joyce8/EMBER2024-capa huggingface dataset:
Function at 0x78155e6a
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x78155e97
call sym.MSVCR80.dll___doserrno
mov dword [eax], esi
call sym.MSVCR80.dll__errno
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call sym.MSVCR80.dll__invalid_parameter
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x78155eb5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.MSVCR80.dll__dosmaperr
pop ecx
jmp 0x78155e92
test byte [esp + 0xc], 0x80
je 0x78155ec1
and eax, 0xfffffffe
jmp 0x78155ec4
or eax, 1
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x78155ea6
xor eax, eax
pop esi
ret

Function at 0x7817601a
Capabilities:
Enumerate pe sections

Disassembly:
dec esp
and al, 8
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x78176054
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x7817603b
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x7817604c
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x78176056
inc edi
add eax, 0x28
cmp edi, esi
jb 0x78176031
xor eax, eax
pop edi
pop esi
ret

Function at 0x781763a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov esi, 0xc6975d88
inc ebp
cwde
pop ss
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.78175fe9
push eax
push esi
push dword [ebp + 8]
call fcn.78175f9e
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.78175fe9
push eax
push esi
push dword [ebp + 8]
call fcn.78175f9e
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.78175fd9
and edx, dword [esi - 0x6277736f]
jl 0x7817645e
invalid
invalid

Function at 0x781764cd
Capabilities:
Inspect section memory permissions

Disassembly:
push eax
push esi
push dword [ebp + 8]
call fcn.78175f9e
add esp, 0x10
mov dword [ebp - 0xc0], eax
push 0x40
push 0x1000
push dword [ebp + 0xc]
push ebx
invalid

Function at 0x78176528
Capabilities:
Inspect section memory permissions

Disassembly:
dec eax
adc al, 0x8b
inc eax
or al, 3
dec ebp
adc byte [ebx], al
invalid
Function at 0x7817662e
Capabilities:
Inspect section memory permissions

Disassembly:
or dl, byte [eax - 0x75]
xchg dword [eax + 0x3b000000], esp
add byte [eax], al
cmp eax, ebx

Function at 0x78176841
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [eax + 0x56fffffc], edi
mov byte [ebp - 0x347], 0x56
invalid
invalid
invalid
cld

Function at 0x781768b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.78175fe9
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.78175f9e
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.78175fe9
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.78175f9e
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.78175fd9
lds ecx, [ecx - 0x5a7ffc13]
int3
Function at 0x78177a54
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 1
pop eax
test eax, eax
je 0x7817807f
lea eax, [ebp - 0x230]
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x6fc], 0
jne 0x78177b54
and byte [ebp - 0x77c], 0
and byte [ebp - 0x77b], 0
mov byte [ebp - 0x77a], 4
and byte [ebp - 0x779], 0
mov byte [ebp - 0x778], 0xb8
mov byte [ebp - 0x777], 0xc1
mov byte [ebp - 0x776], 0xa7
mov byte [ebp - 0x775], 0xab
mov byte [ebp - 0x774], 0x89
mov byte [ebp - 0x773], 0x94
mov byte [ebp - 0x772], 0x9c
mov byte [ebp - 0x771], 0x89
mov byte [ebp - 0x770], 0x9a
nop
clc
invalid
call [edx - 0x76e7a3a]
invalid
call dword [esi - 0x76d7a3a]
invalid
invalid
fcmovnb st(0), st(6)
test dword [ebx - 0x42000008], edx
mov byte [ebp - 0x76c], 0x92
call dword [edx - 0x76a7a3a]
invalid
call dword [edi - 0x7697a3a]
invalid
call [esi - 0x7687a3a]
invalid
dec dword [eax - 0x7677a3a]
invalid
jmp dword [edi - 0x7667a3a]
clc
invalid
invalid
mov eax, 0xf89a85c6
invalid
call dword [esi + eax*8 - 0x7647b]
call dword [esi - 0x7637a3a]
invalid
call dword [esi - 0x7627a3a]
invalid
invalid
xchg esp, eax
xchg esp, eax
mov byte [ebp - 0x762], 0x95
mov byte [ebp - 0x761], 0xdb
mov byte [ebp - 0x760], 0xbd
mov byte [ebp - 0x75f], 0x92
invalid
invalid
invalid
clc

Function at 0x781781a5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call [esi - 0x741519af]
clc
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
Function at 0x403200
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x24
mov eax, dword [ecx + 4]
push ebx
push esi
mov dword [esp + 0x14], edx
lea esi, [ecx + 4]
mov edx, dword [ecx]
add esi, 4
xor eax, edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], eax
push edi
movd xmm0, edx
mov edi, eax
pshufd xmm0, xmm0, 0
movdqa xmmword [esp + 0x20], xmm0
test al, 3
je 0x403240
and edi, 0xfffffffc
add edi, 4
mov eax, dword [0x40dddc]
test eax, eax
jne 0x403264
mov ecx, 0x802173e5
call fcn.00403df0
mov edx, 0x51a2922a
mov ecx, eax
call fcn.00403d50
mov dword [0x40dddc], eax
call eax
mov ebx, eax
mov eax, dword [0x40e1fc]
test eax, eax
jne 0x40328c
mov ecx, 0x802173e5
call fcn.00403df0
mov edx, 0xb1fe2c86
mov ecx, eax
call fcn.00403d50
mov dword [0x40e1fc], eax
push edi
push 8
push ebx
call eax
mov dword [esp + 0xc], eax
test eax, eax
je 0x403342
shr edi, 2
xor edx, edx
lea ecx, [esi + edi*4]
mov edi, eax
mov ebx, ecx
sub ebx, esi
add ebx, 3
shr ebx, 2
cmp esi, ecx
mov ecx, eax
cmova ebx, edx
test ebx, ebx
je 0x403332
cmp ebx, 8
jb 0x403317
lea eax, [esi - 4]
lea eax, [eax + ebx*4]
cmp ecx, eax
ja 0x4032d6
lea eax, [ecx - 4]
lea eax, [eax + ebx*4]
cmp eax, esi
jae 0x403317
movdqa xmm1, xmmword [esp + 0x20]
mov eax, ebx
and eax, 7
mov dword [esp + 0xc], ebx
sub dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
lea ecx, [ecx]
movdqu xmm0, xmmword [esi]
add edx, 8
pxor xmm0, xmm1
movdqu xmmword [edi], xmm0
movdqu xmm0, xmmword [esi + 0x10]
add esi, 0x20
pxor xmm0, xmm1
movdqu xmmword [edi + 0x10], xmm0
add edi, 0x20
cmp edx, eax
jb 0x4032f0
cmp edx, ebx
jae 0x403332
sub edi, esi
lea ecx, [ecx]
mov eax, dword [esi]
lea esi, [esi + 4]
xor eax, dword [esp + 0x14]
inc edx
mov dword [edi + esi - 4], eax
cmp edx, ebx
jb 0x403320
mov edx, dword [esp + 0x18]
test edx, edx
je 0x403340
mov eax, dword [esp + 0x1c]
mov dword [edx], eax
mov eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4033b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
xor eax, edx
push ebx
push esi
lea esi, [ecx + 4]
mov dword [esp + 8], edx
lea ebx, [eax + 1]
mov dword [esp + 0x10], eax
add esi, 4
push edi
test bl, 3
je 0x4033d9
and ebx, 0xfffffffc
add ebx, 4
mov eax, dword [0x40dddc]
test eax, eax
jne 0x4033fd
mov ecx, 0x802173e5
call fcn.00403df0
mov edx, 0x51a2922a
mov ecx, eax
call fcn.00403d50
mov dword [0x40dddc], eax
call eax
mov edi, eax
mov eax, dword [0x40e1fc]
test eax, eax
jne 0x403425
mov ecx, 0x802173e5
call fcn.00403df0
mov edx, 0xb1fe2c86
mov ecx, eax
call fcn.00403d50
mov dword [0x40e1fc], eax
lea ecx, [ebx + ebx]
push ecx
push 8
push edi
call eax
mov edi, eax
mov dword [esp + 0x10], edi
test edi, edi
je 0x4034a5
shr ebx, 2
xor eax, eax
push ebp
xor ebp, ebp
mov edx, edi
lea ecx, [esi + ebx*4]
mov ebx, ecx
sub ebx, esi
add ebx, 3
shr ebx, 2
cmp esi, ecx
cmova ebx, eax
test ebx, ebx
je 0x40349a
mov edi, dword [esp + 0x10]
lea esp, [esp]
mov ecx, dword [esi]
lea edx, [edx + 8]
xor ecx, edi
lea esi, [esi + 4]
movzx eax, cl
inc ebp
mov word [edx - 8], ax
mov eax, ecx
shr eax, 8
movzx eax, al
mov word [edx - 6], ax
shr ecx, 0x10
movzx eax, cl
mov word [edx - 4], ax
shr ecx, 8
movzx eax, cl
mov word [edx - 2], ax
cmp ebp, ebx
jb 0x403460
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
xor ecx, ecx
pop ebp
mov word [edi + eax*2], cx
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0xc
ret

Function at 0x4034b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
xor eax, edx
push ebx
push ebp
push esi
lea esi, [ecx + 4]
mov dword [esp + 0xc], edx
lea ebx, [eax + 1]
mov dword [esp + 0x14], eax
add esi, 4
push edi
test bl, 3
je 0x4034da
and ebx, 0xfffffffc
add ebx, 4
mov eax, dword [0x40dddc]
test eax, eax
jne 0x4034fe
mov ecx, 0x802173e5
call fcn.00403df0
mov edx, 0x51a2922a
mov ecx, eax
call fcn.00403d50
mov dword [0x40dddc], eax
call eax
mov edi, eax
mov eax, dword [0x40e1fc]
test eax, eax
jne 0x403526
mov ecx, 0x802173e5
call fcn.00403df0
mov edx, 0xb1fe2c86
mov ecx, eax
call fcn.00403d50
mov dword [0x40e1fc], eax
push ebx
push 8
push edi
call eax
mov ebp, eax
mov dword [esp + 0x14], ebp
test ebp, ebp
je 0x403592
shr ebx, 2
xor eax, eax
xor edi, edi
mov ecx, ebp
lea edx, [esi + ebx*4]
mov ebx, edx
sub ebx, esi
add ebx, 3
shr ebx, 2
cmp esi, edx
cmova ebx, eax
test ebx, ebx
je 0x40358a
mov ebp, dword [esp + 0x10]
lea esp, [esp]
mov edx, dword [esi]
lea ecx, [ecx + 4]
xor edx, ebp
lea esi, [esi + 4]
mov byte [ecx - 4], dl
mov eax, edx
shr eax, 8
inc edi
shr edx, 0x10
mov byte [ecx - 3], al
mov byte [ecx - 2], dl
shr edx, 8
mov byte [ecx - 1], dl
cmp edi, ebx
jb 0x403560
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov byte [eax + ebp], 0
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x403af0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov dword [esp], 0x21c3
mov eax, 0xbacf914d
shl dword [esp], 0xd
add dword [esp], 0xffffee0d
xor dword [esp], 0xc6d3a95b
or dword [esp], 0xe006cb71
push ebx
push esi
mov esi, dword [esp + 8]
mov ebx, ecx
mul esi
mov eax, 0xaaaaaaab
sub esi, edx
shr esi, 1
add esi, edx
shr esi, 5
mov dword [esp + 8], esi
add dword [esp + 8], 0x86d
xor dword [esp + 8], 0x2a29b567
xor dword [esp + 8], 0x2c0b8419
mov dword [esp + 0xc], 0x6024
mov ecx, dword [esp + 0xc]
mul ecx
shr edx, 5
mov dword [esp + 0xc], edx
xor dword [esp + 0xc], 0x206
mov dword [esp + 0xc], 0x7624
shl dword [esp + 0xc], 5
add dword [esp + 0xc], 0xcdd4
xor dword [esp + 0xc], 0xf9244
cmp byte [ebx], 0
je 0x403c06
push edi
lea esp, [esp]
mov edi, dword [esp + 0xc]
lea ebx, [ebx + 1]
mov dword [esp + 0x10], 0x6024
mov eax, 0xaaaaaaab
mov ecx, dword [esp + 0x10]
mul ecx
shr edx, 5
mov dword [esp + 0x10], edx
xor dword [esp + 0x10], 0x206
movzx ecx, byte [esp + 0x10]
mov esi, dword [esp + 0xc]
mov dword [esp + 0x10], 0x7624
shl dword [esp + 0x10], 5
add dword [esp + 0x10], 0xcdd4
xor dword [esp + 0x10], 0xf9244
shl esi, cl
movzx ecx, byte [esp + 0x10]
mov edx, dword [esp + 0xc]
movsx eax, byte [ebx - 1]
mov dword [esp + 0xc], eax
add dword [esp + 0xc], esi
shl edx, cl
add dword [esp + 0xc], edx
sub dword [esp + 0xc], edi
cmp byte [ebx], 0
jne 0x403b90
pop edi
mov eax, dword [esp + 8]
pop esi
pop ebx
add esp, 8
ret
Function at 0x403d50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [esp + 4], edx
push ebp
push esi
push edi
mov eax, dword [ebx + 0x3c]
xor esi, esi
add eax, 0x78
add eax, ebx
mov dword [esp + 0x1c], eax
mov edi, dword [eax]
mov eax, dword [edi + ebx + 0x1c]
add edi, ebx
add eax, ebx
mov dword [esp + 0x18], eax
mov ebp, dword [edi + 0x20]
mov eax, dword [edi + 0x24]
add ebp, ebx
add eax, ebx
mov dword [esp + 0x14], eax
cmp dword [edi + 0x18], esi
jbe 0x403dac
lea esp, [esp]
mov ecx, dword [ebp + esi*4]
add ecx, ebx
call fcn.00403af0
xor eax, 0x15977d8f
cmp eax, dword [esp + 0x10]
je 0x403db6
inc esi
cmp esi, dword [edi + 0x18]
jb 0x403d90
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
movzx eax, word [eax + esi*2]
mov ecx, dword [ecx + eax*4]
add ecx, ebx
cmp ecx, edi
jb 0x403de4
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 4]
add eax, edi
cmp ecx, eax
jae 0x403de4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
jmp 0x403f80
pop edi
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x10
ret
sub esp, 0x104
lea edx, [esp]
push esi
mov esi, ecx
push edi
mov al, byte [esi]
test al, al
je 0x403fa6
cmp al, 0x2e
je 0x403fa3
inc esi
mov byte [edx], al
inc edx
mov al, byte [esi]
test al, al
jne 0x403f93
jmp 0x403fa6
mov byte [edx], 0
mov eax, dword [0x40dd94]
test eax, eax
jne 0x403fca
mov ecx, 0x802173e5
call fcn.00403df0
mov edx, 0xe2afc2b8
mov ecx, eax
call fcn.00403d50
mov dword [0x40dd94], eax
lea ecx, [esp + 8]
push ecx
call eax
mov edi, eax
test edi, edi
jne 0x404011
mov eax, dword [0x40df8c]
test eax, eax
jne 0x403ffb
mov ecx, 0x802173e5
call fcn.00403df0
mov edx, 0xcabcc663
mov ecx, eax
call fcn.00403d50
mov dword [0x40df8c], eax
lea ecx, [esp + 8]
push ecx
call eax
mov edi, eax
test edi, edi
jne 0x404011
pop edi
pop esi
add esp, 0x104
ret
lea ecx, [esi + 1]
call fcn.00403af0
xor eax, 0x15977d8f
mov ecx, edi
mov edx, eax
call fcn.00403d50
pop edi
pop esi
add esp, 0x104
ret
Function at 0x403df0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
sub esp, 0x10
mov eax, dword fs:[0x30]
push ebx
push ebp
push esi
mov ebx, dword [eax + 0xc]
add ebx, 0xc
mov dword [esp + 0x18], ecx
push edi
mov dword [esp + 0x18], ebx
mov ebp, dword [ebx]
cmp ebp, ebx
je 0x403f65
jmp 0x403e20
mov esi, dword [ebp + 0x30]
mov eax, 0xbacf914d
mov dword [esp + 0x10], 0x21c3
shl dword [esp + 0x10], 0xd
add dword [esp + 0x10], 0xffffee0d
xor dword [esp + 0x10], 0xc6d3a95b
or dword [esp + 0x10], 0xe006cb71
mov ecx, dword [esp + 0x10]
mul ecx
mov eax, 0xaaaaaaab
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 5
mov dword [esp + 0x10], ecx
add dword [esp + 0x10], 0x86d
xor dword [esp + 0x10], 0x2a29b567
xor dword [esp + 0x10], 0x2c0b8419
mov dword [esp + 0x14], 0x6024
mov ecx, dword [esp + 0x14]
mul ecx
shr edx, 5
mov dword [esp + 0x14], edx
xor dword [esp + 0x14], 0x206
mov dword [esp + 0x14], 0x7624
shl dword [esp + 0x14], 5
add dword [esp + 0x14], 0xcdd4
xor dword [esp + 0x14], 0xf9244
cmp word [esi], 0
je 0x403f4b
mov ebx, dword [esp + 0x10]
mov eax, 0xaaaaaaab
mov dword [esp + 0x14], 0x6024
mov ecx, dword [esp + 0x14]
mul ecx
shr edx, 5
mov dword [esp + 0x14], edx
xor dword [esp + 0x14], 0x206
movzx ecx, byte [esp + 0x14]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x14], 0x7624
shl dword [esp + 0x14], 5
add dword [esp + 0x14], 0xcdd4
xor dword [esp + 0x14], 0xf9244
shl edx, cl
movzx ecx, byte [esp + 0x14]
mov edi, dword [esp + 0x10]
movzx eax, word [esi]
shl edi, cl
cmp eax, 0x41
jb 0x403f2a
cmp eax, 0x5a
ja 0x403f2a
add eax, 0x20
mov dword [esp + 0x10], eax
add esi, 2
add dword [esp + 0x10], edx
add dword [esp + 0x10], edi
sub dword [esp + 0x10], ebx
cmp word [esi], 0
jne 0x403ec1
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
xor eax, 0xf5f9597
cmp eax, dword [esp + 0x1c]
je 0x403f6f
mov ebp, dword [ebp]
cmp ebp, ebx
jne 0x403e20
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x404240
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub esp, 0x14
push ebp
mov ebp, ecx
mov dword [esp + 0x10], ebp
push edi
cmp edx, 0x40
jb 0x4043de
mov eax, 0x5a4d
cmp word [ebp], ax
jne 0x4043de
mov edi, dword [ebp + 0x3c]
add edi, ebp
mov dword [esp + 0x18], edi
cmp dword [edi], 0x4550
jne 0x4043de
mov eax, 0x10b
cmp word [edi + 0x18], ax
jne 0x4043de
mov eax, dword [0x40dda8]
test eax, eax
jne 0x4042ab
mov ecx, 0x802173e5
call fcn.00403df0
mov edx, 0x2c46dbc5
mov ecx, eax
call fcn.00403d50
mov dword [0x40dda8], eax
push ebx
push 0x40
push 0x3000
push dword [edi + 0x50]
push 0
call eax
mov ebx, eax
test ebx, ebx
je 0x4043d5
movzx ecx, word [edi + 0x14]
push esi
lea esi, [edi + 0x18]
add esi, ecx
movzx ecx, word [edi + 6]
mov dword [esp + 0x18], esi
lea ecx, [ecx + ecx*4]
lea eax, [esi + ecx*8]
mov dword [esp + 0x14], eax
mov eax, dword [edi + 0x54]
mov dword [esp + 0x10], eax
mov eax, dword [0x40e03c]
test eax, eax
jne 0x40430b
mov ecx, 0xdd71b583
call fcn.00403df0
mov edx, 0x282aa2f8
mov ecx, eax
call fcn.00403d50
mov dword [0x40e03c], eax
push dword [esp + 0x10]
push ebp
push ebx
call eax
mov ecx, dword [esp + 0x20]
add esp, 0xc
cmp esi, ecx
jae 0x40438e
sub ecx, dword [esp + 0x18]
mov eax, 0xcccccccd
dec ecx
add esi, 0x10
mul ecx
mov ecx, edx
shr ecx, 5
inc ecx
mov edi, ecx
mov ebp, dword [esi]
cmp dword [esi - 8], ebp
mov eax, dword [esi + 4]
cmovb ebp, dword [esi - 8]
add eax, dword [esp + 0x1c]
mov dword [esp + 0x18], eax
mov eax, dword [esi - 4]
add eax, ebx
mov dword [esp + 0x14], eax
mov eax, dword [0x40e03c]
test eax, eax
jne 0x404376
mov ecx, 0xdd71b583
call fcn.00403df0
mov edx, 0x282aa2f8
mov ecx, eax
call fcn.00403d50
mov dword [0x40e03c], eax
push ebp
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call eax
add esp, 0xc
add esi, 0x28
dec edi
jne 0x404335
mov edi, dword [esp + 0x20]
mov edx, edi
mov ecx, ebx
call fcn.00404510
mov edx, edi
mov ecx, ebx
call fcn.00404420
pop esi
test eax, eax
jne 0x4043d5
mov eax, dword [0x40e024]
test eax, eax
jne 0x4043c9
mov ecx, 0x802173e5
call fcn.00403df0
mov edx, 0xef65a2d8
mov ecx, eax
call fcn.00403d50
mov dword [0x40e024], eax
push 0x8000
push 0
push ebx
call eax
xor ebx, ebx
mov eax, ebx
pop ebx
pop edi
pop ebp
add esp, 0x14
ret
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
Function at 0x402575
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x104
mov eax, dword [0x44db30]
xor eax, esp
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x110]
push ebx
mov ebx, dword [esp + 0x10c]
push ebp
push esi
push edi
mov edi, dword [esp + 0x11c]
mov esi, ebx
push 7
push str.dta_tcc
push ebx
movsx ebp, ax
call fcn.00413c80
add esp, 0xc
test eax, eax
je 0x4025ca
lea eax, [esp + 0x10]
push eax
push ebx
call fcn.00402988
pop ecx
pop ecx
mov esi, eax
push 3
push 0x424434
push ebx
call fcn.00411c01
add esp, 0xc
test eax, eax
jne 0x4025eb
push ebp
push edi
push esi
call fcn.004024ec
add esp, 0xc
jmp 0x40265e
push 0x4241ac
push esi
call fcn.0040edf2
movzx eax, ax
pop ecx
pop ecx
test ax, ax
jns 0x402609
push ebp
push esi
push str.__Cant_open__s__msgnr___d
jmp 0x402640
movsx esi, ax
push 0
imul eax, ebp, 0x50
push 0x50
pop ecx
sub eax, ecx
push eax
push esi
call fcn.0041445f
push 0x50
pop eax
push eax
push edi
push esi
call fcn.004145f5
add esp, 0x18
mov word [0x452f48], ax
push 0x50
pop ecx
cmp ax, cx
je 0x40264d
push ebp
push ebx
push str.__Msgfile__s__error_in_message._Msgnr___d.
push edi
call fcn.00411b7d
mov byte [edi + 0x4e], 0x33
add esp, 0x10
lea esi, [edi + 0x4e]
push esi
call fcn.00413cf8
movzx eax, ax
pop ecx
mov byte [esi], 0
cwde
mov ecx, dword [esp + 0x110]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00413da7
add esp, 0x104
ret

Function at 0x4044ad
Capabilities:
Read file on windows

Disassembly:
push ecx
push dword [esp + 8]
call fcn.00404977
movzx eax, ax
pop ecx
test ax, ax
jns 0x4044c4
xor eax, eax
pop ecx
ret
push ebx
push ebp
push 0
movsx ebx, ax
push 0
push ebx
call fcn.0041445f
push 4
pop ebp
push ebp
push 0x43b09c
push ebx
call fcn.004145f5
add esp, 0x18
mov word [0x452f48], ax
cmp ax, bp
je 0x4044f8
push 0xfffffffffffffffd
pop eax
jmp 0x404599
push esi
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x40450a
mov esi, dword [esp + 0x20]
test esi, esi
jne 0x40451d
push 1
push dword [0x43b09c]
call fcn.00405ece
pop ecx
pop ecx
mov esi, eax
xor edi, edi
push esi
push dword [0x43b09c]
call fcn.004061d9
push 0x4614b4
mov ebp, eax
call fcn.00413cf8
add esp, 0xc
cmp edi, eax
jle 0x404540
push 0xfffffffffffffff8
jmp 0x404554
push dword [0x43b09c]
push esi
call fcn.00406407
pop ecx
pop ecx
test eax, eax
jns 0x404557
push 0xfffffffffffffff7
pop eax
jmp 0x404597
push 0x4614b4
call fcn.00413cf8
inc eax
imul eax, ebp
push 0
add eax, edi
shl eax, 2
push eax
push ebx
call fcn.0041445f
push 4
pop esi
push esi
lea eax, [esp + 0x24]
push eax
push ebx
call fcn.004145f5
xor ecx, ecx
mov word [0x452f48], ax
add esp, 0x1c
cmp ax, si
cmove ecx, dword [esp + 0x10]
mov eax, ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret