joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002160
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, 0x32080
call fcn.14003410
mov ecx, dword [esp + 0x32088]
push ebx
push esi
xor ebx, ebx
push edi
push ebx
push 0x80
push 3
push ebx
push 1
lea eax, [esp + 0x1903c]
push bind
push ecx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x34], 0x19064
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xffffffff
je 0x14002305
mov eax, dword [esp + 0x14]
lea edx, [esp + 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [eax], esi
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x32090]
push ebp
add ecx, 4
push edx
push eax
mov dword [esp + 0x1c], ecx
call fcn.14001f00
mov ecx, 0x7d000
add esp, 8
cmp ecx, esi
mov dword [esp + 0x24], ebx
sbb ebp, ebp
and ebp, 0x16800
add ebp, 0x2800
mov edx, dword [esp + 0x32098]
push 0
push 0x80
push 3
push 0
push 1
push bind
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
mov ecx, 0x6400
xor eax, eax
lea edi, [esp + 0x2c]
rep stosd dword es:[edi], eax
mov ecx, 0x6400
lea edi, [esp + 0x1902c]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x18]
push 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x28]
push 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ecx, [esp + 0x20]
push 0
push ecx
lea edx, [esp + 0x34]
push ebp
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
lea esi, [esp + 0x2c]
mov dword [eax], ecx
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
add eax, 4
mov dword [esp + 0x14], eax
mov dword [eax], edx
mov ecx, dword [esp + 0x20]
mov edi, dword [esp + 0x14]
mov eax, ecx
add edi, 4
lea edx, [esp + 0x10]
shr ecx, 2
mov dword [esp + 0x14], edi
push edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x32098]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x28]
mov edi, dword [esp + 0x1c]
add edi, ecx
mov dword [esp + 0x1c], edi
call fcn.14001f00
mov eax, dword [esp + 0x28]
add esp, 8
cmp eax, ebp
jb 0x140022fb
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
inc edx
add ecx, ebp
push ebx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x28], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14002208
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
jmp 0x14002333
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x32090]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [eax], ebx
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0xc]
add esi, 4
push ecx
push edx
mov dword [esp + 0x18], esi
call fcn.14001f00
add esp, 8
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x32090]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [eax], 0xffffffff
mov edi, dword [esp + 0x10]
lea eax, [esp + 0xc]
add edi, 4
push eax
push ecx
mov dword [esp + 0x18], edi
call fcn.14001f00
add esp, 8
pop edi
pop esi
pop ebx
add esp, 0x32080
ret
Function at 0x14002370
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x244
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x140]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x25c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x150]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x140082c0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x154]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x140023fd
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x244
ret
mov al, byte [esp + 0x3c]
mov ebp, dword [esp + 0x258]
cmp al, 0x2e
je 0x14002460
test byte [esp + 0x10], 0x10
je 0x1400241b
mov edx, dword [ebp + 4]
mov byte [edx], 0x3f
jmp 0x14002421
mov eax, dword [ebp + 4]
mov byte [eax], 0x3e
mov ecx, dword [ebp + 4]
lea edi, [esp + 0x3c]
inc ecx
xor eax, eax
mov dword [ebp + 4], ecx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x3c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, dword [ebp + 4]
not ecx
add eax, ecx
mov dword [ebp + 4], eax
lea ecx, [esp + 0x10]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x140024fc
cmp byte [esp + 0x3c], 0x2e
je 0x140024e8
mov edx, dword [ebp + 4]
lea edi, [esp + 0x3c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov esi, dword [ebp + 8]
mov eax, edx
not ecx
dec ecx
sub eax, esi
lea ecx, [ecx + eax + 5]
mov eax, dword [ebp + 0xc]
cmp ecx, eax
jae 0x14002513
mov eax, dword [esp + 0x10]
lea edi, [esp + 0x3c]
shr al, 4
or al, 0x3e
mov byte [edx], al
mov ecx, dword [ebp + 4]
inc ecx
xor eax, eax
mov dword [ebp + 4], ecx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x3c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, dword [ebp + 4]
not ecx
add eax, ecx
mov dword [ebp + 4], eax
lea ecx, [esp + 0x10]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x14002474
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x244
ret
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x244
ret
Function at 0x14002e30
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x18c
push ebx
push ebp
push esi
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
lea eax, [esp + 0x74]
push eax
push ebx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x14002eeb
mov ebp, dword [esp + 0x1a0]
mov ecx, 0x19
xor eax, eax
lea edi, [esp + 0x10]
lea edx, [esp + 0x10]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x98]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push ecx
call fcn.14006e6b
push ebp
call fcn.14006e6b
add esp, 8
lea esi, [esp + 0x10]
mov eax, ebp
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x14002ecf
test cl, cl
je 0x14002ecb
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x14002ecf
add eax, 2
add esi, 2
test cl, cl
jne 0x14002eab
xor eax, eax
jmp 0x14002ed4
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x14002ef8
lea eax, [esp + 0x74]
push eax
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x14002e5f
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18c
ret
mov eax, dword [esp + 0x7c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18c
ret

Function at 0x14002fe0
Capabilities:
Acquire debug privileges
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
lea ecx, [esp + 0x10]
push ecx
push 0x20
mov eax, dword [edi + 0x3c]
mov ebp, dword [eax + edi + 0x50]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov edx, dword [esp + 0x10]
push 1
push str.SeDebugPrivilege
push edx
call fcn.14002f80
mov eax, dword [esp + 0x24]
push eax
call fcn.14002e30
add esp, 0x10
push eax
push 1
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x140030ae
push 0x8000
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0x40
push 0x3000
push ebp
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ebx, eax
test ebx, ebx
je 0x140030a7
push 0
push ebp
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14003098
cmp dword [esp + 0x1c], 1
jne 0x14003090
push 0
push 0
push 0
push 0x14002f10
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
jmp 0x14003094
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x140030b6
push 0x8000
push 0
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
push esi
call edi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x140049c5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x14008458
cmp edx, dword [eax]
je 0x140049e7
add eax, 8
inc ecx
cmp eax, 0x140084e8
jl 0x140049d8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x14008458]
jne 0x14004b15
mov eax, dword [0x14008dac]
cmp eax, 1
je 0x14004aef
test eax, eax
jne 0x14004a18
cmp dword [0x140083a4], 1
je 0x14004aef
cmp edx, 0xfc
je 0x14004b15
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x14004a4f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.140054c0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.14004e90
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x14004a92
lea eax, [ebp - 0x1a4]
push eax
call fcn.14004e90
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x14007508
push edi
call fcn.14003240
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.140054c0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.140054d0
lea eax, [ebp - 0xa0]
push 0x140074e8
push eax
call fcn.140054d0
push dword [esi + 0x1400845c]
lea eax, [ebp - 0xa0]
push eax
call fcn.140054d0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.140061ae
add esp, 0x2c
pop edi
jmp 0x14004b15
lea eax, [ebp + 8]
lea esi, [esi + 0x1400845c]
push 0
push eax
push dword [esi]
call fcn.14004e90
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x407915
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
add dword [0x48bbf4], 0xaf7cc000
cmp ebx, edi
je 0x407976
mov ax, word [0x489e1a]
add eax, 0x7a3e
mov word [0x489e1a], ax
call fcn.0040ef0d
mov esi, eax
push edi
push ebx
call fcn.00410120
add esp, 8
mov ecx, eax
xor edx, edx
mov eax, esi
div ecx
lea eax, [ebx + edx*4]
push eax
push ebx
call fcn.00430739
add esp, 8
xor dword [0x48ff44], 0xf44c5aa7
add ebx, 4
cmp edi, ebx
jne 0x40792e
mov ax, word [0x488eec]
add eax, 0x17ec
mov word [0x488eec], ax
pop esi
pop edi
pop ebx
ret
Function at 0x40bef2
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
mov eax, dword [0x48ef70]
lea edx, [eax + 1]
mov dword [0x48ef70], edx
mov dx, word [0x48835c]
lea eax, [eax + edx + 0xf990]
mov word [0x48835c], ax
xor dword [0x48edbc], 0x386cda5
mov eax, dword [0x48cb64]
mov eax, dword [0x48fa74]
inc eax
mov dword [0x48fa74], eax
cmp eax, 0x42b484a0
jne 0x40bf4f
mov ax, word [0x48a814]
imul eax, eax, 0x2875
mov word [0x48a814], ax
test ecx, ecx
jle 0x40c08d
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
xor eax, eax
mov edi, ecx
mov ebp, dword [0x48fe80]
shl ebp, 0xa
or ebp, 0x85af2469
xor ebp, 0x28501986
mov edx, dword [0x48df88]
imul edx, ebp
mov dword [0x48df88], edx
mov edx, dword [ebx]
mov bp, word [0x489894]
imul ebp, ebp, 0x3830
mov word [0x489894], bp
sub dword [ebx], eax
mov ebp, dword [0x48d41c]
imul ebp, ebp, 0x72183a43
mov dword [0x48d41c], ebp
mov ebp, dword [ebx]
cmp ebp, dword [esi]
sbb ebp, ebp
and ebp, 1
cmp edx, eax
mov eax, ebp
adc eax, 0
mov edx, dword [0x48f52c]
mov ebp, 0x1f729905
sub ebp, edx
add dword [0x48e04c], ebp
mov edx, dword [esi]
sub dword [ebx], edx
mov dword [0x48ae7c], 0xf34fd7df
add esi, 4
add ebx, 4
dec edi
jne 0x40bf63
test eax, eax
je 0x40c08d
mov edx, dword [esp + 0x1c]
lea ecx, [edx + ecx*4]
mov dx, word [0x487524]
movsx edx, dx
shl edx, 8
mov esi, dword [0x48b568]
and esi, edx
and esi, 0x10041000
mov dword [0x48b568], esi
mov edx, dword [ecx]
cmp edx, eax
sbb esi, esi
and esi, 1
add dword [0x48e24c], 0xb7ac6d9a
sub dword [ecx], eax
mov edi, dword [0x490e10]
imul edi, edi, 0x61e66548
mov bx, word [0x48875e]
or ebx, edi
mov word [0x48875e], bx
mov edi, dword [0x48e9c8]
imul edi, edi, 0x156f4140
mov dword [0x48e9c8], edi
mov dword [0x490c50], 0x48239305
add ecx, 4
mov di, word [0x48948a]
and edi, 0x355f
cmp edx, eax
mov word [0x48948a], di
mov eax, esi
jb 0x40bffe
mov eax, dword [0x49141c]
mov ax, word [0x489ab2]
cwde
shl eax, 8
cmp eax, 0xffbecd79
jg 0x40c0a8
mov eax, dword [0x48e990]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40f2c8
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [esp + 8], ecx
mov edi, dword [esp + 0x2c]
mov eax, dword [0x48ac34]
imul eax, eax, 0x46762554
mov dword [0x48ac34], eax
mov eax, dword [0x48c330]
and eax, 0xf29cbc23
xor eax, 0x82426b3
and dword [0x48d59c], eax
or dword [0x48c694], 0xcfcd67b0
mov ax, word [0x487818]
and eax, 0x9a29
mov word [0x487818], ax
test edi, edi
je 0x40f498
mov eax, dword [esp + 0x28]
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0x24]
lea eax, [ebx + 8]
mov dword [esp + 4], eax
add dword [0x48ef34], 0x6120976e
mov ecx, dword [esp + 8]
push edi
push ebx
call fcn.0042b986
mov cx, word [0x4884a8]
mov cx, word [0x4874da]
movsx ecx, cx
and ecx, 0xe92d3ce0
xor ecx, 0x97ccc891
mov dword [0x48e508], ecx
cmp eax, edi
jle 0x40f38e
mov ecx, dword [0x48d624]
imul ecx, ecx, 0x11c82020
mov dword [0x48d624], ecx
add dword [0x48e464], 0x32b9656
mov esi, edi
jmp 0x40f3dc
mov ecx, dword [0x48c80c]
mov dx, word [0x489fea]
lea esi, [edx + 1]
mov word [0x489fea], si
movsx edx, dx
mov esi, dword [0x490414]
lea ebp, [esi + 1]
mov dword [0x490414], ebp
mov ebp, 0xe5f09da0
sub ebp, esi
and ebp, edx
cmp ecx, ebp
jg 0x40f3d0
mov ecx, dword [0x491600]
or dword [0x48f760], ecx
add dword [0x48d1a0], 0x81f39ca4
mov esi, eax
xor dword [0x48f838], 0xd678a1ac
test esi, esi
je 0x40f44b
not eax
mov ecx, edi
not ecx
cmp eax, ecx
jge 0x40f3f6
mov eax, ecx
not eax
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0xc]
mov ebp, dword [0x49046c]
lea ebx, [ebp + 1]
mov dword [0x49046c], ebx
mov ebx, 0x1b4f6daa
sub ebx, ebp
mov bp, word [0x487c5e]
movsx ebp, bp
xor ebp, ebx
mov ebx, dword [0x48c35c]
sub ebx, ebp
mov dword [0x48c35c], ebx
mov bl, byte [ecx]
xor byte [edx], bl
mov ebx, dword [0x48f120]
xor ebx, 0x22a674
mov dword [0x48ee24], ebx
inc edx
inc ecx
dec eax
jne 0x40f400
mov eax, dword [0x48c6a8]
imul eax, eax, 0x1a8d0f41
and dword [0x4901d4], eax
push esi
mov ebx, dword [esp + 0x28]
push ebx
call fcn.00412720
add dword [0x48f324], 0xdedbffdf
add dword [esp + 0xc], esi
mov dword [0x48e53c], 0x6c328515
mov eax, dword [0x48e2fc]
imul eax, eax, 0xbc43b2ce
xor dword [0x48b8b4], eax
sub edi, esi
jne 0x40f332
mov eax, dword [0x48d404]
lea ecx, [eax + 1]
mov dword [0x48d404], ecx
mov ecx, 0xb5a0cb19
sub ecx, eax
add dword [0x48d120], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x419956
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [0x490b78]
imul eax, eax, 0xfc63cd4e
and dword [0x48e538], eax
xor eax, eax
mov dword [ecx], eax
mov edx, dword [0x49015c]
shl edx, 3
or edx, 0x43692ffc
and dword [0x48d930], edx
mov dword [ecx + 4], eax
mov ax, word [0x48a55a]
or eax, 0x38c4
mov word [0x48a55a], ax
mov dword [ecx + 8], 0x67452301
mov ax, word [0x487eaa]
and eax, 0xf9ff
mov word [0x487eaa], ax
mov dword [ecx + 0xc], 0xefcdab89
mov eax, dword [0x48f8a8]
mov dword [ecx + 0x10], 0x98badcfe
mov eax, dword [0x4906f8]
lea edx, [eax - 1]
mov dword [0x4906f8], edx
and eax, 0xa632d184
mov dword [0x48ef10], eax
mov dword [ecx + 0x14], 0x10325476
mov eax, dword [0x4905a8]
cmp eax, 0x11c09b99
jg 0x4199f4
add dword [0x48cf84], 0x260d31c3
ret

Function at 0x41a91a
Capabilities:
Terminate process

Disassembly:
add dword [0x48eef8], 0x98040208
push dword [0x491a2c]
call fcn.0041e0a9
add esp, 4
mov ax, word [0x48a046]
lea ecx, [eax - 1]
mov word [0x48a046], cx
cwde
mov ecx, dword [0x48c5a0]
shl ecx, 6
and ecx, eax
cmp ecx, 0xcc8c4c97
jg 0x41a96c
mov eax, dword [0x48c1b8]
cmp eax, 0x208dd2f8
jne 0x41a96c
or dword [0x48c9a0], 0x17726d10
push 1
call fcn.0043f178
add esp, 4
Function at 0x420634
Capabilities:
Write file on windows

Disassembly:
mov ax, word [0x487f5e]
and eax, 0xffff8404
mov cx, word [0x4882aa]
or ecx, eax
or ecx, 0x717a
mov word [0x4882aa], cx
mov ax, word [0x488c58]
cwde
xor eax, 0x6cafbd98
cmp eax, 0x135a4ea4
jl 0x420691
mov eax, dword [0x48fa6c]
dec eax
mov dword [0x48fa6c], eax
cmp eax, 0x1089c200
jl 0x42069b
mov eax, dword [0x48f2e4]
and eax, 0x8287c340
or eax, 0x25703c81
and dword [0x48f928], eax
jmp 0x42069b
or dword [0x4916b8], 0xf7bf36fa
push ebp
push ebx
push edi
push esi
mov ebx, dword [esp + 0x14]
cmp dword [0x492204], 0
jne 0x42070c
mov ax, word [0x4893b6]
cwde
shl eax, 4
xor dword [0x48bdfc], eax
call fcn.0040ef0d
mov dword [0x492204], eax
mov ax, word [0x489a3c]
cwde
shl eax, 8
cmp eax, 0xd8784929
jl 0x4206ff
mov ax, word [0x48a0c2]
mov eax, dword [0x48f298]
add eax, 0xeb58
mov ecx, dword [0x48c7a8]
or ecx, eax
mov ax, word [0x4891bc]
and eax, ecx
mov word [0x4891bc], ax
jmp 0x42070c
mov ax, word [0x48a316]
cwde
or dword [0x48c220], eax
mov eax, dword [0x48bda4]
lea ecx, [eax + 1]
mov dword [0x48bda4], ecx
mov cx, word [0x48781a]
movsx ecx, cx
imul ecx, eax
mov eax, dword [0x48daac]
or eax, ecx
or eax, 0xe5bac307
mov dword [0x48daac], eax
mov ebp, 3
push ebp
push 0x4787
call fcn.00407b14
add esp, 8
mov edi, eax
add dword [0x48d824], 0xe74969c9
push edi
push ebx
call fcn.0043f482
add esp, 8
mov esi, eax
mov ax, word [0x488f7e]
xor eax, 0x5c19
mov word [0x488f7e], ax
push edi
push ebp
call fcn.00409272
add esp, 8
mov eax, dword [0x490628]
imul eax, eax, 0x3fdf9fba
mov dword [0x490628], eax
test esi, esi
jne 0x420829
mov eax, dword [0x48e3c0]
imul eax, eax, 0xc814fb5c
mov dword [0x48e3c0], eax
push 0x447
call dword [0x487158]
mov eax, dword [0x48ad28]
sar eax, 8
mov ecx, 0x9cd4804
sub ecx, eax
or ecx, 0x6d9cc162
xor dword [0x490210], ecx
push ebp
push 0x4787
call fcn.00407b14
add esp, 8
mov edi, eax
mov ax, word [0x487f22]
or eax, 0xd0ec
mov word [0x487f22], ax
push edi
push ebx
call fcn.0043f482
add esp, 8
mov esi, eax
add dword [0x48d644], 0xf612f1b6
push edi
push ebp
call fcn.00409272
add esp, 8
mov eax, dword [0x48d518]
lea ecx, [eax + 1]
mov dword [0x48d518], ecx
mov ecx, dword [0x48d4f4]
sub ecx, eax
mov dword [0x48d4f4], ecx
mov eax, dword [0x490198]
or eax, 0x97c96d47
cmp eax, 0xb8dfc0b9
jb 0x42086b
mov eax, dword [0x48d01c]
or eax, 0xab21f268
xor eax, 0x54de0d90
cmp eax, 0xf7fd9ff8
jb 0x420857
mov eax, dword [0x48de30]
jmp 0x42086b
mov eax, dword [0x48dd84]
and eax, 0x30314919
xor eax, 0xffff7dbd
mov dword [0x48d72c], eax
test esi, esi
je 0x4208c1
mov ax, word [0x48730e]
add eax, 0xfffff950
mov word [0x48730e], ax
push esi
push 1
push 4
push 0x492204
call fcn.0043fad7
add esp, 0x10
mov ax, word [0x488348]
cwde
add dword [0x48afa8], eax
push esi
call fcn.0043fbbd
add esp, 4
mov eax, dword [0x49061c]
lea ecx, [eax + 1]
mov dword [0x49061c], ecx
add eax, 0xf68d2f47
and dword [0x48acdc], eax
mov ax, word [0x489fb8]
cwde
add eax, 0xbc9b307e
mov dword [0x48d170], eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x45f6f4
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045f4e8

Function at 0x461988
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00461162

Function at 0x461993
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0046139d
Function at 0x401500
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x40
call dbg.__main
mov dword [esp + 0x3c], 0
mov dword [esp + 0x2c], 0xa
mov dword [esp + 4], 0x1312d00
mov dword [esp], str.Please_enter_the_size__10_to__d__of_the_array__11_to_quit_n
call sym._printf
lea eax, [esp + 0x2c]
mov dword [esp + 4], eax
mov dword [esp], 0x40403b
call sym._scanf
mov eax, dword [esp + 0x2c]
cmp eax, 9
jle 0x40151e
mov eax, dword [esp + 0x2c]
shl eax, 2
mov dword [esp], eax
call sym._malloc
mov dword [esp + 0x3c], eax
cmp dword [esp + 0x3c], 0
jne 0x40158b
mov dword [esp], str.unable_to_allocate_the_memory
call sym._puts
mov dword [esp], str.pause
call sym._system
mov eax, 1
jmp 0x40167f
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call sym._fillArrayRandom
mov dword [esp + 4], 0xa
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call sym._printArray
mov dword [esp], str.Please_enter_1_to_start_the_sort
call sym._puts
lea eax, [esp + 0x28]
mov dword [esp + 4], eax
mov dword [esp], 0x40403b
call sym._scanf
call sym._clock
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0xc], sym._myIntCompare
mov dword [esp + 8], 4
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call sym._qsort
call sym._clock
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
sub eax, dword [esp + 0x38]
mov dword [esp + 0x1c], eax
fild dword [esp + 0x1c]
fld dword [0x4040bc]
fdivp st(1)
fstp dword [esp + 0x30]
mov dword [esp + 4], 0xa
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call sym._printArray
fld dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
fstp qword [esp + 8]
mov dword [esp + 4], eax
mov dword [esp], str.Time_to_sort__d_items___.3f_n
call sym._printf
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call sym._free
mov eax, dword [esp + 0x2c]
cmp eax, 0xb
jne 0x40151e
mov dword [esp], str.pause
call sym._system
mov eax, 0
leave
ret

Function at 0x401681
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], 0x4c4b400
call sym._malloc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4016b4
mov dword [esp], str.not_enough_memory
call sym._puts
mov dword [esp], str.pause
call sym._system
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x401ce0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._vfprintf
call sym._abort
jmp dbg.mark_section_writable