joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002350
Capabilities:
Check for software breakpoints

Disassembly:
sub esp, 0x304
push ebx
push ebp
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x111]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x211]
mov byte [esp + 0x210], 0
mov ebp, dword [esp + 0x314]
xor ebx, ebx
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x110]
mov byte [esp + 0x110], 0x3a
stosw word es:[edi], ax
mov al, byte [esp + 0x318]
push ecx
push 4
push ebp
mov byte [esp + 0x11d], 0x5a
mov byte [esp + 0x11e], 0xa
mov byte [esp + 0x11f], al
call fcn.10001850
lea edx, [esp + 0x1c]
push edx
push ebp
call fcn.100018e0
mov cl, byte [esp + 0x24]
add esp, 0x14
cmp cl, 0x3a
jne 0x1000246a
cmp byte [esp + 0x11], 0x5a
jne 0x1000246a
cmp eax, 2
jle 0x1000240f
mov al, byte [esp + 0x12]
push 0xa
mov byte [esp + 0x10], al
call fcn.10001970
add esp, 4
jmp 0x1000246a
push esi
lea ecx, [esp + 0x14]
mov byte [esp + 0x14], 0
push ecx
push ebp
call fcn.100018e0
add esp, 8
test eax, eax
jle 0x10002444
mov ecx, eax
lea esi, [esp + 0x15]
mov edx, ecx
lea edi, [esp + 0x214]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
add ebx, eax
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x10002410
mov al, byte [esp + 0x214]
push 0xa
mov byte [esp + 0x14], al
call fcn.10001970
add esp, 4
pop esi
mov al, byte [esp + 0xc]
pop edi
pop ebp
cmp al, 0xcc
pop ebx
jne 0x10002481
mov eax, 0xfffffff5
add esp, 0x304
ret
mov eax, dword [esp]
and eax, 0xff
add esp, 0x304
ret
Function at 0x1004d400
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.1004f040
mov dword [ebp - 8], 0xffffffff
mov byte [ebp - 1], 0
cmp dword [ebp + 8], 0
je 0x1004d426
mov eax, dword [ebp + 8]
and eax, 0x400001ff
je 0x1004d42a
mov byte [ebp - 1], 1
mov ecx, dword [ebp + 8]
and ecx, 0x20000000
je 0x1004d458
mov ecx, 0x4068cd0
call fcn.1004d580
movzx edx, al
test edx, edx
je 0x1004d453
push 1
call fcn.1008ad70
add esp, 4
mov dword [ebp - 8], eax
jmp 0x1004d55c
mov eax, dword [ebp + 8]
and eax, 1
je 0x1004d46f
mov ecx, dword [ebp - 8]
push ecx
call fcn.1004d5f0
add esp, 4
mov dword [ebp - 8], eax
mov edx, dword [ebp + 8]
and edx, 2
je 0x1004d488
push 1
mov eax, dword [ebp - 8]
push eax
call fcn.1004d8b0
add esp, 8
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
and ecx, 4
je 0x1004d49f
mov edx, dword [ebp - 8]
push edx
call fcn.1004da50
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
and eax, 8
je 0x1004d4b6
mov ecx, dword [ebp - 8]
push ecx
call fcn.1004db90
add esp, 4
mov dword [ebp - 8], eax
mov edx, dword [ebp + 8]
and edx, 0x10
je 0x1004d4cf
push 1
mov eax, dword [ebp - 8]
push eax
call fcn.1004dc70
add esp, 8
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
and ecx, 0x20
je 0x1004d4e8
push 1
mov edx, dword [ebp - 8]
push edx
call fcn.1004de30
add esp, 8
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
and eax, 0x40
je 0x1004d50d
call fcn.1004e690
cmp dword [ebp + 0xc], eax
jge 0x1004d50d
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.1004ee30
add esp, 8
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
and eax, 0x80
je 0x1004d526
mov ecx, dword [ebp - 8]
push ecx
call fcn.1004ee80
add esp, 4
mov dword [ebp - 8], eax
mov edx, dword [ebp + 8]
and edx, 0x100
je 0x1004d540
mov eax, dword [ebp - 8]
push eax
call fcn.1004ef70
add esp, 4
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
and ecx, 0x40000000
je 0x1004d55c
push 0
mov edx, dword [ebp - 8]
push edx
call fcn.1004dc70
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1004d56b
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x1004ebd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40665c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x20], 0
mov byte [ebp - 0x1f], 3
mov byte [ebp - 0x1e], 0x8a
mov byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 3
mov byte [ebp - 0x1b], 0xff
mov byte [ebp - 0x1a], 0
mov byte [ebp - 0x19], 5
mov byte [ebp - 0x18], 0x69
mov byte [ebp - 0x17], 0
mov byte [ebp - 0x16], 0xc
mov byte [ebp - 0x15], 0x29
mov byte [ebp - 0x14], 0
mov byte [ebp - 0x13], 0x50
mov byte [ebp - 0x12], 0x56
mov byte [ebp - 0x11], 0
mov byte [ebp - 0x10], 0x50
mov byte [ebp - 0xf], 0xf2
mov byte [ebp - 0xe], 0
mov byte [ebp - 0xd], 0x53
mov byte [ebp - 0xc], 0x45
mov byte [ebp - 0xb], 0x44
mov byte [ebp - 0xa], 0x45
mov byte [ebp - 9], 0x53
mov byte [ebp - 8], 0xff
mov byte [ebp - 7], 0xff
mov byte [ebp - 6], 0xff
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 2]
cmp ecx, 0x20
jne 0x1004ec83
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 3]
cmp eax, 0x52
jne 0x1004ec83
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 4]
cmp edx, 0x41
jne 0x1004ec83
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 5]
cmp ecx, 0x53
jne 0x1004ec83
mov al, 1
jmp 0x1004ed45
mov dword [ebp - 0x24], 0
jmp 0x1004ec95
mov edx, dword [ebp - 0x24]
add edx, 1
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
imul eax, eax, 3
movzx ecx, byte [ebp + eax - 0x20]
cmp ecx, 0xff
je 0x1004ecef
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x24]
imul ecx, ecx, 3
movzx edx, byte [ebp + ecx - 0x20]
cmp eax, edx
jne 0x1004eced
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 1]
mov edx, dword [ebp - 0x24]
imul edx, edx, 3
movzx eax, byte [ebp + edx - 0x1f]
cmp ecx, eax
jne 0x1004eced
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 2]
mov eax, dword [ebp - 0x24]
imul eax, eax, 3
movzx ecx, byte [ebp + eax - 0x1e]
cmp edx, ecx
jne 0x1004eced
mov al, 1
jmp 0x1004ed45
jmp 0x1004ec8c
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 3]
test eax, eax
jne 0x1004ed28
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 4]
cmp edx, 0x30
jne 0x1004ed28
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 5]
test ecx, ecx
jne 0x1004ed28
call fcn.10066640
xor edx, edx
mov ecx, 0x64
div ecx
cmp eax, 4
jne 0x1004ed28
mov al, 1
jmp 0x1004ed45
push 6
push 0x404dc88
mov edx, dword [ebp + 8]
push edx
call fcn.10090853
add esp, 0xc
test eax, eax
jne 0x1004ed43
mov al, 1
jmp 0x1004ed45
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008fca1
mov esp, ebp
pop ebp
ret
Function at 0x10057b80
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x10325476
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.10055fe0
add esp, 0xc
pop ebp
ret
Function at 0x10073be0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x40665c0]
xor eax, ebp
mov dword [ebp - 0xc], eax
call fcn.10058e10
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, dword [0x4072c68]
add eax, 5
mov ecx, dword [0x4072c6c]
adc ecx, 0
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x4c]
jg 0x10073c29
jl 0x10073c24
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x50]
jae 0x10073c29
jmp 0x10073dae
mov ecx, dword [ebp - 8]
mov dword [0x4072c68], ecx
mov edx, dword [ebp - 4]
mov dword [0x4072c6c], edx
mov byte [0x40714ad], 0
mov al, byte [0x40714ad]
mov byte [0x40714ac], al
mov byte [ebp - 0x2f], 0x4f
mov byte [ebp - 0x25], 0x43
mov byte [ebp - 0x10], 0
mov byte [ebp - 0x33], 0x52
mov byte [ebp - 0x32], 0x4f
mov byte [ebp - 0x3f], 0x73
mov byte [ebp - 0x17], 0x6f
mov byte [ebp - 0x34], 0x50
mov byte [ebp - 0x46], 0x67
mov byte [ebp - 0x40], 0x61
mov byte [ebp - 0x23], 0x41
mov byte [ebp - 0x22], 0x53
mov byte [ebp - 0x1c], 0x46
mov byte [ebp - 0x45], 0x4d
mov byte [ebp - 0x24], 0x4c
mov byte [ebp - 0x21], 0x53
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x2e], 0x4e
mov byte [ebp - 0x2d], 0x5f
mov byte [ebp - 0x42], 0x43
mov byte [ebp - 0x16], 0x6e
mov byte [ebp - 0x3d], 0
mov byte [ebp - 0x27], 0x57
mov byte [ebp - 0x26], 0x5f
mov byte [ebp - 0x44], 0x6f
mov byte [ebp - 0x47], 0x65
mov byte [ebp - 0x13], 0x61
mov byte [ebp - 0x41], 0x6c
mov byte [ebp - 0x15], 0x43
mov byte [ebp - 0x30], 0x4d
mov byte [ebp - 0x20], 0
mov byte [ebp - 0x18], 0x4d
mov byte [ebp - 0x48], 0x52
mov byte [ebp - 0x31], 0x43
mov byte [ebp - 0x2a], 0x4e
mov byte [ebp - 0x3e], 0x73
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x43], 0x6e
mov byte [ebp - 0x12], 0x73
mov byte [ebp - 0x29], 0x44
mov byte [ebp - 0x28], 0x4f
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x2c], 0x57
mov byte [ebp - 0x2b], 0x49
mov byte [ebp - 0x14], 0x6c
push 0
lea ecx, [ebp - 0x1c]
push ecx
call dword [0x4049400]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x10073d20
mov byte [0x40714ad], 1
push 0
lea edx, [ebp - 0x48]
push edx
call dword [0x4049400]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x10073d3c
mov byte [0x40714ac], 1
push 0
lea eax, [ebp - 0x34]
push eax
call dword [0x4049400]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x10073d5f
mov byte [0x40714ac], 1
mov byte [0x40714ad], 1
movzx ecx, byte [0x40714ac]
test ecx, ecx
je 0x10073d75
movzx edx, byte [0x40714ad]
test edx, edx
jne 0x10073d82
push 0
push 0x4001430
call dword [0x40493d0]
mov edx, dword [0x4049044]
push edx
mov eax, dword [0x4049004]
push eax
call fcn.10086290
add esp, 8
test eax, eax
je 0x10073dae
mov byte [0x40714ac], 1
mov cl, byte [0x40714ac]
mov byte [0x40714ad], cl
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1008fca1
mov esp, ebp
pop ebp
ret
Function at 0x10075c40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x40665c0]
xor eax, ebp
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x118]
push eax
push 0x104
call dword [0x4049314]
push 0x40713a8
lea ecx, [ebp - 0x118]
push ecx
call fcn.1008fed0
add esp, 8
push 0x404f1f4
lea edx, [ebp - 0x118]
push edx
call fcn.10093c8c
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10075c9a
xor eax, eax
jmp 0x10075d0a
mov dword [ebp - 8], 0
push 2
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.10094725
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
call fcn.10094630
add esp, 4
cmp eax, 4
jne 0x10075ce6
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call fcn.10094725
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
push 1
push 4
lea ecx, [ebp - 8]
push ecx
call fcn.1009447d
add esp, 0x10
mov edx, dword [ebp - 4]
push edx
call fcn.10094165
add esp, 4
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10075d07
lea ecx, [ebp - 0x118]
push ecx
call dword [0x4049324]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1008fca1
mov esp, ebp
pop ebp
ret
Function at 0x401764
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
not eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
jmp 0x40181a
mov eax, dword [ebp - 4]
shr eax, 8
mov edx, eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
movzx eax, al
xor eax, dword [ebp - 4]
movzx eax, al
mov eax, dword [eax*4 + 0xb654c0]
xor eax, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
shr eax, 8
mov edx, eax
mov eax, dword [ebp - 8]
add eax, 1
movzx eax, byte [eax]
movzx eax, al
xor eax, dword [ebp - 4]
movzx eax, al
mov eax, dword [eax*4 + 0xb654c0]
xor eax, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
shr eax, 8
mov edx, eax
mov eax, dword [ebp - 8]
add eax, 2
movzx eax, byte [eax]
movzx eax, al
xor eax, dword [ebp - 4]
movzx eax, al
mov eax, dword [eax*4 + 0xb654c0]
xor eax, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
shr eax, 8
mov edx, eax
mov eax, dword [ebp - 8]
add eax, 3
movzx eax, byte [eax]
movzx eax, al
xor eax, dword [ebp - 4]
movzx eax, al
mov eax, dword [eax*4 + 0xb654c0]
xor eax, edx
mov dword [ebp - 4], eax
add dword [ebp - 8], 4
sub dword [ebp + 0x10], 4
cmp dword [ebp + 0x10], 3
ja 0x40177d
jmp 0x401851
mov eax, dword [ebp - 4]
shr eax, 8
mov edx, eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
movzx eax, al
xor eax, dword [ebp - 4]
movzx eax, al
mov eax, dword [eax*4 + 0xb654c0]
xor eax, edx
mov dword [ebp - 4], eax
add dword [ebp - 8], 1
sub dword [ebp + 0x10], 1
cmp dword [ebp + 0x10], 0
jne 0x401826
mov eax, dword [ebp - 4]
not eax
leave
ret
Function at 0x41bffb
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
cmp al, 0x40
jle 0x41c01f
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
cmp al, 0x5a
jle 0x41c033
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
cmp al, 0x60
jle 0x41c047
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
cmp al, 0x7a
jg 0x41c047
mov eax, dword [ebp + 8]
add eax, 1
movzx eax, byte [eax]
cmp al, 0x3a
jne 0x41c047
mov eax, 1
jmp 0x41c04c
mov eax, 0
mov dword [ebp - 0x14], eax
mov dword [esp + 8], 0x201
mov dword [esp + 4], 0
lea eax, [ebp - 0x215]
mov dword [esp], eax
call sub.msvcrt.dll_memset
cmp dword [ebp - 0x14], 0
je 0x41c093
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
mov byte [ebp - 0x215], al
mov eax, dword [ebp + 8]
movzx eax, byte [eax + 1]
mov byte [ebp - 0x214], al
mov dword [ebp - 0x10], 2
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
jmp 0x41c110
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
cmp al, 0x2f
je 0x41c0b4
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
cmp al, 0x5c
jne 0x41c0f6
cmp dword [ebp - 0x14], 0
jne 0x41c0c0
cmp dword [ebp - 0x10], 0
jg 0x41c0cc
cmp dword [ebp - 0x14], 0
je 0x41c0f6
cmp dword [ebp - 0x10], 2
jle 0x41c0f6
lea eax, [ebp - 0x215]
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__mkdir]
call eax
cmp eax, 0xffffffff
jne 0x41c0f6
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
cmp eax, 0x11
je 0x41c0f6
mov eax, 0xffffffe9
jmp 0x41c12c
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
mov dword [ebp - 0x10], edx
mov edx, dword [ebp - 0xc]
movzx edx, byte [edx]
mov byte [ebp + eax - 0x215], dl
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test al, al
je 0x41c127
cmp dword [ebp - 0x10], 0x1ff
jle 0x41c0a0
mov eax, 0
leave
ret
Function at 0x41d127
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x1c]
cmp dword [ebp + 0x24], eax
jae 0x41d157
mov eax, 0xffffffe6
jmp 0x41d213
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov dword [esp + 0xc], 0
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [0x4280bc]
call eax
test eax, eax
je 0x41d188
mov eax, 0xffffffe5
jmp 0x41d213
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp + 0x20]
mov dword [esp], eax
call sub.msvcrt.dll_fread
cmp dword [ebp + 0x1c], eax
je 0x41d1b5
mov eax, 0xffffffe4
jmp 0x41d213
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [0x4280bc]
call eax
test eax, eax
je 0x41d1e3
mov eax, 0xffffffe5
jmp 0x41d213
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp + 0x20]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
cmp dword [ebp + 0x1c], eax
je 0x41d210
mov eax, 0xffffffe3
jmp 0x41d213
mov eax, dword [ebp + 0x1c]
leave
ret
Function at 0x4200e0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00426530
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00426530
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x420140
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0xbc7078]
test esi, esi
jle 0x420260
mov eax, dword [0xbc707c]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x420174
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x4201f7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x420160
mov dword [esp], ebx
call fcn.00420b30
mov edi, eax
test eax, eax
je 0x420287
mov eax, dword [0xbc707c]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00420c70
mov edx, dword [0xbc707c]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x420267
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x4201f0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x420200
add dword [0xbc7078], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0xbc707c]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4201f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.004200e0
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x42017e
mov eax, dword [0xbc707c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.004200e0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.004200e0
lea esi, [esi]
nop
Function at 0x4207a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0xbc7094
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0xbc708c]
sub esp, 4
test ebx, ebx
je 0x4207f5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4207ee
test esi, esi
je 0x4207ee
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4207d0
mov dword [esp], 0xbc7094
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x420b30
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x420b55
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x420b60
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x420b55
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x420ba8
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x420b9e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x420baa
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x420b90
xor eax, eax
pop ebx
pop esi
ret
Function at 0x427050
Capabilities:
Get common file path

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea ebx, [ebp - 0x120]
push ecx
sub esp, 0x148
call fcn.0041ff20
mov eax, dword [0xbc7044]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [esp + 4], ebx
mov dword [esp], 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
sub esp, 8
test eax, eax
je 0x427219
mov dword [esp], str..zip
call fcn.00426de0
mov dword [esp], str..exe
mov edi, eax
call fcn.00426de0
mov dword [esp], ebx
mov esi, eax
call sub.msvcrt.dll_strlen
mov dword [ebp - 0x12c], eax
mov dword [esp], edi
call sub.msvcrt.dll_strlen
mov edx, dword [ebp - 0x12c]
lea eax, [edx + eax + 1]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x130], eax
mov dword [esp], esi
call sub.msvcrt.dll_strlen
mov edx, dword [ebp - 0x12c]
lea eax, [edx + eax + 1]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x12c], eax
mov dword [esp + 8], ebx
mov dword [esp + 0xc], edi
mov dword [esp + 4], str._s_s
mov ecx, dword [ebp - 0x130]
mov dword [esp], ecx
call fcn.00421080
mov dword [esp + 8], ebx
mov dword [esp + 0xc], esi
mov dword [esp + 4], str._s_s
mov eax, dword [ebp - 0x12c]
mov dword [esp], eax
call fcn.00421080
lea eax, [ebp - 0x128]
mov dword [esp + 8], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x426f10
mov dword [esp + 4], 0x17c7ac
mov dword [esp], 0x4280e0
call fcn.0041f66b
mov dword [esp], 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push eax
lea eax, [ebp - 0x124]
mov dword [esp + 8], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x426f10
mov dword [esp + 4], 0x5beebc
mov dword [esp], 0x5a48a0
call fcn.0041f66b
mov dword [esp], str.after_n
call fcn.00426fd0
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x124]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [esp], eax
call ebx
push edx
push edx
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x128]
mov dword [esp], eax
call ebx
push ecx
push ecx
mov dword [esp], edi
call sub.msvcrt.dll_free
mov dword [esp], esi
call sub.msvcrt.dll_free
mov ecx, dword [ebp - 0x130]
test ecx, ecx
je 0x4271fe
mov dword [esp], ecx
call sub.msvcrt.dll_free
cmp dword [ebp - 0x12c], 0
je 0x427215
mov eax, dword [ebp - 0x12c]
mov dword [esp], eax
call sub.msvcrt.dll_free
xor eax, eax
jmp 0x42722a
mov dword [esp], str.Failed_to_get_temp_path
call sub.msvcrt.dll_perror
mov eax, 1
mov edx, dword [ebp - 0x1c]
sub edx, dword [0xbc7044]
jne 0x427241
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
call fcn.0041fe30
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
ud2