joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c1f60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov eax, 1
push edi
mov dword [esi + 0x30], eax
mov dword [esi + 0x44], eax
or eax, 0xffffffff
xor edi, edi
mov dword [esi + 0x90], eax
mov dword [esi + 0x94], eax
mov eax, dword [esi + 4]
mov dword [esi + 0x78], edi
mov dword [esi + 0x68], edi
cmp eax, 0x20
mov dword [esi + 0x7c], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x88], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x84], edi
jbe 0x100c1fcb
mov eax, 0x20
mov ecx, dword [esi + 0x20]
mov dword [esi + 0x54], eax
mov eax, dword [esi]
mov dword [esi + 0x58], edi
cmp eax, ecx
je 0x100c200c
lea ebx, [esi + 0xc8]
mov ebp, 0x20
cmp dword [ebx + 8], edi
je 0x100c1ff1
mov ecx, ebx
call fcn.100c1c50
add ebx, 0x28
dec ebp
jne 0x100c1fe5
mov edx, dword [esi + 0x5c]
cmp edx, edi
je 0x100c2007
mov ecx, dword [esi + 0x14]
call dword [ecx + 4]
mov dword [esi + 0x5c], edi
mov ecx, dword [esi]
mov dword [esi + 0x20], ecx
mov edx, dword [esi + 0x10]
lea ecx, [esi + 0x98]
call fcn.100c1b20
mov eax, dword [esi + 0x58]
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
lea edx, [eax + eax*4 + 0x19]
inc eax
mov dword [esi + 0x58], eax
lea ebp, [esi + edx*8]
mov ecx, ebp
call fcn.100c20b0
mov ebx, eax
cmp ebx, edi
jne 0x100c206f
lea ecx, [ebp + 0x20]
call fcn.100c86b0
mov ebx, eax
cmp ebx, edi
jne 0x100c206f
lea ecx, [ebp + 0x1c]
call fcn.100c86b0
mov ebx, eax
cmp ebx, edi
jne 0x100c206f
push ebp
call fcn.1006a3b2
mov ebx, eax
cmp ebx, edi
je 0x100c2084
mov ecx, esi
mov dword [esi + 0x44], edi
call fcn.100c20e0
cmp ebx, edi
jle 0x100c207f
and ebx, 0xffff
or ebx, 0x80070000
cmp ebx, edi
je 0x100c2084
mov dword [esi + 0x40], ebx
cmp dword [esi + 0x38], edi
jne 0x100c2096
cmp dword [esi + 0x40], edi
jne 0x100c2096
cmp dword [esi + 0x3c], edi
jne 0x100c2096
mov dword [esi + 0x44], edi
mov eax, dword [esi + 0x44]
pop edi
neg eax
sbb eax, eax
pop esi
not eax
and eax, ebx
pop ebp
pop ebx
ret
Function at 0x406de0
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80
push eax
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_SetWindowLongA
push 5
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x510024
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edx], al
add al, byte [eax]
add byte [eax], al
cld
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, byte [eax]
add byte [eax], al
cld
invalid
stc
jb 0x51002e
pop ds
xor esi, dword [ecx - 0x49]
jno 0x50ffe2
cwde
leave
jmp 0x51008f
pushal
jmp 0x510034
call 0x51003f
dec ecx
stc
mov dl, 0xed
pop ecx
pop ebx
jb 0x510049
jne 0x50ffd9
jge 0x510029
sbb dword [edx - 0x383c7edc], 0xffffffff
invalid
add ebx, 0xffffffc7
jmp 0x510058
cmp dword [ebx], 0
stc
jmp 0x510067
je 0x5100ed
jmp 0x510076
mov ecx, ebx
jmp 0x510081
add ebx, 4
jmp 0x510089
mov edx, dword [ebx]
jmp 0x510097
and eax, 0x8ced9cec
in eax, dx
cmp ebp, dword [ebx + 3]
sar ecx, cl
add edx, ebx
stc
jb 0x5100a3
mov ah, 0xb1
mov ebx, 0xc91a740d
mov eax, dword [ebx + 4]
jmp 0x5100ac
sub dword [edx], 0x3c62176a
jmp 0x5100b6
add edx, 4
jmp 0x5100bf
sub eax, 1
jmp 0x5100c6
jne 0x5100a6
jmp 0x5100d0
add ebx, 8
jmp 0x5100d7
sub dword [ecx], 1
stc
jb 0x5100de
and ecx, dword [edi]
test dword [eax + 0x72ffffff], esp
add dh, byte [ecx + 0xee83b]
add byte [eax], al
jne 0x510084
jb 0x5100e8
mov cl, 0x3b
call 0x5100fb
jmp 0x5100f1
popal
jmp 0x5100f6
jmp 0x50ed00

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x1fb91567
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
mov ecx, 0x79e53ae6
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x403a90
Capabilities:
Encode data using xor

Disassembly:
clc
pop ss
inc ecx
add byte [ebp + 0x4589ec4d], cl
invalid
push ebp
mov ebp, esp
sub esp, 0x14
push esi
pop ecx
jne 0x403aa2
push edi
inc edi
inc esi
or al, 0x50
rol byte [eax + 0x22], 0x8b
xchg byte [edi + esi*2], ah
add byte [eax], al
mov eax, dword [esi + 0x7724]
add eax, 0xa15083c0
mov ah, 2
inc ecx
jae 0x403a37
ror byte [edi], 0x84
insb byte es:[edi], dx
add dword [eax], eax
add byte [eax - 0x5d], cl
mov al, byte [edx]
inc ecx
add cl, ch
popal
add dword [eax], eax
add byte [edx - 0x1a], cl
test dword [eax - 0x47fe87a0], esp
or cl, byte [ebx - 0x735cefba]
add al, byte [ecx]
jmp 0x403afb
mov eax, dword [0x1b02ac]
mov ecx, dword [0x40d010]
cmp eax, ecx
pop esi
lea edx, [edi]
add dword [eax], eax
jecxz 0x403a9a
adc eax, 0x410bc8
mov edi, eax
shl dword [edx + 0x403f03af], 0xa3
lodsb al, byte [esi]
add al, byte [ecx]
call fcn.0040695c
mov dword [0x410ba0], eax
mov dword [0x410ba4], edx
mov dword [esi + 0x36ba0850], eax
mov ebp, dword [0xa60ad2a4]
mov eax, dword [esi + 0x8bd]
mov eax, edx
cmp dword [eax], ecx
add byte [eax], al
mov dword [edi], eax
mov ecx, dword [esi + 0x834]
mov dl, 0x3b
add al, 0x8b
invalid
Function at 0x4014a9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x250
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x228], 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x21c], 6
push ebx
push ebx
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x218], 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push esi
push esi
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
mov dword [ebp - 0x220], eax
call dword [sym.imp.USER32.dll_LoadIconA]
push edx
push edx
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x238]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_RegisterClassA]
push ecx
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push ebx
lea ebx, [ebp - 0x210]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
push esi
push esi
mov dword [esp + 4], ebx
mov dword [esp], 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push eax
push eax
mov dword [esp], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x80000000
call dword [sym.imp.KERNEL32.dll_CreateFileW]
sub esp, 0x1c
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
lea esp, [ebp - 8]
lea eax, [ebx - 3]
pop ebx
pop esi
pop ebp
ret

Function at 0x401692
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xa4
mov dword [ebp - 0x88], 1
call fcn.004014a9
test eax, eax
jne 0x40172c
lea eax, [ebp - 0x8c]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
mov eax, 0x402196
sub eax, 0x401734
mov dword [esp], 0x401734
mov dword [esp + 4], eax
mov dword [ebp - 0x8c], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp dword [ebp - 0x8c], 0
je 0x40172c
lea ebx, [ebp - 0x88]
mov dword [esp], 0
call fcn.0040141d
mov dword [esp + 4], ebx
mov dword [esp], 0
call fcn.00401626
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1b400
mov dword [esp], 0x40300c
call fcn.00401e99
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x8de118
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8de11e
pop ebp
sub ebp, 6
sub ebp, 0x4de118
jmp 0x8de17c
jmp 0x8de185
mov eax, 0x4de118
add eax, ebp
add eax, 0x93
mov ecx, 0x63e
mov edx, 0xfc242cca
xor byte [eax], dl
inc eax
dec ecx
jne 0x8de19c
jmp 0x8de1af
mov al, byte [0xdacaa28a]
retf 0xa2ca
Function at 0x4011c0
Capabilities:
Initialize winsock library
Terminate process

Disassembly:
sub esp, 0x1a4
lea eax, [esp + 0x14]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x4011f5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.WSAStartup_failed._Error:__d_r_n
call fcn.004017a1
add esp, 8
push 0xffffffffffffffff
call fcn.0040180f
push ebx
push ebp
push esi
push edi
mov dword [0x40b118], 1
call fcn.004012d0
mov eax, dword [0x40af28]
test eax, eax
jne 0x40122c
push str.Error__could_not_find_any_ethernet_interfaces._r_n
call fcn.004017a1
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a4
ret
test eax, eax
mov dword [esp + 0x10], 0
jle 0x401292
mov edi, dword [sym.imp.WS2_32.dll_htonl]
mov ebx, dword [sym.imp.WS2_32.dll_htons]
mov ebp, dword [sym.imp.WS2_32.dll_bind]
mov esi, 0x40b0d8
mov ecx, dword [esi + 4]
push ecx
call edi
push 0xd431
mov dword [esp + 0x1c], eax
call ebx
mov word [esp + 0x16], ax
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0x10
push edx
push eax
mov word [esp + 0x20], 2
call ebp
test eax, eax
jne 0x40129f
mov eax, dword [esp + 0x10]
mov ecx, dword [0x40af28]
inc eax
add esi, 8
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x40124f
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1a4
ret
push str.Error__could_not_bind_interfaces._r_n
call fcn.004017a1
push str.Please_close_the__Tiny_Network_Explorer_._r_n
call fcn.004017a1
add esp, 8
mov eax, 0xfffffffe
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a4
ret
Function at 0x4012d0
Capabilities:
Create udp socket
Set socket configuration
Terminate process

Disassembly:
sub esp, 0x270
mov ecx, 0x10
xor eax, eax
push ebx
push esi
xor ebx, ebx
push edi
mov edi, 0x40b0d8
push ebx
push 2
push 2
rep stosd dword es:[edi], eax
mov dword [0x40af28], ebx
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x401410
push ebx
lea eax, [esp + 0x18]
push ebx
push eax
lea ecx, [esp + 0x28]
push 0x260
push ecx
push ebx
push ebx
push 0x4004747f
push esi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
jne 0x401410
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [esp + 0x14]
mov eax, 0xaf286bcb
mul ecx
sub ecx, edx
mov dword [0x40af28], ebx
shr ecx, 1
add ecx, edx
shr ecx, 6
cmp ecx, ebx
mov dword [esp + 0x18], ecx
jle 0x401410
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
lea edx, [esp + 0x24]
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WS2_32.dll_ntohl]
mov esi, eax
cmp esi, 0x7f000001
je 0x4013f8
cmp dword [0x40af28], 8
jge 0x4013f8
push 0
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov edx, dword [0x40af28]
cmp eax, 0xffffffff
mov dword [edx*8 + 0x40b0d8], eax
je 0x40141a
lea ecx, [esp + 0xc]
push 4
push ecx
push 0x20
push 0xffff
push eax
mov dword [esp + 0x20], 1
call edi
mov eax, dword [0x40af28]
lea edx, [esp + 0xc]
push 4
push edx
mov ecx, dword [eax*8 + 0x40b0d8]
push 0x1006
push 0xffff
push ecx
mov dword [esp + 0x20], 0xc8
call edi
mov eax, dword [0x40af28]
mov dword [eax*8 + 0x40b0dc], esi
inc eax
mov dword [0x40af28], eax
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
inc ebx
add ecx, 0x4c
cmp ebx, eax
mov dword [esp + 0x10], ecx
jl 0x401367
pop edi
pop esi
pop ebx
add esp, 0x270
ret
push 0
call fcn.0040180f
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x401529
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
test eax, eax
setne al
test al, al
je 0x401599
mov dword [esp + 4], str.Open_Regkey_error_
mov dword [esp], 0x489140
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov dword [esp], method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____
mov ecx, eax
call method.std::ostream.operator___std::ostream____std::ostream__
sub esp, 4
mov eax, 0
jmp 0x401613
mov eax, dword [ebp + 0x14]
mov dword [esp], eax
call sym._strlen
lea edx, [eax + 1]
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x14], edx
mov edx, dword [ebp + 0x14]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov edx, dword [ebp + 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
test eax, eax
setne al
test al, al
je 0x40160e
mov dword [esp + 4], str.RegSetValueEx_error_
mov dword [esp], 0x489140
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov dword [esp], method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____
mov ecx, eax
call method.std::ostream.operator___std::ostream____std::ostream__
sub esp, 4
mov eax, 0
jmp 0x401613
mov eax, 1
leave
ret
Function at 0x401615
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
test eax, eax
setne al
test al, al
je 0x40168c
mov dword [esp + 4], str.Open_Regkey_error_
mov dword [esp], 0x489140
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov dword [esp], method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____
mov ecx, eax
call method.std::ostream.operator___std::ostream____std::ostream__
sub esp, 4
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x14], 4
lea edx, [ebp + 0x14]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov edx, dword [ebp + 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
test eax, eax
setne al
test al, al
je 0x4016f7
mov dword [esp + 4], str.RegSetValueEx_error_
mov dword [esp], 0x489140
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov dword [esp], method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____
mov ecx, eax
call method.std::ostream.operator___std::ostream____std::ostream__
sub esp, 4
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0
setne al
leave
ret

Function at 0x401bd9
Capabilities:
Create process on windows
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp], 0x48a028
call sym._system
mov dword [esp + 0x14], 5
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.rbcleaner.bat
mov dword [esp + 4], str.open
mov dword [esp], 0
mov eax, dword [sym.imp.SHELL32.DLL_ShellExecuteA]
call eax
sub esp, 0x18
mov dword [ebp - 0xc], eax
leave
ret
Function at 0x401ea9
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x28
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call eax
sub esp, 0xc
test eax, eax
setne al
test al, al
je 0x401f69
lea eax, [ebp - 0x24]
add eax, 4
mov dword [esp + 8], eax
mov dword [esp + 4], str.SeDebugPrivilege
mov dword [esp], 0
mov eax, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
call eax
sub esp, 0xc
test eax, eax
setne al
test al, al
je 0x401f59
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x18], 2
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
lea edx, [ebp - 0x24]
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call eax
sub esp, 0x18
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
leave
ret
Function at 0x40eb70
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._vfprintf
call sym._abort
jmp dbg.mark_section_writable

Function at 0x40ebd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x4934b0]
test esi, esi
jle 0x40ecbd
mov edi, dword [0x4934b4]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x40ec04
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x40ecb6
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x40ebf0
mov dword [esp], eax
mov ebx, eax
call dbg.__mingw_GetSectionForAddress
test eax, eax
mov edi, eax
je 0x40ecfa
lea ebx, [esi + esi*2]
mov esi, dword [0x4934b4]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call dbg._GetPEImageBase
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x4934b4]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x40ecda
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x40ecaf
sub eax, 0x40
and eax, 0xffffffbf
je 0x40ecaf
mov eax, dword [esp + 0x20]
add ebx, dword [0x4934b4]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x40ecc4
add dword [0x4934b0], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor esi, esi
jmp 0x40ec0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
mov eax, dword [0x4934b4]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
Function at 0x40f1c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x493848
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x493840]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x40f215
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40f20e
test esi, esi
je 0x40f20e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x40f1f0
mov dword [esp], 0x493848
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40f430
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x40f468
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x40f45e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40f46a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x40f450
xor eax, eax
pop ebx
pop esi
ret