joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6c4c7a2c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0xbc
mov eax, dword [ebp + 8]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xa8], eax
call sym._is_dll__6873nvoke_u138_4
mov dword [esp], 0x6c4da124
mov esi, eax
call sym.___emutls_get_address
cmp byte [eax], 0
mov dword [ebp - 0xa0], eax
jne 0x6c4c7b59
test esi, esi
je 0x6c4c7b4f
mov esi, ebx
add esi, dword [ebx + 0x3c]
jo 0x6c4c7ab5
lea eax, [ebp - 0x98]
add esi, 0x78
mov ecx, 0x20
mov edi, eax
rep movsd dword es:[edi], dword [esi]
cmp dword [ebp - 0x94], 0
je 0x6c4c7b4f
mov edi, dword [ebp - 0x98]
test edi, edi
je 0x6c4c7b4f
xor eax, eax
add edi, ebx
seto al
mov esi, eax
jno 0x6c4c7abf
call sym._raiseOverflow
jmp 0x6c4c7b59
mov eax, dword [edi + 0x18]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0xa8]
or eax, dword [ebp - 0xa4]
je 0x6c4c7b4f
cmp esi, dword [ebp - 0xac]
jg 0x6c4c7b4f
imul eax, esi, 4
jo 0x6c4c7ab5
add eax, dword [edi + 0x20]
jo 0x6c4c7ab5
add eax, ebx
jo 0x6c4c7ab5
mov ecx, ebx
add ecx, dword [eax]
jo 0x6c4c7ab5
call sym._getHash__6873nvoke_u95_4
mov ecx, dword [ebp - 0xa0]
cmp byte [ecx], 0
jne 0x6c4c7b59
cmp dword [ebp - 0xa8], edx
jne 0x6c4c7b12
cmp dword [ebp - 0xa4], eax
je 0x6c4c7b19
add esi, 1
jno 0x6c4c7ad6
jmp 0x6c4c7ab5
imul esi, esi, 2
jo 0x6c4c7ab5
add esi, dword [edi + 0x24]
jo 0x6c4c7ab5
add esi, ebx
jo 0x6c4c7ab5
mov ax, word [esi]
shl eax, 2
movzx eax, ax
add eax, dword [edi + 0x1c]
jo 0x6c4c7ab5
add eax, ebx
jo 0x6c4c7ab5
add ebx, dword [eax]
jo 0x6c4c7ab5
mov dword [ebp - 0x9c], ebx
test ebx, ebx
jne 0x6c4c7b59
mov dword [ebp - 0x9c], 0
mov eax, dword [ebp - 0x9c]
add esp, 0xbc
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
Function at 0x6c4c7b6c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
push ebx
sub esp, 0x4c
mov dword [ebp - 0x2c], ecx
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
lea edx, [eax + 0x14]
mov esi, dword [eax + 0x14]
mov dword [ebp - 0x30], edx
mov eax, dword [esi + 0x28]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call dword [0x6c4e306c]
push edx
push edx
test eax, eax
je 0x6c4c7bae
mov esi, dword [esi]
cmp dword [ebp - 0x30], esi
jne 0x6c4c7b8c
jmp 0x6c4c7bb6
mov eax, dword [esi + 0x10]
jmp 0x6c4c7d1d
not edi
mov ecx, edi
call sym._winimConverterBOOLToBoolean__winimZutils_u5_4
mov dword [esp], 0x6c4da124
mov edi, eax
call sym.___emutls_get_address
cmp byte [eax], 0
mov esi, eax
jne 0x6c4c7d1b
mov eax, edi
test al, al
jne 0x6c4c7d1b
mov eax, dword [0x6c4db834]
mov edx, dword [0x6c4db838]
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._winstrConverterStringToLPWSTR__winimZwinstr_u1291_8
push ecx
push ecx
cmp byte [esi], 0
mov ecx, eax
jne 0x6c4c7d1b
xor edx, edx
call sym._get_library_address__6873nvoke_u140_8
cmp byte [esi], 0
mov ecx, eax
jne 0x6c4c7d1b
mov dword [esp + 8], 0
mov dword [esp], 0xd02065c1
mov dword [esp + 4], 0
call sym._get_function_address__6873nvoke_u143_16
sub esp, 0xc
cmp byte [esi], 0
mov edi, eax
jne 0x6c4c7d1b
test eax, eax
je 0x6c4c7d1b
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], eax
mov dword [esp], eax
call dword [0x6c4e307c]
push edx
mov edx, eax
test eax, eax
jns 0x6c4c7c98
sar edx, 0x1f
mov dword [esp + 0x10], 0x7fffffff
mov dword [esp + 0x14], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._raiseRangeErrorI
jmp 0x6c4c7ca5
mov ecx, dword [ebp - 0x2c]
call sym._UNICODEminusgtstring___winimZwinstr_u206_8
mov dword [ebp - 0x34], eax
mov ebx, edx
cmp byte [esi], 0
jne 0x6c4c7d09
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x24], 0
mov dword [esp + 4], 0
add eax, eax
mov dword [esp], 0
mov word [ebp - 0x20], ax
add eax, 2
mov word [ebp - 0x1e], ax
lea eax, [ebp - 0x24]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x20]
mov dword [esp + 8], eax
call edi
sub esp, 0x10
cmp byte [esi], 0
jne 0x6c4c7d09
test eax, eax
js 0x6c4c7d09
mov eax, dword [ebp - 0x24]
test ebx, ebx
je 0x6c4c7d1d
bt dword [ebx], 0x1e
jb 0x6c4c7d1d
mov dword [esp], ebx
mov dword [ebp - 0x2c], eax
call sym._deallocShared
mov eax, dword [ebp - 0x2c]
jmp 0x6c4c7d1d
test ebx, ebx
je 0x6c4c7d1b
bt dword [ebx], 0x1e
jb 0x6c4c7d1b
mov dword [esp], ebx
call sym._deallocShared
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6c4c8870
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call sym.___acrt_iob_func
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], 0x6c4db9fc
call sym._fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call sym.___acrt_iob_func
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._vfprintf
call sym._abort
Function at 0x6c4c9164
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x6c4c9183
mov eax, 0
jmp 0x6c4c91c7
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x6c4c91a6
mov eax, 0
jmp 0x6c4c91c7
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x6c4c91c2
mov eax, 0
jmp 0x6c4c91c7
mov eax, 1
leave
ret

Function at 0x6c4c91c9
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x6c4c9228
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x6c4c9220
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x6c4c9220
mov eax, dword [ebp - 4]
jmp 0x6c4c923c
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x6c4c91fd
mov eax, 0
leave
ret
Function at 0x6c4d05a9
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
add esp, 0xffffff80
cmp dword [ebp + 8], 0
je 0x6c4d06c2
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._pthread_spin_destroy
cmp eax, 1
jne 0x6c4d06b8
mov dword [ebp - 0x77], 0x6f727245
mov dword [ebp - 0x73], 0x6c632072
mov dword [ebp - 0x6f], 0x696e6165
mov dword [ebp - 0x6b], 0x7520676e
mov dword [ebp - 0x67], 0x70732070
mov dword [ebp - 0x63], 0x6b5f6e69
mov dword [ebp - 0x5f], 0x20737965
mov dword [ebp - 0x5b], 0x20726f66
mov dword [ebp - 0x57], 0x65726874
mov dword [ebp - 0x53], 0x206461
lea eax, [ebp - 0x4f]
mov ecx, 0x43
mov ebx, 0
mov dword [eax], ebx
mov dword [eax + ecx - 4], ebx
lea edx, [eax + 4]
and edx, 0xfffffffc
sub eax, edx
add ecx, eax
and ecx, 0xfffffffc
shr ecx, 2
mov edi, edx
mov eax, ebx
rep stosd dword es:[edi], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov dword [esp + 8], 0xa
lea edx, [ebp - 0x77]
add edx, 0x27
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__ultoa]
call eax
mov dword [ebp - 0xc], 0x27
jmp 0x6c4d066e
add dword [ebp - 0xc], 1
lea edx, [ebp - 0x77]
mov eax, dword [ebp - 0xc]
add eax, edx
movzx eax, byte [eax]
test al, al
je 0x6c4d0685
mov eax, dword [ebp - 0xc]
cmp eax, 0x69
jbe 0x6c4d066a
mov eax, dword [ebp - 0xc]
cmp eax, 0x69
ja 0x6c4d06a3
lea edx, [ebp - 0x77]
mov eax, dword [ebp - 0xc]
add eax, edx
mov byte [eax], 0xa
mov eax, dword [ebp - 0xc]
add eax, 1
mov byte [ebp + eax - 0x77], 0
lea eax, [ebp - 0x77]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call eax
sub esp, 4
call sym._abort
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [eax], edx
jmp 0x6c4d06c3
nop
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret
Function at 0x6c4d14ca
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [sym.imp.KERNEL32.dll_TlsAlloc]
call eax
mov dword [0x6c4da23c], eax
mov eax, dword [0x6c4da23c]
cmp eax, 0xffffffff
jne 0x6c4d14eb
call sym._abort
nop
leave
ret

Function at 0x6c4d165d
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [ebp - 0x1c], 0xffffffff
mov dword [esp + 4], sym._pthread_tls_init
mov dword [esp], 0x6c4e3afc
call sym.__pthread_once_raw
mov eax, dword [0x6c4da23c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x6c4d16a4
mov eax, dword [ebp - 0x20]
jmp 0x6c4d17ef
call sym._pop_pthread_mem
mov dword [ebp - 0x20], eax
mov eax, dword [entry3]
test eax, eax
je 0x6c4d16bb
cmp dword [ebp - 0x20], 0
jne 0x6c4d16c5
mov eax, 0
jmp 0x6c4d17ef
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x24], 1
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateEventA]
call eax
sub esp, 0x10
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x1c], 0xffffffff
mov eax, dword [ebp - 0x20]
lea edx, [eax + 0x38]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], edx
call sym._replace_spin_keys
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x64], 0
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x20]
lea edi, [eax + 0x14]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call eax
mov ebx, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
call eax
sub esp, 0x1c
test eax, eax
jne 0x6c4d1797
call sym._abort
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetThreadPriority]
call eax
sub esp, 4
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x6c], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x68], 0
mov eax, dword [ebp - 0x20]
movzx edx, byte [eax + 0x20]
and edx, 0xffffffcf
or edx, 0x10
mov byte [eax + 0x20], dl
mov eax, dword [0x6c4da23c]
mov edx, dword [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
test eax, eax
jne 0x6c4d17ec
call sym._abort
mov eax, dword [ebp - 0x20]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6c4d18b3
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
call sym.___pthread_self_lite
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xb4]
mov dword [esp], eax
call sym.__pthread_cleanup_dest
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + 0x20]
and eax, 0x30
test al, al
jne 0x6c4d190e
mov eax, dword [ebp - 0x14]
add eax, 0x70
mov dword [esp + 4], 1
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll_longjmp]
call eax
mov eax, dword [0x6c4da23c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x6c4d1a38
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x6c4d19a0
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x6c4d195d
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._push_pthread_mem
mov dword [ebp - 0x10], 0
mov eax, dword [0x6c4da23c]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
jmp 0x6c4d1a38
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x68], 1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x6c4d19d0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x24]
and eax, 4
test eax, eax
je 0x6c4d1a38
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._push_pthread_mem
mov dword [ebp - 0x10], 0
mov eax, dword [0x6c4da23c]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__endthreadex]
call eax
Function at 0x4013ca
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x406054], 1
mov dword [0x406058], 1
mov dword [0x40605c], 1
mov dword [ebp - 4], 0x400000
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40140b
mov eax, 0
jmp 0x4014a5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40142e
mov eax, 0
jmp 0x4014a5
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
movzx eax, ax
cmp eax, 0x10b
je 0x401450
cmp eax, 0x20b
je 0x401475
jmp 0x4014a0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x5c]
cmp eax, 0xe
ja 0x401462
mov eax, 0
jmp 0x4014a5
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x4014a5
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x6c]
cmp eax, 0xe
ja 0x40148d
mov eax, 0
jmp 0x4014a5
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x4014a5
mov eax, 0
leave
ret

Function at 0x401968
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call sym.___acrt_iob_func
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call sym.___acrt_iob_func
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._vfprintf
call sym._abort

Function at 0x40253c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40255b
mov eax, 0
jmp 0x40259f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40257e
mov eax, 0
jmp 0x40259f
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x40259a
mov eax, 0
jmp 0x40259f
mov eax, 1
leave
ret
Function at 0x4025a1
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x402600
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x4025f8
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x4025f8
mov eax, dword [ebp - 4]
jmp 0x402614
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x4025d5
mov eax, 0
leave
ret
Function at 0x401c60
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x407048
call sym._EnterCriticalSection_4
mov ebx, dword [0x407040]
sub esp, 4
test ebx, ebx
je 0x401cab
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401ca4
test esi, esi
je 0x401ca4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401c80
mov dword [esp], 0x407048
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x401e90
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x401ee0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x401fb8
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x401f1e
cmp eax, 4
jne 0x401f40
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x401f2e
cmp edx, 4
je 0x401f2e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00401e90
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ed0
mov ecx, 0x40061e46
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x32e931ef
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x409f94
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x40a047
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]

Function at 0x40a6b2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x40a6d5
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x40a6d5
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x40a6df
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x40a721
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x40a783
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x40a77e
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x40a769
test dl, dl
je 0x40a765
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x40a769
add ecx, 2
add eax, 2
test dl, dl
jne 0x40a749
xor eax, eax
jmp 0x40a76e
sbb eax, eax
or eax, 1
test eax, eax
je 0x40a78f
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x40a736
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8

Function at 0x40a82c
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
jge 0x40a84e
mov eax, 0xfffffffd
jmp 0x40a920
cmp dword [0x873848], 0
je 0x40a8f9
cmp dword [0x87384c], 5
jl 0x40a87c
cmp dword [0x87384c], 7
jg 0x40a87c
mov eax, 1
jmp 0x40a881
mov eax, 0
test eax, eax
jne 0x40a89a
cmp dword [0x87384c], 0xfffffffb
je 0x40a89a
xor eax, eax
jmp 0x40a89f
mov eax, 1
test eax, eax
je 0x40a8cb
mov eax, dword [ebp]
add eax, 0x80
mov ecx, 0x20
push dword [eax]
sub eax, 4
loop 0x40a8b4
mov eax, dword [ebp + 8]
call dword fs:[0xc0]
nop
nop
leave
ret 4
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0xffff
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [ebp]
lea edx, [edx + 8]
call dword fs:[0xc0]
nop
nop
nop
nop
nop
leave
ret 4
cmp dword [0x873848], 0
jne 0x40a916
mov eax, dword [ebp + 8]
mov edx, dword [ebp]
lea edx, [edx + 8]
int 0x2e
nop
leave
ret 4
mov eax, 0
jmp 0x40a920
mov esp, ebp
pop ebp
ret 4