joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cef80
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
jge 0x4cef99
mov esi, edi
mov edi, eax
jmp 0x4cef9b
mov esi, eax
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, dword [ebx + 8]
jg 0x4cefab
mov eax, ebx
jmp 0x4cefb5
push eax
push ebx
call fcn.00492090
add esp, 8
test eax, eax
jne 0x4cefbd
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [edi + 4], eax
jle 0x4cefd9
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [edi + 4]
jl 0x4cefc4
cmp eax, dword [esi + 4]
jge 0x4ceff0
mov edi, edi
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [esi + 4]
jl 0x4cefe0
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
test eax, eax
jle 0x4cf011
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x4cf00e
dec eax
test eax, eax
jg 0x4cf000
mov dword [ebx + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x535020
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
jmp 0x7f6581
push 0x7369997f
call fcn.008111bb

Function at 0x536c80
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x536d8c
test eax, eax
je 0x536d8c
push esi
push edi
mov ecx, 0x10
mov esi, 0x551ff0
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x536d73
lea edi, [eax + 4]
jmp 0x536cd7
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x536cec
mov dword [ebp - 4], 2
jmp 0x536d0d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x536d03
mov dword [ebp - 4], 1
jmp 0x536d0d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x536d83
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x536d46
mov byte [ecx], 0x3d
jmp 0x536d52
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x536d5d
mov byte [ecx], 0x3d
jmp 0x536d63
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x536cd4
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x68eae1
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
push 0xd80eb919
call fcn.0087f1b2
Function at 0x79c340
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x1e], 0x64
mov byte [ebp - 0x1b], 0x2e
jmp 0x18dd9cb
mov byte [ebp - 0x17], 0
mov byte [ebp - 0xd8], 0x52
jmp 0x752cb4
push edi
movsx edi, sp
mov edi, ecx
not cl
mov cl, 0x69
mov byte [ebp - 0x1d], al
jmp 0x774c91
mov byte [ebp - 0xd7], dl
mov byte [ebp - 0xd5], 0x47
jmp loc.0041f302
mov byte [ebp - 0x19], al
jmp 0x7ceeba
mov byte [ebp - 0x1c], al
jmp 0x76f228
push ebp
mov ebp, esp
cmp dx, si
lea esp, [esp - 0x160]
clc
lahf
and ax, di
mov eax, dword [0x51f620]
xor eax, ebp
mov dl, 0xd2
mov dword [ebp - 4], eax
push ebx
mov al, 0x6c
mov dl, 0x74
mov bl, 0x3e
xchg bl, bl
mov bl, 0x6f
push esi
jmp 0x737d99
mov byte [ebp - 0x18], al
mov byte [ebp - 0xd6], al
not al
mov al, 0x73
mov byte [ebp - 0x20], 0x6e
jmp 0x18ea865
mov byte [ebp - 0x1a], 0x64
jmp 0x72f860
mov byte [ebp - 0x1f], dl
jmp 0x57dc8d

Function at 0x79fe69
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push 0x14bf3b81
call fcn.0088c55d

Function at 0x7ae828
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
movzx ebp, ax
mov ebp, esp
btr eax, 0x87
lea esp, [esp - 0x4ac]
rcr ah, 0x6b
mov eax, dword [0x51f620]
xor eax, ebp
sub ecx, ebp
cmp edi, 0x78042eb4
mov dword [ebp - 4], eax
test edx, ebp
sub eax, eax
push 0x3fe
setl ch
push eax
mov cx, di
cmovp cx, di
lea ecx, [ebp - 0x49e]
push ecx
jmp 0x7b48a9
mov word [ebp - 0x4a0], ax
jmp loc.00424851
Function at 0x7b97bd
Capabilities:
Read file on windows
Write file on windows

Disassembly:
jne 0x807259
mov byte [0x529b4c], 1
test edx, edi
cmp dword [0x529b48], ebx
jmp 0x5929c0
push ebx
jmp 0x5b2b7e
jne 0x70a266
push 0xa00000
jmp 0x7ad96a
push 0x4c8
jmp 0x61f45a
call fcn.004405e0
push eax
xchg dx, dx
mov edx, 0x52afa8
jmp 0x4280c3
push ecx
call dword [0x4e7668]
call 0x586a6d
push 6
mov esi, eax
xchg di, di
mov edi, 0x512a00
jmp 0x85c42a
mov dword [ebp - 0x10], eax
cmp ebp, 0x5ee276c
push ebx
push esi
cmp esi, ebp
push edi
cmc
test edx, edi
push eax
shl eax, cl
cmova ax, bx
xadd ax, ax
lea eax, [ebp - 0xc]
clc
test edx, 0x26537378
mov dword fs:[0], eax
or eax, esi
sbb ax, sp
mov eax, dword [0x52afa0]
clc
jmp 0x8526bf
call 0x7bb1c1
test eax, eax
jmp 0x6f2f05
push ebx
push eax
jmp 0x64c92c
add esp, 8
push ebx
jmp 0x58adaf
je 0x807259
mov ecx, dword [0x529d70]
clc
cmp bx, 0x503b
cmp ecx, ebx
jmp 0x72ea0c
lea edx, [ebp - 0x1020]
jmp 0x7e7a19
je 0x807259
call fcn.008d5129
lea esi, [eax + 0x14]
call 0x6c6b3e
xor eax, dword [esi]
cmc
cmp edi, edi
test si, 0x6ed9
cmp eax, 0x1b7d6a4
jmp 0x563595
call fcn.0040beb0
mov ecx, dword [0x529908]
jmp 0x69c2ca
call fcn.0045023c
lea esp, [esp + 4]
mov dword [0x529b48], eax
cmp edi, ebp
cmp eax, ebx
jmp 0x8ad2a8
jmp 0x807259
push ebp
mov ebp, esp
not al
cmovbe ax, sp
push 0xffffffffffffffff
not ah
xchg ah, ah
push 0x4e4f12
nop
mov eax, dword fs:[0]
push eax
mov eax, 0x1054
call fcn.00474480
mov eax, dword [0x51f620]
xor eax, ebp
cmc
jmp 0x642799
push edx
jmp 0x60788c
mov ecx, dword [ebp - 0xc]
add bh, ah
mov dword fs:[0], ecx
bts di, di
shl ebx, cl
cmovno cx, bx
pop ecx
shld si, sp, 0xfb
pop edi
pop esi
mov bx, di
pop ebx
and cx, 0x1d59
btr ecx, 0x43
rcr cx, cl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
jmp 0x8d2c7c
sub ebx, ebx
jmp 0x6522f0
call fcn.004383f0
add esp, 4
jmp 0x7b6dcf
jne 0x70a266
push str.Cant_Optimize_Resource_File.
push str._s_Error:0x00000006
mov dl, bl
movsx edx, bx
mov edx, 0x529928
mov byte [0x529b4c], bl
jmp 0x783108
call fcn.0046d9cb
mov esp, ebp
movzx ebp, di
pop ebp
jmp 0x40ebb1
Function at 0x7d35c8
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 0x20], esp
push 0x5118b4
jmp 0x787790
call fcn.00465dbf
push 0xffffffffffffffff
xchg ch, ch
movsx ecx, ax
mov cl, 0xa3
push 0
cmovo ecx, esp
mov cl, 0x51
movzx ecx, sp
lea ecx, [ebp - 0x34]
jmp 0x71d0b0
push eax
jmp 0x73b569
mov byte [ebp - 4], 1
jmp 0x723ebb
call fcn.00465e66
lea eax, [ebp - 0x34]
jmp 0x71d045
push ecx
movzx ecx, ax
mov ecx, esp
jmp 0x6c1b7e
call fcn.004465b0
mov byte [ebp - 4], 2
jmp loc.00428123
push ebp
mov ebp, esp
push 0xffffffffffffffff
sub cl, ch
and ch, 0xde
bsf ecx, ebx
push 0x4e5030
shl eax, 0xf6
or al, dl
mov eax, dword fs:[0]
and ch, 0xf
sub cx, 0x7ed
push eax
lea esp, [esp - 0x28]
push ebx
adc ch, 0xa4
push esi
sbb eax, 0x26284851
add ecx, esp
push edi
movzx ax, ah
cmovns ax, cx
jmp 0x7eb146
mov eax, dword [0x51f620]
rol cx, 0x8e
clc
xchg cl, cl
xor eax, ebp
movsx cx, dl
cmovnp ecx, eax
bswap cx
push eax
movzx eax, si
bswap cx
lea eax, [ebp - 0xc]
cmovno cx, si
not ecx
mov dword fs:[0], eax
not cl
movzx ecx, sp
setg ch
lea ecx, [ebp - 0x34]
jmp 0x81018f
mov dword [ebp - 4], 0
jmp 0x6d3ea1

Function at 0x7eb146
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 0x20], esp
push 0x5118b4
jmp 0x787790
call fcn.00465dbf
push 0xffffffffffffffff
xchg ch, ch
movsx ecx, ax
mov cl, 0xa3
push 0
cmovo ecx, esp
mov cl, 0x51
movzx ecx, sp
lea ecx, [ebp - 0x34]
jmp 0x71d0b0
push eax
jmp 0x73b569
mov byte [ebp - 4], 1
jmp 0x723ebb
call fcn.00465e66
lea eax, [ebp - 0x34]
jmp 0x71d045
push ecx
movzx ecx, ax
mov ecx, esp
jmp 0x6c1b7e
call fcn.004465b0
mov byte [ebp - 4], 2
jmp loc.00428123
push ebp
mov ebp, esp
push 0xffffffffffffffff
sub cl, ch
and ch, 0xde
bsf ecx, ebx
push 0x4e5030
shl eax, 0xf6
or al, dl
mov eax, dword fs:[0]
and ch, 0xf
sub cx, 0x7ed
push eax
lea esp, [esp - 0x28]
push ebx
adc ch, 0xa4
push esi
sbb eax, 0x26284851
add ecx, esp
push edi
movzx ax, ah
cmovns ax, cx
jmp 0x7eb146
mov eax, dword [0x51f620]
rol cx, 0x8e
clc
xchg cl, cl
xor eax, ebp
movsx cx, dl
cmovnp ecx, eax
bswap cx
push eax
movzx eax, si
bswap cx
lea eax, [ebp - 0xc]
cmovno cx, si
not ecx
mov dword fs:[0], eax
not cl
movzx ecx, sp
setg ch
lea ecx, [ebp - 0x34]
jmp 0x81018f
mov dword [ebp - 4], 0
jmp 0x6d3ea1
Function at 0x814525
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edx
jmp 0x7a8725
ret
call fcn.0046d9cb
mov esp, ebp
not ebp
pop ebp
jmp 0x5b72eb
lea edx, [ebp - 0xc]
mov eax, 0x3a
jmp 0x689204
call fcn.018d84f0
test eax, eax
jmp 0x815e6c
push edx
mov word [ebp - 0xc], di
jmp 0x814e9c
mov ecx, dword [ebp - 4]
btr si, ax
cmc
pop esi
rol bl, cl
xor ecx, ebp
bt bx, ax
rcl bh, cl
rol bl, cl
sub al, al
movsx ebx, di
mov bl, 0x27
movsx bx, dh
pop ebx
jmp 0x70097b
call fcn.0046d9cb
mov esp, ebp
pop ebp
jmp loc.0040395d
call fcn.004737c0
lea esp, [esp + 0xc]
test ebx, ebx
jmp 0x18cdb8d
mov dword [ebp - 0xa], eax
mov word [ebp - 6], ax
jmp 0x8acc11
mov word [ebp - 0xc], ax
jmp 0x742f29
xor ecx, ecx
xor dl, 0x57
xchg dx, dx
push 0x7e
clc
cdq
cmp esi, edi
sub eax, eax
cmovnp edx, ebx
xchg dx, dx
push ecx
lea edx, [ebp - 0x8a]
jmp 0x534991
inc edi
cmp edi, esi
stc
cmp di, 0x5b
jl 0x821c25
pop edi
pop esi
or bx, si
test si, ax
sub al, al
pop ebx
cmp dl, 0xe5
mov ecx, dword [ebp - 4]
cmp edi, ebp
xor ecx, ebp
jmp 0x6144ab
mov dword [ebp - 0x90], esi
jmp 0x7598fb
push ebp
rol edx, 0x9e
shr eax, cl
mov ebp, esp
sub esp, 0x90
bts dx, si
rdtsc
sbb eax, 0x2aea7355
mov eax, dword [0x51f620]
xor eax, ebp
mov dword [ebp - 4], eax
shld dx, bx, 0x7b
sal edx, cl
push ebx
xchg bh, dl
shrd dx, cx, 0x34
or dx, di
mov ebx, dword [ebp + 8]
push esi
shr dl, 0xa
mov esi, ecx
jmp 0x77904c
mov word [ebp - 0xa], ax
jmp 0x66d1fd
je 0x7a05a3
lea eax, [ebp - 0x8c]
sub dx, di
lea edx, [eax + 2]
stc
lea ecx, [ecx]
sub cx, sp
bts cx, bp
test di, 0x1c7a
mov cx, word [eax]
test esi, ecx
jmp loc.004494ad
je 0x6eb55a
push edi
mov edi, 0x41
rdtsc
movzx eax, cx
mov ch, 0xb9
mov edi, edi
movzx ecx, si
push 0x40
movzx edx, dx
setge ch
lea ecx, [ebp - 0x8c]
rdtsc
jmp 0x871dab
push ecx
seto al
cwde
jmp 0x634db4
mov word [ebp - 0x8c], cx
jmp 0x73d984
je 0x6eb55a
test esi, esi
jmp 0x821c0c
Function at 0x4027a9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push edi
push 0x40d920
lea eax, [ebp - 0x268]
push str.PYTHONHOME_s
push eax
mov dword [ebp - 4], 0x104
call esi
lea eax, [ebp - 0x268]
push eax
call dword [sym.imp.MSVCRT.dll__putenv]
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0x10
push dword [ebp + 8]
call edi
test eax, eax
jne 0x40287b
push dword [0x40d890]
lea eax, [ebp - 0x54]
push dword [0x40da24]
push str.SOFTWAREPythonPythonCore_d._dInstallPath
push eax
call esi
add esp, 0x10
lea eax, [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push eax
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x54]
push eax
push 0x80000001
call esi
test eax, eax
je 0x40284f
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x54]
push eax
push 0x80000002
call esi
test eax, eax
je 0x40284f
xor eax, eax
jmp 0x40287b
lea eax, [ebp - 0x158]
push 0x40b5c8
push eax
call sub.MSVCRT.dll_strcat
push dword [ebp + 8]
lea eax, [ebp - 0x158]
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x10
lea eax, [ebp - 0x158]
push eax
call edi
pop edi
pop esi
leave
ret
Function at 0x401102
Capabilities:
Terminate process

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x44
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0x18
mov eax, dword [ebp - 0x18]
mov eax, dword fs:[eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0
jmp 0x40115e
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
jne 0x40114d
mov dword [ebp - 0xc], 1
jmp 0x401188
mov dword [esp], 0x3e8
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], 0x617ae8
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x20]
lock cmpxchg dword [edx], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40113c
mov eax, dword [0x617ae4]
cmp eax, 1
jne 0x4011a0
mov dword [esp], 0x1f
call fcn.0041c938
jmp 0x4011d3
mov eax, dword [0x617ae4]
test eax, eax
jne 0x4011c9
mov dword [0x617ae4], 1
mov dword [esp + 4], 0x61a014
mov dword [esp], 0x61a00c
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
jmp 0x4011d3
mov dword [0x61701c], 1
mov eax, dword [0x617ae4]
cmp eax, 1
jne 0x4011fb
mov dword [esp + 4], 0x61a008
mov dword [esp], section..CRT
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov dword [0x617ae4], 2
cmp dword [ebp - 0xc], 0
jne 0x401217
mov dword [ebp - 0x2c], 0x617ae8
mov dword [ebp - 0x30], 0
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
xchg dword [eax], edx
mov eax, dword [entry1]
test eax, eax
je 0x401241
mov eax, dword [entry1]
mov dword [esp + 8], 0
mov dword [esp + 4], 2
mov dword [esp], 0
call eax
sub esp, 0xc
call fcn.0040d671
mov dword [esp], 0x40d78c
mov eax, dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call eax
sub esp, 4
mov dword [0x617074], eax
mov dword [esp], section..text
call sub.api_ms_win_crt_runtime_l1_1_0.dll__set_invalid_parameter_handler
call fcn.0040d010
mov eax, dword [0x617004]
mov dword [esp + 4], 0x617008
mov dword [esp], eax
call fcn.004013c8
call fcn.0040ce4c
mov eax, dword [0x4d33b0]
mov edx, dword [0x61700c]
mov dword [eax], edx
mov ecx, dword [0x61700c]
mov edx, dword [0x617008]
mov eax, dword [0x617004]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004c9340
mov dword [0x617014], eax
mov eax, dword [0x617018]
test eax, eax
jne 0x4012d0
mov eax, dword [0x617014]
mov dword [esp], eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
mov eax, dword [0x61701c]
test eax, eax
jne 0x4012de
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
mov eax, dword [0x617014]
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret
Function at 0x4012eb
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x61704c], 1
mov dword [0x617050], 1
mov dword [0x617054], 1
mov dword [ebp - 4], 0x400000
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40132c
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40134f
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
movzx eax, ax
cmp eax, 0x10b
je 0x401371
cmp eax, 0x20b
je 0x401396
jmp 0x4013c1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x5c]
cmp eax, 0xe
ja 0x401383
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x4013c6
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x6c]
cmp eax, 0xe
ja 0x4013ae
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x4013c6
mov eax, 0
leave
ret

Function at 0x401685
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
xor ebx, ebx
sub esp, 0x2c
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x3c]
mov esi, dword [edi + eax + 0x78]
add esi, edi
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x20]
add eax, edi
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], ebx
je 0x4016dd
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + ebx*4]
add eax, edi
mov dword [esp], eax
call fcn.0040166c
cmp eax, dword [ebp + 0xc]
jne 0x4016da
add ebx, ebx
add ebx, edi
add ebx, dword [esi + 0x24]
movzx eax, word [ebx]
lea eax, [edi + eax*4]
add eax, dword [esi + 0x1c]
add edi, dword [eax]
mov eax, edi
jmp 0x4016df
inc ebx
jmp 0x4016aa
xor eax, eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401711
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov eax, 0x114c
mov ebp, esp
push edi
push esi
push ebx
call fcn.0040dfc8
sub esp, eax
lea eax, [ebp - 0x1138]
mov dword [esp + 8], eax
lea eax, [ebp - 0x1018]
mov dword [esp + 4], 0x1000
mov dword [esp], eax
call sub.PSAPI.DLL_EnumProcesses
sub esp, 0xc
test eax, eax
jne 0x401751
xor eax, eax
jmp 0x401854
mov eax, dword [ebp - 0x1138]
xor esi, esi
shr eax, 2
mov dword [ebp - 0x1140], eax
mov eax, dword [ebp - 0x1140]
cmp esi, eax
je 0x40174a
mov eax, dword [ebp + esi*4 - 0x1018]
test eax, eax
je 0x40184e
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x40184e
xor ecx, ecx
lea edi, [ebp - 0x111c]
mov dword [esp + 0xc], 0x104
mov dword [esp + 4], ecx
mov dword [esp + 8], edi
mov dword [esp], eax
call sub.PSAPI.DLL_GetModuleBaseNameA
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x1134]
sub esp, 0x10
mov dword [esp], eax
call fcn.00401592
push eax
mov ecx, dword [ebp - 0x1130]
mov dword [ebp - 0x1144], ecx
mov dword [esp], edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov ecx, dword [ebp - 0x1144]
mov byte [ebp - 0x1139], 0
cmp ecx, eax
jne 0x401823
mov byte [ebp - 0x1139], 1
test ecx, ecx
je 0x401823
mov dword [esp + 8], ecx
mov dword [esp + 4], edi
mov eax, dword [ebp - 0x1134]
mov dword [esp], eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcmp
test eax, eax
sete byte [ebp - 0x1139]
lea ecx, [ebp - 0x1134]
call fcn.004a75d0
cmp byte [ebp - 0x1139], 0
mov dword [esp], ebx
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x40184b
call eax
push edx
mov eax, dword [ebp + esi*4 - 0x1018]
jmp 0x401854
call eax
push eax
inc esi
jmp 0x401762
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40d018
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0041c758
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort

Function at 0x40dbec
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40dc0b
mov eax, 0
jmp 0x40dc4f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40dc2e
mov eax, 0
jmp 0x40dc4f
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x40dc4a
mov eax, 0
jmp 0x40dc4f
mov eax, 1
leave
ret

Function at 0x40dc51
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x40dcb0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x40dca8
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x40dca8
mov eax, dword [ebp - 4]
jmp 0x40dcc4
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x40dc85
mov eax, 0
leave
ret
Function at 0x41f758
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
cmp dword [ebp + 8], 0
je 0x41f820
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0041eefc
cmp eax, 1
jne 0x41f816
mov dword [ebp - 0x3d], 0
mov dword [ebp - 0x39], 0
mov dword [ebp - 0x35], 0
mov dword [ebp - 0x31], 0
mov dword [ebp - 0x2d], 0
mov dword [ebp - 0x29], 0
mov dword [ebp - 0x25], 0
mov dword [ebp - 0x21], 0
mov dword [ebp - 0x1d], 0
mov dword [ebp - 0x19], 0
mov dword [ebp - 0x15], 0
mov dword [ebp - 0x11], 0
mov dword [ebp - 0xd], 0
mov byte [ebp - 9], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.Error_cleaning_up_spin_keys_for_thread__lu._n
mov dword [esp + 4], 0x35
lea eax, [ebp - 0x3d]
mov dword [esp], eax
call fcn.00426e00
lea eax, [ebp - 0x3d]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call eax
sub esp, 4
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [eax], edx
jmp 0x41f821
nop
leave
ret