joyce8/EMBER2024-capa huggingface dataset:
Function at 0x888058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x8881a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x88807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x88806a
add dl, dl
jne 0x888089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8880dc
xor eax, eax
add dl, dl
jne 0x888096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x88817d
add dl, dl
jne 0x8880a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8880b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8880bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8880c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8880d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x888075
mov eax, 1
add dl, dl
jne 0x8880ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8880f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8880e1
sub eax, ebx
mov ebx, 1
jne 0x888128
mov ecx, 1
add dl, dl
jne 0x88810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x888119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x888105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x888075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x88813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x88814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x888136
cmp eax, 0x7d00
jae 0x88816d
cmp eax, 0x500
jb 0x888168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x888075
cmp eax, 0x7f
ja 0x888170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x888075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x88819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x888075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x57ca6d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push pe_nt_image_headers32
call fcn.00597adc
add esp, 4
mov dword [ebp - 4], eax
mov edi, eax
mov esi, 0x5bca32
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
xor eax, eax
mov ecx, 0x40
rep stosd dword es:[edi], eax
push pe_nt_image_headers32
call fcn.00597adc
add esp, 4
mov dword [ebp - 8], eax
mov edi, eax
mov esi, 0x5bca32
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
xor eax, eax
mov ecx, 0x40
rep stosd dword es:[edi], eax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 4]
xor eax, 0x12476359
mov dword [ebp + 4], eax
push eax
mov eax, dword [ebp]
xor eax, 0x97815643
mov dword [ebp], eax
push eax
mov ebx, dword [ebp - 4]
call fcn.0057ca4d
mov eax, 0
cmp eax, ecx
jl 0x57cb05
push 0x20b
push 0x4011022
push 1
call fcn.00597af4
add esp, 0xc
add ebx, eax
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x10]
mov byte [ebx], 0
mov ebx, dword [ebp - 8]
call fcn.0057ca4d
mov eax, 0
cmp eax, ecx
jl 0x57cb38
push 0x234
push 0x4011022
push 1
call fcn.00597af4
add esp, 0xc
add ebx, eax
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x10]
mov byte [ebx], 0
mov eax, dword [ebp - 4]
add eax, 8
mov ecx, 0x100
xor ebx, ebx
sub bl, cl
mov byte [ebx + eax], bl
loop 0x57cb4e
push eax
mov edx, dword [ebp + 0x10]
mov edx, dword [edx]
mov edi, dword [edx + 4]
add edx, 8
mov esi, dword [ebp - 8]
add esi, 8
mov ecx, 0x100
xor ebx, ebx
cmp ebx, edi
jb 0x57cb76
xor ebx, ebx
mov ah, byte [ebx + edx]
mov byte [esi], ah
inc esi
inc ebx
loop 0x57cb70
pop edi
xor ebx, ebx
sub esi, 0x100
xor eax, eax
mov ecx, 0x100
mov dl, byte [eax + esi]
add bl, dl
mov dl, byte [eax + edi]
add bl, dl
mov dl, byte [eax + edi]
mov dh, byte [ebx + edi]
mov byte [eax + edi], dh
mov byte [ebx + edi], dl
inc eax
loop 0x57cb8f
mov esi, dword [ebp + 8]
mov esi, dword [esi]
mov ecx, dword [esi + 4]
mov dword [ebp - 0xc], ecx
add esi, 8
push 0x80000301
push 0
push dword [ebp - 0xc]
push 1
mov ebx, 0x1bc
call fcn.005989d0
add esp, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp + 0xc]
mov ebx, dword [ebx]
test ebx, ebx
je 0x57cbeb
push ebx
call fcn.00597ad6
add esp, 4
pop eax
mov ebx, dword [ebp + 0xc]
mov dword [ebx], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
add edx, 8
xor eax, eax
xor ebx, ebx
push ecx
movzx ecx, al
inc cl
push edx
mov dh, byte [ecx + edi]
add bl, dh
mov dl, byte [ebx + edi]
mov byte [ecx + edi], dl
mov byte [ebx + edi], dh
add dl, dh
movzx edx, dl
mov dl, byte [edx + edi]
mov cl, byte [eax + esi]
xor cl, dl
pop edx
mov byte [eax + edx], cl
inc eax
pop ecx
loop 0x57cc00
push eax
pushfd
mov eax, dword [esp + 8]
xor eax, 0x97815643
mov dword [ebp], eax
mov eax, dword [esp + 0xc]
xor eax, 0x12476359
mov dword [ebp + 4], eax
xchg dword [esp + 4], eax
popfd
pop eax
mov ebx, dword [ebp - 4]
push ebx
call fcn.00597ad6
add esp, 4
mov ebx, dword [ebp - 8]
push ebx
call fcn.00597ad6
add esp, 4
mov esp, ebp
pop ebp
ret 0xc
Function at 0x599450
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x59946e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x599463
pop esi
ret

Function at 0x59cb0a
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.0059cb89
jae 0x59cb16
xor ecx, ecx
call fcn.0059cb89
jae 0x59cb40
xor eax, eax
call fcn.0059cb89
jae 0x59cb51
mov al, 0x10
call fcn.0059cb89
adc al, al
jae 0x59cb32
jne 0x59cb7e
stosb byte es:[edi], al
jmp 0x59cb17
call fcn.0059cb95
dec ecx
loop 0x59cb5d
mov eax, ebp
call fcn.0059cb93
jmp 0x59cb7f
lodsb al, byte [esi]
shr eax, 1
je 0x59cba5
adc ecx, 2
mov ebp, eax
jmp 0x59cb7f
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.0059cb93
cmp eax, 0x7d00
jae 0x59cb7d
cmp eax, 0x500
jae 0x59cb7e
cmp eax, 0x7f
ja 0x59cb7f
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x59cb17
pop ebp
ret 8

Function at 0x5daf49
Capabilities:
Check for software breakpoints
Encode data using base64

Disassembly:
push dword [esp + 4]
popfd
lea esp, [esp + 0x10]
call fcn.0071b7ba

Function at 0x60320f
Capabilities:
Check for software breakpoints
Check http status code
Encode data using base64
Parse pe header

Disassembly:
mov eax, dword [eax + 4]
test edi, 0x66113c46
cmp eax, 0x42792bda
add eax, 8
push eax
call fcn.00597adc
pop ecx
pop esi
mov bx, dx
xchg bx, di
mov edi, eax
movsx ebx, cx
bswap bx
mov bx, 0x331a
rep movsb byte es:[edi], byte [esi]
not bl
sete bl
bswap esi
pop edi
pop esi
movzx cx, ah
stosd dword es:[edi], eax
bswap cx
movsx ebx, bp
cbw
mov ecx, 3
movsx ebx, cx
rep movsd dword es:[edi], dword [esi]
pop eax
sbb edi, edi
pop edi
mov dword [edi], eax
rcl bh, cl
shr ebx, cl
cmp ebp, eax
mov ebx, dword [ebp - 0x70]
clc
push ebx
cmp edi, 0x29803894
jmp 0x601f80
add ebx, 4
stc
clc
push ebx
test sp, 0x440e
mov ebx, dword [ebx]
test ebx, ebx
je 0x601fa0
push ebx
call fcn.00597ad6
add esp, 4
xchg bl, bl
pop ebx
call fcn.00597ad6
add esp, 4
cwde
not ax
push dword [esp + 0x30]
popfd
lea esp, [esp + 0x40]
call fcn.005de963
stosd dword es:[edi], eax
movzx ax, cl
lodsd eax, dword [esi]
push esi
clc
cmc
push edi
clc
test sp, bx
test eax, 0x3e303414
test eax, eax
je 0x5f8482
push eax
jmp 0x5f844e

Function at 0x653aac
Capabilities:
Authenticate hmac

Disassembly:
mov dword [ebp - 4], 0
jmp 0x6da11b
stosd dword es:[edi], eax
lodsd eax, dword [esi]
jmp 0x6b35fa
push ebp
mov ebp, esp
sub esp, 0x98
jmp 0x621af7
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
jmp 0x62024d
stosd dword es:[edi], eax
jmp 0x6b578d
mov dword [ebp - 0xc], 0
jmp 0x6692fb
push 8
call fcn.00597adc
add esp, 4
xchg di, si
movsx edi, cx
mov dword [ebp - 8], eax
movsx esi, bp
mov edi, eax
cbw
mov esi, 0x59c23e
movsx ax, dh
lodsd eax, dword [esi]
jmp 0x651869
Function at 0x71c9aa
Capabilities:
Authenticate hmac

Disassembly:
push esi
pushfd
mov esi, 0x149741e
call fcn.006b33ea
Function at 0x7451b2
Capabilities:
Authenticate hmac
Encode data using base64
Parse pe header

Disassembly:
xor dword [esp + 0xc], 0x1b9e1148
push dword [esp + 8]
popfd
lea esp, [esp + 0x10]
call fcn.006b3a05
push esi
jne 0x657e59
cmc

Function at 0x74f693
Capabilities:
Check for software breakpoints
Check http status code
Encode data using base64
Parse pe header

Disassembly:
push dword [esp + 0x10]
popfd
lea esp, [esp + 0x20]
call fcn.0061fb0b

Function at 0x751071
Capabilities:
Check for software breakpoints
Check http status code
Encode data using base64
Parse pe header

Disassembly:
mov dword [esp + 4], 0xfd091814
pushfd
call fcn.0057dbf7
Function at 0x40686f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x460114], 0
jne 0x4068ad
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406883
mov dword [ecx*4 + 0x460110], eax
inc ecx
cmp ecx, 0x100
jl 0x40687e
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x4068da
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x460110]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4068bb
not eax
pop ebp
ret 0xc

Function at 0x10471058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x104711a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1047107e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1047106a
add dl, dl
jne 0x10471089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104710dc
xor eax, eax
add dl, dl
jne 0x10471096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1047117d
add dl, dl
jne 0x104710a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104710b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104710bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104710c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x104710d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10471075
mov eax, 1
add dl, dl
jne 0x104710ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104710f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104710e1
sub eax, ebx
mov ebx, 1
jne 0x10471128
mov ecx, 1
add dl, dl
jne 0x1047110e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10471119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10471105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10471075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1047113f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1047114a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10471136
cmp eax, 0x7d00
jae 0x1047116d
cmp eax, 0x500
jb 0x10471168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10471075
cmp eax, 0x7f
ja 0x10471170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10471075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1047119e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10471075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x402ca3
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x409290
call fcn.00403768
mov edi, 0x94
mov eax, edi
call fcn.00405cb0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x40b900], ecx
mov eax, dword [esi + 4]
mov dword [0x40b90c], eax
mov edx, dword [esi + 8]
mov dword [0x40b910], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x40b904], esi
cmp ecx, 2
je 0x402d03
or esi, 0x8000
mov dword [0x40b904], esi
shl eax, 8
add eax, edx
mov dword [0x40b908], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x402d3e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x402d3e
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x402d56
cmp eax, 0x20b
je 0x402d43
mov dword [ebp - 0x1c], esi
jmp 0x402d6a
cmp dword [ecx + 0x84], 0xe
jbe 0x402d3e
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x402d64
cmp dword [ecx + 0x74], 0xe
jbe 0x402d3e
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push esi
call fcn.00405c5c
pop ecx
test eax, eax
jne 0x402d96
cmp dword [0x40b8ac], 1
jne 0x402d83
call fcn.00405411
push 0x1c
call fcn.00405299
push 0xff
call fcn.004050fe
pop ecx
pop ecx
call fcn.00405bba
mov dword [ebp - 4], esi
call fcn.00405a0f
test eax, eax
jge 0x402daf
push 0x1b
call fcn.00402c7e
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x40ce94], eax
call fcn.004058ed
mov dword [0x40b8a4], eax
call fcn.0040584b
test eax, eax
jge 0x402dd5
push 8
call fcn.00402c7e
pop ecx
call fcn.00405618
test eax, eax
jge 0x402de6
push 9
call fcn.00402c7e
pop ecx
push 1
call fcn.0040512e
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x402dfc
push eax
call fcn.00402c7e
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.004055bb
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x402e1d
movzx eax, word [ebp - 0x40]
jmp 0x402e20
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.00401be0
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x402e3e
push edi
call fcn.00405259
call fcn.0040527b
jmp 0x402e70
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.004037a3
ret
Function at 0x405198
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
inc esi
cmp dword [0x40b940], esi
push edi
jne 0x4051b8
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x40b93c], esi
mov byte [0x40b938], al
jne 0x40521e
mov ecx, dword [0x40ce88]
test ecx, ecx
je 0x4051ff
mov eax, dword [0x40ce84]
sub eax, 4
cmp eax, ecx
jmp 0x4051f8
mov eax, dword [eax]
test eax, eax
je 0x4051ea
call eax
mov eax, dword [0x40ce84]
sub eax, 4
cmp eax, dword [0x40ce88]
mov dword [0x40ce84], eax
jae 0x4051e2
mov eax, 0x40b024
mov esi, 0x40b02c
cmp eax, esi
mov edi, eax
jae 0x40521e
mov eax, dword [edi]
test eax, eax
je 0x405217
call eax
add edi, 4
cmp edi, esi
jb 0x40520f
mov eax, 0x40b030
mov esi, 0x40b038
cmp eax, esi
mov edi, eax
jae 0x40523d
mov eax, dword [edi]
test eax, eax
je 0x405236
call eax
add edi, 4
cmp edi, esi
jb 0x40522e
cmp dword [ebp + 0x10], 0
pop edi
pop esi
jne 0x405257
push dword [ebp + 8]
mov dword [0x40b940], 1
call fcn.004050fe
pop ebp
ret

Function at 0x405299
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x40b0e0]
mov ecx, dword [ebp + 0x98]
push ebx
xor eax, ebp
push esi
mov dword [ebp + 0x8c], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x40b168]
je 0x4052d0
inc eax
cmp eax, 0x13
jb 0x4052c1
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x40b168]
jne 0x4053f3
mov eax, dword [0x40b8ac]
cmp eax, 1
je 0x4053ce
cmp eax, edx
jne 0x405300
cmp dword [0x40b104], 1
je 0x4053ce
cmp ecx, 0xfc
je 0x4053f3
push 0x104
lea eax, [ebp - 0x7c]
push eax
push edx
mov byte [ebp + 0x88], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x405336
lea eax, [ebp - 0x7c]
push str._program_name_unknown_
push eax
call fcn.004068a0
pop ecx
pop ecx
lea edi, [ebp - 0x7c]
mov eax, edi
push eax
call fcn.00402f20
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x40536a
mov eax, edi
push eax
call fcn.00402f20
mov edi, eax
lea eax, [ebp - 0x7c]
sub eax, 0x3b
push 3
add edi, eax
push 0x4092fc
push edi
call fcn.004071f0
add esp, 0x10
push edi
call fcn.00402f20
push dword [esi + 0x40b16c]
mov ebx, eax
call fcn.00402f20
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.00405cb0
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.004068a0
push edi
push ebx
call fcn.004068b0
push 0x4092f8
push ebx
call fcn.004068b0
push dword [esi + 0x40b16c]
push ebx
call fcn.004068b0
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.004070ed
add esp, 0x2c
jmp 0x4053f3
push edx
lea eax, [ebp - 0x80]
push eax
lea esi, [esi + 0x40b16c]
push dword [esi]
call fcn.00402f20
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x8c]
xor ecx, ebp
call fcn.004025ce
add ebp, 0x90
leave
ret
Function at 0x1000e7f0
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x1000e9b4
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa000]
push edi
or ebp, 0xffffffff
jmp 0x1000e81a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1000e821
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1000e810
mov eax, 1
add ebx, ebx
jne 0x1000e833
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1000e828
jne 0x1000e844
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1000e828
xor ecx, ecx
sub eax, 3
jb 0x1000e858
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1000e8ca
mov ebp, eax
add ebx, ebx
jne 0x1000e863
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x1000e870
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x1000e894
inc ecx
add ebx, ebx
jne 0x1000e880
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1000e875
jne 0x1000e891
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1000e875
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1000e8b4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1000e8a5
jmp 0x1000e816
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1000e8b4
add edi, ecx
jmp 0x1000e816
pop esi
mov edi, esi
mov ecx, 0x152
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x1000e8d2
cmp byte [edi], 3
jne 0x1000e8d2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x1000e8d7
lea edi, [esi + 0xb000]
mov eax, dword [edi]
or eax, eax
je 0x1000e946
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xe408]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xe4d0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1000e904
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xe4d4]
or eax, eax
je 0x1000e940
mov dword [ebx], eax
add ebx, 4
jmp 0x1000e921
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x1000e977
cmp al, 0xef
ja 0x1000e96a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x1000e94c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x1000e959
mov ebp, dword [esi + 0xe4d8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1000e9ab
sub esp, 0xffffff80
jmp 0x10004ffd
Function at 0x10005300
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002e940
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x1003f048]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.1000cfcc
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.1000c17a
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
lea edi, [eax + 0x14]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov ebx, dword [ebp - 0x10]
mov dword [edi], 0
mov dword [edx], 0
mov dword [eax + 0x20], ecx
mov dword [ebx], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x3d], 0
mov ebx, dword [ebp - 0x14]
mov dword [eax + 0xc], ebx
mov ebx, dword [ebp - 0x10]
mov dword [eax + 0x2c], edx
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov eax, dword [ebp - 0x18]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov ecx, dword [0x1004110c]
mov dword [eax], 0
mov eax, dword [0x10041108]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x40], eax
mov eax, edx
mov dword [edx + 0x4c], 0
mov dword [edx + 0x44], ecx
mov dword [edx + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001a50f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1001a54e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001a54e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001a54e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1001a54e
cmp dword [ecx + 0x74], 0xe
jbe 0x1001a54e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x100200f7
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10034408
push 0x10034400
push str.FlsAlloc
push 0x1f
call fcn.1001ffbf
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002012b
push dword [ebp + 8]
mov ecx, esi
call dword [0x10030150]
call esi
jmp 0x10020131
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10020175
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10034418
push 0x10034410
push str.FlsGetValue
push 0x21
call fcn.1001ffbf
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100201ac
push dword [ebp + 8]
mov ecx, esi
call dword [0x10030150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x100201b4
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10034420
push 0x10034418
push str.FlsSetValue
push 0x22
call fcn.1001ffbf
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100201ee
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10030150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]