joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000512c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x1000513b
pop dword [ebp - 0xc]
mov eax, 0x3d11499f
sub eax, 0x2d10f864
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x9d278762
sub dword [ebp - 0x1c], 0x4ed54217
mov dword [ebp - 0x18], 0x1acdcf9d
add dword [ebp - 0x18], 0x17657ca8
mov dword [ebp - 0x14], 0xd74db247
sub dword [ebp - 0x14], 0x8b016e19
mov dword [ebp - 0x10], 0x3eb3373d
sub dword [ebp - 0x10], 0x3eb3373d
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x8eec4441
add eax, 0x81148c3f
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xe0b30e11
add dword [ebp - 0x1c], 0x93bf5b45
mov dword [ebp - 0x18], 0x3313550a
sub dword [ebp - 0x18], 0xf1a6f395
mov dword [ebp - 0x14], 0x1f80aeeb
sub dword [ebp - 0x14], 0xbc11427f
mov dword [ebp - 0x10], 0xd8d26c9a
sub dword [ebp - 0x10], 0xd8d26c9a
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x25f6f225
sub eax, 0x15f621ad
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x39b28
push 0
call eax
mov ecx, 0xb7c86d56
sub ecx, 0xb7c81ff8
xor esi, esi
add esi, eax
mov edi, 0x8df5e56f
add edi, 0x820bce91
add edi, dword [ebp - 0xc]
mov ebx, 0x8e812919
sub ebx, 0xa2366179
xor dword [ebp - 8], edx
mov edx, dword [edi]
mov dword [ebp - 8], 0x5283bc6a
add edx, ebx
mov dword [ebp - 4], 0x8428f7d2
mov dword [esi], edx
sub dword [ebp - 8], edx
add esi, 0x1837a5cc
add esi, 0xe7c85a38
add edi, 4
loop 0x1000525f
add eax, 0x1284b
mov ebx, eax
add eax, 0x4ec02730
add eax, 0xb13fd8d5
mov ecx, 0xd00f99ac
sub ecx, 0xc00f99ac
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x10009670
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
cmp eax, 0x1a
jl 0x100096c8
mov eax, dword [esi + 8]
cmp eax, dword [esi]
jl 0x100096c8
push 0
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
push 0x10
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi]
push eax
push dword [esi + 4]
push dword [esi]
push 0
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, edi
call fcn.1000512c
push 1
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
ret 4

Function at 0x10009c50
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push dword [ebp + 0xc]
push 0xd
push dword [ecx + 0x38]
call dword [sym.imp.USER32.dll_SendMessageA]
pop ebp
ret 8
Function at 0x42e000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x5a74793f
nop
test eax, eax
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0xe2a2407
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x1000800f
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push 0x178
mov eax, 0x1000bbb4
call fcn.10009cac
cmp byte [0x10044502], 0
mov edi, dword [ebp + 8]
push 0xa
pop eax
jne 0x1000819d
lea eax, [ebp - 0x15c]
xor ebx, ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREApple_Computer__Inc.QuickTime
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x100080c1
lea eax, [ebp - 0x160]
mov dword [ebp - 0x160], 4
push eax
lea eax, [ebp - 0x164]
push eax
lea eax, [ebp - 0x16c]
push eax
push ebx
push str.Version
push dword [ebp - 0x15c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x15c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x100080c1
mov ecx, dword [ebp - 0x164]
mov eax, ecx
shr eax, 0x18
shr ecx, 0x10
push 0xa
mov byte [0x1004450b], al
mov byte [0x1004450a], cl
mov word [0x10044508], bx
pop eax
jmp 0x1000818e
push 0x104
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
push ebx
push 0x1000cb50
lea eax, [ebp - 0x128]
push 0x118
push eax
call fcn.10005a7a
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
add esp, 0x18
test eax, eax
jne 0x10008180
lea eax, [ebp - 0x128]
push eax
lea ecx, [ebp - 0x184]
call fcn.10005a7a
lea ecx, [ebp - 0x184]
call fcn.10005a7a
mov esi, edx
mov ebx, eax
mov ecx, esi
mov edx, ebx
shr ecx, 0x10
mov eax, esi
and cl, 0xf
mov byte [0x1004450b], cl
mov ecx, esi
shrd edx, ecx, 0x1c
mov ecx, ebx
shrd ecx, eax, 0x10
shrd ebx, esi, 0x1c
xor dl, cl
xor eax, eax
and dl, 0xf
mov word [0x10044508], ax
xor dl, bl
mov dword [0x10044504], eax
mov byte [0x1004450a], dl
mov esi, eax
lea ecx, [ebp - 0x184]
mov dword [ebp - 4], eax
mov dword [ebp - method.CFileVersion.virtual_0], vtable.CFileVersion.0
call fcn.10007bfb
or dword [ebp - 4], 0xffffffff
mov ebx, dword [0x10044504]
test esi, esi
push 0xa
pop eax
cmovne ebx, eax
mov dword [0x10044504], ebx
mov byte [0x10044502], 1
jmp 0x100081a3
mov ebx, dword [0x10044504]
test ebx, ebx
jne 0x100081bd
push 4
push 0x10044508
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
call fcn.10009c56
ret
mov dword [ebp - 0x168], eax
lea eax, [ebp - 0x168]
push 0x10042958
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x401210
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
not edx
dec eax
sub esi, 0x1a
sbb ebx, 0xc
sub esi, 0xf5
bswap edx
mov esi, 0xc5
mov edx, 0xdc
sbb ebx, 0xf4
rcl esi, 1
ror eax, 0x9a
ror esi, 0xc
rcr ebx, 0x62
rcr eax, 0xa6
sub eax, 0x8c
or edi, 0x75
rol eax, 0xf9
imul edi
add edx, 0x41
and ebx, 0xe1
sub eax, 0
sbb esi, 0xe9
add eax, 0xf9
sub edi, 9
inc eax
and edi, 5
mov eax, 0xa0
or edi, 0xc6
inc edx
not edi
mov edi, 0x74
or esi, 0xf8
sub edi, 0xed
imul edx
imul edx
rcr ebx, 0xf2
dec edi
inc edx
neg edx
rcl edx, 0x79
inc esi
imul esi
rol edi, 0x44
not esi
inc edx
sub edx, 0x30
add edx, 0xe0
add esi, 0xe5
inc esi
or esi, 0x21
xor ecx, ecx
xor edi, edi
not ebx
inc edx
add edi, 0x4d
sbb esi, 0x50
not edx
ror edi, 0x9c
not ebx
neg esi
bswap eax
bswap eax
add ebx, 0x84
inc eax
inc esi
sbb edx, 0xa5
imul edx
bswap esi
bswap ebx
bswap edx
sbb eax, 0xa0
bswap esi
rcr esi, 0xed
and edi, 0xc2
rol edx, 0x5a
rol ebx, 0x10
dec esi
or edi, 0xbd
bswap edi
inc edx
and esi, 0xdd
dec esi
sbb esi, 0x9e
and eax, 0x6e
bswap ebx
rcl edx, 0xed
rcr edi, 0x56
imul edi
inc edx
dec edx
neg esi
inc edi
bswap esi
sub edx, 0x92
sub ebx, 0xaf
bswap eax
not ebx
inc ebx
neg edx
or esi, 5
neg eax
rol ebx, 0x75
mov ecx, dword [ebp + 0xc]
mov esi, 0x9e
and eax, 0x78
ror ebx, 0xfa
inc edi
inc edx
dec ebx
or ebx, 0xc2
sbb edi, 0xbe
add esi, 0x9c
rol esi, 0xe9
sbb edx, 0x90
sub edi, 0x76
imul edi
rcl ebx, 0xb0
dec edx
bswap edx
and ebx, 0xa
rol esi, 0x7e
bswap eax
neg esi
or edx, 0x34
ror eax, 0x9c
not ebx
sbb edx, 0x78
imul ebx
sub edi, 0xd7
imul edx
sub edx, 0x59
bswap eax
add edx, 9
ror edi, 0xf3
sub esi, 0xd0
or edi, 0xf
or edi, 0xa3
neg edx
neg edi
rcr edi, 0xfe
mov edx, 0x96
neg eax
or esi, 0x56
mov edi, 0xa9
ror ebx, 0x22
ror esi, 0xfe
or eax, 0xe5
inc edi
dec ebx
imul ebx
imul edi
inc edx
add edx, 0x5b
mov edi, dword [ebp + 8]
xor eax, esi
mov eax, esi
mov esi, ebx
not byte [edi]
xor esi, esi
mov esi, eax
xor ebx, esi
xor esi, esi
xor esi, esi
mov ebx, ebx
mov ebx, esi
mov eax, eax
xor esi, ebx
add byte [edi], 0x48
xor esi, esi
mov esi, esi
xor ebx, ebx
mov esi, esi
xor ebx, esi
xor eax, eax
xor ebx, esi
mov esi, ebx
mov ebx, eax
sub byte [edi], 0x97
mov eax, esi
xor eax, eax
mov esi, ebx
xor ebx, esi
mov esi, ebx
xor eax, esi
mov esi, ebx
mov eax, eax
mov eax, eax
imul byte [edi]
inc edi
loop 0x4013e9
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4089c4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x59ecf0]
jne 0x4089ce
repz ret
jmp fcn.0040cec5
Function at 0x409333
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406c66
and dword [ebp - 4], 0
cmp dword [0x59f9ec], 0
mov ebx, eax
jne 0x4093e4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x409495
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x409495
push eax
call fcn.00406bf4
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x59f9ec], eax
call esi
push eax
call fcn.00406bf4
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x59f9f0], eax
call esi
push eax
call fcn.00406bf4
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x59f9f4], eax
call esi
push eax
call fcn.00406bf4
pop ecx
mov dword [0x59f9fc], eax
test eax, eax
je 0x4093e4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00406bf4
pop ecx
mov dword [0x59f9f8], eax
mov eax, dword [0x59f9f8]
cmp eax, ebx
je 0x40943c
cmp dword [0x59f9fc], ebx
je 0x40943c
push eax
call fcn.00406c6f
push dword [0x59f9fc]
mov esi, eax
call fcn.00406c6f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40943c
test edi, edi
je 0x40943c
call esi
test eax, eax
je 0x409433
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409433
test byte [ebp - 0xc], 1
jne 0x40943c
or dword [ebp + 0x10], 0x200000
jmp 0x409475
mov eax, dword [0x59f9f0]
cmp eax, ebx
je 0x409475
push eax
call fcn.00406c6f
pop ecx
test eax, eax
je 0x409475
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409475
mov eax, dword [0x59f9f4]
cmp eax, ebx
je 0x409475
push eax
call fcn.00406c6f
pop ecx
test eax, eax
je 0x409475
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x59f9ec]
call fcn.00406c6f
pop ecx
test eax, eax
je 0x409495
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x409497
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4177e4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4213ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00410d17
and dword [ebp - 0x14], 0
cmp dword [0x486f50], 0
mov dword [ebp - 0x18], eax
jne 0x417897
push 0x403f30
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41793f
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403f24
push ebx
call edi
test eax, eax
je 0x41793f
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403f14
push ebx
mov dword [0x486f50], eax
call edi
push eax
call esi
push 0x403f00
push ebx
mov dword [0x486f54], eax
call edi
push eax
call esi
push 0x403ee4
push ebx
mov dword [0x486f58], eax
call edi
push eax
call esi
mov dword [0x486f60], eax
test eax, eax
je 0x417897
push 0x403ecc
push ebx
call edi
push eax
call esi
mov dword [0x486f5c], eax
mov eax, dword [0x486f5c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4178f0
cmp dword [0x486f60], ecx
je 0x4178f0
push eax
call esi
push dword [0x486f60]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4178f0
test ebx, ebx
je 0x4178f0
call edi
test eax, eax
je 0x4178e7
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4178e7
test byte [ebp - 8], 1
jne 0x4178f0
or dword [ebp + 0x10], 0x200000
jmp 0x417923
mov eax, dword [0x486f54]
cmp eax, dword [ebp - 0x18]
je 0x417923
push eax
call esi
test eax, eax
je 0x417923
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x417923
mov eax, dword [0x486f58]
cmp eax, dword [ebp - 0x18]
je 0x417923
push eax
call esi
test eax, eax
je 0x417923
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x486f50]
call esi
test eax, eax
je 0x41793f
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x417941
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b26b
leave
ret
Function at 0x419200
Capabilities:
Get common file path
Manipulate console buffer

Disassembly:
mov eax, 0x1388
call fcn.004180a0
cmp dword [0x9313a4], 0x37
push esi
jne 0x419306
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualUnlock]
push 0
lea ecx, [esp + 0xb8c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
mov esi, dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
lea edx, [esp + 0xc]
push edx
push 0
push 0
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
mov eax, dword [esp + 0xc]
push 0
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
push 0
lea ecx, [esp + 0x38c]
push ecx
push 0x404024
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0
lea edx, [esp + 0x78c]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0x168]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push 0
call esi
push 0x40403c
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
lea edx, [esp + 0x14]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProfileSectionW]
push 0x30
lea ecx, [esp + 0x24]
push 0
push ecx
mov dword [esp + 0x28], 0
call fcn.0040a590
add esp, 0xc
lea edx, [esp + 0x1c]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CommConfigDialogW]
mov eax, dword [0x933b08]
mov dword [esp + 8], eax
mov eax, 0x5d1
add dword [esp + 8], eax
mov ecx, dword [esp + 8]
mov dl, byte [ecx + edi]
mov eax, dword [0x92fb9c]
mov byte [eax + edi], dl
pop esi
add esp, 0x1388
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
jne 0x43101e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x106df160
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.106df2b0
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x106df186
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x106df172
add dl, dl
jne 0x106df191
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x106df1e4
xor eax, eax
add dl, dl
jne 0x106df19e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x106df285
add dl, dl
jne 0x106df1ad
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106df1b8
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106df1c3
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106df1ce
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x106df1da
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x106df17d
mov eax, 1
add dl, dl
jne 0x106df1f2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106df1fd
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x106df1e9
sub eax, ebx
mov ebx, 1
jne 0x106df230
mov ecx, 1
add dl, dl
jne 0x106df216
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x106df221
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x106df20d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x106df17d
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x106df247
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x106df252
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x106df23e
cmp eax, 0x7d00
jae 0x106df275
cmp eax, 0x500
jb 0x106df270
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x106df17d
cmp eax, 0x7f
ja 0x106df278
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x106df17d
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x106df2a6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x106df17d
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x42d060], 1
mov dword [0x42d05c], 1
mov dword [0x42d058], 1
jne 0x401056
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010b0
mov dword [0x42d014], eax
mov eax, dword [0x42d06c]
test eax, eax
je 0x4010a0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x42d080]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x42d068]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x429018], 1
je 0x4010e0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x401070
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x4010f8
cmp dx, 0x20b
jne 0x401056
cmp dword [ecx + 0x84], 0xe
jbe 0x401056
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401056
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401056
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401056
Function at 0x4215b0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x421610
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x42d074]
test esi, esi
jle 0x421730
mov eax, dword [0x42d078]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x421644
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x4216c7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x421630
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x421757
mov eax, dword [0x42d078]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x42d078]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x421737
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x4216c0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x4216d0
add dword [0x42d074], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x42d078]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4216c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x42164e
mov eax, dword [0x42d078]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
nop
Function at 0x421c70
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x42d090
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x42d088]
sub esp, 4
test ebx, ebx
je 0x421cc5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x421cbe
test esi, esi
je 0x421cbe
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x421ca0
mov dword [esp], 0x42d090
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x422000
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x422025
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x422030
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x422025
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x422078
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x42206e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x42207a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x422060
xor eax, eax
pop ebx
pop esi
ret