joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43e950
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x2e000]
push edi
jmp 0x43e96a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x43e971
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x43e960
mov eax, 1
add ebx, ebx
jne 0x43e983
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x43e978
jne 0x43e994
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x43e978
xor ecx, ecx
sub eax, 3
jb 0x43e9a8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x43ea1a
mov ebp, eax
add ebx, ebx
jne 0x43e9b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x43e9c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x43e9e4
inc ecx
add ebx, ebx
jne 0x43e9d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x43e9c5
jne 0x43e9e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x43e9c5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x43ea04
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x43e9f5
jmp 0x43e966
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x43ea04
add edi, ecx
jmp 0x43e966
pop esi
mov edi, esi
mov ecx, 0xa57
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x43ea22
cmp byte [edi], 0x12
jne 0x43ea22
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x43ea27
lea edi, [esi + 0x3c000]
mov eax, dword [edi]
or eax, eax
je 0x43ea9f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x571bc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5729c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x43ea54
mov ecx, edi
jns 0x43ea83
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x572a4]
or eax, eax
je 0x43ea99
mov dword [ebx], eax
add ebx, 4
jmp 0x43ea71
call dword [esi + 0x572a0]
mov ebp, dword [esi + 0x572a8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x17f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x43ead3
sub esp, 0xffffff80
jmp 0x41942f
Function at 0xf02108
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00f02258
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xf0212e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xf0211a
add dl, dl
jne 0xf02139
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xf0218c
xor eax, eax
add dl, dl
jne 0xf02146
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xf0222d
add dl, dl
jne 0xf02155
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf02160
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf0216b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf02176
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xf02182
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xf02125
mov eax, 1
add dl, dl
jne 0xf0219a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf021a5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xf02191
sub eax, ebx
mov ebx, 1
jne 0xf021d8
mov ecx, 1
add dl, dl
jne 0xf021be
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xf021c9
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xf021b5
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xf02125
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xf021ef
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xf021fa
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xf021e6
cmp eax, 0x7d00
jae 0xf0221d
cmp eax, 0x500
jb 0xf02218
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xf02125
cmp eax, 0x7f
ja 0xf02220
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xf02125
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xf0224e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xf02125
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x968058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.009681a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x96807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x96806a
add dl, dl
jne 0x968089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9680dc
xor eax, eax
add dl, dl
jne 0x968096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x96817d
add dl, dl
jne 0x9680a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9680b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9680bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9680c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9680d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x968075
mov eax, 1
add dl, dl
jne 0x9680ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9680f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9680e1
sub eax, ebx
mov ebx, 1
jne 0x968128
mov ecx, 1
add dl, dl
jne 0x96810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x968119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x968105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x968075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x96813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x96814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x968136
cmp eax, 0x7d00
jae 0x96816d
cmp eax, 0x500
jb 0x968168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x968075
cmp eax, 0x7f
ja 0x968170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x968075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x96819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x968075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x1196058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.011961a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x119607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x119606a
add dl, dl
jne 0x1196089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x11960dc
xor eax, eax
add dl, dl
jne 0x1196096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x119617d
add dl, dl
jne 0x11960a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11960b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11960bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11960c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x11960d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1196075
mov eax, 1
add dl, dl
jne 0x11960ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11960f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x11960e1
sub eax, ebx
mov ebx, 1
jne 0x1196128
mov ecx, 1
add dl, dl
jne 0x119610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1196119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1196105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1196075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x119613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x119614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1196136
cmp eax, 0x7d00
jae 0x119616d
cmp eax, 0x500
jb 0x1196168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1196075
cmp eax, 0x7f
ja 0x1196170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1196075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x119619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1196075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x1001aaf3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1001ab32
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001ab32
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001ab32
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1001ab32
cmp dword [ecx + 0x74], 0xe
jbe 0x1001ab32
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1001d7af
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1001d84c
push ebx
push esi
call fcn.1001d778
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1001d70c
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1001d7f9
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001d84b
push edi
push eax
call fcn.1001e76a
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1001d819
call fcn.1001c254
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001d84a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1001d70c
add esp, 0x20
test eax, eax
jne 0x1001d838
push edi
call fcn.1001c254
jmp 0x1001d840
push ebx
call fcn.1001c254
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1001dab9
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10025cc8
push 0x10025cc0
push str.FlsAlloc
push 0x1f
call fcn.1001d9d5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001daed
push dword [ebp + 8]
mov ecx, esi
call dword [0x10024150]
call esi
jmp 0x1001daf3
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1001db37
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10025cd8
push 0x10025cd0
push str.FlsGetValue
push 0x21
call fcn.1001d9d5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001db6e
push dword [ebp + 8]
mov ecx, esi
call dword [0x10024150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1001db76
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10025ce0
push 0x10025cd8
push str.FlsSetValue
push 0x22
call fcn.1001d9d5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001dbb0
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10024150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10023230
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1002325d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002325d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40d3e0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x40d440
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x79d234]
test esi, esi
jle 0x40d560
mov eax, dword [0x79d238]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x40d474
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x40d4f7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x40d460
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x40d587
mov eax, dword [0x79d238]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x79d238]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x40d567
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x40d4f0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x40d500
add dword [0x79d234], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x79d238]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x40d4f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x40d47e
mov eax, dword [0x79d238]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
nop
Function at 0x40da40
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x79d250
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x79d248]
sub esp, 4
test ebx, ebx
je 0x40da95
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40da8e
test esi, esi
je 0x40da8e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x40da70
mov dword [esp], 0x79d250
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40ddc0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x40dde5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x40ddf0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x40dde5
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test esi, esi
je 0x40de38
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x40de2e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40de3a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x40de20
xor eax, eax
pop ebx
pop esi
ret

Function at 0x40e410
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x40e450
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x40e478
xor eax, eax
add esp, 0x1c
ret
add esp, 0x1c
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x421120
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
cmp byte [0x4b4afc], 0
jne 0x421246
mov byte [0x4b4afc], 1
call sym.___cxa_current_exception_type
test eax, eax
je 0x421214
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
sete al
mov dword [esp + 4], 0
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call sym.___cxa_demangle
mov dword [esp], 2
mov esi, dword [dbg.__acrt_iob_func]
mov edi, eax
call esi
mov dword [esp + 8], 0x30
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
call sym._fwrite
mov edx, dword [esp + 0x1c]
mov dword [esp], 2
test edx, edx
je 0x421204
call esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._fputs
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x4b7489
call sym._fwrite
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x4ac374
jmp 0x4ac36c
call esi
mov dword [esp], edi
mov dword [esp + 4], eax
call sym._fputs
jmp 0x4211ca
mov dword [esp], 2
call dword [0x4b307c]
mov dword [esp + 8], 0x2d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
call sym._fwrite
jmp 0x4ac367
mov dword [esp], 2
call dword [0x4b307c]
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_recursively_n
call sym._fwrite
call sym._abort
nop
nop
nop
nop
nop
nop
nop
nop
call sym._abort
mov dword [esp], edi
call sym._free
call sym.___cxa_rethrow
call sym.___cxa_begin_catch
call sym.___cxa_end_catch
jmp 0x4ac367
Function at 0x1001a970
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x10021008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x100
lea eax, [ebp - 0x104]
mov esi, ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
lea eax, [esi + 0x18]
push eax
lea eax, [ebp - 0x104]
push str._s_btn.ini
push eax
call fcn.1001aa50
push 0x1001f324
lea eax, [ebp - 0x104]
mov dword [ebp - 0x108], 0
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
add esp, 0x24
cmp dword [ebp - 0x108], 0
pop esi
je 0x1001aa31
lea eax, [ebp - 0x104]
push eax
push 0xffffffffffffffff
push str.func
push str.Button
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x10022c84], eax
cmp eax, 0x64
je 0x1001aa0f
or ecx, 0xffffffff
cmp eax, 0x6f
cmovne eax, ecx
mov dword [0x10022c84], eax
push dword [ebp - 0x108]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001d263
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.1001d263
mov esp, ebp
pop ebp
ret
Function at 0x4027f8
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004038b0
test esi, esi
jne 0x40282e
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA_1
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004039a0
jmp 0x40284c
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.0040269c
mov edi, eax
test esi, esi
je 0x40284c
cmp dword [ebx], 0
je 0x40284c
dec esi
jmp 0x402835
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4039a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc edi
push es
cmp ax, bx
jbe 0x4039c2
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x4039bc
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x4039ad
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.00403768
mov ecx, 0x8d27b7dc
inc ebp
test al, 0x50
call fcn.00403778
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.0040372d
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x403a56
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
invalid
inc ebp
into

Function at 0x403b2c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
inc ebp
wait
xor eax, 0x349c45c6
invalid
Function at 0x403e10
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x403e1c
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x403e17
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x403e01
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x403e09
cmp edx, ebx
jne 0x403f57
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x403dd8
add eax, dword [eax + 4]
jmp 0x403dc5
mov dword [ebp + 0xc], ebx
jmp 0x403e27
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x403e3f
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x403e5d
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x403ebb
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x403ea2
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x403eab
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x403eb5
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x403e97
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x403e21
mov dword [ebp + 8], esi
xor edi, edi