joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ed724
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0x64]
mov eax, dword [ebp + 8]
cmp dword [eax - 8], 0x1fffffff
jne 0x5ed78b
cmp ebx, dword [ebp - 8]
jge 0x5ed7ae
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
xor eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0x20]
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x5ed759
jmp 0x5ed7ae
cmp ebx, dword [ebp - 8]
jge 0x5ed7ae
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0x20]
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x5ed790
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5ed7b8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x64]
mov eax, dword [ebp + 8]
cmp dword [eax - 8], 0x1fffffff
jne 0x5ed81f
cmp ebx, dword [ebp - 8]
jge 0x5ed842
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
xor eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x20]
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x5ed7ed
jmp 0x5ed842
cmp ebx, dword [ebp - 8]
jge 0x5ed842
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x20]
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x5ed824
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x609410
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x60948d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffffffffffffffff
push 7
lea eax, [ebp - 0x208]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
test eax, eax
je 0x60945b
lea eax, [ebp - 8]
lea edx, [ebp - 0x208]
mov ecx, pe_nt_image_headers32
call fcn.0040a918
push dword [ebp - 8]
push 0x6094a8
push dword [ebp - 4]
mov eax, ebx
mov edx, 3
call fcn.0040ab50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x609494
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409da0
ret

Function at 0x60c360
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.0040780c
ret

Function at 0x612fe4
Capabilities:
Hash data using djb2

Disassembly:
push ebx
push esi
push edi
mov edi, eax
mov ebx, 0x1505
mov esi, ebx
mov eax, edi
call fcn.0040a85c
mov edx, eax
jmp 0x61301f
movzx eax, cx
mov ecx, ebx
shl ecx, 5
add ebx, ecx
xor eax, ebx
mov ebx, eax
movzx eax, word [edx + 2]
test eax, eax
je 0x613027
mov ecx, esi
shl ecx, 5
add esi, ecx
xor eax, esi
mov esi, eax
add edx, 4
movzx ecx, word [edx]
test cx, cx
jne 0x612ffb
imul eax, esi, 0x5d588b65
add eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x621624
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
dec edx
test edx, edx
jl 0x621644
inc edx
mov ebx, ecx
xor bl, byte [eax]
movzx ebx, bl
mov ebx, dword [ebx*4 + 0x64d06c]
shr ecx, 8
xor ebx, ecx
mov ecx, ebx
inc eax
dec edx
jne 0x62162b
mov eax, ecx
pop ebx
ret
Function at 0x63bdf0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp], ecx
mov esi, eax
mov eax, dword [esi]
test eax, eax
je 0x63be07
sub eax, 4
mov eax, dword [eax]
mov ebp, eax
test ebp, ebp
je 0x63bedf
mov eax, edx
shr eax, 0x18
mov byte [esp + 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0xa], al
mov eax, edx
shr eax, 8
mov byte [esp + 9], al
mov byte [esp + 8], dl
mov eax, dword [esp]
dec eax
cmp eax, 0
jl 0x63bedf
mov dword [esp + 4], eax
mov eax, esi
call fcn.0040a2f4
mov edx, dword [esi]
movzx edx, byte [edx]
movzx ecx, byte [esp + 0xa]
add dl, cl
mov byte [eax], dl
mov edi, ebp
sub edi, 2
jl 0x63be89
inc edi
mov ebx, 2
mov eax, esi
call fcn.0040a2f4
mov edx, dword [esi]
movzx edx, byte [edx + ebx - 2]
mov ecx, dword [esi]
movzx ecx, byte [ecx + ebx - 1]
add dl, cl
movzx ecx, byte [esp + 8]
xor dl, cl
mov byte [eax + ebx - 1], dl
inc ebx
dec edi
jne 0x63be63
mov eax, esi
call fcn.0040a2f4
mov edx, dword [esi]
movzx edx, byte [edx + ebp - 1]
movzx ecx, byte [esp + 0xb]
add dl, cl
mov byte [eax + ebp - 1], dl
mov ebx, ebp
dec ebx
cmp ebx, 1
jl 0x63bed0
mov eax, esi
call fcn.0040a2f4
mov edx, dword [esi]
movzx edx, byte [edx + ebx]
mov ecx, dword [esi]
movzx ecx, byte [ecx + ebx - 1]
add dl, cl
movzx ecx, byte [esp + 9]
xor dl, cl
mov byte [eax + ebx - 1], dl
dec ebx
test ebx, ebx
jne 0x63beaa
dec dword [esp + 4]
cmp dword [esp + 4], 0xffffffff
jne 0x63be41
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x63bee8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp], ecx
mov esi, eax
mov eax, dword [esi]
test eax, eax
je 0x63beff
sub eax, 4
mov eax, dword [eax]
mov ebp, eax
test ebp, ebp
je 0x63bfd0
mov eax, edx
shr eax, 0x18
mov byte [esp + 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0xa], al
mov eax, edx
shr eax, 8
mov byte [esp + 9], al
mov byte [esp + 8], dl
mov eax, dword [esp]
dec eax
cmp eax, 0
jl 0x63bfd0
mov dword [esp + 4], eax
mov edi, ebp
dec edi
test edi, edi
jle 0x63bf67
mov ebx, 1
mov eax, esi
call fcn.0040a2f4
mov edx, dword [esi]
movzx edx, byte [edx + ebx - 1]
xor dl, byte [esp + 9]
mov ecx, dword [esi]
movzx ecx, byte [ecx + ebx]
sub dl, cl
mov byte [eax + ebx - 1], dl
inc ebx
dec edi
jne 0x63bf45
mov eax, esi
call fcn.0040a2f4
mov edx, dword [esi]
movzx edx, byte [edx + ebp - 1]
movzx ecx, byte [esp + 0xb]
sub dl, cl
mov byte [eax + ebp - 1], dl
mov ebx, ebp
cmp ebx, 2
jl 0x63bfac
mov eax, esi
call fcn.0040a2f4
mov edx, dword [esi]
movzx edx, byte [edx + ebx - 1]
xor dl, byte [esp + 8]
mov ecx, dword [esi]
movzx ecx, byte [ecx + ebx - 2]
sub dl, cl
mov byte [eax + ebx - 1], dl
dec ebx
cmp ebx, 1
jne 0x63bf87
mov eax, esi
call fcn.0040a2f4
mov edx, dword [esi]
movzx edx, byte [edx]
movzx ecx, byte [esp + 0xa]
sub dl, cl
mov byte [eax], dl
dec dword [esp + 4]
cmp dword [esp + 4], 0xffffffff
jne 0x63bf39
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x64401e81
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
xor eax, eax
push ebx
mov ebx, edx
sub esp, 0x10
test edx, edx
je 0x64401e9b
mov dword [esp], edx
call sym._strlen
mov dword [esp + 0xc], esi
mov dword [esp], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
call sym._fwrite
mov dword [esp], esi
call sym._fflush
add esp, 0x10
pop ebx
pop esi
pop ebp
ret

Function at 0x64401f98
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x64424050]
test eax, eax
je 0x64401fa9
call eax
mov dword [esp], 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov edx, str.out_of_memory_n
call sym._rawWrite
mov dword [esp], 1
call sym._exit

Function at 0x64402a41
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
push ebx
mov ebx, edx
and ebx, 0xfffff000
sub esp, 0xc
mov eax, dword [ebx + 4]
cmp eax, 0xfd0
jle 0x64402a77
mov eax, dword [ebx + 8]
cmp eax, ecx
je 0x64402af1
add esp, 0xc
mov edx, ebx
pop ebx
pop esi
pop edi
pop ebp
jmp sym._addToSharedFreeListBigChunks__system_u6634
cmp dword [ebx + 8], ecx
je 0x64402a8a
add esp, 0xc
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
jmp sym._addToSharedFreeList__system_u6677
sub dword [ecx + 0x1074], eax
mov ecx, dword [ebx + 0x14]
mov dword [edx], ecx
mov dword [ebx + 0x14], edx
mov edx, dword [ebx + 0x18]
lea ecx, [edx + eax]
cmp edx, eax
jl 0x64402ad4
mov dword [ebx + 0x18], ecx
cmp ecx, 0xfd0
jne 0x64402b01
mov ecx, 0x10
cdq
idiv ecx
mov edx, ebx
lea eax, [esi + eax*4]
call sym._listRemove__system_u6897
mov dword [ebx + 4], 0x1000
add esp, 0xc
mov ecx, esi
pop ebx
pop esi
pop edi
pop ebp
jmp sym._freeBigChunk__system_u6553_8
mov edi, 0x10
cdq
idiv edi
mov edx, dword [esi + eax*4]
mov dword [ebx + 0xc], edx
test edx, edx
je 0x64402ae9
mov dword [edx + 0x10], ebx
mov dword [esi + eax*4], ebx
mov dword [ebx + 0x18], ecx
jmp 0x64402b01
add esp, 0xc
mov edx, ebx
mov ecx, eax
pop ebx
pop esi
pop edi
pop ebp
jmp sym._deallocBigChunk__system_u6623_8
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x64402b97
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp], 0x6441b134
call sym.___emutls_get_address
mov edx, dword [ebp + 8]
leave
mov ecx, eax
jmp sym._rawDealloc__system_u6964_8
Function at 0x6440321b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 0x18]
mov edx, dword [ebp + 0x1c]
mov dword [ebp - 0x20], edi
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], edx
mov edx, dword [ebp + 0xc]
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._dollar___systemZdollars_u11_8
push ecx
mov edi, edx
push ecx
mov dword [ebp - 0x2c], eax
mov dword [esp], 0x6441b124
call sym.___emutls_get_address
cmp byte [eax], 0
mov dword [ebp - 0x3c], eax
jne 0x64403378
mov dword [esp], ebx
mov dword [esp + 4], esi
call sym._dollar___systemZdollars_u11_8
push ebx
push ebx
mov ecx, dword [ebp - 0x3c]
mov ebx, edx
mov dword [ebp - 0x30], eax
cmp byte [ecx], 0
jne 0x64403378
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._dollar___systemZdollars_u11_8
push ecx
mov esi, edx
push ecx
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x38], eax
cmp byte [ecx], 0
jne 0x64403378
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
add eax, ecx
mov ecx, dword [ebp - 0x38]
lea ecx, [eax + ecx + 0x1f]
call sym._rawNewString_4
mov ecx, dword [0x6441c5b4]
mov dword [ebp - 0x1c], edx
mov edx, dword [0x6441c5b0]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
call sym._appendString
mov edx, dword [ebp - 0x2c]
mov ecx, edi
lea eax, [ebp - 0x20]
call sym._appendString
mov edx, dword [0x6441c524]
mov ecx, dword [0x6441c528]
lea eax, [ebp - 0x20]
call sym._appendString
mov edx, dword [ebp - 0x30]
mov ecx, ebx
lea eax, [ebp - 0x20]
call sym._appendString
mov edx, dword [0x6441c510]
mov ecx, dword [0x6441c514]
lea eax, [ebp - 0x20]
call sym._appendString
mov edx, dword [ebp - 0x38]
lea eax, [ebp - 0x20]
mov ecx, esi
call sym._appendString
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
call sym._sysFatal__system_u4825
test esi, esi
je 0x6440334d
bt dword [esi], 0x1e
jb 0x6440334d
mov dword [esp], esi
call sym._deallocImpl__system_u1765
test ebx, ebx
je 0x6440335f
bt dword [ebx], 0x1e
jb 0x6440335f
mov dword [esp], ebx
call sym._deallocImpl__system_u1765
test edi, edi
je 0x64403378
bt dword [edi], 0x1e
jb 0x64403378
mov dword [ebp + 8], edi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp sym._deallocImpl__system_u1765
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x644043f2
Capabilities:
Write file on windows

Disassembly:
cmp dword [0x64424048], 0
jne 0x644043fd
jmp sym._writeToStdErr__system_u3961_8
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
call sym._cstrToNimstr_4
mov dword [esp], eax
mov ebx, edx
mov dword [esp + 4], edx
call dword [0x64424048]
push ecx
push ecx
test ebx, ebx
je 0x6440442c
bt dword [ebx], 0x1e
jb 0x6440442c
mov dword [esp], ebx
call sym._deallocImpl__system_u1765
mov dword [esp], 0x6441b124
call sym.___emutls_get_address
cmp byte [eax], 0
je 0x6440445e
mov byte [eax], 0
mov dword [esp], 0x6441b0a4
call sym.___emutls_get_address
mov ecx, eax
mov eax, dword [eax]
mov edx, dword [eax + 0x1c]
xor eax, eax
mov dword [esp], eax
call sym._eqcopy___stdZtypedthreads_u171_12
push edx
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x64404463
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, str.SIGINT:_Interrupted_by_Ctrl_C._n
sub esp, 0x14
mov eax, dword [ebp + 8]
cmp eax, 2
je 0x644044a5
mov ebx, str.SIGSEGV:_Illegal_storage_access.__Attempt_to_read_from_nil___n
cmp eax, 0xb
je 0x644044a5
mov ebx, str.SIGABRT:_Abnormal_termination._n
cmp eax, 0x16
je 0x644044a5
mov ebx, str.SIGFPE:_Arithmetic_error._n
cmp eax, 8
je 0x644044a5
cmp eax, 4
mov ebx, str.SIGILL:_Illegal_operation._n
mov eax, str.unknown_signal_n
cmovne ebx, eax
mov dword [esp], ebx
call sym._strlen
mov ecx, ebx
mov edx, eax
call sym._showErrorMessage__system_u3966_8
mov dword [esp], 1
call sym._exit

Function at 0x644044c2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp + 4], sym._signalHandler
mov dword [esp], 2
call sym._signal
mov dword [esp + 4], sym._signalHandler
mov dword [esp], 0xb
call sym._signal
mov dword [esp + 4], sym._signalHandler
mov dword [esp], 0x16
call sym._signal
mov dword [esp + 4], sym._signalHandler
mov dword [esp], 8
call sym._signal
mov dword [esp + 4], sym._signalHandler
mov dword [esp], 4
call sym._signal
leave
ret

Function at 0x6440489d
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], 2
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
call ebx
mov edx, str.could_not_load:
call sym._rawWrite
lea edx, [edi + 4]
test esi, esi
jne 0x644048d1
mov edx, 0x6441c2e3
mov dword [ebp - 0x1c], edx
mov dword [esp], 2
call ebx
mov edx, dword [ebp - 0x1c]
call sym._rawWrite
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xc1
jne 0x64404905
mov dword [esp], 2
call ebx
mov edx, str._n_bad_format__library_may_be_wrong_architecture_
call sym._rawWrite
mov dword [esp], 2
call ebx
mov edx, 0x6441c326
call sym._rawWrite
mov dword [esp], 1
call sym._exit
Function at 0x644074fd
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
push ebx
sub esp, 0x4c
mov dword [ebp - 0x2c], ecx
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
lea edx, [eax + 0x14]
mov esi, dword [eax + 0x14]
mov dword [ebp - 0x30], edx
mov eax, dword [esi + 0x28]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call dword [0x6442406c]
push ecx
push ecx
test eax, eax
je 0x6440753f
mov esi, dword [esi]
cmp dword [ebp - 0x30], esi
jne 0x6440751d
jmp 0x64407547
mov esi, dword [esi + 0x10]
jmp 0x64407690
not edi
mov ecx, edi
call sym._winimConverterBOOLToBoolean__winimZutils_u5_4
mov dword [esp], 0x6441b124
mov edi, eax
call sym.___emutls_get_address
cmp byte [eax], 0
mov esi, eax
jne 0x6440768e
mov eax, edi
test al, al
jne 0x6440768e
mov edx, dword [0x6441c890]
mov eax, dword [0x6441c88c]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._winstrConverterStringToLPWSTR__winimZwinstr_u1291_8
push edx
mov ecx, eax
push edx
cmp byte [esi], 0
jne 0x6440768e
xor edx, edx
call sym._get_library_address__6873nvoke_u140_8
cmp byte [esi], 0
mov ecx, eax
jne 0x6440768e
xor edi, edi
xor eax, eax
mov dword [esp], 0xd02065c1
mov dword [esp + 8], edi
mov dword [esp + 4], eax
call sym._get_function_address__6873nvoke_u143_16
sub esp, 0xc
cmp byte [esi], 0
mov edi, eax
jne 0x6440768e
test eax, eax
je 0x6440768e
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov dword [esp], eax
call dword [0x6442414c]
push edx
mov edx, eax
test eax, eax
jns 0x64407619
xor ecx, ecx
sar edx, 0x1f
mov dword [esp + 0x10], 0x7fffffff
mov dword [esp + 0x14], ecx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._raiseRangeErrorI
jmp 0x64407626
mov ecx, dword [ebp - 0x2c]
call sym._UNICODEminusgtstring___winimZwinstr_u206_8
mov dword [ebp - 0x34], eax
mov ebx, edx
cmp byte [esi], 0
jne 0x6440767c
mov eax, dword [ebp - 0x34]
xor edx, edx
add eax, eax
mov word [ebp - 0x20], ax
add eax, 2
mov word [ebp - 0x1e], ax
xor eax, eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x20]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], edx
call edi
sub esp, 0x10
cmp byte [esi], 0
jne 0x6440767c
test eax, eax
js 0x6440767c
mov esi, dword [ebp - 0x24]
test ebx, ebx
je 0x64407690
bt dword [ebx], 0x1e
jb 0x64407690
mov dword [esp], ebx
call sym._deallocShared
jmp 0x64407690
test ebx, ebx
je 0x6440768e
bt dword [ebx], 0x1e
jb 0x6440768e
mov dword [esp], ebx
call sym._deallocShared
xor esi, esi
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x644088b8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
call sym._PLJQathai__q90g_u403_0
mov dword [ebp - 0x1c], eax
mov esi, edx
mov dword [esp], 0x6441b124
call sym.___emutls_get_address
cmp byte [eax], 0
jne 0x64408a8e
mov dword [esp], 1
mov ebx, eax
mov dword [esp + 4], 0x64
call sym._rand__q90g_u289_8
push edi
push edi
cmp byte [ebx], 0
jne 0x64408a8e
sub eax, 1
mov edi, eax
seto al
movzx eax, al
jo 0x64408a44
cmp edi, eax
jge 0x64408935
cmp dword [ebp - 0x1c], 0
mov edi, 0x6441c9e0
je 0x64408924
lea edi, [esi + 4]
mov ecx, edi
call sym._winstrConverterCStringToLPWSTR__winimZwinstr_u1302_4
cmp byte [ebx], 0
je 0x64408957
jmp 0x64408a8e
mov dword [ebp - 0x20], eax
mov dword [esp], 0xa
call dword [0x644241c4]
push ecx
cmp byte [ebx], 0
jne 0x64408a8e
mov eax, dword [ebp - 0x20]
add eax, 1
jmp 0x6440890c
mov dword [esp], eax
call dword [0x644241d4]
push edx
cmp byte [ebx], 0
jne 0x64408a8e
inc eax
jne 0x64408977
xor ecx, ecx
mov dword [esp], ecx
call sym._exit
mov dword [esp], 2
mov dword [esp + 4], 0xa
call sym._rand__q90g_u289_8
push edx
push edx
cmp byte [ebx], 0
jne 0x64408a8e
sub eax, 1
mov dword [ebp - 0x20], eax
seto al
movzx eax, al
jo 0x64408a44
cmp dword [ebp - 0x20], eax
jge 0x644089be
mov ecx, edi
call sym._winstrConverterCStringToLPWSTR__winimZwinstr_u1302_4
cmp byte [ebx], 0
je 0x644089e0
jmp 0x64408a8e
mov dword [ebp - 0x24], eax
mov dword [esp], 1
call dword [0x644241c4]
push eax
cmp byte [ebx], 0
jne 0x64408a8e
mov eax, dword [ebp - 0x24]
add eax, 1
jmp 0x644089a2
xor ecx, ecx
xor edi, edi
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], edi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
mov dword [esp], eax
call dword [0x644241d0]
sub esp, 0x1c
cmp byte [ebx], 0
mov edi, eax
jne 0x64408a8e
mov dword [esp], 2
mov dword [esp + 4], 0xa
call sym._rand__q90g_u289_8
push edx
push edx
cmp byte [ebx], 0
jne 0x64408a8e
sub eax, 1
mov dword [ebp - 0x20], eax
seto al
movzx eax, al
jno 0x64408a4b
call sym._raiseOverflow
jmp 0x64408a8e
cmp dword [ebp - 0x20], eax
jge 0x64408a70
test edi, edi
je 0x6440896d
mov dword [esp + 8], edi
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], esi
mov dword [esp], eax
call sym._FTJHzIfHY__q90g_u277_12
sub esp, 0xc
jmp 0x64408a8e
mov dword [ebp - 0x24], eax
mov dword [esp], 1
call dword [0x644241c4]
push eax
cmp byte [ebx], 0
jne 0x64408a8e
mov eax, dword [ebp - 0x24]
add eax, 1
jmp 0x64408a42
test esi, esi
je 0x64408aa0
bt dword [esi], 0x1e
jb 0x64408aa0
mov dword [esp], esi
call sym._deallocShared
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret 4

Function at 0x64409457
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call sym._PreMain
leave
jmp sym._nimTestErrorFlag_0
Function at 0x6440960c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call sym.___acrt_iob_func
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], 0x6441ca30
call sym._fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call sym.___acrt_iob_func
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._vfprintf
call sym._abort

Function at 0x64409f84
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x64409fa3
mov eax, 0
jmp 0x64409fe7
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x64409fc6
mov eax, 0
jmp 0x64409fe7
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x64409fe2
mov eax, 0
jmp 0x64409fe7
mov eax, 1
leave
ret

Function at 0x64409fe9
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x6440a048
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x6440a040
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x6440a040
mov eax, dword [ebp - 4]
jmp 0x6440a05c
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x6440a01d
mov eax, 0
leave
ret
Function at 0x64410fd3
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
add esp, 0xffffff80
cmp dword [ebp + 8], 0
je 0x644110ec
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._pthread_spin_destroy
cmp eax, 1
jne 0x644110e2
mov dword [ebp - 0x77], 0x6f727245
mov dword [ebp - 0x73], 0x6c632072
mov dword [ebp - 0x6f], 0x696e6165
mov dword [ebp - 0x6b], 0x7520676e
mov dword [ebp - 0x67], 0x70732070
mov dword [ebp - 0x63], 0x6b5f6e69
mov dword [ebp - 0x5f], 0x20737965
mov dword [ebp - 0x5b], 0x20726f66
mov dword [ebp - 0x57], 0x65726874
mov dword [ebp - 0x53], 0x206461
lea eax, [ebp - 0x4f]
mov ecx, 0x43
mov ebx, 0
mov dword [eax], ebx
mov dword [eax + ecx - 4], ebx
lea edx, [eax + 4]
and edx, 0xfffffffc
sub eax, edx
add ecx, eax
and ecx, 0xfffffffc
shr ecx, 2
mov edi, edx
mov eax, ebx
rep stosd dword es:[edi], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov dword [esp + 8], 0xa
lea edx, [ebp - 0x77]
add edx, 0x27
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultoa]
call eax
mov dword [ebp - 0xc], 0x27
jmp 0x64411098
add dword [ebp - 0xc], 1
lea edx, [ebp - 0x77]
mov eax, dword [ebp - 0xc]
add eax, edx
movzx eax, byte [eax]
test al, al
je 0x644110af
mov eax, dword [ebp - 0xc]
cmp eax, 0x69
jbe 0x64411094
mov eax, dword [ebp - 0xc]
cmp eax, 0x69
ja 0x644110cd
lea edx, [ebp - 0x77]
mov eax, dword [ebp - 0xc]
add eax, edx
mov byte [eax], 0xa
mov eax, dword [ebp - 0xc]
add eax, 1
mov byte [ebp + eax - 0x77], 0
lea eax, [ebp - 0x77]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call eax
sub esp, 4
call sym._abort
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [eax], edx
jmp 0x644110ed
nop
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret