joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100f8f30
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 4
pop eax
call fcn.100ec810
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x100f8fc5
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x44]
lea esi, [eax - 1]
not esi
and esi, ebx
sub esi, eax
mov dword [ebp - 4], eax
mov eax, dword [0x10183bf4]
mov ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0xffff1000
add ecx, 0x11000
add ecx, edi
cmp esi, ecx
jb 0x100f8fc5
cmp eax, 1
je 0x100f8fdd
mov ebx, edi
mov edi, 0x1000
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x100f8fc5
add ebx, dword [ebp - 0x18]
test dword [ebp - 0x14], edi
je 0x100f8f9a
test byte [ebp - 0xf], 1
mov ebx, dword [ebp - 0x24]
je 0x100f8fc1
xor eax, eax
inc eax
jmp 0x100f8ff9
cmp esi, ebx
jae 0x100f8fc9
xor eax, eax
jmp 0x100f8ff9
push 4
push edi
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x10183bf4]
jmp 0x100f8fdf
mov ebx, esi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 8]
push ecx
inc eax
push eax
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x54]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100fa13e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x10158750]
xor eax, dword [ebp + 4]
mov ecx, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 4], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x1015b6f0]
je 0x100fa16b
inc eax
cmp eax, 0x12
jb 0x100fa15c
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x1015b6f0]
jne 0x100fa29f
mov eax, dword [0x10183d50]
cmp eax, 1
je 0x100fa27a
cmp eax, edx
jne 0x100fa19b
cmp dword [0x1015b6ec], 1
je 0x100fa27a
cmp ecx, 0xfc
je 0x100fa29f
push 0x104
lea eax, [ebp - 0x10c]
push eax
push edx
mov byte [ebp - 8], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x100fa1d4
lea eax, [ebp - 0x10c]
push str._program_name_unknown_
push eax
call sub.MSVCR70D.dll_strcpy
pop ecx
pop ecx
lea eax, [ebp - 0x10c]
push eax
lea edi, [ebp - 0x10c]
call sub.MSVCR70D.dll_strlen
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x100fa216
lea eax, [ebp - 0x10c]
push eax
call sub.MSVCR70D.dll_strlen
mov edi, eax
lea eax, [ebp - 0x10c]
sub eax, 0x3b
push 3
add edi, eax
push 0x1010b398
push edi
call sub.MSVCR70D.dll_strncpy
add esp, 0x10
push edi
call sub.MSVCR70D.dll_strlen
push dword [esi + 0x1015b6f4]
mov ebx, eax
call sub.MSVCR70D.dll_strlen
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.100ec810
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call sub.MSVCR70D.dll_strcpy
push edi
push ebx
call sub.MSVCR70D.dll_strcat
push 0x1010b378
push ebx
call sub.MSVCR70D.dll_strcat
push dword [esi + 0x1015b6f4]
push ebx
call sub.MSVCR70D.dll_strcat
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.100fac08
add esp, 0x2c
jmp 0x100fa29f
push edx
lea eax, [ebp + 8]
push eax
lea esi, [esi + 0x1015b6f4]
push dword [esi]
call sub.MSVCR70D.dll_strlen
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x118]
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
call fcn.100ed7a0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100fac08
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x10183e6c], ebx
push esi
push edi
jne 0x100fac88
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x100facc3
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x10183e6c], eax
je 0x100facc3
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x10183e70], eax
call esi
cmp dword [0x10183bf4], 2
mov dword [0x10183e74], eax
jne 0x100fac88
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x10183e7c], eax
je 0x100fac88
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x10183e78], eax
mov eax, dword [0x10183e78]
test eax, eax
je 0x100faccd
call eax
test eax, eax
je 0x100facb4
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x10183e7c]
test eax, eax
je 0x100facb4
test byte [ebp - 8], 1
jne 0x100faccd
cmp dword [0x10183c00], 4
jb 0x100facc7
or byte [ebp + 0x12], 0x20
jmp 0x100facec
xor eax, eax
jmp 0x100facfc
or byte [ebp + 0x12], 4
jmp 0x100facec
mov eax, dword [0x10183e70]
test eax, eax
je 0x100facec
call eax
mov ebx, eax
test ebx, ebx
je 0x100facec
mov eax, dword [0x10183e74]
test eax, eax
je 0x100facec
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x10183e6c]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403d88
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ebp + 0x42]
add byte [esi + esi*4], ch
add byte [eax], al
mov eax, ebx
call 0x403cb6
mov eax, esi
jmp 0x403d1f
add byte [eax], al
add eax, 0x10
mov dword [esi], eax
wait
add byte [eax], cl
mov eax, dword [ecx]
mov byte [ebp - 4], 1
add byte [eax], al
adc al, 0x85
sar byte [esp + eax - 0x5a], 0
jmp 0x403ca7
push 0x1c70
lea eax, [ebp + 8]
push eax
call 0x403d88
test eax, eax
jne 0x403d42
inc dword [eax]
add bh, bh
adc eax, 0xcf4973b4
add byte [edi + 0x2c], al
jmp 0x403e14
add byte [eax], al
sbb al, 0x4a
add byte [esi - 0x73], dl
sub byte [eax], al
push eax
call fcn.0040b205
test dword [eax], eax
add byte [ecx], dl
push dword [ebp + 0xc]
dec esp
add byte [ebx + 0x49], dh
add byte [ecx + 0xe93047], cl
add byte [eax], al
add byte [eax + 0x7c], ch
sbb al, 0x6c
add byte [ebp - 0x17aff7bb], cl
xchg ecx, eax
je 0x403d73
add byte [ebp - 0x4a7af040], al
mov dword [eax], 0x1c846800
dec edx
add byte [ebp - 0x17b00000], cl
jne 0x410531
push 0x4a1c84
lea eax, [eax]
add byte [eax - 0x18], dl
jnp 0x403dfc
add dl, bh
add al, al
jne 0x403d92
push 0x2f
jmp 0x403e10
add byte [eax], al
inc ebp
or al, 0x50
call fcn.0040c105
test eax, eax
jne 0x403da4
push 0x2b
add byte [eax], al
push 0x4a1c88
aas
add byte [eax + edx*2], cl
call fcn.0040b205
add byte [eax], al
jne 0x403dba
push 0x2a
jmp 0x403d76
add byte [eax - 0x72ffb5e4], dl
inc ebp
or al, 0
add byte [0x85000074], bh
sub al, byte [eax]
add al, 0x6a
jmp 0x403e10
push 0x4a1ca0
lea eax, [eax]
add byte [eax - 0x18], dl
sti
jae 0x403e09
pop eax
add al, al
jne 0x403e27
push 0x27
pop eax
mov dword [eax], eax
add byte [ebx - 0x40170fbb], cl
nop
add byte [eax], al
mov eax, dword [ebp - 0x10]
call 0x40cedb
mov eax, ebx
call int.0040f2db
add al, al
jmp 0x403e45
mov esi, 0x8000c305
jmp 0x403ca7
call 0x6d4642ba
add byte [eax + eax], cl
push dword [esp + 4]
push 0x4a0000
call 0x11cc45b
test eax, eax
pop ecx
pop ecx
jne 0x403e90
push esi
add byte [eax], al
call fcn.0045b609
lodsd eax, dword [esi]
add byte [ebp + 0x1c7459f6], al
and dword [esi], 0
push edi
lea edi, [esi + 8]
mov ecx, 0x4a2900
call 0x1403887
add byte [esi + 0x2c], ah
add byte [ebx + 0x200a5c6], cl
xor eax, eax
pop esi
ret
xor eax, eax
add byte [eax], al
test al, 0x1c
dec edx
add bl, al
or byte [eax], al
and al, 4
push 0x4a1ca8
add byte [eax], al
test dword [0xebd8f700], eax
add al, al
pop ecx
inc eax
ret 4
dec ebx
enter 0x5844, 0xffffffffffffff8a
retf
dec ebp
or edx, eax
and eax, ebp
mov al, byte [0x339c6203]
in eax, 0xbf
pop ebp
test byte [ebp - 0x73004e31], al
popal
lahf
xor esp, ebp
mov edi, 0xcf85845d
mov cl, 0xff
mov word [ecx - 0x61], fs
ja 0x4104fc
lodsd eax, dword [esi]
mov bx, 0x9f35
jmp 0x410494
dec ebp
xchg edx, eax
div dword ss:[edx]
bound ecx, qword [ebx + 0x5f641daf]
xchg esi, eax
arpl word [edi + edi*2], cx
loopne 0x4104f3
imul edi, dword [eax], 0x2b
jnp 0x410532
movsb byte es:[edi], byte [esi]
xchg ebp, eax
fdivrp st(0)
sbb dl, byte [esi + ebx - 0x1d5d151]
scasd eax, dword es:[edi]
int 0x60
mov esi, 0xfa8f8dff
sub cl, byte [edx + 0x1a1bb12a]
invalid
Function at 0x417a10
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x50
test eax, eax
push esi
je 0x417a36
mov eax, dword [0x6347f0]
test eax, eax
je 0x417a2c
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
pop esi
add esp, 0x50
ret
push ebx
push edi
lea eax, [esp + 0xc]
push 0x50
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.dsound.dll
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xd]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
mov dword [0x6347f0], eax
test eax, eax
pop ebx
je 0x417ad1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.DirectSoundCreate
push eax
call esi
mov ecx, dword [0x6347f0]
push str.DirectSoundEnumerateA
push ecx
mov dword [0x6347ec], eax
call esi
mov ecx, dword [0x6347ec]
mov dword [0x6347f4], eax
test ecx, ecx
je 0x417ac7
test eax, eax
je 0x417ac7
mov eax, 1
pop esi
add esp, 0x50
ret
mov dword [0x6347f0], 0
xor eax, eax
pop esi
add esp, 0x50
ret
Function at 0x425592
Capabilities:
Encode data using xor

Disassembly:
clc
jne 0x42555f
movsd dword es:[edi], dword [esi]
adc bh, byte [ebp + ebp*2 + 8]
test al, 0xac
mov al, 0xca
mov ebp, 0xf856aaab
lds eax, [edi + 0x1063002e]
sbb byte [esi - 0x597ff641], ah
ret
Function at 0x43d05b
Capabilities:
Encode data using xor

Disassembly:
loope 0x43d0c2
mov dh, 0xcb
mul ebx
out dx, al
cwde
cmp esi, esi
mov eax, dword [0x898d9ffb]
lodsb al, byte [esi]
or dword [ecx], 0x4d3e4502
or dword [edx], eax
inc ebp
dec ebp
or dword [edx], eax
inc ebp
dec ebp
mov ebx, 0xdc894eb2
pop ds
and al, 0xcd
and byte [esi + 0x20], bl
mov bh, 5
xchg esi, eax
xchg dword [edx], edx
sbb eax, 0xa124bc72
mov cl, 0xb
dec edi
xchg edx, eax
xor dh, byte [esi]
mov byte [0x68c513f6], al
jo 0x43d079
jl 0x43d04a
das
call 0xa0d7893f
and byte [edx - 0x4d54b5de], dh
inc edi
dec eax
mov dh, 0x42
sbb dword [ebp + 0x62], ebx
jbe fcn.0043d05b
leave
fxch st(7)
sbb edx, dword [ebx + 0x1cca9b99]
push edx
scasd eax, dword es:[edi]
and dword [ebp + 0x4c], 0x3b32591a
in al, dx
mov ebp, 0x60d27a35
invalid
dec ebp
Function at 0x45129b
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], ah
in al, dx
mov byte [0x1aec4e6c], al
invalid
jg 0x451253
mov al, 0xfd
jecxz 0x45130d
lodsd eax, dword [esi]
lea ebx, [0x7d0b473d]
outsb dx, byte [esi]
popfd
mov ebp, 0xe0f8ac95
adc al, 0xd4
ror byte [edx], cl
daa
Function at 0x47ca76
Capabilities:
Encode data using xor

Disassembly:
int1
add ch, dl
aaa
cmpsb byte [esi], byte es:[edi]
xor al, 0x83
and dword [edi], edx
mov bh, 0xe2
inc esi
cmpsd dword [esi], dword es:[edi]
sbb eax, 0xccf1f688
xchg edi, eax
jmp 0x47ca77
sbb eax, 0xbfbced20
mov al, 0x7b
stc
out 0x16, al
popal
push edx
hlt
aad 0x56
or byte [edx + 0x6b2fb3f2], dh
in al, dx
inc eax
lodsd eax, dword [esi]
cmp al, 0xc1
xor al, 0x17
cmc
salc
cwde
div esi
mov byte [0x7a855536], al
jge 0x47ca82
xchg esp, eax
movsb byte es:[edi], byte [esi]
add eax, dword [esi - 0x29]
inc esi
xlatb
adc al, 0xe
adc esi, dword [ebx + 0x4d5bcc10]
jae 0x47cac5
sal esp, 1
loop 0x47cae3
add bl, byte [ebx - 0x7a8e7c06]
popfd
adc al, 0x97
jae 0x47ca37
je 0x47ca61
arpl word [esp + eax*4], sp
cmp ecx, 0xffffffb1
fadd dword [esi]
push edx
add dword [ebp - 0x15], 0x3a
cdq
push ds
invalid

Function at 0x47d225
Capabilities:
Encode data using xor

Disassembly:
pop ss
push es
jo 0x47d1d1
push 0x6b
xor ebx, edi
xchg ecx, eax
pop ss
or edi, dword [eax + 0x11]
mov byte [0xead673fa], al
fsubr dword [esi + 0xaae89f0]
mov edi, 0x276aa763
pop eax
xor byte [ecx + 0x66], dh
pop es
popfd
and dword [edx], ebx
outsb dx, byte [esi]
xor eax, edi
inc ebx
push 0x21
xchg al, dh
and eax, 0xdc3e7750
add dword [edx + 0x28b29431], edx
mov cl, 0x60
lahf
pop eax
sub edx, dword [ebx - 0x277d4ade]
lea edi, [ecx]
and dh, byte [ebp + 0x398dd882]
cmp edi, dword [edx + edx*4 - 0x21]
pop ss
jle 0x47d1bf
mov cl, dh
cmp al, 0xe3
ljmp 0x16
xchg ecx, eax
jp 0x47d1a5
out 0xe0, al
mov eax, dword [0xcd279911]
add ecx, dword [eax - 0x2c]
fdiv dword [ecx]
sbb eax, 0x12014a11
loopne 0x47d166
adc dword [ecx + 0x4803cd27], ebx
aam 0xd8
xor dword [0x12014a11], ebx
add dword [edx], edx
and byte [esi + 0x3875a725], ch
or al, 0x63
xor dword [edi - 0x6f], esp
nop
mov ch, 0xb0
pushfd
outsb dx, byte [esi]
pop es
fcomp dword cs:[ecx - 0x23c6ef96]
mov dword [0xad9b92fb], eax
sti
xchg edx, eax
wait
lodsd eax, dword [esi]
xchg dword [edi], eax
outsb dx, byte [esi]
lahf
sub byte [edi], bh
push 0xc1145e98
loop 0x47d1c3
je 0x47d18b
xor bl, dh
or dword [ecx + 0x724b833], ecx
push esi
fst dword [ebx]
push ebp
jo 0x47d1ec
inc ebp
mov al, byte [0x4eba90fe]
jp 0x47d26f
xor eax, 0xd7e05576
cwde
rcl byte [edx - 0x27166433], 5
push ss
push 0x39
push edi
sbb dl, byte [esi - 0x5326b087]
jge 0x47d1ee
invalid
int1
jl 0x47d2b2
mov cl, 0x5c
in al, dx
xchg ecx, eax
int1
jno 0x47d2a2
cmp eax, 0x695e7777
add eax, 0xb9f964b1
and dword [ebp - 0x39], esi
jmp 0x15947b64
and byte [eax + 0x6dd7a668], dl

Function at 0x47fc1b
Capabilities:
Encode data using xor

Disassembly:
sub dword [esi - 0x22], ebx
stosd dword es:[edi], eax
retf
mov ebx, 0x80de5752
pop ecx
fcmovnbe st(0), st(1)
xor ah, byte [esi]
mov es, word [ebp + 0xd573e33]
cmpsb byte [esi], byte es:[edi]
dec esi
or dword [ebx], 0x54da48be
sub esi, dword [edi - 0x5709820b]
jge 0x47fc13
test al, 0xf2
leave
or edi, dword [esi + 0x2b54da48]
mov bh, 0xf5
jge 0x47fc13
test al, 0xf2
leave
jnp 0x47fc00
sbb al, 0x70
jg 0x47fbe8
xor edi, dword [edi + 0x49cb9e33]
retf
Function at 0x627efd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6313c8
cmp edx, dword [eax]
je 0x627f1f
add eax, 8
inc ecx
cmp eax, 0x631458
jl 0x627f10
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6313c8]
jne 0x62804d
mov eax, dword [0x635d9c]
cmp eax, 1
je 0x628027
test eax, eax
jne 0x627f50
cmp dword [0x6312f4], 1
je 0x628027
cmp edx, 0xfc
je 0x62804d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x627f87
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.006288e0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00628d70
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x627fca
lea eax, [ebp - 0x1a4]
push eax
call fcn.00628d70
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62dad4
push edi
call fcn.0062ac40
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.006288e0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.006288f0
lea eax, [ebp - 0xa0]
push 0x62dab4
push eax
call fcn.006288f0
push dword [esi + 0x6313cc]
lea eax, [ebp - 0xa0]
push eax
call fcn.006288f0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062abb4
add esp, 0x2c
pop edi
jmp 0x62804d
lea eax, [ebp + 8]
lea esi, [esi + 0x6313cc]
push 0
push eax
push dword [esi]
call fcn.00628d70
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x432030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x4019b0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._vfprintf
call sym._abort
jmp dbg.mark_section_writable

Function at 0x401a10
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x406054]
test esi, esi
jle 0x401afd
mov edi, dword [0x406058]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x401a44
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x401af6
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x401a30
mov dword [esp], eax
mov ebx, eax
call dbg.__mingw_GetSectionForAddress
test eax, eax
mov edi, eax
je 0x401b3a
lea ebx, [esi + esi*2]
mov esi, dword [0x406058]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call dbg._GetPEImageBase
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x406058]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401b1a
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x401aef
sub eax, 0x40
and eax, 0xffffffbf
je 0x401aef
mov eax, dword [esp + 0x20]
add ebx, dword [0x406058]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x401b04
add dword [0x406054], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor esi, esi
jmp 0x401a4e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
mov eax, dword [0x406058]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
Function at 0x402000
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x406408
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x406400]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x402055
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40204e
test esi, esi
je 0x40204e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402030
mov dword [esp], 0x406408
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x402270
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x4022a8
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x40229e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x4022aa
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x402290
xor eax, eax
pop ebx
pop esi
ret

Function at 0x402a50
Capabilities:
Resume thread
Suspend thread

Disassembly:
push esi
push ebx
mov esi, eax
sub esp, 0x2e4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
sub esp, 4
cmp eax, 0xffffffff
jne 0x402a80
add esp, 0x2e4
mov eax, 0xffffffff
pop ebx
pop esi
ret
lea eax, [esp + 0x14]
mov dword [esp], esi
mov dword [esp + 0x14], 0x10003
mov ebx, 0xffffffff
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
sub esp, 8
test eax, eax
cmovne ebx, dword [esp + 0xcc]
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
sub esp, 4
add esp, 0x2e4
mov eax, ebx
pop ebx
pop esi
ret
Function at 0x403800
Capabilities:
Set current directory

Disassembly:
test al, al
je 0x403814
inc dword [0x4ae44c]
add dword [0x4aa988], 0xe8
mov edx, dword [0x4aa988]
push esi
push edi
mov ecx, 0x3a
mov esi, 0x4acf90
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0xc]
mov esi, edx
mov dword [esi + 0x2c], ecx
test al, al
je 0x403843
push 0
mov eax, 0x4af278
call fcn.004177a0
cmp dword [0x4ae480], 0
mov dword [0x4af8a0], 0
mov dword [0x4af8a4], 0
je 0x40387b
mov eax, dword [0x4ababc]
test eax, eax
je 0x40386f
mov eax, dword [eax]
test eax, eax
jne 0x403874
mov eax, 0x49b8cd
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmp byte [esp + 0x10], 0
jne 0x4038ff
or ecx, 0xffffffff
cmp byte [esi + 0xce], 0
jne 0x4038aa
xor eax, eax
cmp byte [esp + 0x14], 0x65
sete al
mov byte [esi + 0xce], al
test al, al
je 0x4038aa
mov dword [esi], ecx
mov dword [esi + 4], ecx
mov dword [esi + 0x24], ecx
cmp dword [0x4af8ac], 0
je 0x4038bc
cmp dword [0x4af8a8], 0
jne 0x4038c5
cmp byte [esi + 0xce], 0
je 0x4038ff
cmp byte [esi + 0xce], 0
mov byte [esi + 0xcc], 0
jne 0x4038ff
cmp dword [0x4af8ac], 0
jge 0x4038e7
pop edi
mov dword [esi + 0xc0], ecx
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0xbc], eax
mov edx, dword [0x4af8ac]
mov dword [esi + 0xc0], edx
pop edi
pop esi
ret

Function at 0x403f10
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x403f39
lea eax, [esp]
call fcn.004503a0
mov eax, dword [0x4ababc]
push ebx
push esi
push edi
test eax, eax
je 0x403f95
mov ebx, dword [eax]
test ebx, ebx
je 0x403f95
cmp byte [ebx], 0
je 0x403f95
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403f55
sub eax, edx
mov edi, eax
lea eax, [edi + 1]
call fcn.004722b0
mov esi, eax
test esi, esi
jne 0x403f80
push ebx
push str.Out_of_memory.
mov ecx, 0x4af278
call fcn.0042fd40
jmp 0x403f9a
test edi, edi
je 0x403f8f
push edi
push ebx
push esi
call fcn.004905c0
add esp, 0xc
mov byte [esi + edi], 0
jmp 0x403f9a
mov esi, 0x49b8cd
mov dword [0x4aeae8], esi
call fcn.00403dc0
mov esi, dword [0x4aa988]
mov ecx, 0x3a
mov edi, 0x4acf90
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
add esp, 0x104
ret

Function at 0x404800
Capabilities:
Write clipboard data

Disassembly:
cmp dword [0x4af904], 0
push ebx
push ebp
mov ebp, dword [esp + 0xc]
mov ebx, eax
je 0x404818
pop ebp
xor eax, eax
pop ebx
ret 4
push esi
test ebp, ebp
je 0x404865
cmp ebx, 0xffffffff
jne 0x404832
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404827
sub eax, edx
mov ebx, eax
test ebx, ebx
je 0x404865
push edi
lea edi, [ebx + 1]
mov esi, 0x4af8f8
call fcn.00404880
pop edi
test eax, eax
jne 0x40484f
pop esi
pop ebp
pop ebx
ret 4
mov eax, dword [0x4af904]
push ebx
push ebp
push eax
mov esi, eax
call fcn.0048adb0
add esp, 0xc
mov byte [esi + ebx], 0
pop esi
pop ebp
pop ebx
mov dword [esp + 4], 1
mov ecx, 0x4af8f8
jmp fcn.004048f0