joyce8/EMBER2024-capa huggingface dataset:
Function at 0x569030
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x62ab57
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
lea ecx, [esp + 0xc]
mov dword [esp + 0x14], 0
call fcn.004897f0
lea ecx, [esp + 8]
mov dword [esp + 0x20], 1
call fcn.004897f0
mov esi, dword [ebp + 0xc]
xor ecx, ecx
sub esp, 8
xor edx, edx
mov eax, dword [esi + 0x18]
mov cl, byte [esi + 0x19]
shr eax, 0x10
and eax, 0xff
and ecx, 0xff
mov dword [esp + 0x18], eax
mov dl, byte [esi + 0x18]
fild dword [esp + 0x18]
mov dword [esp + 0x18], ecx
sub esp, 8
sub esp, 8
lea eax, [esp + 0x24]
fmul dword [0x642c28]
mov byte [esp + 0x38], 2
fstp qword [esp + 0x10]
fild dword [esp + 0x28]
mov dword [esp + 0x28], edx
fmul dword [0x642c28]
fstp qword [esp + 8]
fild dword [esp + 0x28]
fmul dword [0x642c28]
fstp qword [esp]
push 0x6e4fb0
push eax
call fcn.0048a580
mov ecx, dword [esi + 0x14]
xor edx, edx
shr ecx, 0x10
and ecx, 0xff
mov dl, byte [esi + 0x15]
mov dword [esp + 0x30], ecx
add esp, 0x18
fild dword [esp + 0x18]
and edx, 0xff
xor eax, eax
mov dword [esp + 0x18], edx
mov al, byte [esi + 0x14]
fmul dword [0x642c28]
sub esp, 8
lea ecx, [esp + 0x18]
sub esp, 8
fstp qword [esp + 0x10]
fild dword [esp + 0x28]
mov dword [esp + 0x28], eax
fmul dword [0x642c28]
fstp qword [esp + 8]
fild dword [esp + 0x28]
fmul dword [0x642c28]
fstp qword [esp]
push 0x6e4fc4
push ecx
call fcn.0048a580
add esp, 0x20
lea edx, [esp + 8]
lea ecx, [esp + 0xc]
push edx
call fcn.00489e10
fld dword [esi + 0x10]
sub esp, 8
lea eax, [esp + 0x10]
fstp qword [esp]
push 0x6e5098
push eax
call fcn.0048a580
add esp, 0x10
lea ecx, [esp + 8]
push ecx
lea ecx, [esp + 0x10]
call fcn.00489e10
cmp dword [esi + 0x1c], 0x3f800000
je 0x5691b1
mov eax, dword [esi + 0x20]
lea edx, [esp + 8]
push eax
push 0x6e4f8c
push edx
call fcn.0048a580
add esp, 0xc
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
call fcn.00489e10
push 0x6e7198
lea ecx, [esp + 0x10]
call fcn.00489d70
mov edx, dword [esi]
mov eax, dword [esi + 4]
lea ecx, [esi + 0x24]
mov dword [esi + 0x24], edx
mov edx, dword [esi + 8]
mov dword [ecx + 4], eax
mov eax, dword [esi + 0xc]
mov esi, dword [ebp + 8]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], eax
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.004898b0
mov dword [esp + 0x14], 1
lea ecx, [esp + 8]
mov byte [esp + 0x20], 1
call fcn.00489810
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 0
call fcn.00489810
mov ecx, dword [esp + 0x18]
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x576ce0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x62b4c3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
push 0xffffffffffffffff
push 0
mov dword [esp + 0x1c], 1
call fcn.0048dbd0
lea edi, [esi + 0x14]
push 0xffffffffffffffff
push 0
mov ecx, edi
call fcn.0048dbd0
mov ecx, edi
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov byte [esp + 0x14], 0
call fcn.0048dbc0
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.0048dbc0
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x57b3f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x62b8f7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [esp + 0x24], 0
fld dword [esi + 0xc]
fsub dword [esi + 8]
fmul dword [0x647c74]
fst dword [esp + 0x10]
fstp dword [esp + 0x20]
fld dword [esp + 0x10]
fcomp dword [0x635e2c]
fnstsw ax
test ah, 0x41
je 0x57b448
mov dword [esp + 0x10], 0x3f800000
fld dword [esi + 8]
fadd dword [0x635df0]
mov eax, dword [esi]
lea ecx, [esp + 0xc]
mov dword [esp + 8], eax
fstp dword [esp + 0x18]
call fcn.004897f0
fld dword [esp + 0x18]
sub esp, 8
lea ecx, [esp + 0x14]
mov dword [esp + 0x38], 1
fstp qword [esp]
fld dword [esp + 0x10]
sub esp, 8
fstp qword [esp]
push 0x6e7664
push ecx
call fcn.0048a580
add esp, 0x18
lea ecx, [esp + 0x14]
call fcn.004897f0
fld dword [esp + 8]
fcomp dword [esi + 4]
mov byte [esp + 0x30], 2
mov edi, 1
fnstsw ax
test ah, 1
je 0x57b514
fld dword [esp + 8]
fadd dword [esp + 0x10]
mov edx, edi
sub esp, 8
and edx, 1
sub esp, 8
mov dword [esp + 0x2c], edx
lea eax, [esp + 0x24]
fstp dword [esp + 0x18]
fild dword [esp + 0x2c]
fmul dword [esp + 0x30]
fadd dword [esp + 0x28]
fstp qword [esp + 8]
fld dword [esp + 0x18]
fstp qword [esp]
push 0x6e7658
push eax
call fcn.0048a580
add esp, 0x18
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x10]
call fcn.00489e10
fld dword [esp + 8]
fcomp dword [esi + 4]
inc edi
fnstsw ax
test ah, 1
jne 0x57b4b3
push 0x6e4f88
lea ecx, [esp + 0x10]
call fcn.00489d70
mov esi, dword [ebp + 8]
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call fcn.004898b0
mov dword [esp + 0x24], 1
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 1
call fcn.00489810
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 0
call fcn.00489810
mov ecx, dword [esp + 0x28]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x5a5df0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x62dbc0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x18]
call fcn.005a5090
lea ecx, [esp + 0xc]
mov dword [esp + 0x3c], 0
call fcn.005a5090
mov ecx, dword [esp + 0x54]
mov eax, dword [esp + 0x48]
mov edi, dword [esp + 0x50]
mov ebp, dword [esp + 0x4c]
push ecx
push eax
lea eax, [esp + 0x50]
mov ecx, esi
push eax
mov byte [esp + 0x48], 1
call fcn.005a5d30
mov ecx, dword [eax + 4]
mov dword [esp + 0x1c], ecx
mov edx, dword [eax + 8]
lea ecx, [esp + 0x48]
mov dword [esp + 0x20], edx
call fcn.005a50c0
push ebp
lea eax, [esp + 0x4c]
push edi
push eax
mov ecx, esi
call fcn.005a5d30
mov ecx, dword [eax + 4]
mov dword [esp + 0x10], ecx
mov edx, dword [eax + 8]
lea ecx, [esp + 0x48]
mov dword [esp + 0x14], edx
call fcn.005a50c0
fld dword [esp + 0x1c]
mov esi, dword [esp + 0x44]
mov byte [esp + 0x3c], 0
fstp dword [esp + 0x24]
fld dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov eax, esi
fstp dword [esp + 0x2c]
fld dword [esp + 0x10]
fstp dword [esp + 0x28]
mov edx, dword [esp + 0x28]
mov dword [eax], ecx
fld dword [esp + 0x14]
mov ecx, dword [esp + 0x2c]
mov dword [eax + 4], edx
fstp dword [esp + 0x30]
mov edx, dword [esp + 0x30]
mov dword [eax + 8], ecx
lea ecx, [esp + 0xc]
mov dword [eax + 0xc], edx
call fcn.005a50c0
lea ecx, [esp + 0x18]
mov dword [esp + 0x3c], 0xffffffff
call fcn.005a50c0
mov ecx, dword [esp + 0x34]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x34
ret 0x14

Function at 0x5a5f20
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x62dbf9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.005aa390
mov eax, dword [0x6925a8]
lea ebx, [esi + 0x14]
xor edi, edi
mov dword [esp + 0x28], edi
mov dword [ebx], eax
mov ecx, dword [0x6925a8]
lea ebp, [esi + 0x18]
mov dword [ebp], ecx
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov edx, dword [0x6925a8]
lea ecx, [esi + 0x2c]
mov dword [ecx], edx
push 0x6e7a64
mov byte [esp + 0x2c], 3
mov dword [esi], 0x660c68
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x28], 0x64ffff
mov dword [esi + 0x30], 0xffffffff
mov dword [esi + 0x34], edi
call fcn.005eb1d3
push 0x6e7a54
mov ecx, ebx
call fcn.005eb1d3
push 0x6e7a4c
mov ecx, ebp
call fcn.005eb1d3
lea eax, [esp + 0x14]
push eax
call fcn.00460525
mov ecx, dword [eax]
mov dword [esi + 0x1c], ecx
mov edx, dword [eax + 4]
mov ecx, dword [esp + 0x20]
mov dword [esi + 0x20], edx
mov eax, dword [eax + 8]
mov dword [esi + 0x24], eax
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi], 0x660b98
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x5a6fe0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x62de8c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.005aa390
mov eax, dword [0x6925a8]
lea ebx, [esi + 0x14]
xor edi, edi
mov dword [esp + 0x2c], edi
mov dword [ebx], eax
mov ecx, dword [0x6925a8]
lea ebp, [esi + 0x18]
mov dword [ebp], ecx
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov edx, dword [0x6925a8]
lea ecx, [esi + 0x2c]
mov dword [ecx], edx
push 0x6e7a64
mov byte [esp + 0x30], 3
mov dword [esi], 0x660e10
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x28], 0x64ffff
mov dword [esi + 0x30], 0xffffffff
mov dword [esi + 0x34], edi
call fcn.005eb1d3
push 0x6e7a54
mov ecx, ebx
call fcn.005eb1d3
push 0x6e7a4c
mov ecx, ebp
call fcn.005eb1d3
lea eax, [esp + 0x14]
push eax
call fcn.00460525
mov ecx, dword [eax]
mov dword [esi + 0x1c], ecx
mov edx, dword [eax + 4]
mov dword [esi + 0x20], edx
mov eax, dword [eax + 8]
mov dword [esi + 0x24], eax
lea ebx, [esi + 0x38]
mov dword [esp + 0x2c], 4
mov ecx, ebx
call fcn.005aa020
mov eax, 2
mov edx, dword [ebx]
mov dword [esi + 0x84], eax
mov dword [esi + 0x88], eax
mov eax, dword [esp + 0x34]
push edi
mov dword [esi + 0x80], eax
push eax
lea eax, [esp + 0x1c]
mov ecx, 1
push eax
mov byte [esp + 0x38], 5
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x8c], ecx
mov dword [esi + 0x90], 9
mov dword [esi + 0x94], edi
mov dword [esi + 0xa0], edi
mov dword [esi], 0x660d40
mov dword [esi + 0x28], 0xb46464
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
push 0x50000000
mov ecx, ebx
call dword [edx + 0xbc]
mov ecx, dword [esp + 0x24]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 4
Function at 0x5b0b20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x62ef98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.004897f0
mov eax, dword [esi + 0x30]
lea ecx, [esp + 4]
push eax
push 0x68f684
push ecx
mov dword [esp + 0x1c], 0
call fcn.0048a580
mov edx, dword [esp + 0x10]
add esp, 0xc
mov ecx, esi
push edx
push 0x6e7c34
push 0x6e7bf8
push SysReAllocStringLen
call fcn.005ae750
mov eax, dword [esi + 0x34]
lea ecx, [esp + 4]
push eax
push 0x68f684
push ecx
call fcn.0048a580
mov edx, dword [esp + 0x10]
add esp, 0xc
mov ecx, esi
push edx
push 0x6e7bec
push 0x6e7bf8
push SysReAllocStringLen
call fcn.005ae750
fld dword [esi + 0x38]
sub esp, 8
lea eax, [esp + 0xc]
fstp qword [esp]
push 0x6e7c90
push eax
call fcn.0048a580
mov ecx, dword [esp + 0x14]
add esp, 0x10
push ecx
push 0x690704
push 0x6e7bf8
push SysReAllocStringLen
mov ecx, esi
call fcn.005ae750
fld dword [esi + 0x44]
sub esp, 8
lea edx, [esp + 0xc]
fstp qword [esp]
push 0x6e7c90
push edx
call fcn.0048a580
mov eax, dword [esp + 0x14]
add esp, 0x10
mov ecx, esi
push eax
push 0x69071c
push 0x6e7bf8
push SysReAllocStringLen
call fcn.005ae750
mov ecx, dword [esi + 0x4c]
lea edx, [esp + 4]
push ecx
push 0x68f684
push edx
call fcn.0048a580
mov eax, dword [esp + 0x10]
add esp, 0xc
mov ecx, esi
push eax
push 0x6e7bdc
push 0x6e7bf8
push SysReAllocStringLen
call fcn.005ae750
mov ecx, dword [esi + 0x48]
push ecx
push 0x68f684
lea edx, [esp + 0xc]
push edx
call fcn.0048a580
mov eax, dword [esp + 0x10]
add esp, 0xc
mov ecx, esi
push eax
push 0x6e7bd4
push 0x6e7bf8
push SysReAllocStringLen
call fcn.005ae750
fld dword [esi + 0x40]
sub esp, 8
lea ecx, [esp + 0xc]
fstp qword [esp]
push 0x6e7c90
push ecx
call fcn.0048a580
mov edx, dword [esp + 0x14]
add esp, 0x10
mov ecx, esi
push edx
push 0x69073c
push 0x6e7bf8
push SysReAllocStringLen
call fcn.005ae750
mov eax, dword [esi + 0x3c]
mov ecx, esi
push eax
push 0x690748
push 0x6e7bf8
push SysReAllocStringLen
call fcn.005ae750
lea ecx, [esp + 4]
mov dword [esp + 0x10], 0xffffffff
call fcn.00489810
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x5b0b36
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x62ef98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.004897f0
mov eax, dword [esi + 0x30]
lea ecx, [esp + 4]
push eax
push 0x68f684
push ecx
mov dword [esp + 0x1c], 0
call fcn.0048a580
mov edx, dword [esp + 0x10]
add esp, 0xc
mov ecx, esi
push edx
push 0x6e7c34
push 0x6e7bf8
push SysReAllocStringLen
call fcn.005ae750
mov eax, dword [esi + 0x34]
lea ecx, [esp + 4]
push eax
push 0x68f684
push ecx
call fcn.0048a580
mov edx, dword [esp + 0x10]
add esp, 0xc
mov ecx, esi
push edx
push 0x6e7bec
push 0x6e7bf8
push SysReAllocStringLen
call fcn.005ae750
fld dword [esi + 0x38]
sub esp, 8
lea eax, [esp + 0xc]
fstp qword [esp]
push 0x6e7c90
push eax
call fcn.0048a580
mov ecx, dword [esp + 0x14]
add esp, 0x10
push ecx
push 0x690704
push 0x6e7bf8
push SysReAllocStringLen
mov ecx, esi
call fcn.005ae750
fld dword [esi + 0x44]
sub esp, 8
lea edx, [esp + 0xc]
fstp qword [esp]
push 0x6e7c90
push edx
call fcn.0048a580
mov eax, dword [esp + 0x14]
add esp, 0x10
mov ecx, esi
push eax
push 0x69071c
push 0x6e7bf8
push SysReAllocStringLen
call fcn.005ae750
mov ecx, dword [esi + 0x4c]
lea edx, [esp + 4]
push ecx
push 0x68f684
push edx
call fcn.0048a580
mov eax, dword [esp + 0x10]
add esp, 0xc
mov ecx, esi
push eax
push 0x6e7bdc
push 0x6e7bf8
push SysReAllocStringLen
call fcn.005ae750
mov ecx, dword [esi + 0x48]
push ecx
push 0x68f684
lea edx, [esp + 0xc]
push edx
call fcn.0048a580
mov eax, dword [esp + 0x10]
add esp, 0xc
mov ecx, esi
push eax
push 0x6e7bd4
push 0x6e7bf8
push SysReAllocStringLen
call fcn.005ae750
fld dword [esi + 0x40]
sub esp, 8
lea ecx, [esp + 0xc]
fstp qword [esp]
push 0x6e7c90
push ecx
call fcn.0048a580
mov edx, dword [esp + 0x14]
add esp, 0x10
mov ecx, esi
push edx
push 0x69073c
push 0x6e7bf8
push SysReAllocStringLen
call fcn.005ae750
mov eax, dword [esi + 0x3c]
mov ecx, esi
push eax
push 0x690748
push 0x6e7bf8
push SysReAllocStringLen
call fcn.005ae750
lea ecx, [esp + 4]
mov dword [esp + 0x10], 0xffffffff
call fcn.00489810
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x40c404
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x40c413
pop dword [ebp - 0x48]
mov eax, 0x794e39bc
sub eax, 0x790d75a9
sub dword [ebp - 0x48], eax
push 0x40
push 0x1000
push 0x3f60f
push 0
mov eax, 0x2e1cde
sub eax, 0xffebcac6
add eax, dword [ebp - 0x48]
call dword [eax]
mov ecx, 0x4e7e
mov esi, eax
mov edx, 0x435400
add edx, dword [ebp - 0x48]
mov ebx, 0xb2c10a5a
xor dword [ebp - 0x14], esi
mov edi, dword [edx]
xor dword [ebp - 0xc], 0x4c5c79b3
add edi, ebx
add dword [ebp - 0x20], 0x2f13e530
mov dword [esi], edi
mov dword [ebp - 0x3c], 0x4c4461ed
add esi, 0x17eb2818
add esi, 0xe814d7ec
add edx, 0xea1a10a2
add edx, 0x15e5ef62
loop 0x40c460
add eax, 0x5c84d98a
add eax, 0xa37c5341
mov ebx, eax
add eax, 0xab7754bc
sub eax, 0xab7754b7
mov ecx, 0xbf8eabf
sub ecx, 0xbb8eabf
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x401102
Capabilities:
Terminate process

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x44
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0x18
mov eax, dword [ebp - 0x18]
mov eax, dword fs:[eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0
jmp 0x40115e
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
jne 0x40114d
mov dword [ebp - 0xc], 1
jmp 0x401188
mov dword [esp], 0x3e8
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], 0x4060b4
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x20]
lock cmpxchg dword [edx], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40113c
mov eax, dword [0x4060b8]
cmp eax, 1
jne 0x4011a0
mov dword [esp], 0x1f
call sym.__amsg_exit
jmp 0x4011d3
mov eax, dword [0x4060b8]
test eax, eax
jne 0x4011c9
mov dword [0x4060b8], 1
mov dword [esp + 4], 0x408014
mov dword [esp], 0x40800c
call sym.__initterm
jmp 0x4011d3
mov dword [0x40601c], 1
mov eax, dword [0x4060b8]
cmp eax, 1
jne 0x4011fb
mov dword [esp + 4], 0x408008
mov dword [esp], section..CRT
call sym.__initterm
mov dword [0x4060b8], 2
cmp dword [ebp - 0xc], 0
jne 0x401217
mov dword [ebp - 0x2c], 0x4060b4
mov dword [ebp - 0x30], 0
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
xchg dword [eax], edx
mov eax, dword [entry1]
test eax, eax
je 0x401241
mov eax, dword [entry1]
mov dword [esp + 8], 0
mov dword [esp + 4], 2
mov dword [esp], 0
call eax
sub esp, 0xc
call sym.__pei386_runtime_relocator
mov dword [esp], sym.__gnu_exception_handler_4
mov eax, dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call eax
sub esp, 4
mov dword [0x406074], eax
mov dword [esp], sym.___mingw_invalidParameterHandler
call sym.__set_invalid_parameter_handler
call sym.__fpreset
mov eax, dword [0x406004]
mov dword [esp + 4], 0x406008
mov dword [esp], eax
call sym._duplicate_ppstrings
call sym.___main
mov eax, dword [0x40303c]
mov edx, dword [0x40600c]
mov dword [eax], edx
mov ecx, dword [0x40600c]
mov edx, dword [0x406008]
mov eax, dword [0x406004]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._main
mov dword [0x406014], eax
mov eax, dword [0x406018]
test eax, eax
jne 0x4012d0
mov eax, dword [0x406014]
mov dword [esp], eax
call sym._exit
mov eax, dword [0x40601c]
test eax, eax
jne 0x4012de
call sym.__cexit
mov eax, dword [0x406014]
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret
Function at 0x4012eb
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x40604c], 1
mov dword [0x406050], 1
mov dword [0x406054], 1
mov dword [ebp - 4], 0x400000
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40132c
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40134f
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
movzx eax, ax
cmp eax, 0x10b
je 0x401371
cmp eax, 0x20b
je 0x401396
jmp 0x4013c1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x5c]
cmp eax, 0xe
ja 0x401383
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x4013c6
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x6c]
cmp eax, 0xe
ja 0x4013ae
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x4013c6
mov eax, 0
leave
ret
Function at 0x401590
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x30], str.CodeBlocksWindowsApp
mov dword [ebp - 0x50], sym.__Z15WindowProcedureP6HWND__jjl_16
mov dword [ebp - 0x54], 8
mov dword [ebp - 0x58], 0x30
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_LoadIconA]
call eax
sub esp, 8
mov dword [ebp - 0x40], eax
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_LoadIconA]
call eax
sub esp, 8
mov dword [ebp - 0x2c], eax
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_LoadCursorA]
call eax
sub esp, 8
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x38], 1
lea eax, [ebp - 0x58]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_RegisterClassExA]
call eax
sub esp, 4
test ax, ax
sete al
test al, al
je 0x40164f
mov eax, 0
jmp 0x401727
mov dword [esp + 0x2c], 0
mov eax, dword [ebp + 8]
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0x177
mov dword [esp + 0x18], 0x220
mov dword [esp + 0x14], 0x80000000
mov dword [esp + 0x10], 0x80000000
mov dword [esp + 0xc], 0xcf0000
mov dword [esp + 8], str.Code::Blocks_Template_Windows_App
mov dword [esp + 4], str.CodeBlocksWindowsApp
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_CreateWindowExA]
call eax
sub esp, 0x30
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
call eax
sub esp, 8
jmp 0x4016f3
lea eax, [ebp - 0x28]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_TranslateMessage]
call eax
sub esp, 4
lea eax, [ebp - 0x28]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_DispatchMessageA]
call eax
sub esp, 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea eax, [ebp - 0x28]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_GetMessageA]
call eax
sub esp, 0x10
test eax, eax
setne al
test al, al
jne 0x4016d3
mov eax, dword [ebp - 0x20]
leave
ret 0x10

Function at 0x401b00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call sym.___acrt_iob_func
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call sym.___acrt_iob_func
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._vfprintf
call sym._abort
Function at 0x4026d4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x4026f3
mov eax, 0
jmp 0x402737
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x402716
mov eax, 0
jmp 0x402737
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x402732
mov eax, 0
jmp 0x402737
mov eax, 1
leave
ret

Function at 0x402739
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x402798
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x402790
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x402790
mov eax, dword [ebp - 4]
jmp 0x4027ac
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x40276d
mov eax, 0
leave
ret