
test eax, eax
je 0x415864
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [0x48377c]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
ret
Function at 0x4168e0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov al, byte [esi + 0x11]
test al, al
je 0x4168f5
call fcn.00415a50
mov edi, dword [esp + 0x28]
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x1c]
push 6
push ecx
push edi
call ebp
mov eax, dword [esp + 0x10]
cmp eax, 6
jae 0x416933
push 1
push 0
neg eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret 4
cmp byte [esp + 0x14], 0x47
jne 0x416af0
cmp byte [esp + 0x15], 0x49
jne 0x416af0
cmp byte [esp + 0x16], 0x46
jne 0x416af0
lea edx, [esp + 0x10]
push 0
push edx
lea eax, [esp + 0x24]
push 7
push eax
push edi
call ebp
cmp dword [esp + 0x10], 7
jb 0x416afd
mov cl, byte [esp + 0x20]
mov eax, 1
and cl, 7
inc cl
shl eax, cl
mov byte [esi + 0x10], cl
lea ecx, [eax + eax*2]
push ecx
call fcn.00429f70
add esp, 4
mov dword [esi + 0xc], eax
test eax, eax
je 0x416afd
mov dl, byte [esi + 0x11]
mov cl, byte [esp + 0x20]
or dl, 2
test cl, 0x80
mov byte [esi + 0x11], dl
je 0x4169c5
mov cl, byte [esi + 0x10]
lea edx, [esp + 0x10]
push 0
push edx
mov edx, 1
shl edx, cl
lea ecx, [edx + edx*2]
push ecx
push eax
push edi
call ebp
mov dword [0x483854], edi
mov dword [0x483850], 0
call fcn.00416b10
cmp al, 0x21
jne 0x4169e5
call fcn.00416b90
jmp 0x4169d5
cmp al, 0x2c
jne 0x416afd
mov ebx, 4
call fcn.00416b10
dec ebx
jne 0x4169f2
call fcn.00416b10
and eax, 0xff
mov dword [esi], eax
call fcn.00416b10
mov ebx, dword [esi]
and eax, 0xff
shl eax, 8
add ebx, eax
mov dword [esi], ebx
call fcn.00416b10
and eax, 0xff
mov dword [esi + 4], eax
call fcn.00416b10
mov edx, dword [esi + 4]
and eax, 0xff
shl eax, 8
add edx, eax
mov dword [esi + 4], edx
call fcn.00416b10
test al, 0x40
jne 0x416afd
test al, 0x80
je 0x416a9f
mov edx, dword [esi + 0xc]
and al, 7
inc al
push edx
mov byte [esi + 0x10], al
call fcn.00429ec0
mov cl, byte [esi + 0x10]
mov eax, 1
shl eax, cl
lea eax, [eax + eax*2]
push eax
call fcn.00429f70
add esp, 8
mov dword [esi + 0xc], eax
test eax, eax
jne 0x416a86
mov byte [esi + 0x11], al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
lea ecx, [esp + 0x10]
push 0
push ecx
mov cl, byte [esi + 0x10]
mov edx, 1
shl edx, cl
lea edx, [edx + edx*2]
push edx
push eax
push edi
call ebp
mov eax, dword [esi + 4]
imul eax, dword [esi]
push eax
call fcn.00429f70
add esp, 4
mov dword [esi + 8], eax
test eax, eax
jne 0x416ac8
mov ecx, esi
call fcn.00415a50
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret 4
mov ecx, dword [esi + 4]
mov bl, byte [esi + 0x11]
imul ecx, dword [esi]
or bl, 1
push ecx
push eax
mov byte [esi + 0x11], bl
call fcn.00416c20
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
push 1
push 0
push 0xfffffffffffffffa
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret 4
Function at 0x422130
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x8000
push eax
call fcn.0042d130
mov edi, eax
add esp, 8
cmp edi, 0xffffffff
jne 0x422154
pop edi
pop esi
xor eax, eax
pop ebx
ret 4
push edi
call fcn.00444d40
mov ebx, eax
push ebx
call fcn.00429f70
mov esi, eax
add esp, 8
test esi, esi
jne 0x42217c
push edi
call fcn.0042d000
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
ret 4
push ebx
push esi
push edi
call fcn.00433bf0
push edi
call fcn.0042d000
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
ret 4
Function at 0x40a020
Capabilities:
Get common file path
Move file

Disassembly:
sub esp, 0x200
lea eax, [esp]
push 0xff
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x40a0cb
push ebx
push esi
lea ecx, [esp + 8]
push edi
push ecx
lea edx, [esp + 0x110]
push 0x40e394
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov edi, 0x40e38c
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xc]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x210]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
test eax, eax
pop ebx
je 0x40a0b5
lea eax, [esp + 0x100]
lea ecx, [esp]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_rename]
add esp, 8
add esp, 0x200
ret
lea edx, [esp]
lea eax, [esp + 0x100]
push edx
push eax
call dword [sym.imp.MSVCRT.dll_rename]
add esp, 8
add esp, 0x200
ret

Function at 0x461f20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x455015
lea edi, [esi - 0x54015]
push edi
or ebp, 0xffffffff
jmp 0x461f42
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x461f49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x461f38
mov eax, 1
add ebx, ebx
jne 0x461f5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x461f50
jne 0x461f6c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x461f50
xor ecx, ecx
sub eax, 3
jb 0x461f80
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x461ff2
mov ebp, eax
add ebx, ebx
jne 0x461f8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x461f98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x461fbc
inc ecx
add ebx, ebx
jne 0x461fa8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x461f9d
jne 0x461fb9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x461f9d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x461fdc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x461fcd
jmp 0x461f3e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x461fdc
add edi, ecx
jmp 0x461f3e
pop esi
mov edi, esi
mov ecx, 0x32d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x461ffa
cmp byte [edi], 0
jne 0x461ffa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x461fff
lea edi, [esi + 0x5f000]
mov eax, dword [edi]
or eax, eax
je 0x46206e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x621f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x62254]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x46202c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x62258]
or eax, eax
je 0x462068
mov dword [ebx], eax
add ebx, 4
jmp 0x462049
call dword [esi + 0x6225c]
popal
jmp 0x4095a4
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x402000
Capabilities:
Terminate process

Disassembly:
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
push 0
push 0x40100e
push 0xd
push str.Hello__World_
push eax
call dword [sym.imp.KERNEL32.DLL_WriteConsoleA]
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x401154
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegDisablePredefinedCacheEx]
xor esi, esi
call edi
add byte [esi + 0x4228d0], 0x6c
call edi
add byte [esi + 0x4228d0], 0xcf
call edi
xor byte [esi + 0x4228d0], 0x76
call edi
add byte [esi + 0x4228d0], 0x68
call edi
add byte [esi + 0x4228d0], 0x13
call edi
add byte [esi + 0x4228d0], 0x54
call edi
add byte [esi + 0x4228d0], 0x66
call edi
xor byte [esi + 0x4228d0], 0x29
call edi
add byte [esi + 0x4228d0], 0x8c
call edi
add byte [esi + 0x4228d0], 0x49
call edi
xor byte [esi + 0x4228d0], 0x69
call edi
add byte [esi + 0x4228d0], 0xfc
call edi
add byte [esi + 0x4228d0], 0x6f
call edi
add byte [esi + 0x4228d0], 0x51
call edi
add byte [esi + 0x4228d0], 0x53
call edi
add byte [esi + 0x4228d0], 0x68
call edi
xor byte [esi + 0x4228d0], 0x93
call edi
add byte [esi + 0x4228d0], 0xf4
call edi
add byte [esi + 0x4228d0], 0xf
call edi
add byte [esi + 0x4228d0], 0x31
call edi
add byte [esi + 0x4228d0], 3
call edi
add byte [esi + 0x4228d0], 0xac
call edi
add byte [esi + 0x4228d0], 0xf6
call edi
add byte [esi + 0x4228d0], 0x46
call edi
add byte [esi + 0x4228d0], 0x30
call edi
xor byte [esi + 0x4228d0], 0x44
call edi
add byte [esi + 0x4228d0], 0x7d
call edi
add byte [esi + 0x4228d0], 0x5d
call edi
add byte [esi + 0x4228d0], 0x48
call edi
add byte [esi + 0x4228d0], 0x47
call edi
add byte [esi + 0x4228d0], 0xd
call edi
xor byte [esi + 0x4228d0], 0x88
call edi
xor byte [esi + 0x4228d0], 0x1a
call edi
xor byte [esi + 0x4228d0], 0xe0
call edi
add byte [esi + 0x4228d0], 0xfe
call edi
add byte [esi + 0x4228d0], 9
call edi
xor byte [esi + 0x4228d0], 0x6f
call edi
add byte [esi + 0x4228d0], 0x23
call edi
add byte [esi + 0x4228d0], 0x11
call edi
xor byte [esi + 0x4228d0], 0x90
call edi
add byte [esi + 0x4228d0], 0xb1
call edi
xor byte [esi + 0x4228d0], 0x30
call edi
add byte [esi + 0x4228d0], 0x48
call edi
xor byte [esi + 0x4228d0], 0x5c
call edi
add byte [esi + 0x4228d0], 0xaf
call edi
xor byte [esi + 0x4228d0], 0xee
call edi
add byte [esi + 0x4228d0], 7
call edi
add byte [esi + 0x4228d0], 0x6e
call edi
add byte [esi + 0x4228d0], 0xd2
inc esi
cmp esi, 0x2b800
jb 0x40115e
pop edi
pop esi
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x5da204], 1
mov dword [0x5da200], 1
mov dword [0x5da1fc], 1
jne 0x401056
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010b0
mov dword [0x5da00c], eax
mov eax, dword [0x5da210]
test eax, eax
je 0x4010a0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x5da224]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x5da20c]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x55e148], 1
je 0x4010e0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x401070
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x4010f8
cmp dx, 0x20b
jne 0x401056
cmp dword [ecx + 0x84], 0xe
jbe 0x401056
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401056
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401056
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401056
Function at 0x418200
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x40
mov ebx, dword [ebp + 0xc]
cmp byte [ebp + 8], 0
mov edi, edx
mov esi, ecx
je 0x418291
lea eax, [ebp - 0x14]
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x4c]
inc ebx
mov dword [ebp - 0x30], 0x5629f0
mov dword [ebp - 0x2c], 3
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], sym.core::fmt::num::imp::__LT_impl_u20_core..fmt..Display_u20_for_u20_u32_GT_::fmt::ha05222cc52361d66
mov dword [ebp - 0x44], edx
lea ecx, [ebp - 0x3c]
lea edx, [ebp - 0x30]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x40], sym.core::fmt::num::imp::__LT_impl_u20_core..fmt..Display_u20_for_u20_u32_GT_::fmt::ha05222cc52361d66
mov dword [ebp - 0x24], 2
call dbg.format_inner
mov ebx, dword [ebp - 0x3c]
mov ecx, esi
mov edx, edi
push dword [ebp - 0x34]
push ebx
call sym.console::term::Term::write_str::h642259fedb2f889f
add esp, 8
cmp dword [ebp - 0x38], 0
je 0x4182df
push ebx
push 0
push dword [0x5da100]
call sub.kernel32.dll_HeapFree
jmp 0x4182df
xor eax, eax
cmp byte [edi + 0x20], 0
sete al
or eax, 0xfffffff4
push eax
call sub.kernel32.dll_GetStdHandle
mov edi, eax
xorps xmm0, xmm0
lea eax, [ebp - 0x30]
mov dword [ebp - 0x1e], 0
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x22], 0
push eax
push edi
call sub.kernel32.dll_GetConsoleScreenBufferInfo
test eax, eax
je 0x4182dc
mov word [ebp - 0x10], 0
mov word [ebp - 0xe], bx
mov eax, dword [ebp - 0x10]
push eax
push edi
call sub.kernel32.dll_SetConsoleCursorPosition
mov byte [esi], 4
add esp, 0x40
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41cb30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
xor esi, esi
lea eax, [edx + eax*2]
mov dword [ebp - 0x10], eax
movzx eax, byte [edx + 1]
cmp byte [edx], ch
lea edx, [edx + 2]
lea edi, [esi + eax]
jne 0x41cb80
cmp edi, esi
jb 0x41cbeb
cmp edi, dword [ebp + 0x10]
ja 0x41cbfe
add esi, dword [ebp + 0xc]
nop word [eax + eax]
test eax, eax
je 0x41cb82
dec eax
cmp byte [esi], cl
lea esi, [esi + 1]
jne 0x41cb70
jmp 0x41cbdf
ja 0x41cb89
cmp edx, dword [ebp - 0x10]
mov esi, edi
jne 0x41cb45
mov edi, dword [ebp + 0x18]
movzx ecx, cx
mov al, 1
add edi, ebx
nop word cs:[eax + eax]
nop dword [eax]
movzx edx, byte [ebx]
lea esi, [ebx + 1]
test dl, dl
js 0x41cbc0
mov ebx, esi
sub ecx, edx
jns 0x41cbd7
jmp 0x41cbe1
cmp esi, edi
je 0x41cc12
movzx esi, byte [ebx + 1]
and edx, 0x7f
add ebx, 2
shl edx, 8
or edx, esi
sub ecx, edx
js 0x41cbe1
xor al, 1
cmp ebx, edi
jne 0x41cba0
jmp 0x41cbe1
xor eax, eax
and al, 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
mov edx, edi
push 0x563598
call dbg.slice_index_order_fail
add esp, 4
ud2
mov edx, dword [ebp + 0x10]
mov ecx, edi
push 0x563598
call dbg.slice_end_index_len_fail
add esp, 4
ud2
mov ecx, str.called__Option::unwrap____on_a__None__valueC:UsersTEST.cargo_registry_srcindex.crates.io_6f17d22bba15001fwinapi_util_0.1.5_srcwin.rs
mov edx, 0x2b
push 0x5635a8
call dbg.panic
add esp, 4
ud2