joyce8/EMBER2024-capa huggingface dataset:
Function at 0x445f80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x47c740
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x49a6f0]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
mov eax, dword [0x49a6f0]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, dword [ecx]
xor edx, edx
push 1
push 0x49b9c0
push edx
mov dword [esp + 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x38], edx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], edx
push eax
lea edx, [esp + 0x1c]
mov dword [esp + 0x34], eax
push edx
mov edx, dword [esi + 0x80]
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x2c], vtable.CryptoPP::ArraySink.0
mov dword [esp + 0x30], vtable.CryptoPP::ArraySink.1.0
call edx
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.0045b0e4
mov esp, ebp
pop ebp
ret 8

Function at 0x4463f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x47c710
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x49a6f0]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [0x49a6f0]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
xor edx, edx
push 1
mov dword [esp + 0x20], eax
mov dword [esp + 8], eax
push 0x49b9c0
lea eax, [esp + 0xc]
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], edx
mov dword [esp + 0x10], edx
mov edx, dword [ecx]
mov edx, dword [edx + 0x7c]
push eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], vtable.CryptoPP::ArraySink.0
mov dword [esp + 0x20], vtable.CryptoPP::ArraySink.1.0
call edx
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.0045b0e4
mov esp, ebp
pop ebp
ret 8

Function at 0x449340
Capabilities:
Generate random numbers via winapi

Disassembly:
push 0xffffffffffffffff
push 0x47b568
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x49a6f0]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
call fcn.00449610
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x60]
mov eax, dword [eax]
push ecx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x4493c5
push 0xe
push 0x48838c
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], eax
mov byte [esp + 0x10], al
call fcn.00402ed0
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x5c], 0
call fcn.004490f0
push 0x492eb8
lea edx, [esp + 0x24]
push edx
call fcn.0045cbab
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
add esp, 0x54
ret 8
Function at 0x449840
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x47c638
mov eax, dword fs:[0]
push eax
sub esp, 0x60
push ebx
push esi
push edi
mov eax, dword [0x49a6f0]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov edx, dword [eax + 4]
lea ecx, [esp + 0x13]
push ecx
push 0x49ddd4
push str.InsertLineBreaks
mov ecx, esi
call edx
test al, al
mov bl, byte [esp + 0x13]
jne 0x449893
mov bl, 1
mov eax, dword [esi]
mov edx, dword [eax + 4]
lea ecx, [esp + 0x14]
push ecx
push 0x49c9bc
push str.MaxLineLength
mov ecx, esi
call edx
test al, al
mov eax, dword [esp + 0x14]
jne 0x4498b8
mov eax, 0x48
test bl, bl
mov esi, 0x483d18
jne 0x4498c6
mov esi, 0x483c32
neg bl
mov dword [esp + 0x20], 6
mov dword [esp + 0x14], 0x4861a0
sbb ebx, ebx
and ebx, eax
lea eax, [esp + 0x54]
mov dword [esp + 0x18], ebx
mov ebx, dword [edi + 0x44]
push eax
call fcn.004079a0
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0x3c]
push ecx
mov dword [esp + 0x7c], 0
call fcn.004079a0
mov esi, eax
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x34]
push eax
mov ecx, str.EncodingLookupArray
mov byte [esp + 0x80], 1
call fcn.00449a60
add esp, 8
mov byte [esp + 0x78], 2
movzx ecx, byte [eax + 8]
push ecx
push str.PaddingByte
mov edi, eax
call fcn.00449bb0
movzx edx, byte [eax + 8]
push edx
lea ecx, [esp + 0x1c]
push ecx
push str.GroupSize
mov edi, eax
call fcn.00413ff0
movzx edx, byte [eax + 8]
push edx
push esi
push str.Separator
mov edi, eax
call fcn.0040e8c0
movzx ecx, byte [eax + 8]
mov edx, dword [esp + 0x1c]
push ecx
push edx
push str.Terminator
mov edi, eax
call fcn.0040e8c0
push 1
lea ecx, [esp + 0x24]
push ecx
push str.Log2Base
mov edi, eax
call fcn.00413ff0
mov edx, dword [ebp + 8]
mov dword [esp + 0x28], edx
mov dword [esp + 0x24], vtable.CryptoPP::CombinedNameValuePairs.0
mov dword [esp + 0x2c], eax
mov eax, dword [ebx]
mov edx, dword [eax + 0x28]
push 0xffffffffffffffff
lea ecx, [esp + 0x28]
push ecx
mov ecx, ebx
call edx
mov byte [esp + 0x78], 1
mov ecx, dword [esp + 0x34]
test ecx, ecx
je 0x4499c3
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov edi, dword [esp + 0x50]
mov ecx, dword [esp + 0x4c]
mov edx, edi
xor al, al
push edx
rep stosb byte es:[edi], al
call fcn.0045bd1b
mov edi, dword [esp + 0x6c]
mov ecx, dword [esp + 0x68]
mov edx, edi
xor al, al
push edx
rep stosb byte es:[edi], al
call fcn.0045bd1b
add esp, 8
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x449a60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x47c431
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x49a6f0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x2c]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], vtable.CryptoPP::AlgorithmParameters.0
mov dword [esp + 0x14], 0
mov byte [esp + 0x18], 1
mov eax, dword [esp + 0x30]
push eax
push ecx
lea edi, [esp + 0x18]
mov dword [esp + 0x2c], 1
call fcn.00449b00
push eax
push esi
call fcn.00446910
mov byte [esp + 0x24], 0
mov ecx, dword [esp + 0x14]
test ecx, ecx
mov dword [esp + 0xc], 1
je 0x449ae1
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret
Function at 0x4548b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x47c431
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x49a6f0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x2c]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], vtable.CryptoPP::AlgorithmParameters.0
mov dword [esp + 0x14], 0
mov byte [esp + 0x18], 1
mov eax, dword [esp + 0x30]
push 1
push eax
lea edi, [esp + 0x18]
mov dword [esp + 0x2c], 1
call fcn.00441660
push eax
push esi
call fcn.00446910
mov byte [esp + 0x24], 0
mov ecx, dword [esp + 0x14]
test ecx, ecx
mov dword [esp + 0xc], 1
je 0x454932
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret
Function at 0x45b0e4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x49a6f0]
jne 0x45b0ee
repz ret
jmp fcn.00460da5

Function at 0x461298
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x49a720]
je 0x4612b3
inc edi
cmp edi, 0x17
jb 0x4612a4
cmp edi, 0x17
jae 0x461433
push ebp
push 3
call fcn.004702a0
cmp eax, 1
pop ecx
je 0x4613ff
push 3
call fcn.004702a0
test eax, eax
pop ecx
jne 0x4612e7
cmp dword [0x49a530], 1
je 0x4613ff
cmp ebx, 0xfc
je 0x461432
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x49fc48
push ebp
call fcn.0045fe59
add esp, 0xc
test eax, eax
je 0x46131d
push esi
push esi
push esi
push esi
push esi
call fcn.0045b137
add esp, 0x14
push 0x104
mov esi, 0x49fc61
push esi
push 0
mov byte [0x49fd65], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x461361
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0045fe59
add esp, 0xc
test eax, eax
je 0x461361
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0045b137
add esp, 0x14
push esi
call fcn.0045cb20
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x4613a6
push esi
call fcn.0045cb20
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x49ff5c
push 0x482484
sub ecx, eax
push ecx
push eax
call fcn.00467b7b
add esp, 0x14
test eax, eax
je 0x4613a6
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0045b137
add esp, 0x14
jmp 0x4613a8
xor esi, esi
push 0x482480
push ebx
push ebp
call fcn.00467b0a
add esp, 0xc
test eax, eax
je 0x4613c8
push esi
push esi
push esi
push esi
push esi
call fcn.0045b137
add esp, 0x14
push dword [edi*8 + 0x49a724]
push ebx
push ebp
call fcn.00467b0a
add esp, 0xc
test eax, eax
je 0x4613ea
push esi
push esi
push esi
push esi
push esi
call fcn.0045b137
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.004700e3
add esp, 0xc
jmp 0x461432
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x461432
cmp ebp, 0xffffffff
je 0x461432
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x49a724]
push dword [esi]
call fcn.0045cb20
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4700e3
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0045ff98
xor ebx, ebx
cmp dword [0x4a027c], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x4701b9
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x470299
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x470299
push eax
call fcn.0045ff2a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4a027c], eax
call esi
push eax
call fcn.0045ff2a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4a0280], eax
call esi
push eax
call fcn.0045ff2a
mov dword [0x4a0284], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00460663
test eax, eax
pop ecx
pop ecx
je 0x470187
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0045b137
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x4701b9
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0045ff2a
cmp eax, ebx
pop ecx
mov dword [0x4a028c], eax
je 0x4701b9
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0045ff2a
pop ecx
mov dword [0x4a0288], eax
mov eax, dword [0x4a0288]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x47023e
cmp dword [0x4a028c], ecx
je 0x47023e
push eax
call fcn.0045ffa1
push dword [0x4a028c]
mov esi, eax
call fcn.0045ffa1
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x47023e
cmp edi, ebx
je 0x47023e
call esi
cmp eax, ebx
je 0x47020b
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x47020b
test byte [ebp - 0x18], 1
jne 0x47023e
lea eax, [ebp - 0x10]
push eax
call fcn.0046069a
test eax, eax
pop ecx
je 0x470226
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0045b137
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x470235
or dword [ebp + 0x10], 0x200000
jmp 0x470279
or dword [ebp + 0x10], 0x40000
jmp 0x470279
mov eax, dword [0x4a0280]
cmp eax, dword [ebp - 8]
je 0x470279
push eax
call fcn.0045ffa1
cmp eax, ebx
pop ecx
je 0x470279
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x470279
mov eax, dword [0x4a0284]
cmp eax, dword [ebp - 8]
je 0x470279
push eax
call fcn.0045ffa1
cmp eax, ebx
pop ecx
je 0x470279
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4a027c]
call fcn.0045ffa1
cmp eax, ebx
pop ecx
je 0x470299
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x47029b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1005ae5
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
cmp byte [ecx], al
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], eax
je 0x1005b1b
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x1005b1f
xor eax, eax
jmp 0x1005b35
mov eax, dword [ebp - 8]
push 0x400
imul eax, dword [ebp - 0xc]
push dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
leave
ret 4

Function at 0x1005cb0
Capabilities:
Enumerate pe sections

Disassembly:
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x1005ce6
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x1005ccd
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x1005cde
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x1005ce8
inc edi
add eax, 0x28
cmp edi, esi
jb 0x1005cc3
xor eax, eax
pop edi
pop esi
ret
Function at 0x41c500
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x427850], 0
jne 0x41c581
cmp dword [0x427870], 0
jne 0x41c530
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x427870], eax
test eax, eax
jne 0x41c530
push str.GetEnvironmentStrings_failed
call fcn.0041bd1c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x427870]
jmp 0x41c544
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c53c
lea edi, [ebp + 1]
push edi
call fcn.004161a8
pop ecx
mov ebx, eax
mov dword [0x427854], ebx
test ebx, ebx
jne 0x41c56e
xor eax, eax
jmp 0x41c644
push edi
mov edx, dword [0x427870]
push edx
push ebx
call fcn.00416754
add esp, 0xc
jmp 0x41c5a1
xor esi, esi
mov ebx, dword [0x427850]
jmp 0x41c59b
push eax
call fcn.004168a4
pop ecx
test eax, eax
jne 0x41c597
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c58b
lea ebx, [esi + 4]
push 4
mov dword [0x427858], ebx
inc ebx
push ebx
call fcn.00415c80
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x41c5c4
xor eax, eax
jmp 0x41c644
cmp dword [0x427850], 0
jne 0x41c5f5
xor esi, esi
mov ebx, dword [0x427854]
mov eax, dword [esp]
mov ebp, eax
jmp 0x41c5e6
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c5dc
jmp 0x41c626
xor esi, esi
mov ebx, dword [0x427850]
mov eax, dword [esp]
mov edi, eax
jmp 0x41c620
push eax
call fcn.004168a4
pop ecx
test eax, eax
je 0x41c615
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x41c619
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c604
mov eax, dword [0x427850]
test eax, eax
je 0x41c636
push eax
call fcn.004161b8
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x427850], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x7ffe548d
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x30]
call 0x7ffe5498
pop edx
xor dx, dx
add edx, 0xd5e0
xor ecx, ecx
mov cl, 0x1e
xor byte [ecx + edx], 0x88
loop 0x7ffe54a6
push dword fs:[0x24]
pop dword [edx + 0xa]
mov cl, 0xff
push edx
loop 0x7ffe54b8
mov dword [edx + 0x11], 0xffffacbb
mov ecx, dword [eax + 0x2c]
mov dword [edx + 0x1b], ecx
mov dword [edx + 0x100], ecx
mov dword [eax + 0x2c], esp
push 0
push 0
lea esp, [esp]
push 0
clc
nop
push 0
clc
push 0x30
push 0x20
pushal
inc eax
popal
push 0
clc
cld
push 0
nop
add edx, 0xffff7f35
push edx
push edx
cdq
pop edx
push edx
nop
stc
push 0
cld
call dword [edx + 0x820e]
add esp, 0x3f8
push es
pop ds
stc
xor eax, eax
cld
nop
inc eax
cld
ret 0xc
Function at 0x401fd0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.004080a0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.004080a0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x402030
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x40d074]
test esi, esi
jle 0x402150
mov eax, dword [0x40d078]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x402064
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x4020e7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x402050
mov dword [esp], ebx
call fcn.00402a20
mov edi, eax
test eax, eax
je 0x402177
mov eax, dword [0x40d078]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00402b60
mov edx, dword [0x40d078]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x402157
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x4020e0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x4020f0
add dword [0x40d074], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x40d078]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4020e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00401fd0
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x40206e
mov eax, dword [0x40d078]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00401fd0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00401fd0
lea esi, [esi]
nop
Function at 0x402690
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x40d090
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x40d088]
sub esp, 4
test ebx, ebx
je 0x4026e5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4026de
test esi, esi
je 0x4026de
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4026c0
mov dword [esp], 0x40d090
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x402a20
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x402a45
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x402a50
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x402a45
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x402a98
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x402a8e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x402a9a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x402a80
xor eax, eax
pop ebx
pop esi
ret
Function at 0x4048b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edx, dword [ecx + 0x81c130]
lea esi, [eax + 0x14]
mov ebx, 0x14
mov eax, dword [esi]
xor al, al
je 0x4048dd
mov ecx, dword [eax]
push eax
xor eax, 0x8bd7ff28
push es
sub dword [edi + esi + 0x6c], 0xffffffc0
jne 0x4048cd
adc dword [esi + 4], 0x4b
jne 0x4048c7
fcom qword [ebp - 0x70]
push edx
call edi
add esp, 0x41
pop edi
rcr dword [ebx - 0x24], 1
ret 4

Function at 0x40b13f
Capabilities:
Read file on windows

Disassembly:
dec ebp
adc byte [ebp + 0x518a468b], dh
or dword [edx + 0x50], edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test esp, esp
add al, 0x29
xor eax, eax
jmp 0x40b285
mov cl, 0x1a
out dx, al
inc dword [edx]
cmp al, 0
add byte [edi], dl
adc cl, byte [ebx + 0x558b144d]
adc byte [ebx + 0x5f], bl
xchg ebx, eax
ja 0x40b259
inc edx
add bl, bh
adc dword [esi + 0x5d], ebx
ret
mov edx, dword [ebp + 0x10]
pop ebx
out 0xe5, al
jle 0x40b28c
add dword [eax], eax
movsd dword es:[edi], dword [esi]
adc dword [esi + 0x5d], ebx
ret
mov dh, 0x4d
adc byte [0x8bfb75c9], bh
and eax, 0x10018b14
mov esp, dword [0x10018b14]
pop ebx
pop edi
mov eax, 0x9a117e
mov dword [edx - 0x70], ecx
xor ebx, esp
call 0xd2c5bef9
je 0x40b233
mov dl, byte [esi + 8]
test dl, dl
jne 0x40b2bd
mov edx, dword [esi + 0x50]
add edx, ecx
mov ecx, dword [esi + 0x54]
adc ecx, 0xffffffbf
mov dword [esi + 0x31], edx
test byte [esi + 0x54], 0x8b
dec ebp
adc al, 0x8b
push ebp
jg 0x40b2b6
mov edi, 0xf6315689
dec esi
push esp
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x7f]
push cs
push cs
mov dword [ecx], edx
jb 0x40b326
leave
nop
nop
nop
nop
nop
nop
sal byte [edi + ebp - 0x75], 0x45
cld