joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1e7a3e90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.1e7a3c36
imul edx, dword [edx], 0x458d32b1
test al, 0x50
call fcn.1e7a3c46
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.1e7a3bfb
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x1e7a3f24
invalid
invalid

Function at 0x1e7a3ff0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.1e7a3c46
push eax
push esi
push dword [ebp + 8]
call fcn.1e7a3bfb
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
inc ebp
fistp word [ecx - 0x3a]
inc ebp
loopne 0x1e7a40d1

Function at 0x1e7a4080
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
fistp word [ecx - 0x3a]
inc ebp
loopne 0x1e7a40d1
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.1e7a3c46
push eax
push esi
push dword [ebp + 8]
call fcn.1e7a3bfb
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.1e7a3c36
into
cmp bl, byte [esi + 0x46]
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
pop ebx

Function at 0x1e7a40e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ebx
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
invalid
inc ebp
invalid
Function at 0x1e7a42d0
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x1e7a42ea
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
dec ebp
or byte [ebx], bh
retf 0x3f73
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x1e7a42cf
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x1e7a42d7
cmp edx, ebx
jne 0x1e7a4425
ror dword [edi], cl
test dword [esi + 1], ecx
add byte [eax], al
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x1e7a42a6
add eax, dword [eax + 4]
jmp 0x1e7a4293
mov dword [ebp + 0xc], ebx
jmp 0x1e7a42f5

Function at 0x1e7a4360
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1e7a430d
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1e7a432b
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1e7a4389
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
adc byte [eax], al
add byte [eax], al
invalid
adc byte [eax], al
add byte [eax], al
or byte [ebx - 0x2cc4e7b3], 0x74
add al, 0x80
or al, 8
add dword [ecx], edi
pop ebp
or byte [esp + eax - 0x80], dh
or al, 8
add bh, byte [ecx]
pop ebp
adc byte [ebp + eax + 3], dh
enter 0x980, 4
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1e7a4370
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1e7a4379
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1e7a4383
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1e7a4365
inc dword [ebp + 0xc]
invalid
test dword [eax - 1], edi

Function at 0x1e7a44f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx

Function at 0x1e7a4510
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
inc dword [ebx]
Function at 0x1e7a4930
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ecx], al
add byte [eax], al
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
invalid
invalid
invalid
invalid

Function at 0x1e7a4b20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
stosd dword es:[edi], eax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0

Function at 0x1e7a4b40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.1e7a3c14
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
popfd
cld
invalid
jmp dword [esi]
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
invalid
invalid
invalid
cld
invalid
invalid
Function at 0x1e7a5e00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
fdivp st(7)
dec dword [edx - 0x7420b62c]
clc
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.1e7a3c36
invalid

Function at 0x1e7a7500
Capabilities:
Compare security identifiers

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 4], 0x1e7ba2c0
je 0x1e7a751c
mov eax, dword [sym.imp.python27.dll__Py_NotImplementedStruct]
inc dword [eax]
mov eax, dword [sym.imp.python27.dll__Py_NotImplementedStruct]
ret 8
mov eax, dword [eax + 8]
mov ecx, dword [ecx + 8]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov ecx, dword [esp + 8]
cmp ecx, 2
jne 0x1e7a7541
test eax, eax
je 0x1e7a754a
mov eax, dword [sym.imp.python27.dll__Py_TrueStruct]
inc dword [eax]
ret 8
cmp ecx, 3
jne 0x1e7a7554
test eax, eax
je 0x1e7a7537
mov eax, dword [sym.imp.python27.dll__Py_ZeroStruct]
inc dword [eax]
ret 8
mov eax, dword [sym.imp.python27.dll__Py_NotImplementedStruct]
inc dword [eax]
ret 8

Function at 0x1e7a9c90
Capabilities:
Set thread local storage value

Disassembly:
cmp dword [sym.pywintypes27.dll_struct__is__PyWin_InterpreterState], 0
push ebx
mov ebx, dword [sym.imp.python27.dll_Py_FatalError]
push esi
push edi
mov edi, dword [sym.imp.python27.dll_PyThreadState_Swap]
jne 0x1e7a9ccd
push 0
call edi
mov esi, eax
add esp, 4
test esi, esi
jne 0x1e7a9cbf
push str.pywintypes:_can_not_setup_interpreter_state__as_current_state_is_invalid
call ebx
add esp, 4
mov eax, dword [esi + 4]
push esi
mov dword [sym.pywintypes27.dll_struct__is__PyWin_InterpreterState], eax
call edi
add esp, 4
push 8
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
jne 0x1e7a9ce7
push 0x1e7b10fc
call ebx
add esp, 4
mov ecx, dword [0x1e7ba8b8]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0
call edi
push eax
mov dword [esi], eax
call edi
add esp, 8
pop edi
mov dword [esi + 4], 0
pop esi
pop ebx
ret

Function at 0x1e7a9d10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x1e7ba8b8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x1e7a9d7f
push esi
push edi
mov edi, dword [sym.imp.python27.dll_Py_FatalError]
cmp dword [sym.pywintypes27.dll_struct__is__PyWin_InterpreterState], eax
jne 0x1e7a9d3a
push str.Can_not_setup_thread_state__as_have_no_interpreter_state
call edi
add esp, 4
push 8
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
jne 0x1e7a9d54
push str.Out_of_memory_allocating_thread_state.
call edi
add esp, 4
mov ecx, dword [0x1e7ba8b8]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov edx, dword [sym.pywintypes27.dll_struct__is__PyWin_InterpreterState]
push edx
call dword [sym.imp.python27.dll_PyThreadState_New]
add esp, 4
mov dword [esi], eax
mov eax, 1
pop edi
mov dword [esi + 4], eax
pop esi
ret
xor eax, eax
ret
Function at 0x1e7a9dd0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x1e7ba8b8]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x1e7a9e0b
cmp dword [esi + 4], 0
je 0x1e7a9e0b
mov ecx, dword [esi]
push ecx
call dword [sym.imp.python27.dll_PyThreadState_Delete]
mov edx, dword [0x1e7ba8b8]
add esp, 4
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop esi
ret

Function at 0x1e7aac70
Capabilities:
Allocate thread local storage
Link many functions at runtime

Disassembly:
push esi
push 0x1e7b1a38
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
jne 0x1e7aac97
push str.AdvAPI32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x1e7aad49
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.AddAccessAllowedAce
push esi
call edi
test eax, eax
je 0x1e7aacaf
mov dword [0x1e7ba7d0], eax
push str.AddAccessDeniedAce
push esi
call edi
test eax, eax
je 0x1e7aacc0
mov dword [0x1e7ba7d4], eax
push str.AddAccessAllowedAceEx
push esi
call edi
test eax, eax
je 0x1e7aacd1
mov dword [0x1e7ba7d8], eax
push str.AddMandatoryAce
push esi
call edi
test eax, eax
je 0x1e7aace2
mov dword [0x1e7ba7e0], eax
push str.AddAccessAllowedObjectAce
push esi
call edi
test eax, eax
je 0x1e7aacf3
mov dword [0x1e7ba7e4], eax
push str.AddAccessDeniedAceEx
push esi
call edi
test eax, eax
je 0x1e7aad04
mov dword [0x1e7ba7dc], eax
push str.AddAccessDeniedObjectAce
push esi
call edi
test eax, eax
je 0x1e7aad15
mov dword [0x1e7ba7e8], eax
push str.AddAuditAccessAceEx
push esi
call edi
test eax, eax
je 0x1e7aad26
mov dword [0x1e7ba7ec], eax
push str.AddAuditAccessObjectAce
push esi
call edi
test eax, eax
je 0x1e7aad37
mov dword [0x1e7ba7f0], eax
push str.SetSecurityDescriptorControl
push esi
call edi
pop edi
test eax, eax
je 0x1e7aad49
mov dword [0x1e7ba804], eax
mov eax, dword [esp + 0xc]
sub eax, 0
pop esi
je 0x1e7aad76
sub eax, 1
jne 0x1e7aad8d
push 0x1e7ba81c
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1e7ba8b8], eax
mov eax, 1
ret 0xc
push 0x1e7ba81c
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, dword [0x1e7ba8b8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsFree]
mov eax, 1
ret 0xc
Function at 0x1e7ab3a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x1e7ba8b8]
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
xor edi, edi
cmp esi, edi
je 0x1e7ab3dc
cmp dword [esi + 4], edi
je 0x1e7ab3dc
mov ecx, dword [esi]
push ecx
call dword [sym.imp.python27.dll_PyThreadState_Delete]
mov edx, dword [0x1e7ba8b8]
add esp, 4
push edi
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [sym.pywintypes27.dll_struct__object__PyWinExc_ApiError]
mov dword [sym.pywintypes27.dll_struct__is__PyWin_InterpreterState], edi
cmp eax, edi
je 0x1e7ab402
dec dword [eax]
mov eax, dword [sym.pywintypes27.dll_struct__object__PyWinExc_ApiError]
cmp dword [eax], edi
jne 0x1e7ab402
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 0x18]
push eax
call edx
add esp, 4
mov eax, dword [sym.pywintypes27.dll_struct__object__PyWinExc_COMError]
mov dword [sym.pywintypes27.dll_struct__object__PyWinExc_ApiError], edi
cmp eax, edi
je 0x1e7ab428
dec dword [eax]
mov eax, dword [sym.pywintypes27.dll_struct__object__PyWinExc_COMError]
cmp dword [eax], edi
jne 0x1e7ab428
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 0x18]
push eax
call edx
add esp, 4
mov dword [sym.pywintypes27.dll_struct__object__PyWinExc_COMError], edi
pop edi
pop esi
ret
Function at 0x401c30
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x41f1d8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x4262d0]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebp
push esi
push edi
mov eax, dword [0x4262d0]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
xor edi, edi
mov esi, ecx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x401d9b
mov byte [esp + 0x18], al
mov eax, esi
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], edi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401c90
sub eax, edx
push eax
push esi
lea ecx, [esp + 0x1c]
call fcn.004053a0
mov dword [esp + 0x58], edi
mov ecx, dword [esp + 0x28]
xor esi, esi
lea ebp, [esi + 0x10]
cmp ecx, edi
jbe 0x401ce3
cmp esi, ecx
jbe 0x401cc2
call fcn.0040ba7f
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x2c], ebp
jae 0x401cd0
lea eax, [esp + 0x18]
cmp byte [eax + esi], 0x2f
jne 0x401cde
mov byte [eax + esi], 0x5c
mov ecx, dword [esp + 0x28]
inc esi
cmp esi, ecx
jb 0x401cc2
lea esi, [ecx - 1]
cmp esi, ecx
jbe 0x401cef
call fcn.0040ba7f
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x2c], ebp
jae 0x401cfd
lea eax, [esp + 0x18]
cmp byte [eax + esi], 0x5c
je 0x401d13
push 1
push 0x422548
lea eax, [esp + 0x1c]
call fcn.00405290
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
xor edx, edx
mov byte [esp + 0x18], 0x5c
call fcn.00404be0
mov edi, eax
cmp edi, 0xffffffff
je 0x401d88
mov byte [esp + 0x10], 0x5c
push edi
xor ecx, ecx
lea esi, [esp + 0x34]
lea edx, [esp + 0x18]
call fcn.00403c20
mov eax, dword [esp + 0x34]
inc edi
cmp dword [esp + 0x48], ebp
jae 0x401d54
lea eax, [esp + 0x34]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp dword [esp + 0x48], ebp
jb 0x401d70
mov edx, dword [esp + 0x34]
push edx
call fcn.0040ba9a
add esp, 4
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
mov edx, edi
call fcn.00404be0
mov edi, eax
cmp edi, 0xffffffff
jne 0x401d35
cmp dword [esp + 0x2c], ebp
jb 0x401d9b
mov edx, dword [esp + 0x18]
push edx
call fcn.0040ba9a
add esp, 4
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.0040b112
add esp, 0x4c
ret
Function at 0x405610
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x41effb
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4262d0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0040ad62
push 4
mov dword [esp + 0x20], 0
call fcn.0040be65
mov edi, eax
add esp, 4
test edi, edi
je 0x40568e
call fcn.0040ab63
mov dword [edi], eax
call fcn.0040a991
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.0040acb3
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x405683
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.0040acdb
jmp 0x405690
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x4078d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x41f311
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push edi
mov eax, dword [0x4262d0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0xc], ebx
mov eax, dword [0x429608]
mov edi, eax
add eax, 0x1158
mov ecx, esi
mov dword [esp + 0x10], esi
call fcn.00404070
mov dword [esp + 0x38], ebx
push ebx
push 0x422720
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 1
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.004053a0
lea ecx, [edi + 0x1164]
lea eax, [esp + 0x14]
mov dword [esp + 0x38], 1
call fcn.00407350
cmp dword [esp + 0x2c], 0x10
jb 0x40796c
mov eax, dword [esp + 0x18]
push eax
call fcn.0040ba9a
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x30
ret

Function at 0x407980
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xac
mov eax, dword [0x4262d0]
xor eax, esp
mov dword [esp + 0xa8], eax
push edi
push 0x37
lea eax, [esp + 0x79]
push 0
push eax
mov edi, ecx
mov byte [esp + 0x80], 0
call fcn.00413090
push 0x37
lea ecx, [esp + 0x4d]
push 0
push ecx
mov byte [esp + 0x54], 0
call fcn.00413090
mov edx, dword [esi]
mov ax, word [esi + 4]
push 0x37
lea ecx, [esp + 0x21]
push 0
push ecx
mov dword [esp + 0x60], edx
mov word [esp + 0x64], ax
mov byte [esp + 0x28], 0
call fcn.00413090
mov eax, dword [0x422784]
mov edx, dword [0x422780]
mov cx, word [0x422788]
add esp, 0x24
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov word [esp + 0xc], cx
xor eax, eax
mov dl, byte [esp + eax + 4]
xor dl, byte [esp + eax + 0x3c]
inc eax
cmp eax, 6
mov byte [esp + eax + 0x73], dl
jl 0x407a06
push 6
add edi, 0x110
push edi
lea ecx, [esp + 0x7c]
call fcn.00406ca0
mov ecx, dword [esp + 0xac]
pop edi
xor ecx, esp
call fcn.0040b112
add esp, 0xac
ret
Function at 0x408fe0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x41f670
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push edi
mov eax, dword [0x4262d0]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
cmp byte [esi], 2
mov edi, dword [0x429608]
je 0x40909a
xor ebx, ebx
push ebx
push 0x422720
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
call fcn.004053a0
lea ecx, [edi + 0x1164]
lea eax, [esp + 0x10]
mov dword [esp + 0x50], ebx
call fcn.00407350
mov dword [esp + 0x50], 0xffffffff
cmp dword [esp + 0x28], 0x10
jb 0x409064
mov eax, dword [esp + 0x14]
push eax
call fcn.0040ba9a
add esp, 4
lea ecx, [edi + 0x1158]
test ecx, ecx
je 0x409076
lea eax, [edi + 0x1160]
jmp 0x409078
xor eax, eax
push str.The_entry_is_not_a_file.
push eax
call fcn.00405fe0
add esp, 8
xor al, al
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x48
ret
mov ebx, dword [esi + 0x72]
call fcn.00409770
mov edx, dword [0x429620]
sub edx, dword [0x42961c]
je 0x409188
mov ecx, dword [esi + 0x6e]
mov eax, dword [esi + 0x6a]
mov edx, dword [edi]
xor ebx, ebx
push ebx
push ecx
push eax
push edx
call fcn.0040c7c8
mov eax, dword [0x429620]
add esp, 0x10
sub eax, dword [0x42961c]
jne 0x4090dc
call fcn.0040ba7f
mov ecx, dword [edi]
mov edx, dword [esi + 0x72]
mov eax, dword [0x42961c]
push ecx
push edx
push 1
push eax
call fcn.0040c332
add esp, 0x10
cmp eax, dword [esi + 0x72]
je 0x409188
call fcn.00409370
push 0x422720
lea ecx, [esp + 0x30]
call fcn.00403b60
lea ecx, [edi + 0x1164]
lea eax, [esp + 0x2c]
mov dword [esp + 0x50], 1
call fcn.00407350
mov dword [esp + 0x50], 0xffffffff
cmp dword [esp + 0x44], 0x10
jb 0x409142
mov ecx, dword [esp + 0x30]
push ecx
call fcn.0040ba9a
add esp, 4
lea edx, [edi + 0x1158]
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
test edx, edx
je 0x409164
lea eax, [edi + 0x1160]
jmp 0x409166
xor eax, eax
push str.Could_read_all_of_the_file_data.
push eax
call fcn.00405fe0
add esp, 8
xor al, al
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x48
ret
mov al, 1
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x48
ret

Function at 0x40b112
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4262d0]
jne 0x40b11c
repz ret
jmp fcn.0040fcd6