joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c7473
Capabilities:
Get number of processors

Disassembly:
jmp 0x100bb794
call fcn.100bb77f
salc
arpl word [ebp - 0x79], cx
loop 0x100bb78a
adc eax, 0x24748b56
add al, 0x8d
mov dh, 0xd4
adc byte [edx], al
add byte [ecx + 0x5e042474], cl
push edx
mov dword [esp], ebp
push esp
pop ebp
push ebp
mov ebp, esp
add ebp, 4
sub ebp, 0x80
xchg dword [esp], ebp
pop esp
sub esp, 4
mov dword [esp], ebx
push edi
mov dword [esp], esi
push 0x188b
mov dword [esp], edi
jmp 0x100e13b3
push ebx
mov ebx, 8
add ebx, ebp
mov eax, dword [ebx]
pop ebx
sub esp, 4
mov dword [esp], eax
jmp 0x100da1dd
jmp 0x100c6476
push 0
push 0x41797261
push 0x7262694c
push 0x64616f4c
lea ecx, [ebp - 0x2c]
sub esp, 4
mov dword [esp], ecx
jmp 0x100d5856
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x1983f]
mov dword [esp + 4], ecx
pop ecx
jmp 0x100dde32
jmp 0x100d586d
call fcn.100d5858
adc byte [eax - 0x77], dl
loopne 0x100d587c
add al, 0
add byte [eax], al
add eax, 4
xchg dword [esp], eax
pop esp
rol byte [edi + eax*4], 4
and al, 0x5c
push eax
pop dword [ebp - 4]
push ecx
mov ecx, 0xc
add ecx, ebp
mov eax, dword [ecx]
pop ecx
push esi
mov dword [esp], eax
push dword [ebp - 4]
sub dword [esp], 0x3f8325ed
pop ecx
add ecx, 0x3f8325ed
push esi
mov dword [esp], ecx
push eax
mov eax, 8
add eax, ebp
mov edx, dword [eax]
pop eax
push eax
mov eax, 0x64
add edx, eax
pop eax
push ebx
mov dword [esp], edx
jmp 0x100bb77d
jmp 0x100da1f4
call fcn.100da1df
or eax, dword [ebp + 0x68]
mov byte [eax], 0
jmp 0x100bbbce
push esi
mov esi, 0x6114390f
xor esi, 0x61143917
mov eax, esi
pop esi
mov eax, dword fs:[eax]
push eax
pop dword [ebp - 4]
push dword [ebp - 4]
pop eax
push dword [eax + 0x30]
sub dword [esp], 0x63f80c4b
pop ecx
add ecx, 0x63f80c4b
push eax
mov eax, 0xfffffff8
add eax, ebp
mov dword [eax], ecx
pop eax
push dword [ebp - 8]
pop edx
push ecx
mov ecx, 8
add ecx, edx
mov eax, dword [ecx]
pop ecx
push edx
mov edx, 0xffffffec
add edx, ebp
mov dword [edx], eax
pop edx
push ebx
mov ebx, 0
mov dword [ebp - 0x10], ebx
pop ebx
cmp dword [ebp - 0x10], 0
je 0x100bc698
jmp 0x100bd265

Function at 0x100e66f2
Capabilities:
Access peb ldr_data

Disassembly:
push eax
mov eax, dword [esp + 4]
lea eax, [eax - 0x4e23]
mov dword [esp + 4], eax
pop eax
jmp 0x100d5a70

Function at 0x103faab7
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], ecx
cmp eax, 0x1000
lea ecx, [esp + 8]
jb 0x103fab15
jmp 0x103faad4
push ebx
mov ebx, 0x1000
sub ecx, ebx
pop ebx
push esi
mov esi, 0x42603735
add esi, 0x62b848ad
not esi
xor esi, 0xa3b2af6
xor esi, 0x5731f4a
shr esi, 4
xor esi, 0x55aeb5a
sub eax, esi
pop esi
test dword [ecx], eax
cmp eax, 0x1000
jae 0x103faad4
jmp 0x103fab15
sub ecx, 0x42861a21
sub ecx, eax
add ecx, 0x42861a21
push esp
pop eax
test dword [ecx], eax
mov esp, ecx
push dword [eax]
pop ecx
push dword [eax + 4]
xor dword [esp], 0x1d9f7243
pop eax
xor eax, 0x1d9f7243
push ecx
mov dword [esp], eax
ret
Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43200c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0xf2e5cec
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
nop
mov ecx, 0x2f032563
nop
nop
nop
nop
test eax, eax
nop
je 0x432084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401610
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x6c
mov ebx, dword [esp + 0x80]
mov esi, dword [esp + 0x84]
mov eax, dword [ebx]
test eax, eax
je 0x401790
mov edi, dword [ebx + 4]
mov eax, dword [esi + 4]
mov ebp, dword [sym.imp.WS2_32.dll_ntohl]
mov dword [esp], eax
call ebp
sub esp, 4
add edi, eax
mov dword [esp + 4], edi
mov dword [esp + 8], 0
mov eax, dword [ebx]
mov dword [esp], eax
call sub.msvcrt.dll_fseek
mov eax, dword [esi + 8]
mov dword [esp], eax
call ebp
sub esp, 4
mov dword [esp], eax
call sub.msvcrt.dll_malloc
test eax, eax
mov edi, eax
je 0x4017e0
mov edx, dword [ebx]
mov eax, dword [esi + 8]
mov dword [esp + 0x1c], edx
mov dword [esp], eax
call ebp
sub esp, 4
mov edx, dword [esp + 0x1c]
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov dword [esp], edi
mov dword [esp + 0xc], edx
call sub.msvcrt.dll_fread
test eax, eax
je 0x4017c5
cmp byte [esi + 0x10], 1
je 0x4016d1
mov eax, dword [ebx]
test eax, eax
je 0x4016c7
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov dword [ebx], 0
add esp, 0x6c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.00408980
mov eax, dword [esi + 0xc]
mov dword [esp], eax
call ebp
sub esp, 4
mov dword [esp], eax
call sub.msvcrt.dll_malloc
test eax, eax
mov dword [esp + 0x1c], eax
je 0x401845
mov eax, dword [esi + 8]
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x28], edi
mov dword [esp], eax
call ebp
sub esp, 4
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x34], eax
mov eax, dword [esi + 0xc]
mov dword [esp], eax
call ebp
sub esp, 4
lea ebp, [esp + 0x28]
mov dword [esp + 8], 0x38
mov dword [esp + 4], 0x40c0ab
mov dword [esp + 0x38], eax
mov dword [esp], ebp
call fcn.00405da0
test eax, eax
js 0x4017f1
mov dword [esp + 4], 4
mov dword [esp], ebp
call fcn.00405e40
test eax, eax
js 0x40182b
mov dword [esp], ebp
call fcn.00407d80
mov dword [esp], edi
call sub.msvcrt.dll_free
mov edi, dword [esp + 0x1c]
jmp 0x4016b3
lea eax, [ebx + 0x68]
mov dword [esp + 4], 0x40c044
mov dword [esp], eax
call fcn.00403020
test eax, eax
mov dword [ebx], eax
jne 0x40162f
mov dword [esp], str.Cannot_open_archive_file_n
xor edi, edi
call fcn.00401f20
add esp, 0x6c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.Could_not_read_from_file_n
xor edi, edi
call fcn.00401f20
jmp 0x4016c7
mov dword [esp], str.Could_not_allocate_read_buffer_n
call fcn.00401f20
jmp 0x4016c7
mov edx, dword [esp + 0x40]
mov dword [esp + 4], eax
mov dword [esp], str.Error__d_from_inflateInit:__s_n
mov dword [esp + 8], edx
call fcn.00401f20
mov dword [esp], edi
add esi, 0x12
xor edi, edi
call sub.msvcrt.dll_free
mov dword [esp + 4], esi
mov dword [esp], str.Error_decompressing__s_n
call fcn.00401f20
jmp 0x4016c7
mov edx, dword [esp + 0x40]
mov dword [esp + 4], eax
mov dword [esp], str.Error__d_from_inflate:__s_n
mov dword [esp + 8], edx
call fcn.00401f20
jmp 0x401809
mov dword [esp], str.Error_allocating_decompression_buffer_n
call fcn.00401f20
jmp 0x401809
Function at 0x401860
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
mov dword [esp], ebx
mov dword [esp + 4], esi
call fcn.00401610
mov dword [esp], ebx
mov edi, eax
call fcn.00404970
cmp eax, 0xffffffff
je 0x4018e9
lea ebp, [esi + 0x12]
add ebx, 0x2068
mov dword [esp], ebx
mov dword [esp + 4], ebp
call fcn.00404bf0
mov ebx, eax
mov eax, dword [esi + 0xc]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_ntohl]
sub esp, 4
test ebx, ebx
mov esi, eax
je 0x401908
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov dword [esp], edi
call sub.msvcrt.dll_fwrite
cmp eax, 1
je 0x4018d7
test esi, esi
jne 0x4018f1
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
mov dword [esp], edi
call sub.msvcrt.dll_free
xor eax, eax
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], ebp
mov dword [esp], str.Failed_to_write_all_bytes_for__s_n
call fcn.00401ec0
mov eax, 0xffffffff
jmp 0x4018e9
mov dword [esp + 4], ebp
mov dword [esp], str._s_could_not_be_extracted__n
call fcn.00401ec0
mov eax, 0xffffffff
jmp 0x4018e9
Function at 0x404730
Capabilities:
Query environment variable

Disassembly:
push ebx
mov eax, 0x4018
call fcn.0040a990
sub esp, eax
mov eax, dword [esp + 0x4020]
lea ebx, [esp + 0x10]
mov dword [esp + 8], 0
mov dword [esp], 0
mov dword [esp + 4], eax
call fcn.00405490
mov dword [esp + 8], 0x2000
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
sub esp, 0xc
test eax, eax
jne 0x404790
add esp, 0x4018
xor eax, eax
pop ebx
ret
lea eax, [esp + 0x2010]
mov dword [esp + 8], 0x2000
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
sub esp, 0xc
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], 0
call fcn.004052e0
test eax, eax
je 0x40477c
cmp byte [eax], 0
je 0x40477c
mov dword [esp], eax
call sub.msvcrt.dll__strdup
add esp, 0x4018
pop ebx
ret

Function at 0x4047e0
Capabilities:
Set environment variable

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x20]
mov dword [esp + 8], 0
mov dword [esp], 0
mov dword [esp + 4], eax
call fcn.00405490
mov esi, eax
mov eax, dword [esp + 0x24]
mov dword [esp + 8], 0
mov dword [esp], 0
mov dword [esp + 4], eax
call fcn.00405490
mov dword [esp], esi
mov ebx, eax
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
sub esp, 8
mov edi, eax
mov dword [esp], esi
call sub.msvcrt.dll_free
mov dword [esp], ebx
call sub.msvcrt.dll_free
add esp, 0x10
mov eax, edi
pop ebx
pop esi
pop edi
ret

Function at 0x404850
Capabilities:
Set environment variable

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [esp + 0x20]
mov dword [esp + 8], 0
mov dword [esp], 0
mov dword [esp + 4], eax
call fcn.00405490
mov dword [esp + 4], 0
mov ebx, eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
sub esp, 8
mov esi, eax
mov dword [esp], ebx
call sub.msvcrt.dll_free
add esp, 0x14
mov eax, esi
pop ebx
pop esi
ret

Function at 0x4048a0
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
push edi
mov eax, 0x203c
push esi
push ebx
call fcn.0040a990
mov ebx, 5
sub esp, eax
lea edi, [esp + 0x30]
mov dword [esp], 0x1000
mov dword [esp + 4], edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
sub esp, 8
lea esi, [esp + 0x10]
call sub.msvcrt.dll__getpid
mov dword [esp + 8], str._MEI_d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x10
mov dword [esp], esi
call fcn.00404610
mov dword [esp + 4], esi
mov dword [esp], edi
call dword [sym.imp.msvcrt.dll__wtempnam]
mov ebp, eax
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__wmkdir]
test eax, eax
je 0x404930
mov dword [esp], ebp
call sub.msvcrt.dll_free
sub ebx, 1
jne 0x4048f2
add esp, 0x203c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x2050]
mov dword [esp + 4], ebp
mov dword [esp + 8], 0x1000
mov dword [esp], eax
call fcn.004052e0
mov dword [esp], ebp
call sub.msvcrt.dll_free
add esp, 0x203c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4049d0
Capabilities:
Delete directory

Disassembly:
push ebp
push edi
mov eax, 0x445c
push esi
push ebx
call fcn.0040a990
sub esp, eax
mov eax, dword [esp + 0x4470]
mov dword [esp + 8], 0x1000
lea ebp, [esp + 0x44c]
mov dword [esp + 4], eax
lea eax, [esp + 0x244e]
mov dword [esp], eax
call fcn.00405490
lea eax, [esp + 0x244e]
mov dword [esp], ebp
mov dword [esp + 4], eax
call sub.msvcrt.dll_wcscpy
mov dword [esp], ebp
call sub.msvcrt.dll_wcslen
mov esi, eax
mov dword [esp + 0x22c], eax
movzx eax, word [esp + eax*2 + 0x44a]
cmp ax, 0x2f
je 0x404a45
cmp ax, 0x5c
jne 0x404ad1
lea ebx, [esp + 0x230]
mov dword [esp + 4], 0x40d2dc
mov dword [esp], ebp
call sub.msvcrt.dll_wcscat
mov dword [esp + 4], ebx
mov dword [esp], ebp
call dword [sym.imp.msvcrt.dll__wfindfirst]
cmp eax, 0xffffffff
mov dword [esp + 0x228], eax
je 0x404ab6
mov ecx, 0x87
mov edi, esp
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov eax, ebp
mov edx, dword [esp + 0x22c]
call fcn.00404b00
mov eax, dword [esp + 0x228]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__wfindnext]
test eax, eax
je 0x404a75
mov eax, dword [esp + 0x228]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__findclose]
lea eax, [esp + 0x244e]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__wrmdir]
add esp, 0x445c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 0x40d2d8
mov dword [esp], ebp
call sub.msvcrt.dll_wcscat
mov eax, esi
add eax, 1
mov dword [esp + 0x22c], eax
jmp 0x404a45

Function at 0x404b00
Capabilities:
Delete file

Disassembly:
push edi
push esi
push ebx
push eax
mov eax, 0x101c
call fcn.0040a990
sub esp, eax
mov edi, edx
mov eax, dword [esp + eax]
lea ebx, [esp + 0x1044]
mov dword [esp + 4], 0x40d2e0
mov dword [esp], ebx
mov esi, eax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x404b40
add esp, 0x1020
pop ebx
pop esi
pop edi
ret
mov dword [esp + 4], 0x40d2e4
mov dword [esp], ebx
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x404b32
xor eax, eax
mov dword [esp + 4], ebx
mov dword [esp], esi
mov word [esi + edi*2], ax
call sub.msvcrt.dll_wcscat
test byte [esp + 0x1030], 0x10
jne 0x404ba0
mov dword [esp], esi
mov ebx, dword [sym.imp.msvcrt.dll__wremove]
call ebx
test eax, eax
je 0x404b32
mov dword [esp], 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
mov dword [esp], esi
call ebx
jmp 0x404b32
lea ebx, [esp + 0x1f]
mov dword [esp + 8], 0x1000
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.004052e0
mov dword [esp], ebx
call fcn.004049d0
jmp 0x404b32
Function at 0x404bf0
Capabilities:
Create directory

Disassembly:
push ebp
push edi
mov eax, 0x405c
push esi
push ebx
call fcn.0040a990
sub esp, eax
mov eax, dword [esp + 0x4070]
lea ebx, [esp + 0x50]
lea esi, [esp + 0x1050]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcpy
mov eax, dword [esp + 0x4074]
mov dword [esp], esi
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcpy
mov dword [esp + 4], 0x40d2ea
mov dword [esp], esi
call sub.msvcrt.dll_strtok
test eax, eax
je 0x404cf9
mov edi, eax
mov eax, dword [sym.imp.msvcrt.dll__wstat]
lea esi, [esp + 0x2050]
lea ebp, [esp + 0x2c]
mov dword [esp + 0x1c], eax
nop
mov edx, ebx
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x404c62
mov ecx, eax
shr ecx, 0x10
test eax, 0x8080
cmove eax, ecx
lea ecx, [edx + 2]
cmove edx, ecx
mov ecx, eax
add cl, al
sbb edx, 3
sub edx, ebx
lea eax, [ebx + edx + 1]
mov byte [ebx + edx], 0x5c
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
mov dword [esp + 4], 0x40d2ea
mov dword [esp], 0
call sub.msvcrt.dll_strtok
test eax, eax
mov edi, eax
je 0x404d10
mov dword [esp + 8], 0x1000
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.00405490
mov dword [esp + 4], ebp
mov dword [esp], esi
mov eax, dword [esp + 0x1c]
call eax
test eax, eax
jns 0x404c60
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__wmkdir]
jmp 0x404c60
mov eax, dword [sym.imp.msvcrt.dll__wstat]
lea esi, [esp + 0x2050]
lea ebp, [esp + 0x2c]
mov dword [esp + 0x1c], eax
lea esi, [esi]
mov dword [esp + 8], 0x1000
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.00405490
mov dword [esp + 4], ebp
mov dword [esp], esi
mov eax, dword [esp + 0x1c]
call eax
test eax, eax
jne 0x404d45
mov dword [esp + 4], ebx
mov dword [esp], str.WARNING:_file_already_exists_but_should_not:__s_n
call fcn.00401f20
mov dword [esp], ebx
mov dword [esp + 4], 0x40d31d
call fcn.00403020
add esp, 0x405c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x404d60
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push edi
push esi
mov eax, 0x1010
push ebx
call fcn.0040a990
sub esp, eax
mov eax, dword [esp + 0x1020]
mov dword [esp + 4], 0x40d320
mov dword [esp], eax
call fcn.00403020
mov ebx, eax
mov eax, dword [esp + 0x1028]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1024]
mov dword [esp], eax
call fcn.00404bf0
test ebx, ebx
je 0x404e74
test eax, eax
mov edi, eax
je 0x404e74
lea esi, [esp + 0x10]
nop
lea esi, [esi]
mov dword [esp], ebx
call sub.msvcrt.dll_feof
test eax, eax
jne 0x404e70
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], 0x1000
mov dword [esp], esi
call sub.msvcrt.dll_fread
cmp eax, 0xffffffff
je 0x404e50
mov dword [esp + 0xc], edi
mov dword [esp + 8], 1
mov dword [esp + 4], 0x1000
mov dword [esp], esi
call sub.msvcrt.dll_fwrite
test eax, eax
jle 0x404e1d
mov dword [esp], edi
call sub.msvcrt.dll_ferror
test eax, eax
je 0x404dc0
mov dword [esp], edi
mov esi, 0xffffffff
call sub.msvcrt.dll_clearerr
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
mov dword [esp], edi
call sub.msvcrt.dll_fclose
add esp, 0x1010
mov eax, esi
pop ebx
pop esi
pop edi
ret
mov dword [esp], ebx
call sub.msvcrt.dll_ferror
test eax, eax
je 0x404dc0
mov dword [esp], ebx
mov esi, 0xffffffff
call sub.msvcrt.dll_clearerr
jmp 0x404e2a
xor esi, esi
jmp 0x404e2a
mov esi, 0xffffffff
jmp 0x404e3a
Function at 0x404ef0
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended

Disassembly:
push edi
push esi
mov eax, 0x20a0
push ebx
call fcn.0040a990
sub esp, eax
mov eax, dword [esp + 0x20b0]
lea esi, [esp + 0xa0]
mov dword [esp + 8], 0x1000
mov dword [esp + 0x3c], 0
lea edi, [esp + 0x5c]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.00405490
mov dword [esp + 4], 1
mov dword [esp], 0x16
call sub.msvcrt.dll_signal
mov dword [esp + 4], 1
mov dword [esp], 2
call sub.msvcrt.dll_signal
mov dword [esp + 4], 1
mov dword [esp], 0xf
call sub.msvcrt.dll_signal
mov dword [esp + 4], 1
mov dword [esp], 0x15
call sub.msvcrt.dll_signal
mov dword [esp + 0x40], 0xc
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 1
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, 1
sub esp, 4
mov word [esp + 0x8c], ax
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x88], 0x101
mov dword [esp], eax
call sub.msvcrt.dll__fileno
mov ebx, dword [sym.imp.msvcrt.dll__get_osfhandle]
mov dword [esp], eax
call ebx
mov dword [esp + 0x94], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
mov dword [esp], eax
call sub.msvcrt.dll__fileno
mov dword [esp], eax
call ebx
mov dword [esp + 0x98], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll__fileno
mov dword [esp], eax
call ebx
mov dword [esp + 0x9c], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea edx, [esp + 0x4c]
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x24], edx
lea edx, [esp + 0x40]
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
sub esp, 0x28
test eax, eax
jne 0x4050a0
mov dword [esp], str.Error_creating_child_process__n
call fcn.00401ec0
add esp, 0x20a0
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
ret
mov eax, dword [esp + 0x4c]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
lea eax, [esp + 0x3c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
sub esp, 8
mov eax, dword [esp + 0x3c]
add esp, 0x20a0
pop ebx
pop esi
pop edi
ret
Function at 0x409dd0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.00409e30

Function at 0x409e30
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x41d5a0]
test esi, esi
jle 0x409f1d
mov edi, dword [0x41d5a4]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x409e64
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x409f16
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x409e50
mov dword [esp], eax
mov ebx, eax
call fcn.0040a760
test eax, eax
mov edi, eax
je 0x409f5a
lea ebx, [esi + esi*2]
mov esi, dword [0x41d5a4]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call fcn.0040a860
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x41d5a4]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x409f3a
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x409f0f
sub eax, 0x40
and eax, 0xffffffbf
je 0x409f0f
mov eax, dword [esp + 0x20]
add ebx, dword [0x41d5a4]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x409f24
add dword [0x41d5a0], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor esi, esi
jmp 0x409e6e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00409dd0
mov eax, dword [0x41d5a4]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00409dd0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00409dd0
lea esi, [esi]
Function at 0x40a3d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x41d5b8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x41d5b0]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x40a425
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40a41e
test esi, esi
je 0x40a41e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x40a400
mov dword [esp], 0x41d5b8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40a680
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x40a6b8
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x40a6ae
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40a6ba
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x40a6a0
xor eax, eax
pop ebx
pop esi
ret