joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a21d0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x72000]
push edi
or ebp, 0xffffffff
jmp 0x4a21f2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4a21f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a21e8
mov eax, 1
add ebx, ebx
jne 0x4a220b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4a221c
jne 0x4a222c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a222c
dec eax
add ebx, ebx
jne 0x4a2228
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4a2200
xor ecx, ecx
sub eax, 3
jb 0x4a2244
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4a22b6
sar eax, 1
mov ebp, eax
jmp 0x4a224f
add ebx, ebx
jne 0x4a224f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4a225c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4a2280
inc ecx
add ebx, ebx
jne 0x4a226c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4a2261
jne 0x4a227d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4a2261
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4a22a0
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4a2291
jmp 0x4a21ee
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4a22a0
add edi, ecx
jmp 0x4a21ee
pop esi
mov edi, esi
mov ecx, 0xdc2
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4a22be
cmp byte [edi], 6
jne 0x4a22be
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x4a22c3
lea edi, [esi + 0xa0000]
mov eax, dword [edi]
or eax, eax
je 0x4a2332
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xa2218]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xa227c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4a22f0
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xa2280]
or eax, eax
je 0x4a232c
mov dword [ebx], eax
add ebx, 4
jmp 0x4a230d
call dword [esi + 0xa2284]
popal
jmp 0x41b0b8
Function at 0x40778b
Capabilities:
Terminate process

Disassembly:
add cl, byte [ecx + 0x55c3c901]
mov ebp, esp
push 0xffffffffffffffff
push 0x40d4a0
push 0x4090d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [0x40d17c]
xor edx, edx
mov dl, ah
mov dword [0x41224c], edx
mov ecx, eax
and ecx, 0xff
mov dword [0x412248], ecx
shl ecx, 8
add ecx, edx
mov dword [0x412244], ecx
shr eax, 0x10
mov dword [0x412240], eax
push 1
call fcn.00407dc4
pop ecx
test eax, eax
jne 0x4077fb
push 0x1c
call fcn.004078bd
pop ecx
call fcn.00409d21
test eax, eax
jne 0x40780c
push 0x10
call fcn.004078bd
pop ecx
xor esi, esi
mov dword [ebp - 4], esi
call fcn.0040a570
call dword [0x40d180]
mov dword [0x412924], eax
call fcn.0040a43e
mov dword [0x412230], eax
call fcn.0040a1f1
call fcn.0040a138
call fcn.00407a26
mov dword [ebp - 0x30], esi
lea eax, [ebp - 0x5c]
push eax
call dword [0x40d184]
call fcn.0040a0e0
mov dword [ebp - 0x64], eax
test byte [ebp - 0x30], 1
je 0x40785b
movzx eax, word [ebp - 0x2c]
jmp 0x40785e
push 0xa
pop eax
push eax
push dword [ebp - 0x64]
push esi
push esi
call dword [0x40d078]
push eax
call main
mov dword [ebp - 0x60], eax
push eax
call fcn.00407a53
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x68], ecx
push eax
push ecx
call fcn.00409f68
pop ecx
pop ecx
ret
Function at 0x41d720
Capabilities:
Enumerate gui resources

Disassembly:
push esi
push ebx
sub esp, 0x64
mov esi, dword [esp + 0x70]
mov dword [esp + 4], 1
lea ebx, [esp + 0x28]
mov dword [esp], ebx
mov eax, dword [0x68bb7c]
call dword [eax + 0x2dc]
mov ecx, ebx
mov edx, dword [esi]
mov eax, esi
call fcn.00417ebc
mov eax, dword [esp + 0x40]
lea eax, [eax*4 + 4]
mov dword [esp], eax
mov eax, dword [0x68bb7c]
call dword [eax + 0x14]
mov esi, eax
mov eax, dword [esp + 0x40]
test eax, eax
jne 0x41d78c
mov dword [esi], 0
mov dword [esp], ebx
mov eax, dword [0x68bb7c]
call dword [eax + 0x1bc]
mov eax, esi
add esp, 0x64
pop ebx
pop esi
cmp eax, 1
je 0x41d7dc
mov dword [esp + 0x14], ebx
lea eax, [esi + eax*4]
mov dword [eax], 0
sub eax, 4
mov dword [esp + 0x18], eax
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp], 0x417e64
call sub.USER32.dll_EnumWindows
sub esp, 8
test eax, eax
je 0x41d804
lea eax, [esi - 4]
cmp dword [esp + 0x18], eax
je 0x41d774
mov dword [esp], str.num_matched_toplevel_windows_does_not_equal_num_children
mov eax, dword [0x68bb7c]
call dword [eax + 0x10]
jmp 0x41d774
lea eax, [esp + 0x1c]
mov dword [esp + 4], eax
mov dword [esp], ebx
mov eax, dword [0x68bb7c]
call dword [eax + 0x24c]
mov eax, dword [eax + 0xc]
mov dword [esi], eax
mov dword [esi + 4], 0
jmp 0x41d774
mov dword [esp], esi
mov eax, dword [0x68bb7c]
call dword [eax + 0x18]
xor esi, esi
jmp 0x41d774
Function at 0x4ef034
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
push ebx
sub esp, 0x18
mov ecx, dword [0x68b87c]
test ecx, ecx
je 0x4ef060
mov eax, dword [0x68b880]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
push edx
mov ebx, eax
test eax, eax
je 0x4ef088
mov eax, ebx
add esp, 0x18
pop ebx
ret
call sub.KERNEL32.dll_TlsAlloc
mov dword [0x68b880], eax
mov dword [0x68b87c], 1
cmp eax, 0xffffffff
jne 0x4ef047
mov dword [esp], str.could_not_allocate_thread_local_storage
call fcn.00508cd0
jmp 0x4ef042
call sub.KERNEL32.dll_GetLastError
test eax, eax
je 0x4ef056
mov dword [esp], str.TlsGetValue_failed_from_TclpGetAllocCache
call fcn.00508cd0
jmp 0x4ef056

Function at 0x4ef0a0
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [0x68b880]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsSetValue
sub esp, 8
test eax, eax
je 0x4ef0c4
add esp, 0x1c
ret
mov dword [esp + 0x20], str.TlsSetValue_failed_from_TclpSetAllocCache
add esp, 0x1c
jmp fcn.00508cd0
Function at 0x4fc2d4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov ebp, dword [esp + 0x70]
mov ebx, dword [esp + 0x7c]
mov dword [esp], ebx
call fcn.004fe628
mov edx, dword [ebx]
mov esi, dword [ebx + 8]
dec esi
test ebp, ebp
je 0x4fc410
mov ecx, dword [esp + 0x74]
test ecx, ecx
je 0x4fc424
mov eax, dword [esp + 0x78]
test eax, eax
js 0x4fc3e0
mov eax, 3
mov ecx, esi
mov esi, edx
jmp 0x4fc33c
lea eax, [eax + eax + 1]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.004fe6f8
mov esi, dword [ebx]
add esi, edi
mov ecx, edi
not ecx
add ecx, dword [ebx + 4]
mov eax, 2
lea edx, [esp + 0x4c]
mov dword [esp + 0x24], edx
lea edx, [esp + 0x48]
mov dword [esp + 0x20], edx
lea edx, [esp + 0x44]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], esi
lea edx, [esp + 0x40]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov edx, dword [esp + 0x78]
mov dword [esp + 8], edx
mov eax, dword [esp + 0x74]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x14]
mov dword [esp], eax
mov dword [esp + 0x3c], ecx
call dword [ebp + 8]
mov edi, dword [esp + 0x48]
add edi, esi
sub edi, dword [ebx]
cmp eax, 0xfffffffc
mov ecx, dword [esp + 0x3c]
jne 0x4fc3c4
mov eax, dword [esp + 0x44]
add dword [esp + 0x74], eax
sub dword [esp + 0x78], eax
mov eax, dword [ebx + 4]
test eax, eax
jne 0x4fc31c
mov dword [esp + 4], ecx
mov dword [esp], ebx
call fcn.004fe6f8
mov eax, dword [ebx + 4]
jmp 0x4fc31c
cmp dword [ebp + 0x10], 2
je 0x4fc3fc
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.004fe6f8
mov eax, dword [ebx]
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
xor eax, eax
mov ecx, 0xffffffff
mov edi, dword [esp + 0x74]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x78], ecx
jmp 0x4fc311
lea eax, [edi + 1]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.004fe6f8
jmp 0x4fc3ca
mov ebp, dword [0x68b8fc]
mov ecx, dword [esp + 0x74]
test ecx, ecx
jne 0x4fc305
nop
mov dword [esp + 0x78], 0
jmp 0x4fc311
Function at 0x50afa8
Capabilities:
Encode data using xor

Disassembly:
push esi
push ebx
sub esp, 0x14
call fcn.004eeae0
mov ebx, eax
mov dword [esp], 0x68bba4
call fcn.004eec50
mov edx, dword [0x68bba8]
test edx, edx
jne 0x5093a3
jmp 0x5093bc
mov edx, dword [edx + 0x34]
test edx, edx
je 0x5093bc
cmp dword [edx + 0x28], ebx
jne 0x50939c
mov dword [esp], 0x68bba4
call fcn.004eecb4
add esp, 0x14
pop ebx
pop esi
ret
mov dword [esp + 4], 0x38
mov dword [esp], 0x68bbac
call fcn.00509044
mov esi, eax
mov dword [eax + 0x28], ebx
call dword [0x5f10f4]
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], 1
mov eax, dword [0x68bba8]
mov dword [esi + 0x34], eax
mov dword [0x68bba8], esi
jmp 0x5093a8
sub esp, 0x1c
mov eax, dword [0x68bbd4]
test eax, eax
jne 0x50afe4
mov eax, dword [0x68bbd8]
test eax, eax
je 0x50afc8
add esp, 0x1c
jmp 0x509378
call fcn.004eeae8
mov eax, dword [0x68bbd8]
test eax, eax
je 0x50aff4
call fcn.004eeb38
add esp, 0x1c
jmp 0x509378
mov dword [esp], str.TclInitSubsystems_called_while_exiting
call fcn.00508cd0
jmp 0x50afb4
mov dword [0x68bbd8], 1
call fcn.0057c744
call fcn.004f8c90
call fcn.00527b84
call fcn.004dd5a0
call fcn.004d6474
call fcn.004fbe5c
call fcn.004f8d80
or ebx, 0xca2f8f38
cmp ebx, edi
fistp qword [ecx + 2]
cmp eax, ebp
jns 0x50b030
inc eax
test dword [0x5f6826], 0x702ac27c
jne 0x50b042
sub esi, 0x40160f43
xor eax, eax
ror edx, 0xf
or ecx, ebx
shr edi, 7
shl ebx, 3
or ecx, ebx
mov ecx, 0x8d92b547
call fcn.0049020c
and edi, eax
test ebx, ebx
jg 0x50b064
shl edi, 0x15
not ecx
call fcn.004e439c
xor edx, 0x335b5d07
dec edx
ror edi, 0x12
shl esi, 0x14
call fcn.00555e8c
add ebx, esi
mov ecx, 0x4e24fccf
ror eax, 0x1a
xor ebx, 0x2bfc8920
xchg esi, eax
xor dword [0x5f7a1b], esi
neg esi
test esi, ebx
jo 0x50b0a1
xor edi, dword [0x5f6c12]
rol ebx, 8
add edi, 0x1b0bc862
inc edx
add eax, dword [str._icon]
test dword [0x5f3efe], eax
jae 0x50b0bb
add eax, esp
neg esi
shr eax, 0x1b
and ebx, dword [0x5f1576]
shr esi, 0xf
neg ebx
dec ecx
jne 0x50b084
cmp ebp, eax
jns 0x50b0d9
and edi, dword [0x5e3d63]
and ecx, eax
cmp ebp, 0xb7521d06
jl 0x50b0e5
xchg edi, edx
mov ecx, 0x54844be0
shr edi, 3
neg esi
test dword [0x5f500b], esi
jp 0x50b0fc
mov edi, 0x6211ba9a
shr esi, 0xc
test dword [0x5e3d00], ebx
ja 0x50b10c
call fcn.00496bd8
and eax, dword [0x5f41a5]
test ebx, eax
jae 0x50b119
shr edx, 0x1f
add dword [0x5f7b36], ecx
add eax, dword [0x5e69d0]
shl ebx, 4
and dword [0x5f7954], edi
not esi
dec ecx
jne 0x50b0ea
mov ecx, 0x4babaa9b
call fcn.0049912e
ror esi, 0x1b
not ebx
or edi, 0xdb18794
xor edx, dword [0x5f35bd]
dec edx
xor eax, dword [0x5ed9bc]
rol edx, 8
neg eax
dec edi
inc ebx
not esi
and edi, 0xa68bdd1e
call fcn.0040c62b
or dword [0x5f7ace], 0xee59ef43
shl edx, 0xf
shr ebx, 0x1d
not edi
add eax, dword [0x5eac5b]
and esi, esi
dec ecx
jne 0x50b139
inc edi
invalid
invalid
inc edi
Function at 0x54d620
Capabilities:
Query environment variable

Disassembly:
push edi
push ebx
sub esp, 0x14
mov dword [esp], 0x68c630
call fcn.004eec50
mov dword [esp], 0x62ada0
call sub.msvcrt.dll_getenv
mov ebx, eax
test eax, eax
je 0x54d6ac
mov eax, dword [0x68c634]
test eax, eax
je 0x54d65c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x54d698
call sub.msvcrt.dll__tzset
mov eax, dword [0x68c634]
test eax, eax
je 0x54d672
mov dword [esp], eax
call fcn.004ee144
xor eax, eax
mov ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
mov dword [esp], ecx
call fcn.004edfec
mov dword [0x68c634], eax
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
mov dword [esp], 0x68c630
call fcn.004eecb4
add esp, 0x14
pop ebx
pop edi
ret
mov ecx, dword [0x68c634]
test ecx, ecx
je 0x54d698
call sub.msvcrt.dll__tzset
mov eax, dword [0x68c634]
mov dword [esp], eax
call fcn.004ee144
mov dword [0x68c634], 0
jmp 0x54d698
Function at 0x57662c
Capabilities:
Create directory
Get common file path
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x43c
mov eax, dword [0x68cbb4]
mov ecx, dword [eax]
test ecx, ecx
je 0x576668
mov dword [esp + 8], 0x104
lea eax, [esp + 0x20]
mov dword [esp + 4], eax
mov dword [esp], 0x62d3fc
call sub.KERNEL32.dll_GetEnvironmentVariableW
sub esp, 0xc
test eax, eax
jne 0x576768
mov dword [esp], 0x68c654
call fcn.004eec50
lea ebx, [esp + 0x228]
mov edx, dword [0x68c658]
test edx, edx
je 0x576778
mov dword [esp], 0x68c654
call fcn.004eecb4
mov eax, dword [0x68c658]
mov dword [esp], eax
call fcn.00579478
test eax, eax
je 0x5766d1
mov dword [esp], eax
call fcn.004dda84
mov dword [esp + 0xc], 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.::bitrock_dll_dir
mov eax, dword [esp + 0x450]
mov dword [esp], eax
call fcn.004f6230
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x62d458
mov eax, dword [0x68c658]
mov dword [esp], eax
mov eax, dword [0x68cbb4]
call dword [eax + 0x40]
sub esp, 0x10
test eax, eax
je 0x57675a
mov dword [esp], ebx
call fcn.00579478
add esp, 0x43c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0x26
call fcn.00505cd8
mov edx, dword [esp + 0x450]
mov dword [esp], edx
call fcn.00505cec
mov dword [esp + 4], eax
mov dword [esp], str.couldnt_create_temporary_directory:__s
call fcn.004ec210
mov dword [esp + 4], eax
mov eax, dword [esp + 0x450]
mov dword [esp], eax
call fcn.004e1100
mov dword [esp], 0x68c654
call fcn.004eecb4
xor eax, eax
add esp, 0x43c
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.00516770
add esp, 0x43c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], ebx
mov dword [esp], 0x104
call sub.KERNEL32.dll_GetTempPathW
sub esp, 8
mov dword [esp + 0x1c], eax
cmp eax, 0xf7
ja 0x576710
mov dword [esp + 4], str.BRLXXXXXXXX
mov edx, dword [esp + 0x1c]
lea eax, [ebx + edx*2]
mov dword [esp], eax
call sub.msvcrt.dll_wcscpy
call sub.KERNEL32.dll_GetCurrentProcessId
mov ebp, eax
mov eax, dword [esp + 0x1c]
lea edi, [ebx + eax*2 + 6]
mov esi, 0x100
jmp 0x5767ee
call sub.KERNEL32.dll_GetLastError
cmp eax, 0xb7
jne 0x576840
mov ecx, ebp
shl ecx, 0x10
add ecx, ebp
lea ecx, [ebp + ecx*2]
lea ecx, [ebp + ecx*8]
lea ecx, [ebp + ecx*8]
lea ebp, [ebp + ecx*2]
dec esi
je 0x576840
mov dword [esp + 8], ebp
mov dword [esp + 4], 0x62d43c
mov dword [esp], edi
call sub.USER32.dll_wsprintfW
mov dword [esp + 4], 0
mov dword [esp], ebx
call sub.KERNEL32.dll_CreateDirectoryW
sub esp, 8
test eax, eax
je 0x5767c8
mov edx, dword [esp + 0x1c]
lea eax, [edx + edx + 0x18]
mov dword [esp], eax
call fcn.004edfec
mov dword [0x68c658], eax
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.msvcrt.dll_wcscpy
jmp 0x576689
mov dword [esp], eax
call fcn.0057c980
jmp 0x57671c
Function at 0x585c40
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x50
mov ebx, eax
mov esi, edx
movsx edi, byte [eax]
lea edx, [esp + 0x1e]
call fcn.00585b70
mov dword [esp + 0xc], edi
mov dword [esp + 8], eax
mov dword [esp + 4], str._s.___c
mov dword [esp], esi
call sub.msvcrt.dll_fprintf
mov al, byte [ebx + 1]
test al, 1
jne 0x585e88
test al, 2
jne 0x585e60
test al, 4
jne 0x585e38
test al, 8
jne 0x585e10
test al, 0x10
jne 0x585de8
test al, 0x40
je 0x585dc0
mov eax, dword [ebx + 4]
test eax, eax
jne 0x585da4
cmp dword [ebx + 8], 0x10001
je 0x585cfb
movsx eax, word [ebx + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str.__d_
mov dword [esp], esi
call sub.msvcrt.dll_fprintf
movsx eax, word [ebx + 0xa]
cmp ax, 0x100
je 0x585ceb
mov dword [esp + 8], eax
mov dword [esp + 4], 0x62f54c
mov dword [esp], esi
call sub.msvcrt.dll_fprintf
mov dword [esp + 4], esi
mov dword [esp], 0x7d
call sub.msvcrt.dll_fputc
mov eax, dword [ebx + 0x18]
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x14]
mov eax, dword [eax]
mov dword [esp + 8], eax
mov dword [esp + 4], str.__ld__ld
mov dword [esp], esi
call sub.msvcrt.dll_fprintf
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x585d41
lea edx, [esp + 0x1e]
call fcn.00585b70
mov dword [esp + 8], eax
mov dword [esp + 4], str._L:_s
mov dword [esp], esi
call sub.msvcrt.dll_fprintf
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x585d65
lea edx, [esp + 0x1e]
call fcn.00585b70
mov dword [esp + 8], eax
mov dword [esp + 4], str._R:_s
mov dword [esp], esi
call sub.msvcrt.dll_fprintf
mov eax, dword [ebx + 0x1c]
test eax, eax
jne 0x585eb0
mov dword [esp + 4], esi
mov dword [esp], 0xa
call sub.msvcrt.dll_fputc
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x585d8e
mov edx, esi
call fcn.00585c40
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x585d9c
mov edx, esi
call fcn.00585c40
add esp, 0x50
pop ebx
pop esi
pop edi
ret
mov dword [esp + 8], eax
mov dword [esp + 4], 0x62f598
mov dword [esp], esi
call sub.msvcrt.dll_fprintf
jmp 0x585cac
mov dword [esp + 0xc], esi
mov dword [esp + 8], 7
mov dword [esp + 4], 1
mov dword [esp], str._UNUSED
call sub.msvcrt.dll_fwrite
jmp 0x585ca1
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0xb
mov dword [esp + 4], 1
mov dword [esp], str._hasbackref
call sub.msvcrt.dll_fwrite
mov al, byte [ebx + 1]
jmp 0x585c99
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0xb
mov dword [esp + 4], 1
mov dword [esp], str._hascapture
call sub.msvcrt.dll_fwrite
mov al, byte [ebx + 1]
jmp 0x585c91
mov dword [esp + 0xc], esi
mov dword [esp + 8], 9
mov dword [esp + 4], 1
mov dword [esp], str._hasmixed
call sub.msvcrt.dll_fwrite
mov al, byte [ebx + 1]
jmp 0x585c89
mov dword [esp + 0xc], esi
mov dword [esp + 8], 9
mov dword [esp + 4], 1
mov dword [esp], str._shortest
call sub.msvcrt.dll_fwrite
mov al, byte [ebx + 1]
jmp 0x585c81
mov dword [esp + 0xc], esi
mov dword [esp + 8], 8
mov dword [esp + 4], 1
mov dword [esp], str._longest
call sub.msvcrt.dll_fwrite
mov al, byte [ebx + 1]
jmp 0x585c79
mov dword [esp + 4], esi
mov dword [esp], 0xa
call sub.msvcrt.dll_fputc
jmp 0x585d70
Function at 0x5ae80e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_fread
leave
ret 8

Function at 0x5ae840
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
cmp eax, dword [ebp + 0xc]
sete al
leave
ret 8
Function at 0x407180
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x4071be
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x4071b6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4071c0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x4071a6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4072a0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x4072b6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x4072d1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x461c7d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, 0x401000
call 0x461c7d
lcall 0x5de5, 0x8b10c483
jmp fcn.0086d2bc
Function at 0x401764
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
not eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
jmp 0x40181a
mov eax, dword [ebp - 4]
shr eax, 8
mov edx, eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
movzx eax, al
xor eax, dword [ebp - 4]
movzx eax, al
mov eax, dword [eax*4 + 0xb664c0]
xor eax, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
shr eax, 8
mov edx, eax
mov eax, dword [ebp - 8]
add eax, 1
movzx eax, byte [eax]
movzx eax, al
xor eax, dword [ebp - 4]
movzx eax, al
mov eax, dword [eax*4 + 0xb664c0]
xor eax, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
shr eax, 8
mov edx, eax
mov eax, dword [ebp - 8]
add eax, 2
movzx eax, byte [eax]
movzx eax, al
xor eax, dword [ebp - 4]
movzx eax, al
mov eax, dword [eax*4 + 0xb664c0]
xor eax, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
shr eax, 8
mov edx, eax
mov eax, dword [ebp - 8]
add eax, 3
movzx eax, byte [eax]
movzx eax, al
xor eax, dword [ebp - 4]
movzx eax, al
mov eax, dword [eax*4 + 0xb664c0]
xor eax, edx
mov dword [ebp - 4], eax
add dword [ebp - 8], 4
sub dword [ebp + 0x10], 4
cmp dword [ebp + 0x10], 3
ja 0x40177d
jmp 0x401851
mov eax, dword [ebp - 4]
shr eax, 8
mov edx, eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
movzx eax, al
xor eax, dword [ebp - 4]
movzx eax, al
mov eax, dword [eax*4 + 0xb664c0]
xor eax, edx
mov dword [ebp - 4], eax
add dword [ebp - 8], 1
sub dword [ebp + 0x10], 1
cmp dword [ebp + 0x10], 0
jne 0x401826
mov eax, dword [ebp - 4]
not eax
leave
ret
Function at 0x4200e0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00426530
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00426530
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x420140
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0xc52078]
test esi, esi
jle 0x420260
mov eax, dword [0xc5207c]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x420174
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x4201f7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x420160
mov dword [esp], ebx
call fcn.00420b30
mov edi, eax
test eax, eax
je 0x420287
mov eax, dword [0xc5207c]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00420c70
mov edx, dword [0xc5207c]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x420267
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x4201f0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x420200
add dword [0xc52078], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0xc5207c]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4201f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.004200e0
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x42017e
mov eax, dword [0xc5207c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.004200e0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.004200e0
lea esi, [esi]
nop