joyce8/EMBER2024-capa huggingface dataset:
Function at 0x509039
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add bl, ch
pop es
dec ebx
cmp al, 0x4c
xor eax, 0x5a344e44
push edx
push eax
add esp, 4
sub edx, 0x14e8f
jmp 0x508e2e
pop edx
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push edi
xor edi, 0x7814
xor edi, 0x3527
pop edi
push edx
push ebx
add esp, 4
call 0x508f00
add byte [ecx + 0x32], cl
aaa
dec esp
dec ebx
cmp dword [esi + 0x3d], ecx
push eax
add esp, 4
add edx, 0xb5f0
xor edx, 0x473b
pop edx
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push ebx
push ebx
add esp, 4
add ebx, 0x9abe
or ebx, 0x6c8
add ebx, 0xaca3
pop ebx
push ecx
add ecx, 0xf6ca
xor ecx, 0x4d42
add ecx, 0x135d4
and ecx, 0xc87a
pop ecx
mov dword [ebp - 0x10], 1
push ecx
push esi
add esp, 4
call 0x508f98
add byte [esp + edi + 0x47], cl
dec ebx
dec ebx
cmp esi, dword [esi]
dec ebx
inc esp
add esp, 4
and ecx, 0x1796b
pop ecx
push edi
sub edi, 0x69c8
sub edi, 0x14cda
xor edi, 0x5658
pop edi
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push esi
push eax
add esp, 4
add esi, 0xe69
add esi, 0xdefa
or esi, 0x7a8c
or esi, 0x16379
pop esi
push edx
or edx, 0x11579
and edx, 0x52aa
xor edx, 0x15fdc
pop edx
push ebx
push edi
add esp, 4
call 0x509027
add byte [0x4a4f3f3e], dh
xor al, 0x33
dec edx
add esp, 4
call 0x509039
add byte [ebp + 0x33], al
dec edx
dec ebx
inc esp
xor al, 0x47
cmp al, 0x83
les eax, [ebx + ebx*2]
push ebx
jmp 0x509045
pop ebx
mov dword [ebp - 0x2c], 1
push esi
xor esi, 0x5a60
and esi, 0x332
pop esi
push ecx
call 0x509069
add byte [ebp + 0x38], al
xor al, byte [esi + edi + 0x3c]
aas
add esp, 4
and ecx, 0xf6eb
jmp 0x509078
sub ecx, 0xd739
pop ecx
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x509260
Function at 0x509069
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add bl, ch
pop es
dec ebx
cmp al, 0x4c
xor eax, 0x5a344e44
push edx
push eax
add esp, 4
sub edx, 0x14e8f
jmp 0x508e2e
pop edx
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push edi
xor edi, 0x7814
xor edi, 0x3527
pop edi
push edx
push ebx
add esp, 4
call 0x508f00
add byte [ecx + 0x32], cl
aaa
dec esp
dec ebx
cmp dword [esi + 0x3d], ecx
push eax
add esp, 4
add edx, 0xb5f0
xor edx, 0x473b
pop edx
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push ebx
push ebx
add esp, 4
add ebx, 0x9abe
or ebx, 0x6c8
add ebx, 0xaca3
pop ebx
push ecx
add ecx, 0xf6ca
xor ecx, 0x4d42
add ecx, 0x135d4
and ecx, 0xc87a
pop ecx
mov dword [ebp - 0x10], 1
push ecx
push esi
add esp, 4
call 0x508f98
add byte [esp + edi + 0x47], cl
dec ebx
dec ebx
cmp esi, dword [esi]
dec ebx
inc esp
add esp, 4
and ecx, 0x1796b
pop ecx
push edi
sub edi, 0x69c8
sub edi, 0x14cda
xor edi, 0x5658
pop edi
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push esi
push eax
add esp, 4
add esi, 0xe69
add esi, 0xdefa
or esi, 0x7a8c
or esi, 0x16379
pop esi
push edx
or edx, 0x11579
and edx, 0x52aa
xor edx, 0x15fdc
pop edx
push ebx
push edi
add esp, 4
call 0x509027
add byte [0x4a4f3f3e], dh
xor al, 0x33
dec edx
add esp, 4
call 0x509039
add byte [ebp + 0x33], al
dec edx
dec ebx
inc esp
xor al, 0x47
cmp al, 0x83
les eax, [ebx + ebx*2]
push ebx
jmp 0x509045
pop ebx
mov dword [ebp - 0x2c], 1
push esi
xor esi, 0x5a60
and esi, 0x332
pop esi
push ecx
call 0x509069
add byte [ebp + 0x38], al
xor al, byte [esi + edi + 0x3c]
aas
add esp, 4
and ecx, 0xf6eb
jmp 0x509078
sub ecx, 0xd739
pop ecx
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x509260
Function at 0x50d02d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
sub ecx, 0x9f69
pop ecx
push edi
push edi
add esp, 4
call fcn.0050d02d
add byte [eax + 0x41], al
cmp bh, byte [eax + edx*2]
inc esi
inc edi
add esp, 4
xor edi, 0xd393
sub edi, 0x748c
pop edi
push edi
xor edi, 0xbcf1
pop edi
lea ecx, [ebp - 0x1628]
mov dword [ebp - 0xc1c], ecx
mov edx, dword [ebp - 0x4d4]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc18], eax
xor ecx, ecx
mov word [ebp - 0x1f8], cx
xor edx, edx
mov word [ebp - 0x100], dx
push edi
push ecx
add esp, 4
and edi, 0xb70f
call 0x50d08d
add byte [ebx + 0x4a], al
dec eax
cmp eax, 0x48393941
xor eax, 0x8104c483
not ecx
and eax, dword [ecx]
add byte [edi + 0x50], bl
jmp 0x50d09d
or eax, 0x10ae7
pop eax
mov eax, dword [ebp - 0xc18]
mov cx, word [eax]
mov word [ebp - 0xf7e], cx
mov edx, dword [ebp - 0xc18]
add edx, 2
mov dword [ebp - 0xc18], edx
mov ax, word [ebp - 0xf7e]
mov word [ebp - 0x1f8], ax
mov ecx, dword [ebp - 0xc1c]
mov dx, word [ecx]
mov word [ebp - 0xf80], dx
mov eax, dword [ebp - 0xc1c]
add eax, 2
mov dword [ebp - 0xc1c], eax
mov cx, word [ebp - 0xf80]
mov word [ebp - 0x100], cx
push edx
push edi
add esp, 4
sub edx, 0xf14a
pop edx
push eax
push edi
add esp, 4
jmp 0x50d116
add eax, 0x1282a
sub eax, 0x1792d
pop eax
push ecx
push edi
add esp, 4
jmp 0x50d12f
pop ecx
movzx edx, word [ebp - 0x100]
test edx, edx
jne 0x50d153
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
sub eax, ecx
mov dword [ebp - 0x1498], eax
jmp 0x50d1b6
movzx edx, word [ebp - 0x1f8]
movzx eax, word [ebp - 0x100]
cmp edx, eax
je 0x50d072
movzx ecx, word [ebp - 0x1f8]
xor ecx, 0x20
movzx edx, word [ebp - 0x100]
cmp ecx, edx
je 0x50d072
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
cmp eax, ecx
jge 0x50d1a0
mov dword [ebp - 0x14d8], 0xffffffff
jmp 0x50d1aa
mov dword [ebp - 0x14d8], 1
mov edx, dword [ebp - 0x14d8]
mov dword [ebp - 0x1498], edx
cmp dword [ebp - 0x1498], 0
jne 0x50d1ff
push eax
sub eax, 0x79c4
xor eax, 0x16639
sub eax, 0x4484
pop eax
push ecx
push ecx
add esp, 4
add ecx, 0xd158
and ecx, 0x4b80
jmp 0x50d1eb
jmp 0x50d1f0
pop ecx
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x2e0], eax
jmp 0x50d267
push eax
push ebx
add esp, 4
or eax, 0x17e74
xor eax, 0x9e07
pop eax
push edi
push eax
add esp, 4
sub edi, 0x874c
or edi, 0x14186
add edi, 0x11bcf
pop edi
push esi
sub esi, 0x1183c
pop esi
mov ecx, dword [ebp - 0x4d4]
mov edx, dword [ecx]
mov dword [ebp - 0x4d4], edx
mov eax, dword [ebp - 0x4d4]
cmp eax, dword [ebp - 0xc20]
je 0x50d25d
mov ecx, dword [ebp - 0x4d4]
cmp dword [ecx + 0x30], 0
jne 0x50d013
mov dword [ebp - 0x2e0], 0
Function at 0x50d08d
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
sub ecx, 0x9f69
pop ecx
push edi
push edi
add esp, 4
call fcn.0050d02d
add byte [eax + 0x41], al
cmp bh, byte [eax + edx*2]
inc esi
inc edi
add esp, 4
xor edi, 0xd393
sub edi, 0x748c
pop edi
push edi
xor edi, 0xbcf1
pop edi
lea ecx, [ebp - 0x1628]
mov dword [ebp - 0xc1c], ecx
mov edx, dword [ebp - 0x4d4]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc18], eax
xor ecx, ecx
mov word [ebp - 0x1f8], cx
xor edx, edx
mov word [ebp - 0x100], dx
push edi
push ecx
add esp, 4
and edi, 0xb70f
call 0x50d08d
add byte [ebx + 0x4a], al
dec eax
cmp eax, 0x48393941
xor eax, 0x8104c483
not ecx
and eax, dword [ecx]
add byte [edi + 0x50], bl
jmp 0x50d09d
or eax, 0x10ae7
pop eax
mov eax, dword [ebp - 0xc18]
mov cx, word [eax]
mov word [ebp - 0xf7e], cx
mov edx, dword [ebp - 0xc18]
add edx, 2
mov dword [ebp - 0xc18], edx
mov ax, word [ebp - 0xf7e]
mov word [ebp - 0x1f8], ax
mov ecx, dword [ebp - 0xc1c]
mov dx, word [ecx]
mov word [ebp - 0xf80], dx
mov eax, dword [ebp - 0xc1c]
add eax, 2
mov dword [ebp - 0xc1c], eax
mov cx, word [ebp - 0xf80]
mov word [ebp - 0x100], cx
push edx
push edi
add esp, 4
sub edx, 0xf14a
pop edx
push eax
push edi
add esp, 4
jmp 0x50d116
add eax, 0x1282a
sub eax, 0x1792d
pop eax
push ecx
push edi
add esp, 4
jmp 0x50d12f
pop ecx
movzx edx, word [ebp - 0x100]
test edx, edx
jne 0x50d153
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
sub eax, ecx
mov dword [ebp - 0x1498], eax
jmp 0x50d1b6
movzx edx, word [ebp - 0x1f8]
movzx eax, word [ebp - 0x100]
cmp edx, eax
je 0x50d072
movzx ecx, word [ebp - 0x1f8]
xor ecx, 0x20
movzx edx, word [ebp - 0x100]
cmp ecx, edx
je 0x50d072
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
cmp eax, ecx
jge 0x50d1a0
mov dword [ebp - 0x14d8], 0xffffffff
jmp 0x50d1aa
mov dword [ebp - 0x14d8], 1
mov edx, dword [ebp - 0x14d8]
mov dword [ebp - 0x1498], edx
cmp dword [ebp - 0x1498], 0
jne 0x50d1ff
push eax
sub eax, 0x79c4
xor eax, 0x16639
sub eax, 0x4484
pop eax
push ecx
push ecx
add esp, 4
add ecx, 0xd158
and ecx, 0x4b80
jmp 0x50d1eb
jmp 0x50d1f0
pop ecx
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x2e0], eax
jmp 0x50d267
push eax
push ebx
add esp, 4
or eax, 0x17e74
xor eax, 0x9e07
pop eax
push edi
push eax
add esp, 4
sub edi, 0x874c
or edi, 0x14186
add edi, 0x11bcf
pop edi
push esi
sub esi, 0x1183c
pop esi
mov ecx, dword [ebp - 0x4d4]
mov edx, dword [ecx]
mov dword [ebp - 0x4d4], edx
mov eax, dword [ebp - 0x4d4]
cmp eax, dword [ebp - 0xc20]
je 0x50d25d
mov ecx, dword [ebp - 0x4d4]
cmp dword [ecx + 0x30], 0
jne 0x50d013
mov dword [ebp - 0x2e0], 0
Function at 0x521838
Capabilities:
Encode data using xor

Disassembly:
or byte [edx], cl
or dword [ecx], ecx
or dword [esi + eax*8 + 0x808fa49], ecx
or dword [esi + 0x17], edi
xchg esp, eax
sahf
add esp, ebp
or byte [eax], cl
xchg edx, eax
sahf
test dword [eax + ecx], eax
or ah, dh
sbb dh, dl
out dx, al
push es
or byte [eax], cl
xchg esp, eax
mov fs, word [ecx + 3]
or byte [eax], cl
xchg edx, eax
mov es, word [ebp - 0x6bf7f7fc]
xchg esi, eax
test dword [eax + ecx], eax
or byte [edx + 0x8fe6996], dl
or byte [esi + 0x8e9d19e], dl
or byte [ebx + 0x73], bl
or esi, dword [ebx + 0xa]
xchg esp, eax
invalid

Function at 0x52c6a4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp], cl
mov ebx, edx
mov esi, eax
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
mov edi, eax
test bl, bl
je 0x52c6c5
test edi, 0x40000
je 0x52c6df
test bl, bl
jne 0x52c760
mov eax, edi
and eax, 0x40000
cmp eax, 0x40000
jne 0x52c760
push esi
call sub.user32.dll_IsIconic
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 2], al
push esi
call sub.user32.dll_IsWindowVisible
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 1], al
movzx eax, byte [esp + 1]
or al, byte [esp + 2]
je 0x52c712
push 0
push esi
call sub.user32.dll_ShowWindow
test bl, bl
je 0x52c727
or edi, 0x40000
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
jmp 0x52c736
and edi, 0xfffbffff
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
movzx eax, byte [esp]
and al, byte [esp + 1]
jne 0x52c747
cmp byte [esp + 2], 0
je 0x52c760
cmp byte [esp + 2], 0
je 0x52c758
push 6
push esi
call sub.user32.dll_ShowWindow
jmp 0x52c760
push 5
push esi
call sub.user32.dll_ShowWindow
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x52ca0c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
call sub.user32.dll_GetActiveWindow
mov dword [esp], eax
mov byte [esp + 4], 0
test bl, bl
je 0x52ca32
mov eax, esp
push eax
push 0x52c9d4
call sub.user32.dll_EnumWindows
jmp 0x52ca45
mov eax, esp
push eax
push 0x52c9b4
call sub.kernel32.dll_GetCurrentThreadId
push eax
call sub.user32.dll_EnumThreadWindows
movzx eax, byte [esp + 4]
pop ecx
pop edx
pop ebx
ret

Function at 0x52cb08
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov ebx, eax
movzx esi, word [0x52cb58]
test bl, 4
je 0x52cb1c
or si, 1
test bl, 8
je 0x52cb25
or si, 4
test bl, 1
je 0x52cb2e
or si, 8
test bl, 2
je 0x52cb37
or si, 0x10
test bl, 0x10
je 0x52cb40
or si, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x52cb50
or si, 2
mov eax, esi
pop esi
pop ebx
ret

Function at 0x52cb5c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, word [0x52cb98]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x52cb77
or bx, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x52cb87
or bx, 4
test esi, 0x20000000
je 0x52cb93
or bx, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x401070
Capabilities:
Hide graphical window

Disassembly:
mov ebp, esp
push esi
mov eax, dword [ebp + 4]
mov dword [0x4040f6], eax
xor eax, eax
mov ecx, 0x16
push eax
dec ecx
jne 0x401082
lea ecx, [ebp - 0x5c]
push ecx
mov eax, 0x30
mov dword [ecx], eax
mov eax, dword [0x4040f6]
mov dword [ebp - 0x48], eax
mov eax, 0x40213c
mov dword [ebp - 0x54], eax
mov ecx, str.uquamarine
mov dword [ebp - 0x34], ecx
call dword [sym.imp.USER32.dll_RegisterClassExA]
mov dword [0x4041cc], 8
mov dword [0x4041d0], 0x4000
push 0x4041cc
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
xor ecx, ecx
push ecx
push dword [0x4040f6]
push ecx
push ecx
push 0x12e
push 0x7a
push 0x34c
push 0x2aa
push 0x40000
lea eax, str.kippohome
push eax
mov eax, str.uquamarine
push eax
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x404220], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x404220]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor ebx, ebx
lea edi, [ebp - 0x50]
jmp 0x401132
push edi
call dword [sym.imp.USER32.dll_TranslateMessage]
push edi
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.USER32.dll_GetMessageA]
test al, al
jne 0x401124
mov esp, ebp
ret
Function at 0x401550
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._fread
leave
ret
Function at 0x412900
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x41b050
call sym._EnterCriticalSection_4
mov ebx, dword [0x41b048]
sub esp, 4
test ebx, ebx
je 0x41294b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x412944
test esi, esi
je 0x412944
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x412920
mov dword [esp], 0x41b050
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x412b30
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x412b80
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x412c58
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x412bbe
cmp eax, 4
jne 0x412be0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x412bce
cmp edx, 4
je 0x412bce
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00412b30

Function at 0x412f50
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0x1c
mov dword [global___mutex], 0xffffffff
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0xffff
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._CreateSemaphoreW_16
sub esp, 0x10
mov dword [0x41b080], eax
call sym._TlsAlloc_0
cmp eax, 0xffffffff
je 0x412fb0
mov dword [esp + 4], dbg.emutls_destroy
mov dword [esp], eax
mov dword [global___key], eax
call sym.___mingwthr_key_dtor
test eax, eax
jne 0x412fb7
add esp, 0x1c
ret
call sym._GetLastError_0
jmp 0x412fa8
call sym._abort
lea esi, [esi]
Function at 0x412fc0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebp, dword [0x41b070]
mov ebx, dword [esp + 0x40]
test ebp, ebp
jne 0x412fe4
mov eax, dword [ebx + 8]
test eax, eax
je 0x413040
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, dword [ebx + 8]
test esi, esi
je 0x413091
mov edi, dword [global___key]
call sym._GetLastError_0
mov ebp, eax
mov dword [esp], edi
call sym._TlsGetValue_4
sub esp, 4
mov edi, eax
mov dword [esp], ebp
call sym._SetLastError_4
sub esp, 4
test edi, edi
je 0x413050
mov edx, dword [edi]
mov ebp, edi
cmp esi, edx
ja 0x413114
lea esi, [ebp + esi*4]
mov eax, dword [esi]
test eax, eax
jne 0x412fdc
mov eax, ebx
call dbg.emutls_alloc
mov dword [esi], eax
jmp 0x412fdc
mov eax, ebx
call dbg.emutls_alloc
mov dword [ebx + 8], eax
jmp 0x412fdc
lea eax, [esi + 0x21]
mov dword [esp + 4], 4
lea edi, [esi + 0x20]
mov dword [esp], eax
call sym._calloc
test eax, eax
mov ebp, eax
je 0x41321e
mov dword [eax], edi
mov eax, dword [global___key]
mov dword [esp + 4], ebp
mov dword [esp], eax
call sym._TlsSetValue_8
sub esp, 8
test eax, eax
jne 0x413024
call sym._GetLastError_0
jmp 0x413024
mov edi, dword [0x41b070]
test edi, edi
je 0x4130c0
mov esi, dword [0x415150]
test esi, esi
je 0x4131e1
mov dword [esp], global___mutex
call sym._InterlockedIncrement_4
sub esp, 4
test eax, eax
jne 0x4131ad
mov esi, dword [ebx + 8]
test esi, esi
je 0x413197
mov eax, dword [0x41b070]
test eax, eax
je 0x412fef
mov dword [esp], global___mutex
call sym._InterlockedDecrement_4
sub esp, 4
test eax, eax
js 0x412fef
mov eax, dword [0x41b080]
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], eax
call sym._ReleaseSemaphore_12
sub esp, 0xc
jmp 0x412fef
lea ecx, [edx + edx]
cmp esi, ecx
jbe 0x41311e
lea ecx, [esi + 0x20]
lea eax, [ecx*4 + 4]
mov dword [esp], edi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ecx
mov dword [esp + 4], eax
call sym._realloc
test eax, eax
mov ebp, eax
je 0x41321e
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [eax], ecx
sub ecx, edx
lea eax, [eax + edx*4 + 4]
shl ecx, 2
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov dword [esp], eax
call sym._memset
jmp 0x413072
call dbg.emutls_init
mov dword [0x415150], 1
mov edx, dword [0x41b070]
test edx, edx
jne 0x4130a9
mov esi, dword [ebx + 8]
test esi, esi
jne 0x412fef
mov eax, dword [0x41b074]
lea esi, [eax + 1]
mov dword [0x41b074], esi
mov dword [ebx + 8], esi
jmp 0x4130cb
mov eax, dword [0x41b080]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
test eax, eax
je 0x4130c0
mov dword [esp], global___mutex
call sym._InterlockedDecrement_4
sub esp, 4
jmp 0x4130c0
mov dword [esp], 0x415154
call sym._InterlockedIncrement_4
sub esp, 4
test eax, eax
jne 0x41320f
jmp 0x41316f
mov dword [esp], 0
call sym._Sleep_4
sub esp, 4
mov ecx, dword [0x415150]
test ecx, ecx
je 0x413200
jmp 0x41317e
call sym._abort
lea esi, [esi]
lea edi, [edi]
Function at 0x43b63f
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov edi, 0x43b3c1
mov ebx, ebx
call fcn.0043b67d
and ebx, eax
mov eax, 0xc84ce8bd
xor dword [ecx], edi
sub ebx, 0x7d220c33
and eax, eax
inc ecx
mov eax, ebx
mov ebx, 0xde087763
add eax, 1
cmp ecx, edx
jne fcn.0043b63f
add eax, eax
and eax, ebx
inc ebx
ret

Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..rsrc
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x432072
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x2b823968
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x432060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4320d2
mov ebx, 0x42f314
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x17143681
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219