joyce8/EMBER2024-capa huggingface dataset:
Function at 0xbb56fc
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x75]
xchg dword [esp + 4], ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp]
lea esp, [esp + 4]
xchg esi, eax
lea esp, [esp - 4]
mov dword [esp], esi
mov esi, eax
mov eax, dword [esp]
xchg edx, eax
lea esp, [esp - 4]
mov dword [esp], eax
mov eax, edx
mov edx, dword [esp]
rdtsc
push ebx
mov ebx, dword [esp + 4]
lea ebx, [ebx + 0x43]
xchg dword [esp + 4], ebx
mov dword [esp + 4], ebx
mov ebx, dword [esp]
lea esp, [esp + 4]
and eax, 1
mov ecx, ecx
xchg edx, eax
xchg dword [esp], eax
xchg edx, eax
lea esp, [esp + 4]
xchg ecx, eax
xchg dword [esp], ecx
xchg ecx, eax
lea esp, [esp + 4]
je 0x53f310
jne 0x53f770
jmp 0x53f30e
str word [edi]
mov esi, 0x7c8b5700
and al, 8
movsx eax, byte [eax]
push edi
mov edi, dword [esp + 8]
pop edi
movsx ecx, byte [ecx]
push esi
mov esi, dword [esp + 4]
lea esi, [esi + 0x79]
xchg dword [esp + 4], esi
mov dword [esp + 4], esi
mov esi, dword [esp]
lea esp, [esp + 4]
xchg ecx, edi
xchg dword [esp], ecx
xchg ecx, edi
lea esp, [esp + 4]
xchg ecx, esi
xchg dword [esp], ecx
xchg ecx, esi
lea esp, [esp + 4]
push ecx
cmp eax, dword [esp]
pushfd
not dword [esp + 4]
inc dword [esp + 4]
add eax, dword [esp + 4]
popfd
lea esp, [esp + 4]
xchg ebx, eax
xchg dword [esp], eax
xchg ebx, eax
lea esp, [esp + 4]
xchg ebp, eax
xchg dword [esp], eax
xchg ebp, eax
lea esp, [esp + 4]
ret
call fcn.0051adc0
fstp dword [edi - 0x3cc676ae]
or eax, 0x50b829b9
wait
test byte [eax + 0x102ed34], ah
sbb al, byte [edi + 0x24648def]
cld
mov dword [esp], edi
mov edi, ebp
mov ebp, dword [esp]
xchg ebp, ecx
mov ecx, esp
push ebp
xchg ebp, ecx
pop ecx
xchg esi, eax
mov esi, dword [ebp + 8]
push eax
xchg esi, eax
pop esi
xchg ecx, eax
mov eax, dword [ebp + 0xc]
push ecx
xchg ecx, eax
pop eax
xchg edi, ebx
lea esp, [esp - 4]
mov dword [esp], edi
mov edi, ebx
mov ebx, dword [esp]
xchg esi, eax
lea esp, [esp - 4]
mov dword [esp], eax
mov eax, esi
mov esi, dword [esp]
mov dl, byte [eax]
push ecx
mov ecx, ebx
pop ecx
xor esi, esi
push ebp
mov ebp, esp
leave
xchg edi, eax
lea esp, [esp - 4]
mov dword [esp], eax
mov eax, edi
mov edi, dword [esp]
test dl, dl
push esi
mov esi, dword [esp + 4]
lea esi, [esi + 0x3f]
xchg dword [esp + 4], esi
mov dword [esp + 4], esi
mov esi, dword [esp]
lea esp, [esp + 4]
je 0x50be44
xchg edi, ecx
mov ecx, dword [ebp + 0x10]
push edi
xchg edi, ecx
pop ecx
jmp 0x537098
pushfd
push ecx
mov ecx, dword [esp + 4]
div byte [edx]
popfd
push edx
mov edx, dword [esp + 4]
lea edx, [edx + 0x1c]
xchg dword [esp + 4], edx
mov dword [esp + 4], edx
mov edx, dword [esp]
lea esp, [esp + 4]
je 0xb422b8
jne 0xb422b8
jmp 0xb422b6
popfd
push eax
mov eax, dword [esp + 4]
lea eax, [eax + 0x4c]
xchg dword [esp + 4], eax
mov dword [esp + 4], eax
mov eax, dword [esp]
lea esp, [esp + 4]
je 0x5296e4
jne 0x5296e4
jmp 0x5296e2
mov bh, 0
jmp 0x52d018
Function at 0xbb99db
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edi
mov edi, dword [esp + 4]
lea edi, [edi + 0x2a]
xchg dword [esp + 4], edi
mov dword [esp + 4], edi
mov edi, dword [esp]
lea esp, [esp + 4]
add dword [esp], 0xff972c16
xchg dword [esp], edx
push ebx
mov ebx, dword [esp + 4]
lea ebx, [ebx + 0x44]
xchg dword [esp + 4], ebx
mov dword [esp + 4], ebx
mov ebx, dword [esp]
lea esp, [esp + 4]
xchg dword [esp + 4], edx
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x52]
xchg dword [esp + 4], ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp]
lea esp, [esp + 4]
xchg dword [esp], edx
push ebp
mov ebp, esp
leave
popfd
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x71]
xchg dword [esp + 4], ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp]
lea esp, [esp + 4]
jmp 0x52c598
Function at 0x10008ba0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [0x10083280]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0x63e33c9a
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
sub eax, 0xa95a7108
je 0x10008c04
jmp 0x10008bda
mov eax, dword [ebp - 0x20]
sub eax, 0x63e33c9a
je 0x10008bf2
jmp 0x10008bed
jmp 0x10008c4b
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], 0xa95a7108
jmp 0x10008c4b
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
pop eax
push eax
mov eax, eax
xor eax, 0x85
nop
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
not byte [edi]
pop eax
push eax
mov eax, eax
xor eax, 0x85
nop
add byte [edi], 0x63
sub byte [edi], 0x27
pop eax
push eax
mov eax, eax
xor eax, 0x85
nop
imul byte [edi]
inc edi
loop 0x10008c1a
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10023a30
add esp, 0x1c
pop edi
pop ebp
ret
jmp 0x10008bc4
Function at 0x10028a4a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10028a89
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10028a89
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10028a89
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10028a89
cmp dword [ecx + 0x74], 0xe
jbe 0x10028a89
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1002b414
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1002b4b1
push ebx
push esi
call fcn.1002b3dd
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1002b371
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1002b45e
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1002b4b0
push edi
push eax
call fcn.10029d12
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1002b47e
call fcn.10029d60
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1002b4af
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1002b371
add esp, 0x20
test eax, eax
jne 0x1002b49d
push edi
call fcn.10029d60
jmp 0x1002b4a5
push ebx
call fcn.10029d60
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1002b71e
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10033440
push 0x10033438
push str.FlsAlloc
push 0x1f
call fcn.1002b63a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002b752
push dword [ebp + 8]
mov ecx, esi
call dword [0x10031150]
call esi
jmp 0x1002b758
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1002b79c
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10033450
push 0x10033448
push str.FlsGetValue
push 0x21
call fcn.1002b63a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002b7d3
push dword [ebp + 8]
mov ecx, esi
call dword [0x10031150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1002b7db
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10033458
push 0x10033450
push str.FlsSetValue
push 0x22
call fcn.1002b63a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002b815
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10031150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10030d20
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10030d4d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10030d4d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40102f
Capabilities:
Query environment variable

Disassembly:
push ebx
xor ebx, ebx
cmp dword [esp + 8], ebx
je 0x401052
push 0x104
push dword [esp + 0xc]
push str.USER_JPI_PROFILE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x401052
mov bl, 1
mov al, bl
pop ebx
ret
Function at 0x4015d9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
cmp edi, ebx
jne 0x4015f2
push 0x80004005
call fcn.004014cb
mov esi, dword [ebp + 8]
push edi
push esi
lea eax, [ebp + 0x10]
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp + 0x10], ebx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp esi, ebx
je 0x401641
mov ecx, dword [edi]
cmp ecx, ebx
jbe 0x40163f
cmp dword [ebp + 0x10], ebx
jbe 0x40163c
cmp dword [ebp + 0x10], 2
jbe 0x401648
cmp dword [ebp + 0x10], 7
jne 0x40163c
cmp ecx, 1
jb 0x40163c
lea edx, [ecx + esi]
cmp byte [edx - 1], bl
jne 0x40163c
cmp ecx, 1
jbe 0x401641
cmp byte [edx - 2], bl
je 0x401641
push 0xd
pop eax
mov byte [esi], bl
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
cmp byte [ecx + esi - 1], bl
jmp 0x40163a

Function at 0x401953
Capabilities:
Get common file path

Disassembly:
push 0x14
mov eax, 0x403405
call fcn.0040265b
mov eax, dword [ebp + 8]
push 0x104
push eax
xor edi, edi
push edi
push edi
xor ecx, ecx
push 0x404810
mov word [eax], cx
mov dword [ebp - 4], edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathEx]
mov esi, eax
cmp esi, edi
jge 0x4019c7
push esi
push str.Error:_08x_in_SHGetFolderPathEx_FOLDERID_LocalAppDataLow__0__NULL__pPath__MAX_PATH_
call fcn.00402497
pop ecx
pop ecx
push edi
push esi
call fcn.004030e0
mov ecx, dword [ebp - 0x18]
mov esi, dword [ecx + 4]
mov dword [ebp - 0x14], esi
call fcn.00402205
push eax
push esi
push 0x4044ac
call fcn.00402497
or dword [ebp - 4], 0xffffffff
add esp, 0xc
mov eax, 0x4019c0
ret
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x401a78
push dword [ebp + 8]
mov dword [ebp - 4], 2
push edi
push edi
push 0x1a
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x401a24
push esi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__pPath_
jmp 0x40198b
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x401a78
push 1
push 0x1a
push dword [ebp + 8]
mov dword [ebp - 4], 4
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x401a78
push esi
push str.Error:_08x_in_SHGetSpecialFolderPathW_NULL__pPath__CSIDL_APPDATA__TRUE_
jmp 0x40198b
mov eax, esi
call fcn.00402691
ret
Function at 0x402364
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x406040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push eax
push esi
push 0xffffffffffffffff
lea eax, [ebp - 0x824]
push 0x400
push eax
call dword [sym.imp.MSVCR100.dll__vsnprintf_s]
add esp, 0x14
test eax, eax
jns 0x4023a3
mov byte [ebp - 0x425], 0
lea eax, [ebp - 0x24]
push 0x20
push eax
call fcn.004022e5
push 0x4047e0
lea eax, [ebp - 0x24]
push 0x20
push eax
call dword [sym.imp.MSVCR100.dll_strcat_s]
mov eax, esi
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4023c7
sub eax, edx
cmp eax, 6
jbe 0x4023f0
lea eax, [esi + eax - 6]
push str.__08x_
push eax
call dword [sym.imp.MSVCR100.dll__mbscmp]
pop ecx
pop ecx
test eax, eax
jne 0x4023f0
xor edi, edi
inc edi
jmp 0x4023f2
xor edi, edi
lea eax, [ebp - 0x24]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4023f8
sub eax, edx
mov esi, eax
mov eax, str.Error:
test edi, edi
jne 0x402411
mov eax, 0x4046f6
lea ecx, [ebp - 0x824]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.P:_04d_T:_04d__s_s
mov eax, 0x3ff
sub eax, esi
push 0xffffffffffffffff
push eax
lea eax, [ebp + esi - 0x424]
push eax
call dword [sym.imp.MSVCR100.dll__snprintf_s]
add esp, 0x20
test eax, eax
jns 0x402452
mov dword [ebp - 0x29], 0x2e2e2e
push esi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x424]
push eax
call sub.MSVCR100.dll_memcpy
lea edi, [ebp - 0x424]
add esp, 0xc
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40246d
lea eax, [ebp - 0x424]
mov esi, 0x40480c
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004024e1
leave
ret

Function at 0x4024e1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x406040]
jne 0x4024eb
repz ret
jmp fcn.004029fa
Function at 0x406d40
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff64
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x9c], edx
mov edi, eax
xor eax, eax
push ebp
push 0x406dfc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x97]
push eax
push 0x97
call sub.kernel32.dll_GetLogicalDriveStringsA
xor ebx, ebx
jmp 0x406dd5
mov esi, ebx
and esi, 0xff
lea eax, [ebp + esi - 0x97]
push eax
call sub.kernel32.dll_GetDriveTypeA
sub eax, 5
je 0x406dd2
mov al, byte [ebp + esi - 0x97]
call fcn.0040258c
cmp al, 0x41
je 0x406dd2
mov al, byte [ebp + esi - 0x97]
call fcn.0040258c
cmp al, 0x42
je 0x406dd2
lea eax, [ebp - 0x9c]
mov dl, byte [ebp + esi - 0x97]
call fcn.004031b4
mov edx, dword [ebp - 0x9c]
mov eax, edi
call fcn.00403214
add bl, 4
xor eax, eax
mov al, bl
cmp byte [ebp + eax - 0x97], 0
jne 0x406d79
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406e03
lea eax, [ebp - 0x9c]
call fcn.00403094
ret

Function at 0x407080
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [0x409214]
mov dword [eax], ecx
mov ebx, edx
test ebx, ebx
jle 0x4070a1
mov eax, 0xff
call fcn.00402680
xor byte [esi], al
inc esi
dec ebx
jne 0x407091
pop esi
pop ebx
ret
Function at 0x407bd4
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0xa
add esp, 0xfffff004
push eax
dec eax
jne 0x407bdd
mov eax, dword [ebp - 4]
add esp, 0xfffffdf0
push ebx
xor edx, edx
mov dword [ebp - 0xa214], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407d8d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xa214]
mov edx, 0x4091c0
mov ecx, 3
call fcn.004031f4
mov edx, dword [ebp - 0xa214]
mov eax, dword [ebp - 4]
call fcn.00406fe4
test al, al
je 0x407d6c
mov eax, dword [ebp - 4]
mov al, byte [eax]
call fcn.0040258c
add al, 0xbf
sub al, 2
jb 0x407d6c
sub al, 0x19
je 0x407d6c
mov eax, dword [ebp - 4]
call fcn.00407ad0
mov eax, dword [ebp - 4]
call fcn.00407130
test al, al
je 0x407d6c
mov eax, dword [ebp - 4]
call fcn.0040340c
mov ebx, eax
push ebx
call sub.kernel32.dll_GetFileAttributesA
mov dword [ebp - 8], eax
test dword [ebp - 8], 1
jbe 0x407c95
push 0
push ebx
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [ebp - 4]
call fcn.00405b84
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x407d4a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.0040597c
mov edx, eax
sub edx, 0xa200
mov eax, dword [ebp - 0xc]
call fcn.00405974
lea edx, [ebp - 0xa210]
mov eax, dword [ebp - 0xc]
mov ecx, 0xa200
call fcn.00405988
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x9d3e]
mov ecx, 4
call fcn.0040254c
lea eax, [ebp - 0xa210]
mov ecx, dword [ebp - 0x10]
mov edx, 0x3e8
call fcn.00407080
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00405974
lea edx, [ebp - 0xa210]
mov eax, dword [ebp - 0xc]
mov ecx, 0xa200
call fcn.0040598c
mov eax, dword [ebp - 0xc]
call fcn.0040597c
mov edx, eax
sub edx, 0xa200
mov eax, dword [ebp - 0xc]
call fcn.00405980
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407d51
mov eax, dword [ebp - 0xc]
call fcn.00404520
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407d94
lea eax, [ebp - 0xa214]
call fcn.00403094
lea eax, [ebp - 4]
call fcn.00403094
ret
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret
Function at 0x401a50
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._vfprintf
call sym._abort
jmp dbg.mark_section_writable

Function at 0x401ab0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x4053a0]
test esi, esi
jle 0x401ba3
mov edi, dword [0x4053a4]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x401ae4
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x401b9c
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x401ad0
mov dword [esp], eax
mov esi, eax
call dbg.__mingw_GetSectionForAddress
test eax, eax
mov edi, eax
je 0x401be0
mov esi, dword [0x4053a4]
lea ebx, [ebx + ebx*4]
shl ebx, 2
add esi, ebx
mov dword [esi + 0x10], eax
mov dword [esi], 0
call dbg._GetPEImageBase
add eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x4053a4]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401bc0
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x401b95
sub eax, 4
and eax, 0xfffffffb
je 0x401b95
add ebx, dword [0x4053a4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x401baa
add dword [0x4053a0], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor ebx, ebx
jmp 0x401aee
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
mov eax, dword [0x4053a4]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
Function at 0x402020
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4053b8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4053b0]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x402075
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40206e
test esi, esi
je 0x40206e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402050
mov dword [esp], 0x4053b8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x456980
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push ebx
push esi
push edi
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x10]
mov edx, dword [eax + 0x10]
cmp edx, dword [ecx + 8]
jbe 0x4569a8
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x100], ecx
jmp 0x4569b4
mov edx, dword [ebp + 0x10]
mov eax, dword [edx + 8]
mov dword [ebp - 0x100], eax
mov ecx, dword [ebp - 0x100]
add ecx, 0xfff
and ecx, 0xfffff000
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
sub ecx, dword [edx + 0x10]
xor eax, eax
mov edx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
jge 0x4569ee
add edi, dword [edx + 0xc]
mov edx, dword [ebp + 0x10]
add edi, dword [edx + 0x10]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
add esi, ebx
stosb byte es:[edi], al
cmp dword [ebp + 0xc], 0
je 0x456aaf
push 0x300000
call fcn.0044fc1e
xor byte [0x21510789], bh
wait
adc eax, 0xa4325883
imul ebx, dword [ebp + 0x55], 0x1ff47c32
mov edi, 0x40414e5b
popfd
cmc
jns 0x4569d8
sbb al, 0xd8
iretd
xchg ebp, eax
ret 0x3527
jnp 0x456ad4
adc ch, 0x15
outsb dx, byte [esi]
popal
cmp ebp, dword [eax]
neg byte [ebx]
pop edx
and eax, 0xb598e88c
or eax, 0x33abb8c5
in eax, 0xfe
mov al, byte [0xec505d6a]
inc esp
pop ebx
iretd
xor byte [esi + 0x72], cl
jg 0x456a2e
jno 0x456a75
and bh, byte [edi]
xor dl, byte [eax - 0x7a36cc70]
leave
jne 0x456a9d
cmp dword [ebp + 8], 0
je 0x456bc2
mov dword [ebp - 0xe8], 0
push 0x5f0000
call fcn.0044fc1e
pop eax
inc ebp
sar dword [0xcd63db79], 1
mov ebx, 0x29dc5a78
int 0xbb
js 0x456b32
fsubr qword [ecx]
jge 0x456aa0
xchg esp, eax
sub al, 0x3f
mov dword [0x78192633], eax
xchg ebp, eax
adc ebp, esp
fmul st(3)
retf 0xd24c
pushfd
sbb byte [eax - 0x372af263], cl
mov ebx, 0x8777ebda
jp 0x456bad
sbb al, 0x6a
mov cl, 0x4d
outsb dx, byte [esi]
clc
adc al, byte [0xefe09ff8]
ror byte [edx - 0x5a], cl
invalid
mov dword [ebp - 0xfc], ecx
mov edx, dword [ebp - 0xfc]
push edx
call fcn.0045a5c2
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10