joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009f900
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c246d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x28
mov eax, dword [0x100d7040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [0x1015a358]
mov edi, dword [esi + 0x174]
test edi, edi
jle 0x1009f971
mov edx, dword [esi + 0x4cb0]
mov ecx, dword [0x1015a2fc]
add edx, dword [esi + 0x4cac]
push edx
push dword [esi + 0x4cb4]
mov eax, dword [ecx]
push 1
push edi
mov eax, dword [eax + 0xc]
call eax
cmp byte [0x1015f3ac], 0
jne 0x1009fa44
push 0x22
xorps xmm0, xmm0
mov dword [ebp - 0x24], 0
push str.B8_________3B_F0_0F_4F_F0_89_5D_FC
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x20], 0
movups xmmword [ebp - 0x34], xmm0
call fcn.1002c1b0
mov dword [ebp - 4], 0
mov eax, dword [0x1015a2b4]
test eax, eax
je 0x1009f9b7
mov edx, dword [eax + 0x50]
jmp 0x1009f9b9
xor edx, edx
mov eax, dword [0x1015a2ac]
test eax, eax
je 0x1009f9c7
mov eax, dword [eax + 0x18]
jmp 0x1009f9c9
xor eax, eax
lea ecx, [ebp - 0x34]
push ecx
push eax
lea ecx, [ebp - 0x1c]
call fcn.10024460
mov edi, dword [ebp - 0x1c]
add esp, 8
mov ecx, dword [ebp - 0x20]
inc edi
cmp ecx, 0xf
jbe 0x1009fa13
mov edx, dword [ebp - 0x34]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1009fa09
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1009fa09
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100b89ea
add esp, 8
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x18]
push eax
push 0x40
push 4
push edi
mov dword [ebp - 0x18], 0
call esi
lea eax, [ebp - 0x18]
mov dword [edi], 0x3e
push eax
push dword [ebp - 0x18]
push 4
push edi
call esi
mov byte [0x1015f3ac], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100b84bc
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x1009fdb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dl, byte [esi]
xor dl, byte [edi]
and dl, 1
xor dl, byte [edi]
mov byte [edi], dl
mov cl, byte [esi]
xor cl, dl
and cl, 2
xor cl, dl
mov byte [edi], cl
movzx eax, byte [esi]
xor al, cl
and al, 4
xor al, cl
mov byte [edi], al
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
movq xmm0, qword [esi + 0xc]
movq qword [edi + 0xc], xmm0
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
movq xmm0, qword [esi + 0x18]
movq qword [edi + 0x18], xmm0
mov eax, dword [esi + 0x20]
mov dword [edi + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [edi + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [edi + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x2c], eax
mov eax, dword [esi + 0x30]
mov dword [edi + 0x30], eax
mov eax, dword [esi + 0x34]
mov dword [edi + 0x34], eax
mov eax, dword [esi + 0x38]
mov dword [edi + 0x38], eax
mov eax, dword [esi + 0x3c]
mov dword [edi + 0x3c], eax
movq xmm0, qword [esi + 0x40]
movq qword [edi + 0x40], xmm0
mov eax, dword [esi + 0x48]
mov dword [edi + 0x48], eax
movq xmm0, qword [esi + 0x4c]
movq qword [edi + 0x4c], xmm0
mov eax, dword [esi + 0x54]
mov dword [edi + 0x54], eax
mov eax, dword [esi + 0x58]
mov dword [edi + 0x58], eax
movq xmm0, qword [esi + 0x5c]
movq qword [edi + 0x5c], xmm0
mov eax, dword [esi + 0x64]
mov dword [edi + 0x64], eax
movq xmm0, qword [esi + 0x68]
movq qword [edi + 0x68], xmm0
mov eax, dword [esi + 0x70]
mov dword [edi + 0x70], eax
mov eax, dword [esi + 0x74]
mov dword [edi + 0x74], eax
movq xmm0, qword [esi + 0x78]
movq qword [edi + 0x78], xmm0
mov eax, dword [esi + 0x80]
mov dword [edi + 0x80], eax
movq xmm0, qword [esi + 0x84]
movq qword [edi + 0x84], xmm0
mov eax, dword [esi + 0x8c]
mov dword [edi + 0x8c], eax
movq xmm0, qword [esi + 0x90]
movq qword [edi + 0x90], xmm0
mov eax, dword [esi + 0x98]
mov dword [edi + 0x98], eax
mov eax, dword [esi + 0x9c]
mov dword [edi + 0x9c], eax
mov eax, dword [esi + 0xa0]
mov dword [edi + 0xa0], eax
mov eax, dword [esi + 0xa4]
mov dword [edi + 0xa4], eax
movzx eax, byte [esi + 0xa8]
mov byte [edi + 0xa8], al
movq xmm0, qword [esi + 0xac]
movq qword [edi + 0xac], xmm0
mov eax, dword [esi + 0xb4]
mov dword [edi + 0xb4], eax
mov eax, edi
pop edi
pop esi
pop ebp
ret 4
Function at 0x100a9590
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100d7040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
mov ebx, edx
mov esi, ebx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0xc], esi
lea eax, [ecx - 1]
mov dword [ebp - 0x1c], eax
sar eax, 1
mov dword [ebp - 0x14], eax
cmp ebx, eax
jge 0x100a9603
lea esi, [edx + edx]
lea ecx, [edi + 0x10]
lea ecx, [ecx + esi*8]
lea eax, [ecx - 8]
push eax
push ecx
lea ecx, [ebp + 0x10]
call fcn.100a3440
movzx edx, al
xor edx, 1
inc edx
add edx, esi
mov eax, dword [edi + edx*8]
mov ecx, dword [edi + edx*8 + 4]
mov dword [edi + ebx*8], eax
mov eax, dword [ebp - 0x14]
mov dword [edi + ebx*8 + 4], ecx
mov ebx, edx
cmp edx, eax
jl 0x100a95c7
mov esi, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
mov ebx, edx
cmp edx, eax
jne 0x100a9620
test cl, 1
jne 0x100a9620
mov eax, dword [edi + ecx*8 - 8]
mov ecx, dword [edi + ecx*8 - 4]
mov ebx, dword [ebp - 0x1c]
mov dword [edi + edx*8], eax
mov dword [edi + edx*8 + 4], ecx
mov al, byte [ebp + 0x10]
mov byte [ebp - 8], al
cmp esi, ebx
jge 0x100a965d
nop word [eax + eax]
push dword [ebp - 0x10]
lea esi, [ebx - 1]
sar esi, 1
lea ecx, [ebp - 8]
lea eax, [edi + esi*8]
push eax
call fcn.100a3440
test al, al
je 0x100a965d
mov eax, dword [edi + esi*8]
mov ecx, dword [edi + esi*8 + 4]
mov dword [edi + ebx*8], eax
mov dword [edi + ebx*8 + 4], ecx
mov ebx, esi
cmp dword [ebp - 0xc], esi
jl 0x100a9630
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [edi + ebx*8 + 4], ecx
mov ecx, dword [ebp - 4]
mov dword [edi + ebx*8], eax
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.100b84bc
mov esp, ebp
pop ebp
ret
Function at 0x100b5070
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
sub esp, 8
movzx eax, byte [edx]
push ebx
push esi
xor eax, 0x811c9dc5
push edi
mov edi, ecx
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 8]
imul ebx, ecx, 0x1000193
mov ecx, edi
push ebx
push edx
push eax
call fcn.100b5ad0
mov esi, dword [eax + 4]
test esi, esi
je 0x100b5125
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 0xc]
and ecx, ebx
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], esi
jne 0x100b50ec
cmp eax, esi
jne 0x100b50e4
mov eax, dword [edi + 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x100b50f4
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x100b50f4
cmp eax, esi
jne 0x100b50f4
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
dec dword [edi + 8]
mov eax, dword [esi + 4]
mov dword [eax], ecx
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
lea ecx, [esi + 0x50]
call fcn.1002b940
push 0x5c
push esi
call fcn.100b89ea
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100b5210
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, ecx
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], edx
cmp ebx, eax
je 0x100b537f
mov eax, dword [edx + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 8], eax
movzx eax, byte [ebx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 9]
push esi
push edi
mov edi, dword [edx + 0xc]
mov esi, ebx
xor ecx, eax
mov dword [ebp - 0x1c], edi
movzx eax, byte [ebx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 4], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
nop word [eax + eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0x50]
call fcn.1002b940
push 0x5c
push edi
call fcn.100b89ea
mov edx, dword [ebp - 0x14]
add esp, 8
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x10]
je 0x100b52dd
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x100b5290
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x100b5375
mov edi, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [edi], esi
mov dword [ecx], esi
pop edi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x100b52f1
mov eax, dword [ebp - 0x18]
mov ecx, eax
mov dword [edi], eax
jmp 0x100b52f4
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], ecx
cmp esi, eax
je 0x100b5375
nop
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebp - 0x1c]
and eax, dword [edx + 0x18]
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0x50]
call fcn.1002b940
push 0x5c
push edi
call fcn.100b89ea
mov edx, dword [ebp - 0x14]
add esp, 8
mov eax, dword [ebp + 0xc]
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x10]
je 0x100b5386
cmp esi, eax
jne 0x100b5345
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp - 0x18]
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
cmp esi, eax
jne 0x100b5300
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x6f7c58e2
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x7029d014]
mov dword [ebp - 0xc], eax
jmp 0x6f7c59a4
jmp 0x6f7c5a58
jmp 0x6f7c5b0c
jmp 0x6f7c5bc0
jmp 0x6f7c5c74
jmp 0x6f7c5d28
jmp 0x6f7c5ddc
jmp 0x6f7c5e90
jmp 0x6f7c5f44
jmp 0x6f7c5ff8
jmp 0x6f7c60ac
jmp 0x6f7c6160
cmp dword [ebp - 0xc], 0
je 0x6f7c837c
mov eax, dword [0x7029d014]
mov dword [0x7029d00c], eax
jmp 0x6f7c6228
jmp 0x6f7c62dc
jmp 0x6f7c6390
jmp 0x6f7c6444
jmp 0x6f7c64f8
jmp 0x6f7c65ac
jmp 0x6f7c6660
jmp 0x6f7c6714
jmp 0x6f7c67c8
jmp 0x6f7c687c
jmp 0x6f7c6930
jmp 0x6f7c69e4
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 0xc]
add eax, edx
mov dword [0x7029d008], eax
jmp 0x6f7c6aa8
jmp 0x6f7c6b5c
jmp 0x6f7c6c10
jmp 0x6f7c6cc4
jmp 0x6f7c6d78
jmp 0x6f7c6e2c
jmp 0x6f7c6ee0
jmp 0x6f7c6f94
jmp 0x6f7c7048
jmp 0x6f7c70fc
jmp 0x6f7c71b0
jmp 0x6f7c7264
mov eax, dword [0x7029d008]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x10], eax
jmp 0x6f7c7323
jmp 0x6f7c73d7
jmp 0x6f7c748b
jmp 0x6f7c753f
jmp 0x6f7c75f3
jmp 0x6f7c76a7
jmp 0x6f7c775b
jmp 0x6f7c780f
jmp 0x6f7c78c3
jmp 0x6f7c7977
jmp 0x6f7c7a2b
jmp 0x6f7c7adf
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call eax
sub esp, 0x10
mov dword [0x7029d004], eax
jmp 0x6f7c7bc0
jmp 0x6f7c7c74
jmp 0x6f7c7d28
jmp 0x6f7c7ddc
jmp 0x6f7c7e90
jmp 0x6f7c7f44
jmp 0x6f7c7ff8
jmp 0x6f7c80ac
jmp 0x6f7c8160
jmp 0x6f7c8214
jmp 0x6f7c82c8
jmp 0x6f7c837c
nop
leave
ret
Function at 0x6f7c94a3
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x7029d008]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x7029d008]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
jmp 0x6f7c9577
jmp 0x6f7c962b
jmp 0x6f7c96df
jmp 0x6f7c9793
jmp 0x6f7c9847
jmp 0x6f7c98fb
jmp 0x6f7c99af
jmp 0x6f7c9a63
jmp 0x6f7c9b17
jmp 0x6f7c9bcb
jmp 0x6f7c9c7f
jmp 0x6f7c9d33
mov dword [ebp - 0x14], 0
jmp 0x6f7c9dee
jmp 0x6f7c9ea2
jmp 0x6f7c9f56
jmp 0x6f7ca00a
jmp 0x6f7ca0be
jmp 0x6f7ca172
jmp 0x6f7ca226
jmp 0x6f7ca2da
jmp 0x6f7ca38e
jmp 0x6f7ca442
jmp 0x6f7ca4f6
jmp 0x6f7ca5aa
mov dword [ebp - 0x18], 0
jmp 0x6f7ca665
jmp 0x6f7ca719
jmp 0x6f7ca7cd
jmp 0x6f7ca881
jmp 0x6f7ca935
jmp 0x6f7ca9e9
jmp 0x6f7caa9d
jmp 0x6f7cab51
jmp 0x6f7cac05
jmp 0x6f7cacb9
jmp 0x6f7cad6d
jmp 0x6f7cae21
mov dword [ebp - 0x10], 0
jmp 0x6f7caedc
jmp 0x6f7caf90
jmp 0x6f7cb044
jmp 0x6f7cb0f8
jmp 0x6f7cb1ac
jmp 0x6f7cb260
jmp 0x6f7cb314
jmp 0x6f7cb3c8
jmp 0x6f7cb47c
jmp 0x6f7cb530
jmp 0x6f7cb5e4
jmp 0x6f7cb698
mov dword [ebp - 0x10], 0
jmp 0x6f7ce11a
jmp 0x6f7cb758
jmp 0x6f7cb80c
jmp 0x6f7cb8c0
jmp 0x6f7cb974
jmp 0x6f7cba28
jmp 0x6f7cbadc
jmp 0x6f7cbb90
jmp 0x6f7cbc44
jmp 0x6f7cbcf8
jmp 0x6f7cbdac
jmp 0x6f7cbe60
jmp 0x6f7cbf14
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [0x7029d004]
add eax, edx
mov dword [ebp - 0x14], eax
jmp 0x6f7cbfd9
jmp 0x6f7cc08d
jmp 0x6f7cc141
jmp 0x6f7cc1f5
jmp 0x6f7cc2a9
jmp 0x6f7cc35d
jmp 0x6f7cc411
jmp 0x6f7cc4c5
jmp 0x6f7cc579
jmp 0x6f7cc62d
jmp 0x6f7cc6e1
jmp 0x6f7cc795
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
mov edx, dword [0x7029d00c]
add eax, edx
mov dword [ebp - 0x18], eax
jmp 0x6f7cc85a
jmp 0x6f7cc90e
jmp 0x6f7cc9c2
jmp 0x6f7cca76
jmp 0x6f7ccb2a
jmp 0x6f7ccbde
jmp 0x6f7ccc92
jmp 0x6f7ccd46
jmp 0x6f7ccdfa
jmp 0x6f7cceae
jmp 0x6f7ccf62
jmp 0x6f7cd016
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
jmp 0x6f7cd0e6
jmp 0x6f7cd19a
jmp 0x6f7cd24e
jmp 0x6f7cd302
jmp 0x6f7cd3b6
jmp 0x6f7cd46a
jmp 0x6f7cd51e
jmp 0x6f7cd5d2
jmp 0x6f7cd686
jmp 0x6f7cd73a
jmp 0x6f7cd7ee
jmp 0x6f7cd8a2
add dword [ebp - 0xc], 0x28
jmp 0x6f7cd95a
jmp 0x6f7cda0e
jmp 0x6f7cdac2
jmp 0x6f7cdb76
jmp 0x6f7cdc2a
jmp 0x6f7cdcde
jmp 0x6f7cdd92
jmp 0x6f7cde46
jmp 0x6f7cdefa
jmp 0x6f7cdfae
jmp 0x6f7ce062
jmp 0x6f7ce116
add dword [ebp - 0x10], 1
mov eax, dword [0x7029d008]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x10]
ja 0x6f7cb6a4
nop
leave
ret

Function at 0x6f7e63d0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], 0x7029c040
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.6f7e6430
Function at 0x6f7e6430
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x7029d378]
test esi, esi
jle 0x6f7e651d
mov edi, dword [0x7029d37c]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x6f7e6464
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x6f7e6516
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x6f7e6450
mov dword [esp], eax
mov esi, eax
call fcn.6f7e6bd0
test eax, eax
mov edi, eax
je 0x6f7e655a
mov esi, dword [0x7029d37c]
lea ebx, [ebx + ebx*2]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call fcn.6f7e6ce0
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x7029d37c]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x6f7e653a
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x6f7e650f
sub eax, 0x40
and eax, 0xffffffbf
je 0x6f7e650f
mov eax, dword [esp + 0x20]
add ebx, dword [0x7029d37c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x6f7e6524
add dword [0x7029d378], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor ebx, ebx
jmp 0x6f7e646e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.6f7e63d0
mov eax, dword [0x7029d37c]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.6f7e63d0
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.6f7e63d0
lea esi, [esi]

Function at 0x6f7e6840
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x7029d388
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x7029d380]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x6f7e6895
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x6f7e688e
test esi, esi
je 0x6f7e688e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6f7e6870
mov dword [esp], 0x7029d388
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402610
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408048
call sym._EnterCriticalSection_4
mov ebx, dword [0x408040]
sub esp, 4
test ebx, ebx
je 0x40265b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x402654
test esi, esi
je 0x402654
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402630
mov dword [esp], 0x408048
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402840
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x402890
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402968
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x4028ce
cmp eax, 4
jne 0x4028f0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x4028de
cmp edx, 4
je 0x4028de
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402840
Function at 0x402ed8
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x402f14
movzx eax, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x402f34
lea eax, [esp + 0x109]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.00405078
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x40316c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404e08
test esi, esi
jne 0x4031a2
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404ef8
jmp 0x4031c0
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00403070
mov edi, eax
test esi, esi
je 0x4031c0
cmp dword [ebx], 0
je 0x4031c0
dec esi
jmp 0x4031a9
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4031f4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x48d008], 0x8088405
inc edx
mov dword [ebx + 0x48d008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4037cc
Capabilities:
Read file on windows

Disassembly:
push ebx
xor ecx, ecx
mov ebx, eax
mov cx, word [eax + 4]
sub ecx, 0xd7b1
je 0x4037e2
sub ecx, 2
jne 0x403804
push 0
mov eax, esp
push 0
push eax
push dword [ebx + 8]
push edx
push dword [ebx]
call sub.kernel32.dll_ReadFile
pop edx
dec eax
jne 0x40380b
cmp edx, dword [ebx + 8]
je 0x403815
mov eax, 0x64
jmp 0x403810
mov eax, 0x67
jmp 0x403810
call sub.kernel32.dll_GetLastError
call fcn.00402e78
pop ebx
ret

Function at 0x403a1c
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, eax
movzx eax, word [eax + 4]
sub eax, 0xd7b2
cmp eax, 1
ja 0x403a4f
push 0
mov eax, esp
push 0
push eax
push dword [ebx + 8]
push edx
push dword [ebx]
call sub.kernel32.dll_WriteFile
pop edx
dec eax
jne 0x403a56
cmp edx, dword [ebx + 8]
je 0x403a60
mov eax, 0x65
jmp 0x403a5b
mov eax, 5
jmp 0x403a5b
call sub.kernel32.dll_GetLastError
call fcn.00402e78
mov eax, ebx
pop ebx
ret