joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4209b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x420a09
test eax, edx
je 0x420a0c
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x4209c7
movzx eax, word [eax]
sub eax, ecx
jmp 0x4209ee
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [eax + ecx]
xor ebx, dword [edx + ecx]
jne 0x4209ef
add ecx, 4
js 0x4209df
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x4209ec
movzx eax, word [eax + ecx]
movzx edx, word [edx + ecx]
sub eax, edx
pop ebx
pop ebx
jmp 0x4209ee
xor eax, eax
ret
test eax, eax
je 0x420a18
test edx, edx
jne 0x4209b8
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x426440
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x426479
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.0040a0fc
jmp 0x426482
mov eax, ebx
mov edx, esi
call fcn.0040a354
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x42648c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov edi, ecx
mov esi, edx
mov ebx, eax
push 3
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x4264b0
movzx eax, word [esp]
jmp 0x4264b2
mov eax, edi
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4281a8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x4282cf
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.00427fb0
mov esi, eax
mov eax, dword [0x4dae90]
cmp byte [eax], 0
je 0x428275
mov eax, dword [0x4dacc0]
call fcn.0040799c
call fcn.00406f48
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x428178]
call fcn.0040cdf4
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x4282e8
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
jmp 0x4282b1
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x4dac7c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4de634]
call fcn.0040d4c4
push eax
call sub.user32.dll_LoadStringW
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4282d6
lea eax, [ebp - 4]
mov edx, dword [0x428178]
call fcn.0040cf18
pop eax
jmp eax

Function at 0x42a6c4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.0040a444
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.00410140
mov edi, eax
cmp edi, 0x104
jbe 0x42a66f
mov eax, edi
add eax, eax
call fcn.00406dd0
mov esi, eax
jmp 0x42a671
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.00410140
push esi
call sub.user32.dll_CharUpperW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x42a6aa
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x42a694
mov eax, esp
cmp esi, eax
je 0x42a6b7
mov eax, esi
call fcn.00406dec
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x42a6f0
cmp bl, 0
je 0x42a6ec
cmp bl, 0x41
jl 0x42a6e7
cmp bl, 0x5a
jg 0x42a6e7
or bl, 0x20
xor al, bl
inc esi
jmp 0x42a6cb
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x42a630

Function at 0x42b00c
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, ecx
mov word [esp], 0
push 0x400
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW
mov eax, ebx
mov edx, esp
mov ecx, 0x400
call fcn.0040aa64
add esp, 0x800
pop ebx
ret
Function at 0x42b580
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff800
mov esi, edx
mov edi, eax
mov eax, esi
call fcn.00409f64
push 0x400
lea eax, [esp + 4]
push eax
mov eax, edi
call fcn.0040a9c8
mov ebp, eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableW
mov ebx, eax
cmp ebx, 0x400
jge 0x42b5c5
mov edx, esp
mov eax, esi
mov ecx, ebx
call fcn.0040a0fc
jmp 0x42b5de
mov edx, ebx
dec edx
mov eax, esi
call fcn.0040ab3c
push ebx
mov eax, dword [esi]
call fcn.0040a9c8
push eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableW
add esp, 0x800
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x42d824
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x42d842
mov eax, dword [eax - 4]
lea ebx, [edi + esi]
cmp eax, ebx
jg 0x42d85a
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x42d855
mov eax, dword [eax - 4]
mov dword [ebp - 8], eax
jmp 0x42d85f
add edi, esi
mov dword [ebp - 8], edi
movzx eax, word [ebp + 0x14]
cmp ax, word [ebp + 0x10]
je 0x42d8cd
xor eax, eax
mov dword [ebp - 0xc], eax
cmp esi, dword [ebp - 8]
jge 0x42d916
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x14]
jne 0x42d88b
inc dword [ebp - 0xc]
jmp 0x42d8a3
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x10]
jne 0x42d8a3
cmp dword [ebp - 0xc], 0
jle 0x42d8a3
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
jne 0x42d8c5
xor eax, eax
jmp 0x42d8c1
movzx edi, word [edx + eax*2]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
cmp di, word [ebx + esi*2]
jne 0x42d8c0
mov eax, esi
jmp 0x42d919
inc eax
cmp eax, ecx
jle 0x42d8ad
inc esi
cmp esi, dword [ebp - 8]
jl 0x42d877
jmp 0x42d916
mov byte [ebp - 0xd], 0
cmp esi, dword [ebp - 8]
jge 0x42d916
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x14]
jne 0x42d8ee
movzx eax, byte [ebp - 0xd]
xor al, 1
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
jne 0x42d910
xor eax, eax
jmp 0x42d90c
movzx edi, word [edx + eax*2]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
cmp di, word [ebx + esi*2]
jne 0x42d90b
mov eax, esi
jmp 0x42d919
inc eax
cmp eax, ecx
jle 0x42d8f8
inc esi
cmp esi, dword [ebp - 8]
jl 0x42d8d6
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x42db08
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov word [ebp - 0xa], cx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x42db25
mov eax, dword [eax - 4]
mov esi, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x42db33
mov eax, dword [eax - 4]
mov ebx, eax
sub ebx, dword [ebp + 8]
sub ebx, esi
inc ebx
cmp dword [ebp + 8], 0
jl 0x42dc55
test ebx, ebx
jl 0x42dc55
test esi, esi
jle 0x42dc55
mov eax, dword [ebp - 8]
call fcn.0040a9c8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040a9c8
mov ecx, eax
mov eax, dword [ebp + 8]
add eax, eax
add ecx, eax
movzx eax, word [ebp - 0xa]
cmp ax, word [ebp + 0xc]
je 0x42dbf2
xor eax, eax
mov dword [ebp - 0x14], eax
test ebx, ebx
jl 0x42dc55
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x42dbd7
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x42dba6
inc dword [ebp - 0x14]
jmp 0x42dbb6
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp + 0xc]
jne 0x42dbb6
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0
jle 0x42dbc1
or eax, 0xffffffff
jmp 0x42dbd7
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x42dbd4
inc eax
jmp 0x42dbd7
or eax, 0xffffffff
test eax, eax
jl 0x42dbdf
cmp esi, eax
jg 0x42db94
cmp esi, eax
jg 0x42dbea
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x42dc58
inc edx
dec dword [ebp - 0x1c]
jne 0x42db90
jmp 0x42dc55
mov byte [ebp - 0x15], 0
test ebx, ebx
jl 0x42dc55
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x42dc3c
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x42dc1b
movzx ebx, byte [ebp - 0x15]
xor bl, 1
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x42dc26
or eax, 0xffffffff
jmp 0x42dc3c
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x42dc39
inc eax
jmp 0x42dc3c
or eax, 0xffffffff
test eax, eax
jl 0x42dc44
cmp esi, eax
jg 0x42dc04
cmp esi, eax
jg 0x42dc4f
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x42dc58
inc edx
dec dword [ebp - 0x1c]
jne 0x42dc00
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x43de74
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x43de7c
mov eax, edx
pop esi
pop ebx
ret

Function at 0x440af0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
add edx, eax
cmp edx, eax
jbe 0x440b07
movzx ebx, byte [eax]
xor ecx, ebx
imul ecx, ecx, 0x1000193
inc eax
cmp edx, eax
ja 0x440af7
mov eax, ecx
pop ebx
ret
Function at 0x454fc4
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
test dl, dl
je 0x454fd8
add esp, 0xfffffff0
call fcn.0040877c
mov ebx, edx
mov esi, eax
mov dl, 1
mov eax, dword [0x44ef48]
call fcn.00473a30
mov dword [esi + 4], eax
mov dl, 1
mov eax, dword [0x453f94]
call fcn.004767e4
mov dword [esi + 8], eax
mov dl, 1
mov eax, dword [0x453f94]
call fcn.004767e4
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x20]
mov dword [esi + 0x10], eax
mov eax, esi
test bl, bl
je 0x45502d
call fcn.004087d4
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b890c
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
or dl, byte [ebx + 0xd]
je 0x4b894f
cmp byte [ebx + 0x11], 0
jne 0x4b894f
cmp byte [ebx + 0x24], 0
jne 0x4b894f
mov byte [ebx + 0xf], 0
mov byte [ebx + 0xd], 0
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x4b8966
mov ecx, dword [0x4dae44]
mov dl, 1
mov eax, dword [0x48b784]
call fcn.00428434
call fcn.0040964c
pop ebx
ret
mov ecx, dword [0x4dae44]
mov dl, 1
mov eax, dword [0x48b784]
call fcn.00428434
call fcn.0040964c
pop ebx
ret

Function at 0x4b92d4
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x4b9322
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.004b87b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b933b
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4b9344
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.004b87b8
dec esi
jne 0x4b9366
mov byte [ebx + 0xf], 0
pop esi
pop ebx
ret
Function at 0x4d6d24
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov eax, 0x4d1b00
call fcn.00411304
xor eax, eax
push ebp
push 0x4d6e03
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4d6dd0
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0x18]
mov eax, 0x4d6e20
call fcn.0042b580
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00429ae4
mov edx, dword [ebp - 0x14]
mov eax, 0x4e18b0
mov ecx, dword [0x4dabc4]
call fcn.0040ac18
mov eax, 0x4e18b4
mov edx, 0x4d6e38
call fcn.0040a354
mov edx, dword [0x4e18b0]
mov eax, dword [0x4e18b4]
call fcn.004d1a8c
test al, al
je 0x4d6dc6
push 0
push 0
push 0
mov eax, dword [0x4e18b0]
call fcn.0040a9c8
push eax
push 0x4d6e74
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d6de6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d6e0a
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00409fc4
pop eax
jmp eax
Function at 0x401520
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push eax
mov eax, 0x4048
call fcn.00402960
sub esp, eax
lea ebx, [ebp - 0x4018]
lea edi, [ebp - 0x401c]
mov eax, dword [esp + eax]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x2000
mov dword [esp], ebx
call sym.__vsnwprintf
mov dword [esp], 0xfffffff5
mov esi, eax
call sym._GetStdHandle_4
sub esp, 4
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym._WriteConsoleW_20
sub esp, 0x14
test eax, eax
je 0x4015a0
mov edx, dword [ebp - 0x401c]
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x4034], eax
call sym._GetConsoleOutputCP_0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._WideCharToMultiByte_32
sub esp, 0x20
mov dword [ebp - 0x402c], eax
mov ecx, dword fs:[0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ecx + 0x30]
mov dword [ebp - 0x4038], ecx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sym._HeapAlloc_12
mov edx, dword [ebp - 0x4034]
sub esp, 0xc
test eax, eax
mov dword [ebp - 0x4030], eax
je 0x401594
call sym._GetConsoleOutputCP_0
mov ecx, dword [ebp - 0x4030]
mov edx, dword [ebp - 0x402c]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._WideCharToMultiByte_32
sub esp, 0x20
mov dword [esp], 0xfffffff5
call sym._GetStdHandle_4
mov edx, dword [ebp - 0x402c]
sub esp, 4
mov dword [esp + 0xc], edi
mov edi, dword [ebp - 0x4030]
mov dword [esp + 8], edx
mov dword [esp + 0x10], 0
mov dword [esp + 4], edi
mov dword [esp], eax
call sym._WriteFile_20
mov ecx, dword [ebp - 0x4038]
sub esp, 0x14
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sym._HeapFree_12
sub esp, 0xc
jmp 0x40158e
Function at 0x4017b0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x40
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
cmp esi, 1
jle 0x401860
mov dword [esp + 8], 2
mov dword [esp + 4], global_slashHelpW
mov eax, dword [ebx + 4]
mov dword [esp], eax
call sym._wcsncmp
test eax, eax
je 0x40184a
mov eax, dword [ebx + 4]
mov edx, 1
cmp word [eax], 0x2d
jne 0x401840
movzx eax, word [eax + 2]
cmp ax, 0x3f
je 0x40184a
cmp ax, 0x73
je 0x401830
mov dword [esp + 4], eax
mov dword [esp], 0x66
call dbg.hostname_message_printfW
mov eax, 0x65
call dbg.hostname_message
lea esp, [ebp - 8]
mov eax, 1
pop ebx
pop esi
pop ebp
ret
add edx, 1
cmp edx, esi
je 0x401860
mov eax, dword [ebx + edx*4]
cmp word [eax], 0x2d
je 0x4017f4
mov eax, 0x68
call dbg.hostname_message
mov eax, 0x65
call dbg.hostname_message
lea esp, [ebp - 8]
mov eax, 1
pop ebx
pop esi
pop ebp
ret
lea eax, [ebp - 0x2c]
lea ebx, [ebp - 0x28]
mov dword [ebp - 0x2c], 0x10
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._GetComputerNameW_8
sub esp, 8
test eax, eax
je 0x4018a0
mov dword [esp + 4], ebx
mov dword [esp], str._s_r_n
call dbg.hostname_printfW
lea esp, [ebp - 8]
xor eax, eax
pop ebx
pop esi
pop ebp
ret
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp], 0x67
mov dword [esp + 4], eax
call dbg.hostname_message_printfW
lea esp, [ebp - 8]
mov eax, 1
pop ebx
pop esi
pop ebp
ret
Function at 0x401e10
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x4053a0]
test esi, esi
jle 0x401f20
mov edi, dword [0x4053a4]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x401e44
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x401ec5
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x401e30
mov dword [esp], eax
mov ebx, eax
call dbg.__mingw_GetSectionForAddress
test eax, eax
mov edi, eax
je 0x401f47
mov eax, dword [0x4053a4]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
add eax, dword [edi + 0xc]
mov edx, dword [0x4053a4]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401f27
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x401ebe
sub eax, 4
and eax, 0xfffffffb
jne 0x401ed0
add dword [0x4053a0], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
add ebx, dword [0x4053a4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401ebe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, [esi]
xor esi, esi
jmp 0x401e4e
mov eax, dword [0x4053a4]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
nop

Function at 0x402380
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4053b8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4053b0]
sub esp, 4
test ebx, ebx
je 0x4023d5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4023ce
test esi, esi
je 0x4023ce
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4023b0
mov dword [esp], 0x4053b8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402a30
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
invalid
Function at 0x4027da
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push 0
push 0x400000
call fcn.004015ac
mov dword [0x414040], eax
cmp dword [0x414014], 0
jne 0x403e75
push eax
call dword [sym.imp.MSVCR110_CLR0400.dll_exit]
push esi
mov esi, ecx
call dword [sym.imp.ole32.dll_CoReleaseServerProcess]
test eax, eax
jne 0x401692
mov dword [esi + 4], 1
pop esi
ret
call 0x40171c
push 0x14
push 0x402908
call fcn.00402010
and dword [ebp - 0x20], 0
call sub.MSVCR110_CLR0400.dll___crtGetShowWindowMode
movzx ebx, ax
and dword [ebp - 4], 0
mov eax, dword fs:[0x18]
mov edx, dword [eax + 4]
xor edi, edi
mov esi, 0x414148
mov ecx, edx
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0x403dd8
xor esi, esi
inc esi
cmp dword [0x41414c], esi
je 0x403dea
cmp dword [0x41414c], 0
jne 0x402931
mov dword [0x41414c], esi
push 0x402904
push 0x4028f0
call sub.MSVCR110_CLR0400.dll__initterm_e
pop ecx
pop ecx
test eax, eax
jne 0x403df7
cmp dword [0x41414c], esi
jne 0x402879
push 0x4028ec
push 0x4028cc
call sub.MSVCR110_CLR0400.dll__initterm
pop ecx
pop ecx
mov dword [0x41414c], 2
test edi, edi
jne 0x402886
xor eax, eax
mov ecx, 0x414148
xchg dword [ecx], eax
cmp dword [0x414158], 0
jne 0x403e08
mov eax, dword [sym.imp.MSVCR110_CLR0400.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x1c], esi
mov edi, dword [ebp - 0x20]
mov cl, byte [esi]
cmp cl, 0x20
jbe 0x402924
cmp cl, 0x22
je 0x403e2c
movzx eax, cl
push eax
call dword [sym.imp.MSVCR110_CLR0400.dll__ismbblead]
pop ecx
test eax, eax
jne 0x403e3d
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x4028a0
test cl, cl
je 0x40293c
test edi, edi
je 0x40293c
jmp 0x4028a7
mov dword [0x414268], esi
jmp 0x402856
mov al, byte [esi]
test al, al
je 0x401657
cmp al, 0x20
ja 0x401657
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x40293c
cmp eax, edx
jne 0x40280b
xor esi, esi
inc esi
mov edi, esi
jmp 0x40281e
push 0x1f
call sub.MSVCR110_CLR0400.dll__amsg_exit
pop ecx
jmp 0x402856
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x403e90
push 0x414158
call fcn.0040f0a8
pop ecx
test eax, eax
je 0x402893
push 0
push 2
push 0
call dword [0x414158]
jmp 0x402893
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [ebp - 0x20], edi
jmp 0x4028b0
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x4028c3
cmp dword [0x414268], 0
jne 0x403e89
call dword [sym.imp.MSVCR110_CLR0400.dll__cexit]
mov eax, dword [0x414040]
mov dword [ebp - 4], 0xfffffffe
call fcn.004017d6
ret
Function at 0x401000
Capabilities:
Allocate thread local storage

Disassembly:
push 0x30
push 0
push 0x40c744
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleW
mov dword [0x40c748], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x40c744], eax
mov eax, 0x40b8c0
mov dword [0x40c750], eax
call fcn.00402235
call fcn.00408210
call fcn.004079a0
call fcn.004073c0
call fcn.00406f39
call fcn.00406ac1
call fcn.00406441
call fcn.00405e86
call fcn.00405be0
call fcn.00403d1c
call fcn.004035c0
call fcn.00402e19
call fcn.004029f2
call fcn.004029de
call fcn.0040291a
call fcn.004028a9
call fcn.004027d0
call fcn.004022ee
mov dword [0x40c758], 0
mov edx, dword [0x40c880]
push edx
push edx
mov edx, dword [0x40c880]
push edx
push edx
call fcn.00406470
mov edx, dword [0x40b8e0]
add dword [esp], edx
call fcn.00406c3d
push 0x40c75c
call fcn.00408290
call fcn.00401a83
push 0
jmp 0x4010eb
call 0x401105
call fcn.00408260
push dword [0x40c744]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess