joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1046bc75
Capabilities:
Encode data using xor

Disassembly:
dec eax
sub ebp, 4
mov ecx, 0x91b35f39
dec esp
lea ebp, [ecx*8 + 0x7f3f7ea9]
inc esp
mov ebx, dword [ebp]
inc ebp
xor ebx, ecx
movsx edi, cl
dec eax
mov dword [esp + edi*2 - 0x72], edi
dec eax
mov dword [esp + edi*2 - 0x72], 0x98db79a
inc ecx
dec ebx
dec eax
xor dword [esp + edi - 0x39], ecx
sar word [esp + edi*4 - 0xe1], 0xaa
sal byte [esp + edi*4 - 0xe4], 0x87
inc ecx
neg ebx
sub byte [esp + edi - 0x34], 0x2e
inc esp
sbb byte [esp + edi - 0x33], ch
inc ecx
not ebx
inc eax
rol bh, 0xa7
inc ecx
neg ebx
call fcn.10369bbc
dec esi
cmp eax, 0xb9356cc4
add eax, 0x6a5414cc
pop ecx
jne 0x1046bc91
test byte [edx + ebp*2 + 0x59], dl
and eax, 0x6a549c85
pop ecx
jge 0x1046bcf6
lodsb al, byte [esi]
push esp
push 0x59
lodsd eax, dword [esi]
popfd
aam 0x54
push 0x59
push ebp
xchg ebp, eax
cld
push esp
push 0x59
pop ebp
add al, 0x8c
push esp
push 0x59
lea eax, [ebx + ebx*4 - 0x55]
pop ds
add byte [ebp - 0x31], bh
out 0x2f, eax
mov bh, 0xc0
push ecx
inc esp
mov dh, 0xef
add byte [eax], al
add byte [eax], al
add dword [edx], 0xcdbcaf3c
dec edx
in al, 0xa7
mov ecx, 0xe13a3733
or al, 0x7d
push edx
mov bh, 0x12
loope 0x1046bd3c
jge 0x1046bd7c
punpckhdq mm4, mm1
or al, 0x7d
mov byte [0xce15a07], al
jge 0x1046bd58
out dx, eax
inc edx
loope 0x1046bd4e
jge 0x1046bd0f
outsd dx, dword [esi]
shl cl, cl
or al, 0x7d
xor eax, dword [edi + 0x7d0ce102]
sub byte [ecx + 0x5bc5e6b6], 0xa8
adc dword [ebp + esi - 0x47], ebp
nop
fldenv [ecx + 0x596a54]
dec ecx
loope 0x1046bdb8
jge 0x1046bcd2
test eax, 0x5bc5e6b6
test al, 0x11
insb byte es:[edi], dx
xor eax, 0xa1d990b9
push esp
push 0x59
add byte [ecx - 0x1f], cl
push esp
push 0x59
inc eax
adc byte [ecx + 0x28596a54], ch
or ecx, eax
push esp
push 0x59
rol byte [eax + 0x29], 0x54
push 0x59
dec eax
loope 0x1046bde4
push esp
push 0x59
dec eax
cwde
popal
push esp
push 0x59
mov al, byte [0x1fab26b8]
add al, bl
add ch, byte [edx]
das
mov bh, 0xc0
pushfd
inc esp
mov dh, 0xef
out dx, eax
add byte [eax], al
add byte [eax], al
dec esp
add bh, byte [edi + ebp*4]
jno 0x1046bdbe
xlatb
in al, 0xa7
mov ecx, 0xe1df9247
or al, 0x7d
cmpsb byte [esi], byte es:[edi]
mov byte [0x7d0ce19f], al
not dword [edx + 0x7d0ce177]
lahf
loope 0x1046bdb9
jge 0x1046bda6
xchg edx, eax
ja 0x1046bd93
or al, 0x7d
outsb dx, byte [esi]
sub bl, byte [edi]
loope 0x1046bdc5
or al, 0x7d
out dx, eax
jge 0x1046bdaa
cli
push edi
loope 0x1046bdcb
or al, 0x7d
push ds
jge 0x1046bddf
cmp dl, byte [edi]
loope 0x1046bdd1
jge 0x1046bd8d
adc ah, byte [edi - 0x3882f31f]
jge 0x1046bd94
sub al, 0xb6
out 0xc5, al
ljmp 0xd61e:0xe9b5641f
push eax
sahf
push esi
jg 0x1046be36
sahf
invalid
dec edi
pushal
xlatb
inc edx
lcall 0xa0be, 0xc36a3918
sub ch, al
movd mm7, dword [eax]
and edi, dword [eax]
add dword [edx], edi
and esi, ecx
cmp ch, dh
movsd dword es:[edi], dword [esi]
sbb dword [edx + 0x46], esp
in eax, 0x19
invalid
Function at 0x10473ac6
Capabilities:
Encode data using base64

Disassembly:
not eax
sar edx, 0x70
inc ecx
lea eax, [eax + ecx + 0x4ee62d7e]
sbb ecx, ecx
sub dx, dx
lea edx, [edx + edx*8 - 0x446b7cd1]
xor ebx, eax
inc ecx
add esi, eax
mov eax, dword [ecx + ebp]
inc cl
or ecx, 0xbc33dd0e
adc ebp, 4
movzx ecx, byte [edi]
add edi, 1
xor cl, bl
sar dx, 0xc6
adc edx, edx
btr edx, 0x95
not cl
setae dl
sar edx, 0xac
dec cl
btc edx, 0x84
sar edx, 0xb0
neg cl
ror cl, 1
inc edx
sub dx, dx
call fcn.1036dd18
mov dword [ebp - 4], eax
ja 0x104786f9
call fcn.104ae2a0
mov edx, 0x88371be
mov eax, dword [edx + edi - 0x88371be]
ror edx, 0x72
not dx
sbb edx, edx
adc edi, 3
lea ecx, [edx*4 + 0x40396daf]
shr cx, 0x46
add dx, cx
xor eax, ebx
sar dx, 0x69
ror eax, 3
not eax
xor eax, 0x9248713
ror eax, 3
rol edx, 0x9c
jae 0x10320df1
mov eax, ebp
push 0xcf246e20
rol dword [esp], 0x6a
mov dword [esp + 4], 0x82320685
adc eax, edx
sar dword [esp + 1], 0x87
not byte [esp + 6]
js 0x10439254
mov cs, ebp
and byte [esi], 0xf0
pop ds
inc ebx
push edx
jp 0x10473b21
and byte [ecx + 0x1b], cl
mov bl, 0x3a
sub al, 0x20
dec ecx
sbb eax, dword [edx + 0x49202c0a]
sub edi, ebx
ret 0x202c
int1
dec ebp
sar bh, cl
invalid

Function at 0x10480db8
Capabilities:
Encode data using base64

Disassembly:
dec ebx
lea esp, [esp + 4]
jne 0x1047870a

Function at 0x10482ca4
Capabilities:
Encode data using base64

Disassembly:
jle 0x102db21a
mov edx, dword [edx + ecx - 0x33f5]
mov dword [ebp - 4], edx
shl byte [esp + 6], 0x21
movzx edx, word [esp]
mov ecx, dword [edx + ebp - 0x33f9]
movsx edi, dl
not dword [esp + edx - 0x33f1]
sub word [esp + edx*2 - 0x67ea], dx
mov edi, ecx
pop esi
mov esi, ebp
pop ecx
jp 0x1036cbd6
mov cx, word [ecx + edx - 0x821e300]
sbb ebp, 2
mov word [ebp], cx
mov ecx, dword [edi]
and dword [esp], eax
xor dword [esp], 0xc5abb9be
lea eax, [eax + eax*4 + 0x36bc823a]
adc edi, 4
mov edx, dword [esp]
not dword [esp + edx - 0x58bb9be]
ror edx, 0x65
xor ecx, ebx
neg ecx
xor ecx, 0x5696ec1f
lea eax, [edx*4 - 0x336056ed]
div dl
dec ecx
imul dword [esp]
bswap eax
neg ecx
imul al
rol ecx, 1
bt dx, ax
neg dx
and al, 0x19
inc ecx
xor ebx, ecx
and dword [esp + eax*2 - 0x51f21822], 0xe2341b90
adc esi, ecx
push eax
or edx, dword [esp + edx - 0x27cfe24]
pop ecx
pop ecx
jne fcn.1044af2a
xor eax, 0x469adbba
not eax
neg eax
bswap eax
rol eax, 2
neg cx
neg eax
mov dword [esp + edx*8 - 0x51811c48], edx
not eax
xor ebx, eax
rol dword [esp + edx - 0xa302389], 0x4e
cmovb ecx, dword [esp + edx*2 - 0x14604712]
neg dl
lea ebp, [edx + ebp - 0xa30237b]
adc byte [esp + edx - 0xa302377], dh
mov dword [ebp + edx*2 - 0x146046ee], eax
neg dx
pop eax
jne fcn.104769e1
movzx edx, byte [edi]
mov ecx, 0x33067e23
lea edi, [ecx + edi - 0x33067e22]
bt ecx, ecx
setae cl
movzx eax, cx
xor dl, bl
add cx, 0x9e94
shl eax, cl
ror dl, 1
cbw
div cl
not dl
bt cx, cx
neg ecx
rol dl, 1
bts ecx, eax
idiv cl
push eax
neg dl
and ecx, 0x3b27e311
xor bl, dl
or byte [esp + ecx*2 - 0x1043c5ff], al
setns cl
lea edx, [esp + edx + 4]
ja 0x102d9ecf
call fcn.1037091a
Function at 0x1048afde
Capabilities:
Encode data using xor

Disassembly:
dec dl
mov dword [esp + ecx - 0x4324ca51], eax
ror dl, 1
inc al
shr dword [esp + ecx - 0x4324ca51], 0x37
dec dl
and ax, cx
seta al
add cl, ah
not dl
not ecx
xor bl, dl
shr cl, 0x24
btr ecx, 0x8d
bt eax, ecx
lea edx, [esp + edx + 4]
cbw
adc byte [esp], al
mov cx, word [edx]
jo 0x103a6d50
sbb word [esp + 1], ax
sbb ebp, 2
xor word [esp + 2], ax
movzx edx, al
xor eax, 0x9c3a620a
mov word [ebp + edx*2 - 2], cx
pop eax
jae fcn.104769e1

Function at 0x1048b729
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
mov word [ebp], dx
mov eax, ecx
sar eax, 4
movzx edx, cl
pop edx
pop ecx
pop edx
pop eax
jae fcn.104769e1
sysenter
call fcn.103f715c
not eax
xor eax, 0x2ebad2a9
neg eax
xor ebx, eax
add ebp, eax
movsx eax, dx
lea eax, [ecx + ecx*8 + 0x37b6b903]
jmp ebp

Function at 0x104909e1
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
mov dword [esp + 4], eax
dec ebx
push 0x4a173b8
lea esp, [esp + 8]
jne 0x103da5a5

Function at 0x10491256
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
call fcn.104b655c
mov dword [esp], esi
mov esi, 0x908c0918
add esi, esi
bt si, si
movzx esi, byte [ecx + esi*2 - 0x42302460]
call fcn.1048eb5f
add eax, edx
mov dword [esp], 0x76226e25
inc dword [esp]
push 0x43b577b8
mov dword [ebp - 4], eax
test ebx, ebx
lea esp, [esp + 8]
je 0x104b3c90
mov eax, 0x3ba9af0d
shr eax, 0xfd
mov eax, dword [ebp + ebx*4]
jnp 0x103a38d8
push 0xbda8c7a7
call fcn.1038cb92
jmp fcn.103497f4

Function at 0x1049493f
Capabilities:
Encode data using xor

Disassembly:
mov byte ss:[ecx + eax - 0x3f175000], dl
xor word [esp + ecx*2 - 0x7e2ea000], cx
inc word [esp + ecx*2 - 0x7e2ea000]
mov ecx, dword [edi + ecx*2 - 0x7e2ea000]
adc edi, 4
mov eax, 0x41b68789
xor ecx, ebx
mov edx, eax
inc ecx
sub dl, byte [esp + edx - 0x41b68789]
pop edx
bswap ecx
sbb al, 0x21
dec edx
rol ecx, 2
rol eax, 0x7a
jb 0x1043799a
jne 0x1041ec94
mov edx, 0xb2b23c83
mov ecx, dword [edi]
add edi, 4
inc dl
xor ecx, ebx
dec dx
sub edx, edx
movzx eax, dl
lea ecx, [ecx + edx*2 - 0x20245281]
setb dl
bswap edx
sal edx, 0x5c
rol ecx, 1
xor dl, dl
lea ecx, [edx + ecx - 0x77895789]
call fcn.1035de43
adc edi, 3
div ecx
mov ecx, 0x8326512
mov dword [esp + ecx*4 - 0x20c99448], 0x2800692f
neg byte [esp + ecx - 0x8326511]
mov dword [ecx + edi - 0x8326512], edx
call fcn.102ce17d
mov eax, dword [esi]
mov ecx, 0x3f17ff8a
push ecx
sar dword [esp + ecx - 0x3f17ff8a], cl
mov dl, byte [esi + ecx - 0x3f17ff86]
rol word [esp + ecx - 0x3f17ff89], 0x8c
shl cx, 0xab
lea esi, [esi + ecx - 0x3f174ffa]
jae 0x104435a5
mov eax, dword [edi]
mov edx, 0xc8be3089
movzx ecx, dx
neg dx
lea edi, [edi + ecx*8 - 0x18444]
or edx, 0x9512adbe
xor eax, ebx
dec eax
push edx
neg eax
not byte [esp + ecx - 0x3086]
not eax
jmp 0x103c3bb2
Function at 0x1049fe88
Capabilities:
Execute anti-debugging instructions

Disassembly:
xadd dword [esp + eax*4], ecx
add esi, edx
bts ax, cx
pop ecx
jae fcn.1044af2a
not edx
not ecx
sar edx, 0xd8
add dl, dh
ror eax, 0xa4
neg ecx
bswap ecx
rol ecx, 2
ror dx, 0xef
cdq
btr eax, 0x98
neg ecx
not eax
not ecx
bt edx, edx
setb dl
ror al, 0x64
xor ebx, ecx
dec eax
lea ebp, [ebp + edx*8 - 4]
mov dword [ebp + edx*2], ecx
push edx
xor edx, dword [esi + edx*4]
lea ecx, [eax + eax*2 + 0xd8cde12]
lea esi, [esi + ecx*2 - 0x1b195eba]
btc ecx, eax
xor edx, ebx
jmp 0x103b7a44
neg ecx
xor edx, 0xdd87cfaf
rol edx, cl
and cl, ch
dec edx
xchg byte [esp + 3], cl
pop eax
not edx
xor ebx, edx
lea eax, [ecx + 0x7588ef04]
bts ecx, ecx
sub eax, eax
adc edi, edx
imul eax
or dx, 0x58aa
jg fcn.104769e1
ror edx, 1
sar eax, 0x43
bswap edx
dec edx
xor ebx, edx
jmp 0x1033a206
mov eax, dword [ebp]
mov edx, 0xb58cf5b3
xadd byte [esp + 5], dh
inc dx
adc ebp, 3
mov ecx, edx
bt cx, 0xa6
mov dword [esp], 0xe99b4d29
xor eax, ebx
dec byte [esp + 4]
xor eax, 0xc7b08d0b
dec eax
sal ecx, cl
not eax
add dx, dx
or cx, 0x4e3d
jns 0x1033599b
mov edx, 0xf4898536
movzx ecx, dl
mov eax, ebp
inc ecx
lea ebp, [ebp + ecx*8 - 0x1bc]
mov dword [ebp + ecx*8 - 0x1b8], eax
movzx eax, dx
cdq
or edx, dword [edi + edx*2]
ror al, 0xe4
sbb ecx, eax
lea edi, [edi + eax - 0x855f]
sub cl, 0xc
push eax
rol dword [esp + eax - 0x8563], 0x6c
xor edx, ebx
xor eax, eax
neg edx
btr ecx, 0x8f
jae 0x1045c34f
mov ecx, 0xbf96cb19
movzx eax, cl
lea edx, [eax + eax*4 + 0x30fb423]
mov ecx, dword [esi + eax*2 - 0x32]
not ax
lea esi, [esi + eax*8 - 0x7ff2c]
xor ecx, ebx
shl ax, 0xc6
btc edx, edx
dec ecx
cbw
xor ecx, 0x469adbba
jmp 0x1039f17c

Function at 0x104a747f
Capabilities:
Encode data using xor

Disassembly:
call fcn.104b543e
xor edx, edx
test ecx, ecx
push 0x248e2398
lea esp, [esp + 0x10]
je 0x102be90c
push esi

Function at 0x104a990b
Capabilities:
Encode data using xor

Disassembly:
and ecx, dword [esp + 0x1c]
pop ecx
pop edx
pop edx
pop edx
pop edx
pop edx
pop ecx
pop ecx
jbe fcn.10440eae
sub eax, 0x30cefd6c
mov bh, 0xb8
pop esp
popal
salc
xor al, 0xa7
mov eax, 0x5a9e615c
scasd eax, dword es:[edi]
mov eax, 0x6c9e615c
xchg edi, eax
xchg edx, eax
sbb al, 0x6f
rcr edi, 1
mov dh, byte [edx - 0x4e]
dec edi
sti
dec ecx
invalid
Function at 0x104b0e9d
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0x423ee9f
sbb edi, 7
mov dword [edi + 0xc], eax
mov eax, dword [esp]
mov dword [edi + eax*4 - 0x108fba74], ebx
mov dword [eax + edi - 0x423ee9b], ecx
movzx ecx, word [esp + eax - 0x423ee9f]
shl cl, 0x81
inc ecx
mov dword [edi + eax*2 - 0x847dd3e], edx
cdq
cmovns ecx, dword [esp + eax - 0x423ee9f]
shl al, 4
mov ebx, dword [esp + eax*2 - 0x847dddc]
or cl, ah
mov ecx, dword [eax + ebp - 0x423eef0]
inc dl
mul dl
and dl, dl
lea ebp, [eax + ebp - 0x42300ec]
xor ecx, ebx
or dx, ax
mov dword [esp + eax - 0x42300ec], 0x65aa95a6
inc ecx
inc dx
shr dword [esp + eax*2 - 0x84601dc], 0xa7
neg ecx
bswap ecx
add ecx, 0xb7076e02
mov dword [esp + eax - 0x42300f0], 0xfc9de294
push edx
sar ax, 0x41
xor ebx, ecx
ror edx, 0x13
xor dx, dx
xchg word [esp + eax - 0x423006f], ax
adc esi, ecx
mul byte [esp + eax*2 - 0x84796a6]
pop ecx
pop eax
pop edx
jb fcn.10315919
jb 0x10475962

Function at 0x104b0eb3
Capabilities:
Encode data using base64

Disassembly:
mov esi, 0x13b3a2ba
bswap esi
push esi
mov dword [esp + 0xc], 0x81f092a
mov esi, dword [esp + 8]
call fcn.1046b01b
test cx, sp
Function at 0x104b2911
Capabilities:
Encode data using xor

Disassembly:
sbb ecx, 0x8c9fd09e
call fcn.1032c968
jnp 0x104a9194
inc ecx
mov esi, 0xc7b8b03b
dec eax
sub ebp, 4
inc cx
dec esi
inc ebp
movzx ebp, si
inc ecx
mov eax, dword [ebp + ebp - 0xb03a]
inc ecx
xor eax, ecx
xor eax, 0x6618cc1e
dec ebp
xadd ebp, esi
inc ebp
movsx eax, si
inc ecx
movsx esi, bp
ror eax, 3
inc eax
dec dh
lea eax, [eax + esi*8 + 0x37b3ca20]
neg eax
inc ecx
push ecx
dec ecx
lea ecx, [eax + 0x461461a8]
xor dword [esp + esi*2 - 0xc0e6], eax
inc ebp
movsx ebx, ax
dec esi
lea esp, [ebx*4 - 0x69686bee]
inc ecx
pop ecx
dec edx
lea edi, [eax*2 + 0x511dcf86]
inc ebp
movzx edx, bl
dec ecx
ror ebx, cl
dec eax
arpl ax, ax
dec eax
dec esi
dec eax
adc ebx, eax
inc ebp
or bl, dl
call fcn.10331179
inc ebp
xchg cl, ch
dec esi
mov ebp, dword [esp + ebp*4 - 0x10]
dec esi
mov edx, dword [esp + edx*2 - 0xb5d4]
dec edx
mov edx, dword [esp + ecx + 0x34]
call fcn.10325d5c
sub esi, 4
neg cx
mov ecx, dword [edi - 6]
mov eax, 0x6811eebf
imul eax, eax
not eax
lea edi, [eax + edi - 0x3bfa4d84]
sbb eax, eax
xor ecx, ebx
mov edx, 0x39bcadb9
btr eax, 0x8b
jb 0x1031dc25
mov byte [0x46141e30], al
invalid

Function at 0x104b37f0
Capabilities:
Encode data using base64

Disassembly:
dec eax
sub byte [esp + edx*2 - 0x6044010d], 0xb6
dec cl
xor ebx, eax
add esi, eax
movzx eax, dx
neg cx
pop edx
jns fcn.1044af2a
mov edx, 0xb78cf908
mov cx, word [edi]
lea eax, [edx + edx*4 + 0x318dcfb9]
shr dx, 0xa6
lea edi, [edi + edx - 0x604408a]
mov dword [esp + edx - 0x604408e], edx
sets dl
setnp dl
xor eax, ebx
inc dx
ror edx, 0xdd
neg eax
ror eax, 1
bswap eax
or ecx, 0x192a49a7
btc edx, ecx
jae 0x102e8f8c
jmp 0x103b6bf0

Function at 0x104b399c
Capabilities:
Encode data using base64

Disassembly:
push dword [esp + 0x10]
popfd
lea esp, [esp + 0x1c]
call fcn.1046d00f

Function at 0x104b3c74
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov dword [esp], 0xa70d061b
shr byte [esp + 3], 0x25
dec ebx
not dword [esp]
lea esp, [esp + 4]
jne 0x10491279
Function at 0x104b685e
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
xor cl, bl
xadd dx, ax
dec cl
ror cl, 1
push eax
dec cl
imul edx, eax
not cl
bts ax, 0x8c
ror byte [esp + eax*2 - 0xab15], 0xe6
bts edx, 0x90
xor bl, cl
sar eax, 0xf1
sar dword [esp + eax*4 + 4], 0x97
sub eax, 0x5b30729d
lea ecx, [esp + ecx + 8]
add dx, ax
mov dx, word [ecx]
mov ecx, eax
ja 0x103bafe4
inc byte [esp + 7]
sbb ebp, 1
mov word [ebp], dx
pop eax
pop edx
jmp fcn.104769e1
btc edx, 0x9a
xor ebx, eax
and ecx, 0x53a759af
lea edx, [edx*8 + 0x40aa8b8d]
lea edx, [ecx + ecx*2 + 0x32ae0639]
adc edi, eax
movzx ax, byte [edx + ebp - 0x2da41337]
sub ecx, ecx
setp dl
mov dl, byte [ebp + ecx*8 + 2]
shr ecx, 0xbb
xchg ch, cl
not cx
lea ebp, [ebp + ecx*2 - 0x1fffc]
and ecx, 0x14a82195
shr cl, 0x82
not al
sal ecx, cl
js 0x10329d0f
dec ecx
not dl
or al, dl
mov edx, 0xb7be9dbd
or ecx, 0x4a9ee832
mov word [ecx + ebp - 0x4a9eecbf], ax
lea eax, [edx*8 - 0x6c61e7ff]
jmp edi
movzx ecx, dl
btr eax, edx
mov cl, byte [esi + eax - 0x70f3]
mov dword [esp + eax - 0x70f3], eax
add dl, byte [esp + eax*2 - 0xe1e5]
lea esi, [esi + eax*2 - 0xe1e5]
rol edx, 0x74
jnp 0x103977e9
inc ecx
and edi, ebp
into
push eax
ret
pop edx
jae fcn.104769e1
je 0x104ad646
mov dword [esp + ecx*2 - 0x82], esi
ret

Function at 0x104ba32f
Capabilities:
Encode data using base64

Disassembly:
push 0x11a6f3a2
sal byte [esp + 0xf], 0x61
test ecx, ecx
push 0xe8b4ebab
jmp 0x103b671c
Function at 0x40b801
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x411a00
cmp edx, dword [eax]
je 0x40b823
add eax, 8
inc ecx
cmp eax, 0x411a90
jl 0x40b814
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x411a00]
jne 0x40b951
mov eax, dword [0x41911c]
cmp eax, 1
je 0x40b92b
test eax, eax
jne 0x40b854
cmp dword [0x411488], 1
je 0x40b92b
cmp edx, 0xfc
je 0x40b951
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40b88b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00408740
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00408910
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40b8ce
lea eax, [ebp - 0x1a4]
push eax
call fcn.00408910
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x41050c
push edi
call fcn.00408fa0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00408740
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00408750
lea eax, [ebp - 0xa0]
push 0x4104ec
push eax
call fcn.00408750
push dword [esi + 0x411a04]
lea eax, [ebp - 0xa0]
push eax
call fcn.00408750
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040e2c6
add esp, 0x2c
pop edi
jmp 0x40b951
lea eax, [ebp + 8]
lea esi, [esi + 0x411a04]
push 0
push eax
push dword [esi]
call fcn.00408910
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x401000
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ebp, esp
add esp, 0xfffffffc
push esi
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
mov dword [0x403cdc], eax
lea ecx, [ebp - 4]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov eax, dword [ebp + 4]
mov dword [0x403b2d], eax
xor eax, eax
mov ecx, 0x16
push eax
dec ecx
jne 0x401031
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
lea ecx, [ebp - 0x5c]
push ecx
mov eax, 0x30
mov dword [ecx], eax
mov eax, dword [0x403b2d]
mov dword [ebp - 0x48], eax
mov eax, 0x40168b
mov dword [ebp - 0x54], eax
mov ecx, str.Hello
mov dword [ebp - 0x34], ecx
call dword [sym.imp.USER32.dll_RegisterClassExA]
xor ecx, ecx
push ecx
push dword [0x403b2d]
push ecx
push ecx
push 0x12e
push 0x7a
push 0x34c
push 0x2aa
push 0x40000
lea eax, str.klavesn
push eax
mov eax, str.Hello
push eax
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x403d28], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x403d28]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor ebx, ebx
lea edi, [ebp - 0x50]
jmp 0x4010ce
push edi
call dword [sym.imp.USER32.dll_TranslateMessage]
push edi
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.USER32.dll_GetMessageA]
test al, al
jne 0x4010c0
mov esp, ebp
ret
Function at 0x401a20
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.00401a80

Function at 0x401a80
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x4053e0]
test esi, esi
jle 0x401b6d
mov edi, dword [0x4053e4]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x401ab4
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x401b66
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x401aa0
mov dword [esp], eax
mov ebx, eax
call fcn.004023b0
test eax, eax
mov edi, eax
je 0x401baa
lea ebx, [esi + esi*2]
mov esi, dword [0x4053e4]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call fcn.004024b0
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x4053e4]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401b8a
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x401b5f
sub eax, 0x40
and eax, 0xffffffbf
je 0x401b5f
mov eax, dword [esp + 0x20]
add ebx, dword [0x4053e4]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x401b74
add dword [0x4053e0], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor esi, esi
jmp 0x401abe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00401a20
mov eax, dword [0x4053e4]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00401a20
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00401a20
lea esi, [esi]
Function at 0x402020
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4053f8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4053f0]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x402075
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40206e
test esi, esi
je 0x40206e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402050
mov dword [esp], 0x4053f8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4022d0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x402308
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x4022fe
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40230a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x4022f0
xor eax, eax
pop ebx
pop esi
ret