joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46c0a2
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x49c4b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0046b39b
mov dword [ebp - 0x14], eax
cmp dword [0x49fa04], esi
jne 0x46c195
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x46c122
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x46c275
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x46c275
push 0x481f88
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x46c275
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x49fa04], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x49fa08], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x49fa0c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x49fa14], eax
test eax, eax
je 0x46c192
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x49fa10], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x46c1ba
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x46c1ad
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x46c1cf
push 4
pop eax
jmp 0x46c277
cmp dword [ebp - 0x14], esi
je 0x46c1cf
push dword [0x49fa04]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x46c1b4
mov eax, dword [0x49fa10]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x46c22d
cmp dword [0x49fa14], edi
je 0x46c22d
push eax
call ebx
push dword [0x49fa14]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x46c22d
test eax, eax
je 0x46c22d
call ecx
test eax, eax
je 0x46c222
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x46c222
test byte [ebp - 8], 1
jne 0x46c22d
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x46c25d
mov eax, dword [0x49fa08]
cmp eax, edi
je 0x46c25a
push eax
call ebx
test eax, eax
je 0x46c25a
call eax
mov esi, eax
test esi, esi
je 0x46c25a
mov eax, dword [0x49fa0c]
cmp eax, edi
je 0x46c25a
push eax
call ebx
test eax, eax
je 0x46c25a
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x49fa04]
call ebx
test eax, eax
je 0x46c275
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x46c277
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045eb02
mov esp, ebp
pop ebp
ret
Function at 0x401510
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push edi
push esi
push eax
mov edi, dword [esp + 0x14]
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x40
push 0x3000
push edi
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test eax, eax
je 0x401568
mov esi, eax
mov eax, dword [esp + 0x10]
mov dword [esp], 0
mov ecx, esp
push ecx
push edi
push eax
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x401568
mov eax, dword [esp + 0x18]
mov dword [eax], 0
call esi
add esp, 4
pop esi
pop edi
ret
sub eax, eax
add esp, 4
pop esi
pop edi
ret

Function at 0x401570
Capabilities:
Check for outputdebugstring error
Print debug messages

Disassembly:
push esi
push eax
push 0x457
call dword [sym.imp.KERNEL32.dll_SetLastError]
push section..rdata
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x457
jne 0x4015ed
call fcn.0040dec0
cmp byte [eax + 2], 0
jne 0x4015ed
test byte [eax + 0x68], 0x70
jne 0x4015ed
call fcn.0040e420
mov dword [esp], 0xffffffff
mov eax, dword [0x411294]
mov ecx, dword [0x411298]
mov edx, esp
mov esi, dword [0x411290]
push dword [ecx]
push 1
push edx
push dword [eax]
push esi
call fcn.00401510
add esp, 0x14
or eax, eax
sete al
cmp dword [esp], 0xffffffff
sete cl
or cl, al
movzx eax, cl
neg eax
add esp, 4
pop esi
ret
push 0
call sub.msvcrt.dll_exit
jmp 0x4015f7
push eax
pop eax
nop
pushal
popal
jmp 0x4015ff
nop
Function at 0x40bab9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x1dc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1f0]
push edi
mov ebp, dword [esi + 0x3c]
mov eax, dword [esi + ebp + 0x78]
or eax, eax
je 0x40bbbe
lea edi, [eax + esi]
mov ebx, dword [edi + 0x18]
test ebx, ebx
je 0x40bbbe
mov eax, dword [edi + 0x1c]
xor edx, edx
add eax, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x24], eax
mov eax, dword [edi + 0x20]
add eax, esi
mov dword [esp + 0x14], eax
mov eax, dword [edi + 0x24]
add eax, esi
mov dword [esp + 0x20], eax
mov eax, dword [edi + 0xc]
add eax, esi
mov cl, byte [eax]
test cl, cl
je 0x40bb3d
mov esi, dword [esp + 0x10]
lea edx, [esp + 0xe8]
sub edx, eax
or cl, 0x20
inc esi
mov byte [edx + eax], cl
inc eax
mov cl, byte [eax]
test cl, cl
jne 0x40bb20
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x1f4]
mov edx, dword [esp + 0x10]
push dword [esp + 0x204]
lea eax, [esp + 0xec]
mov byte [esp + edx + 0xec], 0
push dword [esp + 0x204]
push eax
call fcn.0040d9f7
mov dword [esp + 0x24], eax
add esp, 0xc
mov eax, dword [esp + 0x14]
add eax, 0xfffffffc
mov dword [esp + 0x1c], edx
lea eax, [eax + ebx*4]
mov dword [esp + 0x10], eax
push dword [esp + 0x204]
mov ecx, dword [eax]
push dword [esp + 0x204]
add ecx, esi
push ecx
call fcn.0040d9f7
xor eax, dword [esp + 0x24]
add esp, 0xc
xor edx, dword [esp + 0x1c]
cmp eax, dword [esp + 0x1f8]
jne 0x40bbae
cmp edx, dword [esp + 0x1fc]
je 0x40bbcb
mov eax, dword [esp + 0x10]
sub eax, 4
mov dword [esp + 0x10], eax
sub ebx, 1
jne 0x40bb79
sub eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1dc
ret
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
movzx eax, word [eax + ebx*2 - 2]
mov edx, dword [ecx + eax*4]
add edx, esi
cmp edx, edi
jb 0x40bc57
mov eax, dword [esi + ebp + 0x7c]
add eax, edi
cmp edx, eax
jae 0x40bc57
xor ecx, ecx
cmp byte [edx], cl
je 0x40bc0e
lea ebx, [esp + 0x28]
mov edi, edx
sub ebx, edx
cmp ecx, 0x3c
jae 0x40bc0e
mov al, byte [edi]
mov byte [ebx + edi], al
cmp al, 0x2e
je 0x40bc0e
inc ecx
inc edi
cmp byte [edi], 0
jne 0x40bbf9
inc edx
mov dword [esp + ecx + 0x29], 0x6c6c64
add ecx, edx
xor edx, edx
cmp byte [ecx], dl
je 0x40bc36
lea edi, [esp + 0x68]
sub edi, ecx
cmp edx, 0x7f
jae 0x40bc36
mov al, byte [ecx]
inc edx
mov byte [edi + ecx], al
inc ecx
cmp byte [ecx], 0
jne 0x40bc25
lea eax, [esp + 0x68]
mov byte [esp + edx + 0x68], 0
push eax
lea eax, [esp + 0x2c]
push eax
push esi
push dword [esp + 0x1fc]
call fcn.0040bc5e
add esp, 0x10
push eax
pop edx
push edx
pop eax
jmp 0x40bbc0
Function at 0x40bc5e
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
xor ecx, ecx
push ebx
push esi
push edi
mov eax, dword [eax + 0x30]
mov edi, dword [ebp + 8]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0xc]
cmp dword [esi + 0x18], ecx
je 0x40bca7
mov ebx, dword [ebp + 0xc]
or ecx, ecx
jne 0x40bcc3
cmp dword [esi + 0x18], ebx
je 0x40bc9b
push ecx
push dword [ebp + 0x14]
push dword [esi + 0x18]
push edi
call fcn.0040d859
add esp, 0x10
mov ecx, eax
mov esi, dword [esi]
cmp dword [esi + 0x18], 0
jne 0x40bc80
test ecx, ecx
jne 0x40bcc3
push dword [ebp + 0x10]
push edi
call fcn.0040d7bb
pop ecx
pop ecx
or eax, eax
je 0x40bcc1
push dword [ebp + 0x14]
push eax
call dword [edi + 0x34]
push eax
pop ecx
jmp 0x40bcc3
xor ecx, ecx
pop edi
pop esi
mov eax, ecx
pop ebx
pop ebp
ret

Function at 0x40d7bb
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0x40
xor ecx, ecx
push ebx
push esi
or ebx, 0xffffffff
push edi
cmp byte [edx], cl
je 0x40d7e6
lea esi, [ebp - 0x40]
sub esi, edx
cmp ecx, 0x40
jae 0x40d7e6
mov al, byte [edx]
inc ecx
mov byte [esi + edx], al
inc edx
cmp byte [edx], 0
jne 0x40d7d5
cmp byte [ebp + ecx - 0x44], 0x2e
mov byte [ebp + ecx - 0x40], 0
je 0x40d7ff
mov dword [ebp + ecx - 0x40], 0x6c6c642e
mov byte [ebp + ecx - 0x3c], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
mov edi, dword [eax + 0xc]
mov esi, dword [edi + 0x18]
or esi, esi
je 0x40d846
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi + 0x78]
sub eax, eax
or ecx, ecx
je 0x40d83c
mov eax, dword [ecx + esi + 0xc]
add eax, esi
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.0040de89
push eax
pop ebx
sub eax, eax
pop ecx
pop ecx
or ebx, ebx
je 0x40d855
mov edi, dword [edi]
test ebx, ebx
jne 0x40d80e
or eax, eax
jne 0x40d850
lea eax, [ebp - 0x40]
push eax
mov eax, dword [ebp + 8]
call dword [eax + 0x30]
pop edi
pop esi
pop ebx
leave
ret
mov eax, esi
jmp 0x40d850
Function at 0x40d859
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x90
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0xa8]
sub esi, esi
test edi, edi
je 0x40d9a7
mov ecx, dword [edi + 0x3c]
mov dword [esp + 0x18], ecx
mov eax, dword [ecx + edi + 0x78]
test eax, eax
je 0x40d9a7
lea ebx, [eax + edi]
mov eax, dword [ebx + 0x20]
mov edx, dword [ebx + 0x1c]
add eax, edi
mov dword [esp + 0x10], eax
add edx, edi
mov eax, dword [ebx + 0x24]
add eax, edi
mov dword [esp + 0x1c], edx
cmp dword [esp + 0xac], esi
je 0x40d993
mov ebp, dword [ebx + 0x18]
test ebp, ebp
je 0x40d9a7
lea eax, [eax + ebp*2]
add eax, 0xfffffffe
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
lea eax, [eax + ebp*4]
add eax, 0xfffffffc
mov dword [esp + 0x10], eax
mov eax, dword [eax]
push dword [esp + 0xac]
add eax, edi
push eax
call fcn.0040de62
pop ecx
pop ecx
test eax, eax
jne 0x40d8f8
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
movzx eax, word [eax]
mov esi, dword [ecx + eax*4]
add esi, edi
mov eax, dword [esp + 0x10]
sub dword [esp + 0x14], 2
sub eax, 4
mov dword [esp + 0x10], eax
sub ebp, 1
je 0x40d911
or esi, esi
je 0x40d8d1
mov ecx, dword [esp + 0x18]
cmp esi, ebx
jb 0x40d98f
mov eax, dword [ecx + edi + 0x7c]
add eax, ebx
cmp esi, eax
jae 0x40d98f
xor ecx, ecx
cmp byte [esi], cl
je 0x40d946
lea ebx, [esp + 0x20]
mov edx, esi
sub ebx, esi
cmp ecx, 0x3c
jae 0x40d946
mov al, byte [edx]
mov byte [ebx + edx], al
cmp al, 0x2e
je 0x40d946
inc ecx
inc edx
cmp byte [edx], 0
jne 0x40d931
mov dword [esp + ecx + 0x21], 0x6c6c64
sub edx, edx
inc ecx
add ecx, esi
cmp byte [ecx], dl
je 0x40d96e
lea esi, [esp + 0x60]
sub esi, ecx
cmp edx, 0x3f
jae 0x40d96e
mov al, byte [ecx]
inc edx
mov byte [esi + ecx], al
inc ecx
cmp byte [ecx], 0
jne 0x40d95d
lea eax, [esp + 0x60]
mov byte [esp + edx + 0x60], 0
push eax
lea eax, [esp + 0x24]
push eax
push edi
push dword [esp + 0xb0]
call fcn.0040bc5e
add esp, 0x10
mov esi, eax
mov eax, esi
jmp 0x40d9a9
mov eax, dword [esp + 0xb0]
sub eax, dword [ebx + 0x10]
mov esi, dword [edx + eax*4]
add esi, edi
jmp 0x40d915
sub eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x90
ret

Function at 0x40d9b4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
xor ecx, ecx
push esi
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0xc]
jmp 0x40d9eb
test ecx, ecx
jne 0x40d9f2
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.0040bab9
mov esi, dword [esi]
add esp, 0x18
mov ecx, eax
mov eax, dword [esi + 0x18]
or eax, eax
jne 0x40d9cb
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x40dabe
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
push edi
lea edi, [esp + 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
mov dword [esp + 0x28], ecx
push esi
pop ecx
ror eax, 8
mov esi, dword [esp + 0x28]
add eax, edx
ror esi, 8
xor eax, edi
add esi, edi
rol edx, 3
xor esi, ebx
rol edi, 3
xor edx, eax
mov dword [esp + 0x28], ebp
xor edi, esi
push ecx
pop ebp
inc ebx
cmp ebx, 0x1b
jb 0x40daef
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x40ded0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
ret
Function at 0x40e890
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x24]
mov eax, dword [ebp + 0x3c]
mov dword [esp], eax
mov esi, dword [ebp + eax + 0x54]
push esi
push ebx
push ebp
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
je 0x40e8e3
lea edi, [esp + 0xc]
push edi
push 0x40
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
or eax, eax
je 0x40e8e3
push esi
push ebp
push ebx
call sub.msvcrt.dll_memcpy
add esp, 0xc
push edi
push dword [esp + 0x10]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esp]
movzx eax, word [ebp + eax + 6]
test ax, ax
je 0x40e983
push ebp
pop edx
mov ecx, dword [ebp + 0x3c]
add ebp, ecx
add ebp, 0x100
sub esi, esi
jmp 0x40e929
mov edx, dword [esp + 0x24]
mov eax, dword [esp]
movzx eax, word [edx + eax + 6]
add esi, 1
movzx ecx, ax
add ebp, 0x28
cmp esi, ecx
jae 0x40e983
cmp dword [ebp + 0x1c], 0
js 0x40e91c
mov edi, dword [ebp]
mov ebx, dword [ebp + 4]
lea eax, [edx + ebx]
add ebx, dword [esp + 0x28]
push edi
push ebx
mov dword [esp + 0x10], eax
push eax
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
je 0x40e910
lea eax, [esp + 4]
push eax
push 0x40
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
or eax, eax
je 0x40e910
push edi
push dword [esp + 0xc]
push ebx
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x40e910
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40e9f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, dword [esp + 0x24]
xor eax, eax
or edi, edi
je 0x40eb96
mov esi, dword [esp + 0x28]
mov edx, dword [edi + 0x3c]
mov ecx, dword [edx + edi + 0x78]
mov ebx, dword [ecx + edi + 0x1c]
add ebx, edi
cmp esi, 0xffff
ja 0x40ea2f
movzx eax, si
sub eax, dword [edi + ecx + 0x10]
add edi, dword [ebx + eax*4]
push edi
pop eax
jmp 0x40eb96
mov esi, dword [edi + ecx + 0x18]
test esi, esi
je 0x40eb96
mov dword [esp + 4], ebx
mov dword [esp], edx
mov ebx, dword [edi + ecx + 0x20]
add ebx, edi
mov dword [esp + 8], ecx
mov ebp, dword [edi + ecx + 0x24]
add ebp, edi
nop
pushal
popal
nop
nop
nop
pushal
popal
jmp 0x40ea5d
nop
push esi
pop esi
mov eax, dword [ebx]
add eax, edi
push dword [esp + 0x28]
push eax
call sub.msvcrt.dll_strcmp
add esp, 8
test eax, eax
je 0x40ea89
add esi, 0xffffffff
add ebx, 4
add ebp, 2
test esi, esi
jne 0x40ea60
xor eax, eax
jmp 0x40eb96
movzx eax, word [ebp]
mov ecx, dword [esp + 4]
mov esi, dword [ecx + eax*4]
mov eax, dword [esp + 8]
cmp eax, esi
ja 0x40eb92
mov ecx, dword [esp]
add eax, dword [edi + ecx + 0x7c]
cmp esi, eax
jae 0x40eb92
add esi, edi
push 0x2e
push esi
call sub.msvcrt.dll_strchr
add esp, 8
mov edi, eax
add edi, 1
push edi
pop ebp
sub ebp, esi
lea eax, [ebp + 4]
push 2
push eax
call sub.msvcrt.dll_calloc
add esp, 8
or eax, eax
je 0x40ea82
push eax
pop ebx
lea eax, [ebp + 1]
push ebp
push esi
push eax
push ebx
push 0
call dword [sym.imp.msvcrt.dll_mbstowcs_s]
add esp, 0x14
mov eax, dword [0x411040]
mov dword [ebx + ebp*2], eax
movzx eax, word [0x411044]
mov word [ebx + ebp*2 + 4], ax
push 4
push 0x41102c
push ebx
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
or eax, eax
je 0x40eb29
push 4
push str.ext_
push ebx
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
or eax, eax
jne 0x40eb74
lea eax, [esp + 0xc]
push eax
push ebx
push dword [esp + 0x34]
call fcn.0040dee0
add esp, 0xc
test eax, eax
je 0x40eb74
mov ebp, eax
push ebx
call sub.msvcrt.dll_free
add esp, 4
mov esi, dword [esp + 0xc]
lea eax, [esi + 1]
push 2
push eax
call sub.msvcrt.dll_calloc
add esp, 8
mov ebx, eax
test eax, eax
pushfd
and eax, 0
popfd
je 0x40eb96
add esi, esi
push esi
push ebp
push ebx
call sub.msvcrt.dll_memcpy
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push ebx
push edi
push eax
call fcn.0040e9f0
mov esi, eax
push ebx
call sub.msvcrt.dll_free
push esi
pop eax
add esp, 4
jmp 0x40eb96
add esi, edi
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 0xc

Function at 0x40ee70
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.0040fc10
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.0040fc10
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]
Function at 0x40eed0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
push eax
pop ebx
sub esp, 0x30
mov esi, dword [0x41204c]
or esi, esi
jle 0x40eff0
mov eax, dword [0x412050]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x40ef04
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x40ef87
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x40eef0
mov dword [esp], ebx
call fcn.0040f860
mov edi, eax
or eax, eax
je 0x40f017
mov eax, dword [0x412050]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.0040f970
mov edx, dword [0x412050]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x40eff7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x40ef80
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x40ef90
add dword [0x41204c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
nop
push 0x40
nop
pop edx
pushal
popal
push 4
pop eax
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x412050]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
or eax, eax
jne 0x40ef80
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.0040ee70
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x40ef0e
mov eax, dword [0x412050]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.0040ee70
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.0040ee70
lea esi, [esi]
nop

Function at 0x40f4d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x412068
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x412060]
sub esp, 4
or ebx, ebx
je 0x40f525
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40f51e
or esi, esi
je 0x40f51e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
or ebx, ebx
jne 0x40f500
mov dword [esp], 0x412068
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401ae3
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
push str.CLASSPATH
mov byte [ebp - 4], 0x3b
mov byte [ebp - 3], 0
call dword [sym.imp.MSVCR71.dll_getenv]
mov esi, dword [sym.imp.MSVCR71.dll_sprintf]
mov edi, eax
test edi, edi
pop ecx
je 0x401b34
push edi
call sub.MSVCR71.dll_strlen
add eax, 0x28
push eax
call sub.jli.dll_JLI_MemAlloc
push edi
mov ebx, eax
push str._Denv.class.path_s
push ebx
call esi
push 0
push ebx
call fcn.004010bd
add esp, 0x1c
lea eax, [ebp - 0x110]
push 0x104
push eax
call fcn.00403220
test al, al
pop ecx
pop ecx
jne 0x401b60
push 1
push str.Cant_determine_application_home
call fcn.004034c6
pop ecx
pop ecx
xor al, al
jmp 0x401c24
lea eax, [ebp - 0x110]
push eax
call sub.MSVCR71.dll_strlen
add eax, 0x28
push eax
call sub.jli.dll_JLI_MemAlloc
mov edi, eax
lea eax, [ebp - 0x110]
push eax
push str._Dapplication.home_s
push edi
call esi
push 0
push edi
call fcn.004010bd
push 0x28
lea eax, [ebp - 0x110]
pop esi
push eax
call sub.MSVCR71.dll_strlen
mov edi, 0x408018
add esp, 0x20
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edi
mov ebx, 0x408020
mov eax, dword [ebp - 8]
push dword [eax]
call sub.MSVCR71.dll_strlen
add eax, dword [ebp - 0xc]
add dword [ebp - 8], 4
cmp dword [ebp - 8], ebx
pop ecx
lea esi, [esi + eax + 1]
jl 0x401bb0
inc esi
push esi
call sub.jli.dll_JLI_MemAlloc
mov esi, eax
mov dword [esp], str._Djava.class.path
push esi
call sub.MSVCR71.dll_strcpy
pop ecx
pop ecx
lea eax, [ebp - 0x110]
push eax
push esi
call sub.MSVCR71.dll_strcat
push dword [edi]
push esi
call sub.MSVCR71.dll_strcat
lea eax, [ebp - 4]
push eax
push esi
call sub.MSVCR71.dll_strcat
add edi, 4
add esp, 0x18
cmp edi, ebx
jl 0x401be3
push esi
call sub.MSVCR71.dll_strlen
push 0
push esi
mov byte [eax + esi - 1], 0
call fcn.004010bd
add esp, 0xc
mov al, 1
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401e44
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0x1a4]
push eax
call sub.MSVCR71.dll_strcpy
pop ecx
pop ecx
push str._Xusage.txt
lea eax, [ebp - 0x1a4]
push 0x5c
push eax
call dword [sym.imp.MSVCR71.dll_strrchr]
pop ecx
pop ecx
push eax
call sub.MSVCR71.dll_strcpy
lea eax, [ebp - 0x1a4]
push 0x405f88
push eax
call dword [sym.imp.MSVCR71.dll_fopen]
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x401eb9
lea eax, [ebp - 0x1a4]
push eax
mov eax, dword [sym.imp.MSVCR71.dll__iob]
add eax, 0x40
push str.Cant_open__s_n
push eax
call dword [sym.imp.MSVCR71.dll_fprintf]
xor eax, eax
add esp, 0xc
inc eax
jmp 0x401f09
push esi
mov esi, dword [sym.imp.MSVCR71.dll_fread]
push edi
push ebx
mov edi, 0x80
push edi
lea eax, [ebp - 0x80]
push 1
push eax
call esi
add esp, 0x10
jmp 0x401ef9
mov ecx, dword [sym.imp.MSVCR71.dll__iob]
add ecx, 0x20
push ecx
push eax
lea eax, [ebp - 0x80]
push 1
push eax
call dword [sym.imp.MSVCR71.dll_fwrite]
push ebx
push edi
lea eax, [ebp - 0x80]
push 1
push eax
call esi
add esp, 0x20
test eax, eax
jne 0x401ed5
push ebx
call dword [sym.imp.MSVCR71.dll_fclose]
pop ecx
pop edi
xor eax, eax
pop esi
pop ebx
leave
ret