joyce8/EMBER2024-capa huggingface dataset:
Function at 0x562f2d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x5b8fd8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x562f6d
cmp byte [ebx], 0xa
jne 0x562f6d
or byte [edi + eax + 0x28], 4
jmp 0x562f72
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x563071
mov dl, byte [eax]
cmp dl, 0x1a
je 0x563054
inc eax
cmp dl, 0xd
je 0x562f9e
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x562fc4
cmp eax, ecx
jae 0x562fd2
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x562f86
jmp 0x563071
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x56304f
cmp dword [ebp - 0x10], 0
je 0x56304f
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x5b8fd8]
test byte [eax + edi + 0x28], 0x48
je 0x563029
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x563014
mov byte [esi], dl
jmp 0x563025
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x5b8fd8]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x563071
cmp byte [ebp - 1], 0xa
jne 0x563038
cmp esi, ebx
jne 0x563038
mov byte [esi], 0xa
jmp 0x563070
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00562a9e
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x563071
mov byte [esi], 0xd
jmp 0x563070
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x5b8fd8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x56306e
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x563071
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x56307a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x5b8fd8]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x5630c0
cmp word [ebx], dx
jne 0x5630c0
or byte [eax + edi + 0x28], 4
jmp 0x5630c5
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x563228
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x563208
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x563106
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x56313c
cmp eax, edx
jae 0x56314a
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x5630e1
jmp 0x563228
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x563203
cmp dword [ebp - 0x18], 0
je 0x563203
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x5b8fd8]
test byte [eax + edi + 0x28], 0x48
je 0x5631d9
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x56319d
mov word [esi], cx
jmp 0x5631d4
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x5b8fd8]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x5b8fd8]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x5b8fd8]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x563228
pop eax
cmp word [ebp - 4], ax
jne 0x5631e9
cmp esi, ebx
jne 0x5631e9
mov word [esi], ax
jmp 0x563225
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00562a9e
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x563228
push 0xd
pop eax
jmp 0x5631e4
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x5b8fd8]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x563222
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x563228
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x566479
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x5b30cc]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x5664c4
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.00566614
test al, al
jne 0x5664be
sub edx, 2
cmp edx, edi
jne 0x5664a4
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x5664e6
lea eax, [edi + 2]
cmp edx, eax
je 0x5664e6
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.005663c5
add esp, 0x10
jmp 0x5665e0
push esi
lea ecx, [ebp - 0x255]
call fcn.00566614
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x566529
push dword [ebp - 0x25c]
jmp 0x5664d6
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x566566
cmp word [ebp - 0x226], 0
je 0x566587
cmp word [ebp - 0x226], ax
jne 0x566566
cmp word [ebp - 0x224], 0
je 0x566587
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.005663c5
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x5665d3
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x566540
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x5665bb
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x5665e0
push 0x5661f5
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.0056d300
add esp, 0x10
jmp 0x5665b0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00545dd8
leave
ret
Function at 0x566ef6
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x566f93
push ebx
push esi
call fcn.00566ebf
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00564a41
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x566f40
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x566f92
push edi
push eax
call fcn.0055fd1f
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x566f60
call fcn.0055eed2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x566f91
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00564a41
add esp, 0x20
test eax, eax
jne 0x566f7f
push edi
call fcn.0055eed2
jmp 0x566f87
push ebx
call fcn.0055eed2
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x566f96
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x566fa7
pop esi
ret
push ebx
push edi
push esi
call fcn.00566ebf
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.0055fd1f
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x566fcf
push ebx
push esi
push edi
call fcn.00547470
add esp, 0xc
push 0
call fcn.0055eed2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x567729
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00567244

Function at 0x569695
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0055e1cc
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x569704
cmp esi, dword [ebp - 4]
je 0x5696ff
cmp dword [ebp + 0xc], 0
je 0x5696ff
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x5696dc
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.005691e7
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x569706
xor eax, eax
inc eax
jmp 0x569706
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x56976b
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5b30cc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.0055e1cc
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0055e1cc
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x5697e2
cmp word [ecx], dx
je 0x5697e2
mov eax, dword [0x582e8c]
push edi
dec eax
push eax
push 0x582d78
call fcn.0056970a
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x569855
cmp word [eax], dx
je 0x569855
mov eax, dword [edi]
test eax, eax
je 0x569806
cmp word [eax], dx
je 0x569806
lea eax, [ebp - 0x10]
push eax
call fcn.005690ed
jmp 0x56980f
lea eax, [ebp - 0x10]
push eax
call fcn.00569188
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x56987f
mov eax, dword [0x582d74]
push dword [ebp - 0x14]
dec eax
push eax
push 0x582a68
call fcn.0056970a
add esp, 0xc
test al, al
je 0x56987f
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x56984a
cmp word [eax], di
je 0x56984a
lea eax, [ebp - 0x10]
push eax
call fcn.005690ed
pop ecx
jmp 0x569881
lea eax, [ebp - 0x10]
push eax
call fcn.00569188
jmp 0x569847
mov eax, dword [edi]
test eax, eax
je 0x56986c
cmp word [eax], dx
je 0x56986c
lea eax, [ebp - 0x10]
push eax
call fcn.005690a2
pop ecx
jmp 0x56987f
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x56994a
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.0056958f
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x56994a
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x56994a
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x56994a
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x5698d7
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.0055f8c0
test ebx, ebx
je 0x569945
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.0055f8c0
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x56994a
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x56994a
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.0056d96d
add esp, 0x10
xor eax, eax
inc eax
jmp 0x56994c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00545dd8
leave
ret
Function at 0x56da85
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.0056da01
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x56dbf4
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x56dbf4
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x56dba9
jg 0x56dae1
test eax, eax
je 0x56db9f
push 1
push 0x1000
call fcn.0055f150
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x56db04
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x56db96
push 0x8000
push ebx
call fcn.00558381
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x56db2d
jg 0x56db28
cmp ecx, 0x1000
jb 0x56db2d
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.0056267c
add esp, 0x10
cmp eax, 0xffffffff
je 0x56db72
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x56db28
jl 0x56db59
test ecx, ecx
jne 0x56db1a
push dword [ebp - 0xc]
push ebx
call fcn.00558381
push esi
call fcn.0055eed2
add esp, 0xc
xor ebx, ebx
jmp 0x56dc02
cmp byte [edi + 0x24], 0
je 0x56db89
cmp dword [edi + 0x20], 5
jne 0x56db89
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x56db94
mov ebx, dword [edi + 0x18]
jmp 0x56db96
xor ebx, ebx
push esi
call fcn.0055eed2
pop ecx
jmp 0x56dc02
test ecx, ecx
jg 0x56db6b
jl 0x56dba9
test eax, eax
jae 0x56db6b
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00562a9e
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x56dbc9
cmp byte [edi + 0x1c], 0
je 0x56db6b
jmp 0x56dbfa
push ebx
call fcn.0056548c
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x56db6b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x56dc02
cmp byte [edi + 0x1c], 0
je 0x56dbff
mov ebx, dword [edi + 0x18]
jmp 0x56dc02
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.00562a9e
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x56f280
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x56f2ad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x56f2ad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401cc0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x407048
call sym._EnterCriticalSection_4
mov ebx, dword [0x407040]
sub esp, 4
test ebx, ebx
je 0x401d0b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401d04
test esi, esi
je 0x401d04
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401ce0
mov dword [esp], 0x407048
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x401ef0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x401f40
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402018
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x401f7e
cmp eax, 4
jne 0x401fa0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x401f8e
cmp edx, 4
je 0x401f8e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00401ef0
Function at 0xdc2cd4
Capabilities:
Encode data using xor

Disassembly:
jmp 0xdc2cde
pushal
call 0xdc2ce4
pop ebp
sub ebp, 0x10
sub ebp, 0x9c2cd4
jmp 0xdc2cfa
sub al, 0x9c
add cl, ch
add al, 0
add byte [eax], al
out dx, al
inc bp
sub eax, 0x9c2cd4b8
add byte [ebx], al
lds eax, [ecx + 0x4cc0]
add byte [ecx + 0x5cc], bh
mov eax, 0x9c2cd4
add eax, ebp
add eax, 0x4c
mov ecx, 0x5cc
mov edx, 0xd42fe95c
xor byte [eax], dl
inc eax
dec ecx
jne 0xdc2d11
invalid
jmp 0xdc2d24
push es
xlatb
xchg ecx, eax
xlatb
aad 0x60
pop esp
pop esp
pop esp
fstp qword [ebp + 0x5c5c5ca4]
pop edi
xchg ecx, eax
in al, 0x5b
pop esp
pop esp
pop esp
out 0x74, al
pop esp
pop esp
pop esp
stosd dword es:[edi], eax
mov esi, 0xddd7945f
push eax
pop esp
pop esp
pop esp
pop edi
cdq
sar dword [eax], 1
js 0xdc2cee
mov al, byte [0xd17858d5]
aad 0x58
js 0xdc2d23
cmp byte [eax - 0x60], bh
aad 0x58
js 0xdc2d8d
inc eax
stosb byte es:[edi], al
jge 0xdc2db9
pop esp
xor al, 0xe4
push 0x26
pop esp
pop ebp
jo 0xdc2ddd
xor al, 0x87
push dword [eax - 0x4b]
mov ah, 0x59
pop esp
pop esp
pop esp
mov ch, 0x6c
pop esp
pop esp
pop esp
sar dword [eax], 1
js 0xdc2d18
aad 0x70
js 0xdc2d4d
xor byte [eax + 0x5c], bh
xlatb
fst dword [esp + ebx*2 + 0x5c]
pop esp
xlatb
leave
push eax
pop esp
pop esp
pop esp
xlatb
ror dword [esp + ebx*2 + 0x5c], 1
dec esp
pop esp
pop esp
pop esp
popfd
mov ch, 0x5e
insd dword es:[edi], dx
pop esi
fistp word [esi - 0x26aceaa8]
test al, 0xa3
mov dword [0x509e01a3], eax
pop esp
xlatb
sar byte [eax + 0x58], 1
pop esp
pop esp
pop esp
xor al, 0x40
stosb byte es:[edi], al
jge 0xdc2e0c
xor al, 0xe4
push 0x26
pop esp
pop ebp
jo 0xdc2e30
sar dword [eax], 1
js 0xdc2d5c
cmp byte [eax - 0x60], bh
aad 0x50
js 0xdc2d74
pop ecx
pop esp
pop esp
pop esp
mov ch, 0xd
pop esi
pop esp
pop esp
sar dword [eax], 1
js 0xdc2d6d
aad 0x70
js 0xdc2da8
mov al, 0xa3
sub dword [eax - 0x5d], edx
sub dword [esp + esi*4 + 0x22], edx
pop esp
pop esp
pop esp
xlatb
loope 0xdc2e34
pop esp
pop esp
pop esp
invalid
pop esp
pop esp
pop esp
cmp dl, bh
inc eax
fsub qword gs:[edi + 0x46d853b4]
pop esp
pop esp
pop esp
fsub qword [edi + 0x4dd853b5]
pop esp
pop esp
pop esp
cmp bl, ch
cmpsd dword [esi], dword es:[edi]
mov dword [0x49d85379], eax
pop esp
pop esp
pop esp
sbb eax, 0xa3a390b5
mov dword [0x5d651075], eax
mov dword [0x651075a3], eax
pop ebp
fistp word [ebp + 0x58b4df59]
mov ch, 0xe1
mov dword [0x875a3a3], eax
pop esi
fistp word [ebp + 0x58b6df5a]
fbstp tbyte [ecx + ebx*2 - 0x5c5c084b]
mov dword [0x5c509e01], eax
or edi, edx
mov al, 0xa
or ecx, dword [ecx]
xlatb
sub dword [eax - 0x29], edx
and dword [eax - 0x12], edx
invalid
Function at 0x18202aa9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc eax
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.18202745
push eax
push esi
push dword [ebp + 8]
call fcn.182026fa
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.18202745
push eax
push esi
push dword [ebp + 8]
call fcn.182026fa
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.18202745
push eax
push esi
push dword [ebp + 8]
call fcn.182026fa
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.18202735
adc al, 0xd
mov bl, 0x47
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.18202735
neg ebp
iretd