joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405ca2
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
cmp dword [ecx], 0
jne 0x405d0c
mov al, byte [ecx + 0xa]
mov ebx, edx
mov esi, ecx
test al, al
je 0x405c5b
cmp al, 6
ja 0x405cb0
movzx eax, al
jmp dword [eax*4 + 0x5010a0]
push esi
push 0
jmp 0x405ca8
mov eax, dword [esi + 0x520]
test eax, eax
je 0x405c84
cmp byte [eax], 0
je 0x405c84
mov ecx, ebx
shr ecx, 1
and ecx, 1
push ecx
push eax
call fcn.00404370
add esp, 8
mov byte [esi + 0xa], al
cmp al, 6
jbe 0x405c4c
jmp 0x405cb0
mov byte [esi + 0xa], 1
mov eax, dword [esi + 0x20]
or eax, 6
push 0
push eax
push esi
push dword [esi + 0x520]
call fcn.00432890
add esp, 0x10
jmp 0x405cb0
push esi
push 0x501896
call fcn.00432140
add esp, 8
mov eax, dword [esi]
test eax, eax
mov dword [0x51e7c0], eax
je 0x405cc8
push eax
call fcn.00431fc0
add esp, 4
test eax, eax
je 0x405d11
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
mov ebp, dword [esi + 0x520]
mov edi, eax
push dword [esi]
call fcn.0042cf50
add esp, 4
push eax
push ebp
push 0x50281f
push edi
call fcn.004014c0
add esp, 0x10
test bl, 1
je 0x405e9e
push esi
push 0x501896
call fcn.00432140
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
sub esp, 8
push dword [esi]
call fcn.00401c70
add esp, 4
push dword [esi]
call fcn.00401550
add esp, 0xc
push 0
push 0x51d008
push str.completion
push dword [esi]
call fcn.0042de30
add esp, 0x10
push 0x4021a0
push 0
push 1
push str.uint
push dword [esi]
call fcn.004329f0
add esp, 0x14
push 0
push 0
push 0x412770
push 0
push 1
push 3
push str.shell_add_schema
push dword [esi]
call fcn.00430c00
add esp, 0x20
push 0
push 0
push 0x412980
push 0
push 1
push 1
push str.shell_module_schema
push dword [esi]
call fcn.00430c00
add esp, 0x20
push 0
push 0
push 0x4129e0
push esi
push 1
push 1
push str.shell_putsnl
push dword [esi]
call fcn.00430c00
add esp, 0x20
push 0
push 0
push 0x412a20
push 0
push 1
push 1
push str.shell_escape_crnl
push dword [esi]
call fcn.00430c00
add esp, 0x20
push 0
push 0
push 0x412dc0
push 0
push 1
push 2
push str.shell_int32
push dword [esi]
call fcn.00430c00
add esp, 0x20
push 0
push 0
push 0x412e20
push 0
push 1
push 1
push str.shell_idquote
push dword [esi]
call fcn.00430c00
add esp, 0x20
push 0
push 0
push 0x412e60
push 0
push 1
push 1
push str.edit
push dword [esi]
call fcn.00430c00
add esp, 0x20
push 0
push 0
push 0x412e60
push 0
push 1
push 2
push str.edit
push dword [esi]
call fcn.00430c00
add esp, 0x20
cmp byte [esi + 0xa], 3
jne 0x405d0c
push dword [esi + 0x520]
push str.CREATE_VIRTUAL_TABLE_zip_USING_zipfile__Q__
call fcn.0041ef10
add esp, 8
mov edi, eax
push 0
push 0
push 0
push eax
push dword [esi]
call fcn.0042c9a0
add esp, 0x14
push edi
call fcn.0041c220
add esp, 4
jmp 0x405d0c
mov eax, dword [esi + 0x20]
or eax, 6
push str.apndvfs
jmp 0x405c90
mov eax, dword [esi + 0x20]
or eax, 1
jmp 0x405c8e
push 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop word cs:[eax + eax]
nop
Function at 0x405e83
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
cmp dword [ecx], 0
jne 0x405d0c
mov al, byte [ecx + 0xa]
mov ebx, edx
mov esi, ecx
test al, al
je 0x405c5b
cmp al, 6
ja 0x405cb0
movzx eax, al
jmp dword [eax*4 + 0x5010a0]
push esi
push 0
jmp 0x405ca8
mov eax, dword [esi + 0x520]
test eax, eax
je 0x405c84
cmp byte [eax], 0
je 0x405c84
mov ecx, ebx
shr ecx, 1
and ecx, 1
push ecx
push eax
call fcn.00404370
add esp, 8
mov byte [esi + 0xa], al
cmp al, 6
jbe 0x405c4c
jmp 0x405cb0
mov byte [esi + 0xa], 1
mov eax, dword [esi + 0x20]
or eax, 6
push 0
push eax
push esi
push dword [esi + 0x520]
call fcn.00432890
add esp, 0x10
jmp 0x405cb0
push esi
push 0x501896
call fcn.00432140
add esp, 8
mov eax, dword [esi]
test eax, eax
mov dword [0x51e7c0], eax
je 0x405cc8
push eax
call fcn.00431fc0
add esp, 4
test eax, eax
je 0x405d11
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
mov ebp, dword [esi + 0x520]
mov edi, eax
push dword [esi]
call fcn.0042cf50
add esp, 4
push eax
push ebp
push 0x50281f
push edi
call fcn.004014c0
add esp, 0x10
test bl, 1
je 0x405e9e
push esi
push 0x501896
call fcn.00432140
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
sub esp, 8
push dword [esi]
call fcn.00401c70
add esp, 4
push dword [esi]
call fcn.00401550
add esp, 0xc
push 0
push 0x51d008
push str.completion
push dword [esi]
call fcn.0042de30
add esp, 0x10
push 0x4021a0
push 0
push 1
push str.uint
push dword [esi]
call fcn.004329f0
add esp, 0x14
push 0
push 0
push 0x412770
push 0
push 1
push 3
push str.shell_add_schema
push dword [esi]
call fcn.00430c00
add esp, 0x20
push 0
push 0
push 0x412980
push 0
push 1
push 1
push str.shell_module_schema
push dword [esi]
call fcn.00430c00
add esp, 0x20
push 0
push 0
push 0x4129e0
push esi
push 1
push 1
push str.shell_putsnl
push dword [esi]
call fcn.00430c00
add esp, 0x20
push 0
push 0
push 0x412a20
push 0
push 1
push 1
push str.shell_escape_crnl
push dword [esi]
call fcn.00430c00
add esp, 0x20
push 0
push 0
push 0x412dc0
push 0
push 1
push 2
push str.shell_int32
push dword [esi]
call fcn.00430c00
add esp, 0x20
push 0
push 0
push 0x412e20
push 0
push 1
push 1
push str.shell_idquote
push dword [esi]
call fcn.00430c00
add esp, 0x20
push 0
push 0
push 0x412e60
push 0
push 1
push 1
push str.edit
push dword [esi]
call fcn.00430c00
add esp, 0x20
push 0
push 0
push 0x412e60
push 0
push 1
push 2
push str.edit
push dword [esi]
call fcn.00430c00
add esp, 0x20
cmp byte [esi + 0xa], 3
jne 0x405d0c
push dword [esi + 0x520]
push str.CREATE_VIRTUAL_TABLE_zip_USING_zipfile__Q__
call fcn.0041ef10
add esp, 8
mov edi, eax
push 0
push 0
push 0
push eax
push dword [esi]
call fcn.0042c9a0
add esp, 0x14
push edi
call fcn.0041c220
add esp, 4
jmp 0x405d0c
mov eax, dword [esi + 0x20]
or eax, 6
push str.apndvfs
jmp 0x405c90
mov eax, dword [esi + 0x20]
or eax, 1
jmp 0x405c8e
push 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop word cs:[eax + eax]
nop
Function at 0x405e93
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
cmp dword [ecx], 0
jne 0x405d0c
mov al, byte [ecx + 0xa]
mov ebx, edx
mov esi, ecx
test al, al
je 0x405c5b
cmp al, 6
ja 0x405cb0
movzx eax, al
jmp dword [eax*4 + 0x5010a0]
push esi
push 0
jmp 0x405ca8
mov eax, dword [esi + 0x520]
test eax, eax
je 0x405c84
cmp byte [eax], 0
je 0x405c84
mov ecx, ebx
shr ecx, 1
and ecx, 1
push ecx
push eax
call fcn.00404370
add esp, 8
mov byte [esi + 0xa], al
cmp al, 6
jbe 0x405c4c
jmp 0x405cb0
mov byte [esi + 0xa], 1
mov eax, dword [esi + 0x20]
or eax, 6
push 0
push eax
push esi
push dword [esi + 0x520]
call fcn.00432890
add esp, 0x10
jmp 0x405cb0
push esi
push 0x501896
call fcn.00432140
add esp, 8
mov eax, dword [esi]
test eax, eax
mov dword [0x51e7c0], eax
je 0x405cc8
push eax
call fcn.00431fc0
add esp, 4
test eax, eax
je 0x405d11
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
mov ebp, dword [esi + 0x520]
mov edi, eax
push dword [esi]
call fcn.0042cf50
add esp, 4
push eax
push ebp
push 0x50281f
push edi
call fcn.004014c0
add esp, 0x10
test bl, 1
je 0x405e9e
push esi
push 0x501896
call fcn.00432140
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
sub esp, 8
push dword [esi]
call fcn.00401c70
add esp, 4
push dword [esi]
call fcn.00401550
add esp, 0xc
push 0
push 0x51d008
push str.completion
push dword [esi]
call fcn.0042de30
add esp, 0x10
push 0x4021a0
push 0
push 1
push str.uint
push dword [esi]
call fcn.004329f0
add esp, 0x14
push 0
push 0
push 0x412770
push 0
push 1
push 3
push str.shell_add_schema
push dword [esi]
call fcn.00430c00
add esp, 0x20
push 0
push 0
push 0x412980
push 0
push 1
push 1
push str.shell_module_schema
push dword [esi]
call fcn.00430c00
add esp, 0x20
push 0
push 0
push 0x4129e0
push esi
push 1
push 1
push str.shell_putsnl
push dword [esi]
call fcn.00430c00
add esp, 0x20
push 0
push 0
push 0x412a20
push 0
push 1
push 1
push str.shell_escape_crnl
push dword [esi]
call fcn.00430c00
add esp, 0x20
push 0
push 0
push 0x412dc0
push 0
push 1
push 2
push str.shell_int32
push dword [esi]
call fcn.00430c00
add esp, 0x20
push 0
push 0
push 0x412e20
push 0
push 1
push 1
push str.shell_idquote
push dword [esi]
call fcn.00430c00
add esp, 0x20
push 0
push 0
push 0x412e60
push 0
push 1
push 1
push str.edit
push dword [esi]
call fcn.00430c00
add esp, 0x20
push 0
push 0
push 0x412e60
push 0
push 1
push 2
push str.edit
push dword [esi]
call fcn.00430c00
add esp, 0x20
cmp byte [esi + 0xa], 3
jne 0x405d0c
push dword [esi + 0x520]
push str.CREATE_VIRTUAL_TABLE_zip_USING_zipfile__Q__
call fcn.0041ef10
add esp, 8
mov edi, eax
push 0
push 0
push 0
push eax
push dword [esi]
call fcn.0042c9a0
add esp, 0x14
push edi
call fcn.0041c220
add esp, 4
jmp 0x405d0c
mov eax, dword [esi + 0x20]
or eax, 6
push str.apndvfs
jmp 0x405c90
mov eax, dword [esi + 0x20]
or eax, 1
jmp 0x405c8e
push 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop word cs:[eax + eax]
nop
Function at 0x405ee0
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push 2
call esi
add esp, 4
push dword [0x51e78c]
push str.Usage:__s__OPTIONS__FILENAME__SQL__nFILENAME_is_the_name_of_an_SQLite_database._A_new_database_is_created_nif_the_file_does_not_previously_exist._n
push eax
call fcn.004014c0
add esp, 0xc
push 2
call esi
add esp, 4
push str.____append______________append_the_database_to_the_end_of_the_file_n____ascii_______________set_output_mode_to_ascii_n____bail________________stop_after_hitting_an_error_n____batch_______________force_batch_I_O_n____column______________set_output_mode_to_column_n____cmd_COMMAND_________run__COMMAND__before_reading_stdin_n____csv_________________set_output_mode_to_csv_n____echo________________print_commands_before_execution_n____init_FILENAME_______read_process_named_file_n_____no_header__________turn_headers_on_or_off_n____help________________show_this_message_n____html________________set_output_mode_to_HTML_n____interactive_________force_interactive_I_O_n____line________________set_output_mode_to_line_n____list________________set_output_mode_to_list_n____lookaside_SIZE_N____use_N_entries_of_SZ_bytes_for_lookaside_memory_n____memtrace____________trace_all_memory_allocations_and_deallocations_n____mmap_N______________default_mmap_size_set_to_N_n____newline_SEP_________set_output_row_separator._Default:__n_n____nofollow____________refuse_to_open_symbolic_links_to_database_files_n____nullvalue_TEXT______set_text_string_for_NULL_values._Default__n____pagecache_SIZE_N____use_N_slots_of_SZ_bytes_each_for_page_cache_memory_n____quote_______________set_output_mode_to_quote_n____readonly____________open_the_database_read_only_n____separator_SEP_______set_output_column_separator._Default:__n____stats_______________print_memory_stats_before_each_finalize_n____version_____________show_SQLite_version_n____vfs_NAME____________use_NAME_as_the_default_VFS_n
push str.OPTIONS_include:_n_s
push eax
call fcn.004014c0
add esp, 0xc
push 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop word cs:[eax + eax]
nop dword [eax]
Function at 0x40cac0
Capabilities:
Query environment variable

Disassembly:
push ebx
push edi
push esi
mov edi, dword [0x51e7d8]
test ecx, ecx
je 0x40cae7
push edi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
mov dword [0x51e7d8], 0
xor edi, edi
jmp 0x40cbf2
test edi, edi
jne 0x40cbf2
push str.USERPROFILE
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
mov esi, eax
test eax, eax
mov dword [0x51e7d8], eax
jne 0x40cbb4
push str.HOME
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
mov esi, eax
test eax, eax
mov dword [0x51e7d8], eax
jne 0x40cbb4
push str.HOMEDRIVE
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
mov esi, eax
push str.HOMEPATH
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test esi, esi
je 0x40cba5
mov edi, eax
test eax, eax
je 0x40cba5
lea eax, [esi - 1]
cmp byte [eax + 1], 0
lea eax, [eax + 1]
jne 0x40cb50
sub eax, esi
lea ecx, [edi - 1]
nop
cmp byte [ecx + 1], 0
lea ecx, [ecx + 1]
jne 0x40cb60
sub ecx, edi
and eax, 0x3fffffff
and ecx, 0x3fffffff
lea ebx, [eax + ecx + 1]
push ebx
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
test eax, eax
mov dword [0x51e7d8], eax
je 0x40cbf8
push edi
push esi
push 0x505b7c
push eax
push ebx
call fcn.0041f080
add esp, 0x14
mov edi, dword [0x51e7d8]
jmp 0x40cbf2
mov esi, 0x50965f
mov dword [0x51e7d8], 0x50965f
lea ebx, [esi - 1]
nop word [eax + eax]
cmp byte [ebx + 1], 0
lea ebx, [ebx + 1]
jne 0x40cbc0
sub ebx, esi
and ebx, 0x3fffffff
inc ebx
push ebx
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov edi, eax
test eax, eax
je 0x40cbec
push ebx
push esi
push edi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov dword [0x51e7d8], edi
mov eax, edi
pop esi
pop edi
pop ebx
ret
xor edi, edi
jmp 0x40cbf2
Function at 0x40d320
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [ecx + 0x70]
mov esi, edx
mov edi, ecx
test eax, eax
je 0x40d340
push eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
mov dword [edi + 0x70], 0
test esi, esi
je 0x40d43c
movzx ebx, byte [esi]
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalpha]
add esp, 4
cmp ebx, 0x5f
mov dl, 0x22
je 0x40d360
test eax, eax
je 0x40d3b7
xor ebp, ebp
test bl, bl
mov dword [esp], edi
je 0x40d3a0
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalnum]
jmp 0x40d38a
movzx ebx, byte [esi + ebp + 1]
inc ebp
test bl, bl
je 0x40d3a0
movzx eax, bl
push eax
call edi
add esp, 4
cmp bl, 0x5f
je 0x40d380
test eax, eax
jne 0x40d380
mov dl, 0x22
jmp 0x40d3b4
push ebp
push esi
call fcn.0042ed70
add esp, 8
test eax, eax
mov edx, 0x22
cmove edx, eax
mov edi, dword [esp]
lea eax, [esi - 1]
nop word [eax + eax]
cmp byte [eax + 1], 0
lea eax, [eax + 1]
jne 0x40d3c0
sub eax, esi
and eax, 0x3fffffff
test dl, dl
lea ecx, [eax + eax + 2]
cmove ecx, eax
inc ecx
push ecx
mov ebx, edx
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
test eax, eax
mov dword [edi + 0x70], eax
je 0x40d444
test bl, bl
mov edx, ebx
je 0x40d3fb
mov ecx, 1
mov byte [eax], dl
jmp 0x40d3fd
xor ecx, ecx
mov bl, byte [esi]
mov ebp, edx
test bl, bl
je 0x40d42e
movzx edx, dl
inc esi
jmp 0x40d421
mov ebx, ebp
mov byte [eax + ecx + 1], bl
add ecx, 2
movzx ebx, byte [esi]
inc esi
test bl, bl
je 0x40d42e
movsx edi, bl
mov byte [eax + ecx], bl
cmp edi, edx
je 0x40d410
inc ecx
jmp 0x40d419
mov edx, ebp
test dl, dl
je 0x40d438
mov byte [eax + ecx], dl
inc ecx
mov byte [eax + ecx], 0
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push str.Error:_out_of_memory_n
push eax
call fcn.00404690
add esp, 8
push 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop word cs:[eax + eax]
nop
Function at 0x40d470
Capabilities:
Execute command

Disassembly:
push edi
push esi
cmp byte [ecx + 0x41c], 0x7c
mov edi, dword [ecx + 0x28]
mov esi, ecx
jne 0x40d48f
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__pclose]
add esp, 4
jmp 0x40d582
test edi, edi
je 0x40d4ba
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
cmp eax, edi
je 0x40d4ba
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
cmp eax, edi
je 0x40d4ba
push edi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
add esp, 4
cmp byte [esi + 0xb], 0
je 0x40d582
push dword [esi + 0x74]
push str.start
push str._s__s
call fcn.0041ef10
add esp, 0xc
mov edi, eax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll_system
add esp, 4
test eax, eax
je 0x40d504
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push edi
push str.Failed:___s__n
push eax
call fcn.004014c0
add esp, 0xc
jmp 0x40d511
push 0x7d0
call fcn.00433980
add esp, 4
push edi
call fcn.0041c220
add esp, 4
mov eax, dword [esi + 0x38]
mov ecx, dword [esi + 0x60]
mov dword [esi + 0x34], eax
mov dword [esi + 0x5c], ecx
movsd xmm0, qword [esi + 0xbe]
movsd qword [esi + 0x96], xmm0
movsd xmm0, qword [esi + 0xc6]
movsd qword [esi + 0x9e], xmm0
mov eax, dword [esi + 0xce]
mov dword [esi + 0xa6], eax
movsd xmm0, qword [esi + 0xd2]
movsd qword [esi + 0xaa], xmm0
movsd xmm0, qword [esi + 0xda]
movsd qword [esi + 0xb2], xmm0
mov eax, dword [esi + 0xe2]
mov dword [esi + 0xba], eax
mov byte [esi + 0xb], 0
mov byte [esi + 0x41c], 0
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
mov dword [esi + 0x28], eax
pop esi
pop edi
ret

Function at 0x40d670
Capabilities:
Encode data using xor

Disassembly:
push esi
push eax
mov eax, dword [ecx + 0x640]
mov esi, ecx
dec eax
cmp dword [ecx + 0x644], eax
jne 0x40d68e
mov byte [esp + 3], 0x86
lea edx, [esp + 3]
jmp 0x40d6b9
lea edx, [esp + 2]
mov byte [esp + 2], 6
mov byte [esp + 1], pe_nt_image_headers32
mov ecx, esi
push 1
call fcn.0040d5a0
add esp, 4
mov eax, dword [esi + 0x640]
lea edx, [esp + 1]
dec eax
mov dword [esi + 0x644], eax
mov ecx, esi
push 1
call fcn.0040d5a0
add esp, 4
mov eax, dword [esi + 0x640]
test eax, eax
je 0x40d6fe
xor ecx, ecx
nop word cs:[eax + eax]
nop dword [eax + eax]
mov edx, dword [esi + 0x648]
add eax, esi
xor edx, ecx
movzx edx, byte [esi + edx]
mov byte [ecx + eax], dl
inc ecx
mov eax, dword [esi + 0x640]
cmp ecx, eax
jb 0x40d6e0
jmp 0x40d700
xor eax, eax
add esi, eax
mov eax, esi
add esp, 4
pop esi
ret
Function at 0x40fdd0
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edi, ecx
push 0x501918
push edx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fopen
add esp, 8
test eax, eax
je 0x40fe33
mov esi, eax
push 2
push 0
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fseek
add esp, 0xc
push esi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_ftell
add esp, 4
mov ebx, eax
push esi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_rewind
add esp, 4
push edi
call fcn.00427ae0
add esp, 4
push 0xffffffffffffffff
push 0
push eax
call fcn.00432100
add esp, 0xc
cmp ebx, eax
jle 0x40fe38
push 0x12
push edi
call fcn.004266c0
add esp, 8
jmp 0x40fea5
add esp, 4
jmp 0x40feae
mov ebp, ebx
mov eax, 1
sar ebp, 0x1f
test ebx, ebx
mov ecx, ebp
cmovne eax, ebx
cmove ecx, ebx
push ecx
push eax
call fcn.0041c1f0
add esp, 8
test eax, eax
je 0x40fe87
push esi
push ebx
push 1
mov dword [esp + 0xc], eax
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add esp, 0x10
xor eax, ebx
or eax, ebp
jne 0x40fe8f
push fcn.0041c220
push ebp
push ebx
push dword [esp + 0xc]
push edi
call fcn.00425ee0
add esp, 0x14
jmp 0x40fea5
push edi
call fcn.00426770
jmp 0x40fea2
push 0xa
push edi
call fcn.004266c0
add esp, 8
push dword [esp]
call fcn.0041c220
add esp, 4
push esi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x411980
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push esi
sub esp, 0x1c
mov byte [esp + 0x10], 0x2d
mov dword [esp + 0xc], 0x33657469
mov dword [esp + 8], 0x4c51532d
mov dword [esp + 4], 0x664f2d74
mov dword [esp], 0x72617453
mov eax, dword [ecx + 8]
mov esi, dword [ecx + 0xc]
bswap eax
bswap esi
mov dword [esp + 0x11], esi
mov dword [esp + 0x15], eax
mov esi, esp
mov eax, dword [edx]
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0x19
push esi
push edx
call dword [eax + 0xc]
add esp, 0x30
pop esi
ret
Function at 0x413650
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov bl, byte [esp + 0x1c]
mov edi, edx
dec edx
nop
cmp byte [edx + 1], 0
lea edx, [edx + 1]
jne 0x413660
mov eax, dword [ecx + 4]
sub edx, edi
mov dword [esp + 4], ecx
mov esi, edx
and esi, 0x3fffffff
test bl, bl
mov dword [esp], eax
je 0x413740
lea ecx, [eax + esi]
add ecx, 3
test esi, esi
je 0x413744
xor ebp, ebp
cmp esi, 8
jb 0x413727
movzx eax, bl
movdqa xmm3, xmmword [0x5012d0]
and edx, 7
mov ebp, esi
movd xmm1, ecx
lea ecx, [edi + 4]
movd xmm0, eax
sub ebp, edx
punpcklbw xmm0, xmm0
mov eax, ebp
pshuflw xmm2, xmm0, 0xe0
pxor xmm0, xmm0
nop word [eax + eax]
movd xmm4, dword [ecx - 4]
movd xmm5, dword [ecx]
add ecx, 8
add eax, 0xfffffff8
pcmpeqb xmm4, xmm2
pcmpeqb xmm5, xmm2
punpcklbw xmm4, xmm4
punpcklbw xmm5, xmm5
punpcklwd xmm4, xmm4
punpcklwd xmm5, xmm5
pand xmm4, xmm3
pand xmm5, xmm3
paddd xmm1, xmm4
paddd xmm0, xmm5
jne 0x4136d0
paddd xmm0, xmm1
test edx, edx
pshufd xmm1, xmm0, 0x4e
paddd xmm1, xmm0
pshufd xmm0, xmm1, 0xe5
paddd xmm0, xmm1
movd ecx, xmm0
je 0x413744
mov eax, esi
sub eax, ebp
add ebp, edi
nop dword [eax]
xor edx, edx
cmp byte [ebp], bl
sete dl
inc ebp
add ecx, edx
dec eax
jne 0x413730
jmp 0x413744
lea ecx, [eax + esi + 1]
mov eax, dword [esp]
mov ebp, dword [esp + 4]
lea edx, [ecx + eax]
mov eax, dword [ebp + 8]
cmp edx, eax
jge 0x41375d
mov eax, dword [ebp]
mov ecx, dword [esp]
jmp 0x41377a
lea eax, [ecx + eax*2 + 0x14]
mov dword [ebp + 8], eax
push eax
push dword [ebp]
call sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
add esp, 8
test eax, eax
mov dword [ebp], eax
je 0x4137d7
mov ecx, dword [ebp + 4]
add eax, ecx
test bl, bl
je 0x4137b6
mov byte [eax], bl
inc eax
test esi, esi
jne 0x4137aa
mov byte [eax], bl
inc eax
mov ecx, eax
sub ecx, dword [ebp]
mov dword [ebp + 4], ecx
jmp 0x4137cc
mov byte [eax + 1], bl
add eax, 2
inc edi
dec esi
je 0x413787
movzx ecx, byte [edi]
mov byte [eax], cl
cmp byte [edi], bl
je 0x4137a0
inc eax
jmp 0x4137a6
push esi
push edi
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
add esi, dword [ebp + 4]
mov dword [ebp + 4], esi
add esi, dword [ebp]
mov eax, esi
mov byte [eax], 0
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push str.Error:_out_of_memory_n
push eax
call fcn.00404690
add esp, 8
push 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop word [eax + eax]
Function at 0x413d30
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
push 0x501918
push str.testcase_out.txt
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fopen
add esp, 8
xor esi, esi
test eax, eax
je 0x413dc3
mov edi, eax
push 2
push 0
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fseek
add esp, 0xc
push edi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_ftell
add esp, 4
mov ebx, eax
push edi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_rewind
add esp, 4
lea eax, [ebx + 1]
mov ecx, eax
sar ecx, 0x1f
push ecx
push eax
call fcn.0041c1f0
add esp, 8
test eax, eax
je 0x413dad
mov ebp, eax
push edi
push 1
push ebx
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add esp, 0x10
mov esi, eax
push edi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
add esp, 4
cmp esi, 1
jne 0x413db8
mov esi, ebp
mov byte [ebp + ebx], 0
jmp 0x413dc3
push edi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
add esp, 4
jmp 0x413dc3
push ebp
call fcn.0041c220
add esp, 4
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x415050
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, ecx
mov ecx, dword [ecx + 0xc]
mov ebx, edx
mov eax, dword [esi + 0x10]
lea edx, [ecx + 1]
cmp edx, eax
jge 0x415068
mov eax, dword [esi + 8]
jmp 0x41508e
lea eax, [eax + eax + 0x64]
mov ecx, eax
mov dword [esi + 0x10], eax
sar ecx, 0x1f
push ecx
push eax
push dword [esi + 8]
call fcn.0041c4e0
add esp, 0xc
test eax, eax
mov dword [esi + 8], eax
je 0x415097
mov ecx, dword [esi + 0xc]
lea edx, [ecx + 1]
mov dword [esi + 0xc], edx
mov byte [eax + ecx], bl
pop esi
pop ebx
ret
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push str.Error:_out_of_memory_n
push eax
call fcn.00404690
add esp, 8
push 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop word [eax + eax]