joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp int.00401219
Function at 0x406004
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp dword [0x422a1c], esi
push edi
jne 0x40603e
mov ecx, 0x422a18
push 8
mov eax, esi
pop edi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x40601a
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x422e18
jl 0x406015
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
jbe 0x406073
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a18]
xor eax, esi
inc ecx
dec edx
jne 0x406056
pop edi
pop esi
not eax
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x40176b
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, esp
push ebp
mov ebp, esp
add ecx, 4
mov dword [0x404122], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x4043bc], eax
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x404350], eax
mov dword [0x40411a], eax
mov dword [0x40433c], 0x30
mov dword [0x404340], 2
jmp 0x4017b0
mov dword [0x404344], 0x403300
mov dword [0x404348], 0
mov dword [0x40434c], 0
mov dword [0x404364], 0x4042e7
mov dword [0x40435c], 0xf
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x404354], eax
mov dword [0x404368], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x404358], eax
push 0x40433c
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x40411a]
push 0
push 0
push 0x1e5
push 0x203
push 0xfffff98e
push 0xfffff9c0
push 0xcf0000
push str.please_wait
push str.cokun
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x4043b4], eax
push 5
push dword [0x4043b4]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x4043b4]
call dword [sym.imp.user32.dll_UpdateWindow]
xor edi, edi
lea ebx, [0x40436c]
jmp 0x401884
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x401876
mov eax, dword [0x404374]
jmp 0x40189f
call 0x402d98
ret
Function at 0x594310
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.data
lea edi, [esi - 0xf7000]
mov dword [edi + 0x189894], 0x4fb81b6b
push edi
or ebp, 0xffffffff
jmp 0x59433a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x594341
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x594330
mov eax, 1
add ebx, ebx
jne 0x594353
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x594364
jne 0x594383
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x594383
dec eax
add ebx, ebx
jne 0x594370
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x594348
add ebx, ebx
jne 0x59437f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5943d5
xor ecx, ecx
sub eax, 3
jb 0x59439b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x59440a
sar eax, 1
mov ebp, eax
jmp 0x5943a6
add ebx, ebx
jne 0x5943a6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x594374
inc ecx
add ebx, ebx
jne 0x5943b4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x594374
add ebx, ebx
jne 0x5943c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5943b6
jne 0x5943d2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5943b6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5943f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5943e6
jmp 0x594336
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5943f4
add edi, ecx
jmp 0x594336
pop esi
mov edi, esi
mov ecx, 0x67ed
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x594412
cmp byte [edi], 0x11
jne 0x594412
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x594417
lea edi, [esi + 0x191000]
mov eax, dword [edi]
or eax, eax
je 0x59448f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1957d0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x195870]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x594444
mov ecx, edi
jns 0x594473
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x195874]
or eax, eax
je 0x594489
mov dword [ebx], eax
add ebx, 4
jmp 0x594461
call dword [esi + 0x195878]
popal
jmp 0x4bc86b
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x37bf5bcf
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x84116e5
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00401219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0xbec4c6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0xc39538
mov cx, bx
inc cl
mov cx, word [esp]
jmp 0xc39380
lea edx, [eax*4]
bswap edx
mov edx, esp
jmp 0xc3948a
mov dword [esp], esi
push word [esp + 1]
lea esp, [esp + 2]
jmp 0xc39368
lea esp, [esp + 4]
je fcn.00bec31d
jne 0xc39396
adc dword [eax + reloc.WINMM.dll_midiStreamOut], ecx
movsd dword es:[edi], dword [esi]
aam 0x47
out dx, al
popal
ret
mov ecx, dword [ebp + 8]
jmp 0xc393cb
push ebx
jmp 0xbec35a
lea esp, [esp + 0x40]
dec edi
jmp 0xc393d2
mov cl, byte [ecx]
stc
pushal
pushal
jmp 0xc393b5
mov byte [eax + esi + 0x18], cl
jmp 0xc3945b
cmp eax, 0x40
jmp 0xc3947c
inc eax
push esi
lea esp, [esp + 4]
inc dword [ebp + 8]
jmp 0xc39445
lea eax, [esi + 0x1a]
jmp 0xbec370
jne 0xbec307
mov cx, 0xad3f
xor ecx, ecx
jmp 0xc39466
movzx edx, byte [eax + 1]
jmp 0xc3971a
add eax, 4
jmp 0xc3950c
lea esp, [esp + 0x24]
inc ecx
sub esp, 6
pop word [esp + 1]
lea esp, [esp + 2]
lea esp, [esp + 2]
jmp 0xc394b0
mov dword [ebp + ecx*4 - 0x40], edx
sub esp, 5
sub esp, 0x1a
lea esp, [esp + 3]
jmp 0xc394c6
lea ecx, [esi + 8]
jmp 0xc3954e
cmp ecx, 0x10
jb 0xbec370
mov eax, 0x9b990a2b
jmp 0xc394f6
shl edx, 8
or edx, ebx
sub esp, 0xc
pop dword [esp + 3]
jmp 0xc394e6
test edi, edi
call fcn.00c3955d
in eax, 0x14
xchg dword [esi], ebp
popfd
retf
lea eax, [ebp - 0x40]
call fcn.00c075c4
xor eax, eax
jmp 0xbec307
or edx, ebx
mov bx, si
bswap ebx
mov bx, ax
movzx ebx, byte [eax - 2]
jmp 0xc3952a
bswap ebx
movzx ebx, byte [eax - 1]
shl edx, 8
jmp 0xc39577
shl edx, 8
stc
or edx, ebx
mov ebx, edx
jmp 0xc39638
push ebp
mov ebp, eax
movzx ebx, byte [ebp]
pop ebp
jmp 0xc39664

Function at 0x12b58b3
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
lea ebx, [edi - 0xc]
adc cx, 0xe9d7
xchg byte [esp + 3], dl
xchg dword [esp + 3], ebx
dec edx
jmp 0x12b58bd
xchg word [esp + 6], ax
pushfd
xchg edi, eax
jmp 0x12b5889
setno cl
mov si, 0x97af
lea esp, [esp + 2]
pop esi
xchg edi, edx
xchg word [esp + 3], di
jmp 0x12b58ef

Function at 0x12b619c
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
mov eax, 0x78e10f5
mov cx, 0xd711
pop edi
or bl, bl
jmp 0x12b61a4
not bp
bsr esi, ebp
jmp 0x12b6186
lea esp, [esp + 8]
mov dx, word [esp + 8]
cpuid
bts edi, eax
jmp 0x12b61cd
Function at 0x12b6380
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0xb
mov cx, bp
xchg byte [esp + 0xe], dl
mov word [esp + 0x19], bx
jmp 0x12b6324
sub esp, 0x16
xchg bh, cl
neg cx
mov bp, sp
lea edx, [ecx + ebp]
pop dword [esp + 1]
jmp 0x12b62fa
btr cx, bp
lea esp, [esp + 4]
rdtsc
lea edx, reloc.WINMM.dll_midiStreamOut
jmp 0x12b6364
lea esp, [esp + 0x14]
add esp, 0x11
stc
xchg si, di
mov dword [esp], ebx
btc dx, di
jmp 0x12b6310
push si
setle ah
mov al, byte [esp + 2]
lea edx, reloc.WINMM.dll_midiStreamOut
jmp 0x12b63bb
cmp bp, 0x9597
xchg byte [esp + 0xc], ah
mov edi, eax
xchg di, ax
add esp, 0x1e
btc esi, ebp
jmp 0x12b634e
neg bx
lea esp, [esp + 9]
xchg bh, ch
mov eax, dword [esp + 0xe]
mov bx, 0x75b0
jmp 0x12b633a
mov di, word [esp + 2]
mov word [esp], dx
mov bx, word [esp + 2]
not eax
lea esp, [esp + 2]
std
jmp 0x12b63e6
mov dl, ah
xchg esi, ecx
bsf ax, cx
mov dx, 0xef07
xchg byte [esp + 1], bl
lea esi, [ecx + ebx]
jmp 0x12b6393
sub esp, 3
mov ch, cl
inc ch
rcl dx, 0xb
cmc
push ebp
jmp 0x12b6458
mov al, ch
not eax
bsf ebx, esi
std
xchg bx, cx
rcr si, 9
jmp 0x12b63d0
rdtsc
mov word [esp + 0xa], sp
pushal
mov dword [esp + 6], eax
mov word [esp + 0x1d], ax
mov esi, 0x67250312
mov ecx, 0xbb4bd3d4
mov cx, word [esp + 6]
jmp 0x12b6426

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401788
Capabilities:
Encrypt data using rc4 prga
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp], 4
mov eax, dword [sym.imp.USER32.dll_GetAsyncKeyState]
call eax
sub esp, 4
cwde
and eax, 1
test eax, eax
setne al
test al, al
je 0x4017d7
movzx eax, byte [0x406034]
xor eax, 1
mov byte [0x406034], al
mov edx, dword [0x406038]
movzx eax, byte [0x406034]
movzx eax, al
mov dword [esp + 4], edx
mov dword [esp], eax
call sym.menu_bool__int_
movzx eax, byte [0x406034]
test al, al
je 0x40178e
call sym.click__
mov ecx, dword [0x406038]
mov eax, 0x3e8
cdq
idiv ecx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
jmp 0x40178e

Function at 0x401e00
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x4063c0]
test esi, esi
jle 0x401f10
mov edi, dword [0x4063c4]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x401e34
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x401eb5
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x401e20
mov dword [esp], eax
mov ebx, eax
call sym.___mingw_GetSectionForAddress
test eax, eax
mov edi, eax
je 0x401f37
mov eax, dword [0x4063c4]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call sym.__GetPEImageBase
add eax, dword [edi + 0xc]
mov edx, dword [0x4063c4]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401f17
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x401eae
sub eax, 4
and eax, 0xfffffffb
jne 0x401ec0
add dword [0x4063c0], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
add ebx, dword [0x4063c4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401eae
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call sym.___report_error
lea esi, [esi]
xor esi, esi
jmp 0x401e3e
mov eax, dword [0x4063c4]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call sym.___report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call sym.___report_error
mov esi, esi
lea edi, [edi]
Function at 0x402370
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4063d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4063d0]
sub esp, 4
test ebx, ebx
je 0x4023c5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4023be
test esi, esi
je 0x4023be
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4023a0
mov dword [esp], 0x4063d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x402a70
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call sym.___acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call sym.___acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
nop
nop
nop
nop
nop
Function at 0x10003bd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x10003cb8
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x10003ca7
jg 0x10003c10
test edx, edx
je 0x10003ca7
nop dword [eax]
call fcn.10006a50
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x10003c64
jg 0x10003c27
test esi, esi
je 0x10003c64
cmp ebx, eax
jg 0x10003c37
jl 0x10003c31
cmp edi, esi
jae 0x10003c37
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.1000df40
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x10003c8b
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
movzx eax, byte [eax]
push eax
call edx
cmp eax, 0xffffffff
je 0x10003ca1
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x10003c10
jl 0x10003ca1
test edi, edi
jne 0x10003c10
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x10003cda
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x10003cdc
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x10003d5a
jg 0x10003cef
test esi, esi
je 0x10003d5a
test eax, eax
jl 0x10003d3e
jg 0x10003cf9
test ebx, ebx
je 0x10003d3e
cmp edi, eax
jg 0x10003d09
jl 0x10003d03
cmp esi, ebx
jae 0x10003d09
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call fcn.1000df40
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
sub esi, ebx
sbb edi, dword [esp + 0x14]
add edx, ebx
mov eax, dword [ecx + 0x30]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
test edi, edi
jl 0x10003d5a
jg 0x10003d41
test esi, esi
je 0x10003d5a
jmp 0x10003d41
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x10003d5a
push eax
push esi
push 1
push edx
call fcn.10012e68
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc