joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100017c1
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push edi
push 0x14
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
pop ecx
test edi, edi
je 0x1000185c
push str.jvm.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x100017f3
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
xor eax, eax
jmp 0x1000185e
push esi
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.JVM_DTraceGetVersion
push ebx
call esi
push str.JVM_DTraceIsSupported
push ebx
mov dword [edi], eax
call esi
push str.JVM_DTraceActivate
push ebx
mov dword [edi + 4], eax
call esi
push str.JVM_DTraceDispose
push ebx
mov dword [edi + 8], eax
call esi
push str.JVM_DTraceIsProbeEnabled
push ebx
mov dword [edi + 0xc], eax
call esi
push ebx
mov dword [edi + 0x10], eax
call dword [sym.imp.kernel32.dll_FreeLibrary]
xor esi, esi
cmp dword [edi], esi
je 0x10001851
cmp dword [edi + 4], esi
je 0x10001851
cmp dword [edi + 8], esi
je 0x10001851
cmp dword [edi + 0xc], esi
je 0x10001851
cmp dword [edi + 0x10], esi
jne 0x1000185b
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
mov edi, esi
pop esi
mov eax, edi
pop edi
pop ebx
ret

Function at 0x100022cf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x100022de
pop dword [ebp - 0x30]
mov eax, 0x1362c828
sub eax, 0x362a54a
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xdecd80da
add dword [ebp - 0x40], 0x6f84c471
mov dword [ebp - 0x3c], 0x6309ea6
add dword [ebp - 0x3c], 0x2c02ad9f
mov dword [ebp - 0x38], 0x25392335
sub dword [ebp - 0x38], 0xd8ecdf07
mov dword [ebp - 0x34], 0x41e06e5f
add dword [ebp - 0x34], 0xbe1f91a1
lea eax, [ebp - 0x40]
push eax
mov eax, 0x37a2cdf0
add eax, 0xd85d6214
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xeec81749
add dword [ebp - 0x40], 0x85aa520d
mov dword [ebp - 0x3c], 0x75aaf575
add dword [ebp - 0x3c], 0xcbc16c00
mov dword [ebp - 0x38], 0x7ff7d334
add dword [ebp - 0x38], 0xe3779938
mov dword [ebp - 0x34], 0x6074c985
add dword [ebp - 0x34], 0x9f8b367b
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x82161351
sub eax, 0x7215e349
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x39c32
push 0
call eax
mov ecx, 0x551a
xor edi, edi
add edi, eax
mov edx, 0x10006200
add edx, dword [ebp - 0x30]
mov esi, 0xef1b2438
add dword [ebp - 0x2c], eax
mov ebx, dword [edx]
xor dword [ebp - 0x28], 0x73f73aa6
xor ebx, esi
add dword [ebp - 0x14], 0xa9ce0918
mov dword [edi], ebx
add dword [ebp - 0x1c], 0x864da5d4
add edi, 0xb40f232c
sub edi, 0xb40f2328
add edx, 4
loop 0x100023f0
add eax, 0xd419469b
sub eax, 0xd417ff60
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x5aa9ca1a
sub ecx, 0x4aa9ca1a
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x54cef0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xc7000]
push edi
or ebp, 0xffffffff
jmp 0x54cf12
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x54cf19
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x54cf08
mov eax, 1
add ebx, ebx
jne 0x54cf2b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x54cf20
jne 0x54cf3c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x54cf20
xor ecx, ecx
sub eax, 3
jb 0x54cf50
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x54cfc2
mov ebp, eax
add ebx, ebx
jne 0x54cf5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x54cf68
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x54cf8c
inc ecx
add ebx, ebx
jne 0x54cf78
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x54cf6d
jne 0x54cf89
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x54cf6d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x54cfac
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x54cf9d
jmp 0x54cf0e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x54cfac
add edi, ecx
jmp 0x54cf0e
pop esi
mov edi, esi
mov ecx, 0x5559
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x54cfca
cmp byte [edi], 0x1e
jne 0x54cfca
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x54cfcf
lea edi, [esi + 0x148000]
mov eax, dword [edi]
or eax, eax
je 0x54d047
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x14f988]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x14fab4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x54cffc
mov ecx, edi
jns 0x54d02b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x14fab8]
or eax, eax
je 0x54d041
mov dword [ebx], eax
add ebx, 4
jmp 0x54d019
call dword [esi + 0x14fac8]
mov ebp, dword [esi + 0x14fabc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x54d07b
sub esp, 0xffffff80
jmp 0x4b629a
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x23150a75
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x1b401c2a
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x41cee0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1a000]
push edi
or ebp, 0xffffffff
jmp 0x41cf02
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41cf09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41cef8
mov eax, 1
add ebx, ebx
jne 0x41cf1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41cf10
jne 0x41cf2c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41cf10
xor ecx, ecx
sub eax, 3
jb 0x41cf40
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41cfb2
mov ebp, eax
add ebx, ebx
jne 0x41cf4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41cf58
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41cf7c
inc ecx
add ebx, ebx
jne 0x41cf68
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41cf5d
jne 0x41cf79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41cf5d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41cf9c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41cf8d
jmp 0x41cefe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41cf9c
add edi, ecx
jmp 0x41cefe
pop esi
mov edi, esi
mov ecx, 0x157
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41cfba
cmp byte [edi], 0
jne 0x41cfba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x41cfbf
lea edi, [esi + 0x1a000]
mov eax, dword [edi]
or eax, eax
je 0x41d02e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1d0b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1d100]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41cfec
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1d104]
or eax, eax
je 0x41d028
mov dword [ebx], eax
add ebx, 4
jmp 0x41d009
call dword [esi + 0x1d108]
popal
jmp 0x403ab4
Function at 0x606290
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x14b000]
push edi
or ebp, 0xffffffff
jmp 0x6062b2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x6062b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6062a8
mov eax, 1
add ebx, ebx
jne 0x6062cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x6062dc
jne 0x6062fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6062fb
dec eax
add ebx, ebx
jne 0x6062e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x6062c0
add ebx, ebx
jne 0x6062f7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x60634d
xor ecx, ecx
sub eax, 3
jb 0x606313
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x606382
sar eax, 1
mov ebp, eax
jmp 0x60631e
add ebx, ebx
jne 0x60631e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6062ec
inc ecx
add ebx, ebx
jne 0x60632c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6062ec
add ebx, ebx
jne 0x606339
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x60632e
jne 0x60634a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x60632e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x60636c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x60635e
jmp 0x6062ae
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x60636c
add edi, ecx
jmp 0x6062ae
pop esi
mov edi, esi
mov ecx, 0xb186
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x60638a
cmp byte [edi], 0x19
jne 0x60638a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x60638f
lea edi, [esi + 0x1f2000]
mov eax, dword [edi]
or eax, eax
je 0x606407
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x207be4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x207d38]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x6063bc
mov ecx, edi
jns 0x6063eb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x207d3c]
or eax, eax
je 0x606401
mov dword [ebx], eax
add ebx, 4
jmp 0x6063d9
call dword [esi + 0x207d4c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x606438
cmp al, 0xef
ja 0x60642b
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x60640d
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x60641a
mov ebp, dword [esi + 0x207d40]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x60646c
sub esp, 0xffffff80
jmp 0x533d15
Function at 0x423aa4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00419328
and dword [ebp - 4], 0
cmp dword [0x43879c], 0
mov ebx, eax
jne 0x423b55
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x423c06
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x423c06
push eax
call fcn.004192b6
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43879c], eax
call esi
push eax
call fcn.004192b6
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4387a0], eax
call esi
push eax
call fcn.004192b6
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4387a4], eax
call esi
push eax
call fcn.004192b6
pop ecx
mov dword [0x4387ac], eax
test eax, eax
je 0x423b55
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004192b6
pop ecx
mov dword [0x4387a8], eax
mov eax, dword [0x4387a8]
cmp eax, ebx
je 0x423bad
cmp dword [0x4387ac], ebx
je 0x423bad
push eax
call fcn.00419331
push dword [0x4387ac]
mov esi, eax
call fcn.00419331
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x423bad
test edi, edi
je 0x423bad
call esi
test eax, eax
je 0x423ba4
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x423ba4
test byte [ebp - 0xc], 1
jne 0x423bad
or dword [ebp + 0x10], 0x200000
jmp 0x423be6
mov eax, dword [0x4387a0]
cmp eax, ebx
je 0x423be6
push eax
call fcn.00419331
pop ecx
test eax, eax
je 0x423be6
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x423be6
mov eax, dword [0x4387a4]
cmp eax, ebx
je 0x423be6
push eax
call fcn.00419331
pop ecx
test eax, eax
je 0x423be6
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43879c]
call fcn.00419331
pop ecx
test eax, eax
je 0x423c06
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x423c08
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..rsrc
mov ebx, 0x40915c
nop
mov ecx, 0x33b57603
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x431024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
mov ecx, 0x75e31d8e
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x431084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x4013e7
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ecx, eax
mov ebp, esp
push ebx
sub esp, 0x34
xor eax, eax
mov ebx, dword [section..data]
cmp ebx, 0xffffffff
je 0x40141f
lea eax, [ebp - 0xc]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], ebx
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x4023d5
Capabilities:
Accept command line arguments
Hash data with crc32
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 8]
mov dword [0x41a020], eax
call sub.COMCTL32.DLL_InitCommonControls
mov eax, dword [0x406008]
xor edx, edx
mov ecx, 0x104
mov dword [0x41a024], eax
div ecx
mov dword [0x41a028], eax
test edx, edx
mov eax, 0x21646142
jne 0x402628
mov eax, dword [section..rodata]
mov dword [0x41a02c], 0x406010
mov dword [ebp - 0x2c], eax
add eax, 0x406010
mov dword [0x41a030], eax
call sub.KERNEL32.dll_GetCommandLineW
lea edx, [ebp - 0x1c]
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.SHELL32.DLL_CommandLineToArgvW
mov esi, eax
test eax, eax
push edx
push edx
jne 0x402465
mov dword [esp + 0xc], 0x10010
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40527c
jmp 0x4025ce
mov dword [esp + 4], 0x4052b0
mov eax, dword [eax + 4]
mov dword [esp], eax
call sub.msvcrt.dll__wcsicmp
test eax, eax
jne 0x402486
mov dword [0x41a034], 1
xor ecx, ecx
mov eax, ecx
mov edx, ecx
mov ebx, 8
test dl, 1
je 0x4024a0
shr edx, 1
xor edx, 0xedb88320
jmp 0x4024a2
shr edx, 1
test al, 1
je 0x4024af
shr ax, 1
xor ax, 0x8408
jmp 0x4024b2
shr ax, 1
dec ebx
jne 0x402491
mov dword [ecx*4 + 0x41a038], edx
mov word [ecx + ecx + 0x41a438], ax
inc ecx
cmp ecx, 0x100
jne 0x402488
mov dword [esp + 4], 0x4052b6
mov eax, dword [esi]
mov dword [esp], eax
call sub.msvcrt.dll__wfopen
mov dword [esp], esi
mov ebx, eax
call sub.KERNEL32.dll_LocalFree
test ebx, ebx
push edi
je 0x4025b6
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], ebx
call sub.msvcrt.dll_fseek
mov dword [esp], ebx
call sub.msvcrt.dll_ftell
xor edi, edi
mov esi, eax
cmp eax, 0x47fff
ja 0x4025a9
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], ebx
call sub.msvcrt.dll_fseek
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], 1
mov dword [esp], 0x41a638
call sub.msvcrt.dll_fread
lea edx, [esi - 4]
mov eax, 0x41a638
call fcn.004013c0
mov edx, dword [ebp - 0x2c]
cmp dword [esi + 0x41a634], eax
sete al
movzx eax, al
mov edi, eax
mov eax, dword [0x41a02c]
call fcn.004013c0
mov edx, dword [0x41a024]
cmp dword [0x406004], eax
sete al
movzx eax, al
add edi, eax
mov eax, dword [0x41a030]
call fcn.004013c0
cmp dword [0x40600c], eax
sete al
movzx eax, al
add edi, eax
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
cmp edi, 3
je 0x4025e4
mov dword [esp + 0xc], 0x10010
mov dword [esp + 8], 0
mov dword [esp + 4], 0x4052bc
mov dword [esp], 0
call sub.USER32.dll_MessageBoxW
mov eax, 0x63
sub esp, 0x10
jmp 0x402628
mov eax, dword [ebp + 8]
mov dword [0x462638], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x40196b
mov dword [esp + 8], 0
mov dword [esp + 4], 0x65
mov dword [esp], eax
call sub.USER32.dll_DialogBoxParamW
xor eax, eax
sub esp, 0x14
cmp dword [0x462638], 5
setne al
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
Function at 0x4028f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], ebx
mov ebx, dword [sym.imp.msvcrt.dll__iob]
mov dword [ebp - 4], esi
lea esi, [ebp + 0xc]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
add ebx, 0x40
mov dword [esp + 0xc], ebx
mov dword [esp], str.Mingw_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov eax, dword [ebp + 8]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort

Function at 0x402940
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
test ecx, ecx
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 8], esi
mov esi, edx
mov dword [ebp - 4], edi
mov edi, ecx
jne 0x402966
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x38]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x4029fa
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x4029b5
cmp eax, 0x40
je 0x4029b5
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x402959
cmp eax, 0x40
je 0x402959
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
jmp 0x402959
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.004028f0
lea esi, [esi]
lea edi, [edi]
Function at 0x402c80
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call fcn.00402c60
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
je 0x402d20
movzx edx, byte [ebx]
cmp dl, 9
je 0x402d64
cmp dl, 0x20
je 0x402d64
cmp dl, 0x22
je 0x402d04
cmp dl, 9
mov eax, edx
je 0x402d18
cmp dl, 0x20
je 0x402d70
test dl, dl
lea esi, [esi]
jne 0x402cf2
jmp 0x402d20
cmp al, 0x20
je 0x402d70
test al, al
nop
je 0x402d20
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
jne 0x402ce4
jmp 0x402d18
cmp al, 0x22
je 0x402d0e
add ebx, 1
movzx eax, byte [ebx]
test al, al
jne 0x402d00
cmp al, 0x22
jne 0x402d18
add ebx, 1
movzx eax, byte [ebx]
cmp al, 0x20
je 0x402d70
cmp al, 9
je 0x402d70
test byte [ebp - 0x30], 1
mov esi, 0xa
je 0x402d2f
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.004023d5
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
add ebx, 1
jmp 0x402cb1
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
je 0x402d70
cmp al, 0x20
jne 0x402d20
nop
jmp 0x402d70