joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40186d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x40c004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x14]
push edi
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x34]
push 5
mov esi, 0x208
push eax
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], 0x53524a73
mov dword [ebp - 0x2c], 0x4c50784b
mov dword [ebp - 0x28], 0x30386962
mov dword [ebp - 0x24], 0x68324c31
mov dword [ebp - 0x20], 0x4f756f58
mov dword [ebp - 0x1c], 0x49655054
mov dword [ebp - 0x18], 0x694b41
mov dword [ebp - 0x14], 0xd7de10be
mov byte [ebp - 0x10], 0x3a
mov dword [ebp - 0xc], 0xc9cf14b9
mov byte [ebp - 8], 0x3a
mov dword [ebp - 0x38], esi
call fcn.00402a77
lea eax, [ebp - 0xc]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x34]
push 5
push eax
lea ecx, [ebp - 0x30]
call fcn.00402a77
push esi
call fcn.004048eb
push esi
mov edi, eax
push 0
push edi
call fcn.00407d00
add esp, 0x20
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0xc]
push edi
push eax
call fcn.00401502
pop ecx
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00401502
pop ecx
push eax
push 2
push 4
push 6
push 0x40db72
mov ecx, 0x40db7e
call fcn.00402773
mov ecx, dword [ebp - 4]
add esp, 0x20
neg eax
sbb eax, eax
not eax
and eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.00404539
leave
ret

Function at 0x401af0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x40c004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push 0xa
xor ebx, ebx
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x4b49465a
mov dword [ebp - 0x28], 0x30646c77
mov dword [ebp - 0x24], 0x374d6c61
mov dword [ebp - 0x20], 0x54674433
mov dword [ebp - 0x1c], 0x6d656f55
mov dword [ebp - 0x18], 0x4b415a6d
mov word [ebp - 0x14], 0x7847
mov byte [ebp - 0x12], bl
mov dword [ebp - 0x10], 0x1547f708
mov dword [ebp - 0xc], 0x5029123b
mov word [ebp - 8], 0xb435
call fcn.00402a77
push 0x1f4
push 1
push 0x40d798
mov ecx, 0x40d866
call fcn.00402773
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
push 5
push 0x40dab2
mov ecx, 0x40dabd
call fcn.00402773
mov ecx, dword [ebp - 4]
add esp, 0x30
xor ecx, ebp
pop ebx
call fcn.00404539
leave
ret
Function at 0x401c5d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x40c004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x24], 0x6f6a5939
mov dword [ebp - 0x20], 0x4d4b7261
mov dword [ebp - 0x1c], 0x41564d34
mov dword [ebp - 0x18], 0x56547648
mov dword [ebp - 0x14], 0x42754c76
mov dword [ebp - 0x10], 0x47643038
mov dword [ebp - 0xc], 0x7054636b
mov word [ebp - 8], 0x6c
mov dword [ebp - 0x28], 0x3f583e28
call fcn.00401953
mov esi, eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push 4
push eax
lea ecx, [ebp - 0x24]
call fcn.00402a77
pop ecx
pop ecx
test esi, esi
jne 0x401cd8
push esi
call dword [0x40e544]
test eax, eax
jle 0x401cf4
lea eax, [ebp - 0x28]
push eax
call fcn.00401502
push eax
push esi
call fcn.004015b3
add esp, 0xc
test eax, eax
je 0x401cf4
xor eax, eax
inc eax
jmp 0x401cf6
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00404539
leave
ret

Function at 0x401dba
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x40c004]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x58]
push 0xc
push eax
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x54], 0x57633356
mov dword [ebp - 0x50], 0x48626f6c
mov dword [ebp - 0x4c], 0x796f4277
mov dword [ebp - 0x48], 0x6a707a4c
mov dword [ebp - 0x44], 0x56764f76
mov dword [ebp - 0x40], 0x47457456
mov dword [ebp - 0x3c], 0x79783632
mov dword [ebp - 0x38], 0x43445a76
mov dword [ebp - 0x34], 0x62316e61
mov dword [ebp - 0x30], 0x66587a66
mov dword [ebp - 0x2c], 0x424b325a
mov dword [ebp - 0x28], 0x78305658
mov dword [ebp - 0x24], 0x694f7474
mov dword [ebp - 0x20], 0x79546c77
mov dword [ebp - 0x1c], 0x36787251
mov dword [ebp - 0x18], 0x71426a57
mov dword [ebp - 0x14], 0x337473
mov dword [ebp - 0x10], 0xb922a909
mov dword [ebp - 0xc], 0x4ef17cd3
mov dword [ebp - 8], 0xb3ec53cb
call fcn.00402a77
lea eax, [ebp - 0x10]
push eax
call fcn.00401502
push eax
push 1
push 0x40d798
mov ecx, 0x40d7c1
call fcn.00402773
mov ecx, dword [ebp - 4]
xor ecx, ebp
add esp, 0x18
call fcn.00404539
leave
ret

Function at 0x401e94
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x1f4
push 1
mov edi, 0x40d798
mov esi, 0x40d866
push edi
mov ecx, esi
call fcn.00402773
add esp, 0xc
rdtsc
mov ebx, eax
rdtsc
sub eax, ebx
push eax
cmp eax, 1
je 0x401eb7
pop eax
cmp eax, 0x200
jb 0x401ed6
mov dword [ebp - 4], 1
jmp 0x401edd
mov dword [ebp - 4], 0
push 0x1f4
push 1
push edi
mov ecx, esi
call fcn.00402773
mov eax, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4021df
Capabilities:
Check for vm using instruction vpcext

Disassembly:
push 8
push 0x40aed0
call fcn.00406050
mov ebx, 0x1f4
push ebx
push 1
mov edi, 0x40d798
push edi
mov esi, 0x40d866
mov ecx, esi
call fcn.00402773
add esp, 0xc
and dword [ebp - 4], 0
mov eax, 1
invalid
Function at 0x402a77
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
lea ebp, [esp - 0x790]
sub esp, 0x810
mov eax, dword [0x40c004]
xor eax, ebp
mov dword [ebp + 0x78c], eax
mov eax, dword [ebp + 0x798]
push ebx
push esi
mov esi, ecx
xor ecx, ecx
push edi
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], ecx
mov eax, esi
or edi, 0xffffffff
mov dl, byte [eax]
inc edi
inc eax
test dl, dl
jne 0x402aaa
mov ebx, 0x27c71d
mov eax, ecx
cdq
idiv edi
mov dword [ebp + ecx*4 + 0x38c], ecx
inc ecx
movsx eax, byte [edx + esi]
mov dword [ebp + ecx*4 - 0x78], eax
cmp ecx, 0x100
jl 0x402ab7
xor esi, esi
mov ecx, dword [ebp + esi - 0x74]
lea eax, [ebp + esi + 0x38c]
mov edx, dword [eax]
add ecx, edx
add ecx, dword [ebp - 0x7c]
and ecx, 0x800000ff
jns 0x402af8
dec ecx
or ecx, 0xffffff00
inc ecx
mov dword [ebp - 0x7c], ecx
lea ecx, [ebp + ecx*4 + 0x38c]
mov edi, dword [ecx]
mov dword [eax], edi
lea eax, [ebx + 0x15a0]
mov dword [ecx], edx
cdq
sub eax, edx
sar eax, 1
add esi, 4
lea ebx, [eax + 1]
cmp esi, 0x400
jl 0x402ad6
xor eax, eax
xor edi, edi
mov dword [ebp - 0x78], eax
cmp dword [ebp + 0x79c], eax
jle 0x402bc7
jmp 0x402b39
mov eax, dword [ebp - 0x7c]
inc edi
and edi, 0x800000ff
jns 0x402b4a
dec edi
or edi, 0xffffff00
inc edi
lea ecx, [ebp + edi*4 + 0x38c]
mov esi, dword [ecx]
add eax, esi
and eax, 0x800000ff
jns 0x402b63
dec eax
or eax, 0xffffff00
inc eax
mov dword [ebp - 0x7c], eax
lea eax, [ebp + eax*4 + 0x38c]
mov edx, dword [eax]
mov dword [ecx], edx
mov dword [eax], esi
mov ecx, dword [ecx]
lea eax, [ebx + 0x2d]
mov ebx, dword [ebp - 0x78]
cdq
sub eax, edx
mov edx, dword [ebp - 0x80]
mov edx, dword [edx]
sar eax, 1
add ecx, esi
add eax, 0x3b9
and ecx, 0x800000ff
jns 0x402b9c
dec ecx
adc ecx, ecx
adc edi, edi
invalid
mov cl, byte [ebp + ecx*4 + 0x38c]
xor byte [edx + ebx], cl
cdq
push 3
pop ecx
idiv ecx
push 5
pop ecx
cdq
idiv ecx
inc dword [ebp - 0x78]
lea ebx, [eax + 0x41]
mov eax, dword [ebp - 0x78]
cmp eax, dword [ebp + 0x79c]
jl 0x402b36
mov ecx, dword [ebp + 0x78c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404539
add ebp, 0x790
leave
ret
Function at 0x403a9d
Capabilities:
Contain obfuscated stackstrings
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x40c004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x60]
mov dword [ebp - 0x98], eax
lea eax, [ebp - 0x98]
movzx esi, cx
push 0xd
push eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x52595769
mov dword [ebp - 0x1c], 0x6b486341
mov dword [ebp - 0x18], 0x71695463
mov dword [ebp - 0x14], 0x42424d56
mov dword [ebp - 0x10], 0x56387076
mov dword [ebp - 0xc], 0x444c7746
mov word [ebp - 8], 0x37
mov dword [ebp - 0x60], 0x8e934335
mov dword [ebp - 0x5c], 0x1788ac89
mov dword [ebp - 0x58], 0xd598eb1e
mov byte [ebp - 0x54], 0xc4
mov dword [ebp - 0x70], 0x848f4f18
mov dword [ebp - 0x6c], 0x4ac8a5be
mov dword [ebp - 0x68], 0xdc97fd45
mov word [ebp - 0x64], 0x3585
mov dword [ebp - 0x50], 0x84804912
mov dword [ebp - 0x4c], 0x4ac8a5be
mov dword [ebp - 0x48], 0xdc97fd45
mov byte [ebp - 0x44], 0xc4
mov dword [ebp - 0x30], 0x8b824912
mov dword [ebp - 0x2c], 0x4ac8a5be
mov dword [ebp - 0x28], 0xdc97fd45
mov byte [ebp - 0x24], 0xc4
mov dword [ebp - 0x80], 0x859b4f0d
mov dword [ebp - 0x7c], 0x40e9a683
mov dword [ebp - 0x78], 0xcb81e043
mov word [ebp - 0x74], 0x50a7
mov byte [ebp - 0x72], 7
mov dword [ebp - 0x40], 0x85845418
mov dword [ebp - 0x3c], 0x4ac8a5be
mov dword [ebp - 0x38], 0xdc97fd45
mov byte [ebp - 0x34], 0xc4
mov dword [ebp - 0x94], 0xad954319
mov dword [ebp - 0x90], 0x49cea483
mov dword [ebp - 0x8c], 0xd795c755
mov dword [ebp - 0x88], 0x3d6259a0
mov byte [ebp - 0x84], 0x16
call fcn.00402a77
lea eax, [ebp - 0x70]
mov dword [ebp - 0x98], eax
lea eax, [ebp - 0x98]
push 0xe
push eax
lea ecx, [ebp - 0x20]
call fcn.00402a77
lea eax, [ebp - 0x50]
mov dword [ebp - 0x98], eax
lea eax, [ebp - 0x98]
push 0xd
push eax
lea ecx, [ebp - 0x20]
call fcn.00402a77
lea eax, [ebp - 0x30]
mov dword [ebp - 0x98], eax
lea eax, [ebp - 0x98]
push 0xd
push eax
lea ecx, [ebp - 0x20]
call fcn.00402a77
lea eax, [ebp - 0x80]
mov dword [ebp - 0x98], eax
lea eax, [ebp - 0x98]
push 0xf
push eax
lea ecx, [ebp - 0x20]
call fcn.00402a77
lea eax, [ebp - 0x40]
mov dword [ebp - 0x98], eax
lea eax, [ebp - 0x98]
push 0xd
push eax
lea ecx, [ebp - 0x20]
call fcn.00402a77
lea eax, [ebp - 0x94]
mov dword [ebp - 0x98], eax
lea eax, [ebp - 0x98]
push 0x11
push eax
lea ecx, [ebp - 0x20]
call fcn.00402a77
add esp, 0x38
push 0xa
push esi
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x403c82
xor eax, eax
jmp 0x403cc8
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x98], eax
test eax, eax
je 0x403c7e
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x403c7e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x9c], eax
test eax, eax
je 0x403c7e
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 0x98]
mov dword [edi], eax
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00404539
leave
ret

Function at 0x404539
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c004]
jne 0x404543
repz ret
jmp fcn.00404bcc
Function at 0x42b224
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x438e80]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0042b1b9
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.004162c0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x42b273
cmp dword [ebp - 0x1c], 5
jb 0x42b28b
jmp 0x42b287
cmp dword [ebp - 0x10], 1
jne 0x42b28b
cmp dword [ebp - 0x1c], 4
ja 0x42b287
jne 0x42b28b
cmp dword [ebp - 0x18], 0
jbe 0x42b28b
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x4327a4
call fcn.0042b08d
test eax, eax
jge 0x42b2ac
mov byte [0x43a368], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00416063
add ebp, 0x78
leave
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x668a6396
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x6e466ef7
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x5825b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xea000]
push edi
jmp 0x5825ca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5825d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5825c0
mov eax, 1
add ebx, ebx
jne 0x5825e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5825f4
jne 0x582613
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x582613
dec eax
add ebx, ebx
jne 0x582600
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5825d8
add ebx, ebx
jne 0x58260f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x582665
xor ecx, ecx
sub eax, 3
jb 0x58262b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x58269a
sar eax, 1
mov ebp, eax
jmp 0x582636
add ebx, ebx
jne 0x582636
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x582604
inc ecx
add ebx, ebx
jne 0x582644
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x582604
add ebx, ebx
jne 0x582651
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x582646
jne 0x582662
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x582646
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x582684
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x582676
jmp 0x5825c6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x582684
add edi, ecx
jmp 0x5825c6
pop esi
mov edi, esi
mov ecx, 0x1436
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5826a2
cmp byte [edi], 0x1a
jne 0x5826a2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5826a7
lea edi, [esi + 0x17f000]
mov eax, dword [edi]
or eax, eax
je 0x58271f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x182ee4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x182f94]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5826d4
mov ecx, edi
jns 0x582703
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x182f9c]
or eax, eax
je 0x582719
mov dword [ebx], eax
add ebx, 4
jmp 0x5826f1
call dword [esi + 0x182f98]
mov ebp, dword [esi + 0x182fa0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x582753
sub esp, 0xffffff80
jmp 0x42e5e6
Function at 0x431fb0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x5343c0]
test esi, esi
jle 0x4320c0
mov edi, dword [0x5343c4]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x431fe4
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x432065
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x431fd0
mov dword [esp], eax
mov ebx, eax
call sym.___mingw_GetSectionForAddress
test eax, eax
mov edi, eax
je 0x4320e7
mov eax, dword [0x5343c4]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call sym.__GetPEImageBase
add eax, dword [edi + 0xc]
mov edx, dword [0x5343c4]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x4320c7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x43205e
sub eax, 4
and eax, 0xfffffffb
jne 0x432070
add dword [0x5343c0], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
add ebx, dword [0x5343c4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x43205e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call sym.___report_error
lea esi, [esi]
xor esi, esi
jmp 0x431fee
mov eax, dword [0x5343c4]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call sym.___report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call sym.___report_error
mov esi, esi
lea edi, [edi]

Function at 0x432520
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x5343d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x5343d0]
sub esp, 4
test ebx, ebx
je 0x432575
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x43256e
test esi, esi
je 0x43256e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x432550
mov dword [esp], 0x5343d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x436fd0
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0x1c
mov dword [0x534424], 0xffffffff
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0xffff
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
sub esp, 0x10
mov dword [0x534428], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x437040
mov dword [esp + 4], dbg.emutls_destroy
mov dword [esp], eax
mov dword [0x534420], eax
call sym.___mingwthr_key_dtor
test eax, eax
jne sym._emutls_init.cold.6
add esp, 0x1c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x43702a
Function at 0x444800
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
cmp byte [0x4e251c], 0
jne 0x444926
mov byte [0x4e251c], 1
call sym.___cxa_current_exception_type
test eax, eax
je 0x4448f4
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
sete al
mov dword [esp + 4], 0
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call sym.___cxa_demangle
mov dword [esp], 2
mov esi, dword [sym.___acrt_iob_func]
mov edi, eax
call esi
mov dword [esp + 8], 0x30
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
call sym._fwrite
mov edx, dword [esp + 0x1c]
mov dword [esp], 2
test edx, edx
je 0x4448e4
call esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._fputs
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x4ecb35
call sym._fwrite
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x4be988
jmp 0x4be980
call esi
mov dword [esp], edi
mov dword [esp + 4], eax
call sym._fputs
jmp 0x4448aa
mov dword [esp], 2
call dword [0x4e0ac0]
mov dword [esp + 8], 0x2d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
call sym._fwrite
jmp 0x4be97b
mov dword [esp], 2
call dword [0x4e0ac0]
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_recursively_n
call sym._fwrite
call sym._abort
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x4c0290
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call sym.___acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x4f0084
call sym._fwrite
mov dword [esp], 2
call sym.___acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
nop
nop
nop
Function at 0x403250
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, dword [0x4cf5fc]
mov ecx, dword [0x4cc508]
sub esp, 0xc24
push ebx
push ebp
shr eax, 3
push esi
push edi
test eax, eax
jbe 0x403354
mov esi, dword [sym.imp.KERNEL32.dll_SetHandleCount]
mov edi, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
cmp dword [0x4cf5fc], 0x959
jne 0x40333a
push 0
call esi
push 0
lea eax, [esp + 0x434]
push eax
push 0
call edi
push 0
push 0
call ebx
push 0
call ebp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push 0
lea ecx, [esp + 0x34]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
xor eax, eax
lea edx, [esp + 0x1c]
push edx
push eax
push eax
push eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
push 0
push 0x402d74
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov eax, dword [esp + 0x14]
push eax
call fcn.00403090
add dword [esp + 0x14], 8
sub dword [esp + 0x18], 1
jne 0x403290
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc24
ret
Function at 0x40a730
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x463620]
jne 0x40a73a
repz ret
jmp fcn.0040e6d1

Function at 0x40e127
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004090c3
and dword [ebp - 4], 0
cmp dword [0x4650a8], 0
mov ebx, eax
jne 0x40e1d8
push 0x40237c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40e289
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402370
push edi
call esi
test eax, eax
je 0x40e289
push eax
call fcn.00409051
mov dword [esp], 0x402360
push edi
mov dword [0x4650a8], eax
call esi
push eax
call fcn.00409051
mov dword [esp], 0x40234c
push edi
mov dword [0x4650ac], eax
call esi
push eax
call fcn.00409051
mov dword [esp], 0x402330
push edi
mov dword [0x4650b0], eax
call esi
push eax
call fcn.00409051
pop ecx
mov dword [0x4650b8], eax
test eax, eax
je 0x40e1d8
push 0x402318
push edi
call esi
push eax
call fcn.00409051
pop ecx
mov dword [0x4650b4], eax
mov eax, dword [0x4650b4]
cmp eax, ebx
je 0x40e230
cmp dword [0x4650b8], ebx
je 0x40e230
push eax
call fcn.004090cc
push dword [0x4650b8]
mov esi, eax
call fcn.004090cc
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40e230
test edi, edi
je 0x40e230
call esi
test eax, eax
je 0x40e227
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40e227
test byte [ebp - 0xc], 1
jne 0x40e230
or dword [ebp + 0x10], 0x200000
jmp 0x40e269
mov eax, dword [0x4650ac]
cmp eax, ebx
je 0x40e269
push eax
call fcn.004090cc
pop ecx
test eax, eax
je 0x40e269
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40e269
mov eax, dword [0x4650b0]
cmp eax, ebx
je 0x40e269
push eax
call fcn.004090cc
pop ecx
test eax, eax
je 0x40e269
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4650a8]
call fcn.004090cc
pop ecx
test eax, eax
je 0x40e289
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40e28b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret