joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a531
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x414780]
xor eax, dword [ebp + 4]
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
jne 0x40a55a
xor eax, eax
jmp 0x40a6c8
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 8]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x4178a0]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x40a58d
push 2
push edi
push edi
push dword [ebp + 8]
call fcn.0040dfdd
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x40a65f
cmp dword [ebp + 0x10], edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], edi
jbe 0x40a69a
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x420]
mov dword [ebp - 0xc], edi
cmp ecx, dword [ebp + 0x10]
jae 0x40a5e8
mov edx, dword [ebp - 0x10]
inc dword [ebp - 0x10]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x40a5d9
inc dword [ebp - 0x18]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0xc]
mov byte [eax], dl
inc eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x400
jl 0x40a5bc
mov edi, eax
lea eax, [ebp - 0x420]
sub edi, eax
push 0
lea eax, [ebp - 0x1c]
push eax
push edi
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40a628
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x14], eax
cmp eax, edi
jl 0x40a631
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp + 0xc]
xor edi, edi
cmp eax, dword [ebp + 0x10]
jb 0x40a5ad
jmp 0x40a633
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
xor edi, edi
mov eax, dword [ebp - 0x14]
cmp eax, edi
jne 0x40a6c3
cmp dword [ebp - 8], edi
je 0x40a69a
push 5
pop esi
cmp dword [ebp - 8], esi
jne 0x40a68c
call fcn.00409737
mov dword [eax], 9
call fcn.00409740
mov dword [eax], esi
jmp 0x40a695
push edi
lea ecx, [ebp - 0x1c]
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40a681
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], eax
jmp 0x40a633
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x40a633
push dword [ebp - 8]
call fcn.00409749
pop ecx
or eax, 0xffffffff
jmp 0x40a6c6
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x40a6af
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0x1a
jne 0x40a6af
xor eax, eax
jmp 0x40a6c6
call fcn.00409737
mov dword [eax], 0x1c
call fcn.00409740
mov dword [eax], edi
jmp 0x40a695
sub eax, dword [ebp - 0x18]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop edi
call fcn.0040e091
leave
ret
Function at 0x40da7e
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.0040d720
mov eax, dword [0x414780]
xor eax, dword [ebp + 4]
push ebx
push esi
push 1
xor esi, esi
push esi
push dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.0040a781
or ebx, 0xffffffff
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x40dba8
push 2
push esi
push dword [ebp + 8]
call fcn.0040a781
add esp, 0xc
cmp eax, ebx
je 0x40dba8
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x40db4b
mov ebx, 0x1000
push ebx
lea eax, [ebp - 0x100c]
push esi
push eax
call fcn.0040e0a0
push 0x8000
push dword [ebp + 8]
call fcn.0040fbdd
add esp, 0x14
mov dword [ebp - 0xc], eax
cmp edi, ebx
mov eax, ebx
jge 0x40db04
mov eax, edi
push eax
lea eax, [ebp - 0x100c]
push eax
push dword [ebp + 8]
call fcn.0040a531
add esp, 0xc
cmp eax, 0xffffffff
je 0x40db24
sub edi, eax
test edi, edi
jg 0x40dafc
jmp 0x40db3c
call fcn.00409740
cmp dword [eax], 5
jne 0x40db39
call fcn.00409737
mov dword [eax], 0xd
or esi, 0xffffffff
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.0040fbdd
pop ecx
pop ecx
jmp 0x40db93
jge 0x40db93
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040a781
push dword [ebp + 8]
call fcn.00409c90
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, ebx
jne 0x40db93
call fcn.00409737
mov dword [eax], 0xd
call fcn.00409740
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
push 0
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.0040a781
add esp, 0xc
mov eax, esi
pop edi
jmp 0x40dbaa
mov eax, ebx
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop esi
pop ebx
call fcn.0040e091
leave
ret
Function at 0x40f499
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x416120], ebx
push esi
push edi
jne 0x40f519
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x40f554
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x41206c
push edi
call esi
test eax, eax
mov dword [0x416120], eax
je 0x40f554
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x416124], eax
call esi
cmp dword [0x415f30], 2
mov dword [0x416128], eax
jne 0x40f519
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x416130], eax
je 0x40f519
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x41612c], eax
mov eax, dword [0x41612c]
test eax, eax
je 0x40f55e
call eax
test eax, eax
je 0x40f545
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x416130]
test eax, eax
je 0x40f545
test byte [ebp - 8], 1
jne 0x40f55e
cmp dword [0x415f3c], 4
jb 0x40f558
or byte [ebp + 0x12], 0x20
jmp 0x40f57d
xor eax, eax
jmp 0x40f58d
or byte [ebp + 0x12], 4
jmp 0x40f57d
mov eax, dword [0x416124]
test eax, eax
je 0x40f57d
call eax
mov ebx, eax
test ebx, ebx
je 0x40f57d
mov eax, dword [0x416128]
test eax, eax
je 0x40f57d
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x416120]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40fa28
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
mov dword [ebp - 8], ebx
je 0x40fa93
push 0x3d
push dword [ebp + 8]
call fcn.0041023a
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], esi
je 0x40fa93
cmp dword [ebp + 8], esi
je 0x40fa93
xor eax, eax
cmp byte [esi + 1], al
sete al
mov dword [ebp - 4], eax
mov eax, dword [0x415f50]
cmp eax, dword [0x415f54]
jne 0x40fa79
mov edi, eax
call fcn.0040f9c7
mov dword [0x415f50], eax
cmp eax, ebx
jne 0x40fad2
cmp dword [ebp + 0xc], ebx
je 0x40fa9b
cmp dword [0x415f58], ebx
je 0x40fa9b
call fcn.0040d87b
test eax, eax
je 0x40fad2
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
cmp dword [ebp - 4], ebx
jne 0x40fbd6
push 4
call fcn.0040a268
cmp eax, ebx
pop ecx
mov dword [0x415f50], eax
je 0x40fa93
mov dword [eax], ebx
cmp dword [0x415f58], ebx
jne 0x40fad2
push 4
call fcn.0040a268
cmp eax, ebx
pop ecx
mov dword [0x415f58], eax
je 0x40fa93
mov dword [eax], ebx
mov ebx, dword [0x415f50]
mov edi, esi
mov esi, dword [ebp + 8]
sub edi, esi
push esi
call fcn.0040f97a
mov edi, eax
test edi, edi
pop ecx
jl 0x40fb2b
cmp dword [ebx], 0
je 0x40fb2b
lea esi, [ebx + edi*4]
push dword [esi]
call fcn.00408b5e
xor eax, eax
cmp dword [ebp - 4], eax
pop ecx
jne 0x40fb13
mov eax, dword [ebp + 8]
mov dword [esi], eax
jmp 0x40fb61
mov ecx, dword [esi + 4]
mov dword [esi], ecx
inc edi
add esi, 4
cmp dword [esi], eax
jne 0x40fb0a
mov eax, edi
shl eax, 2
push eax
push ebx
call fcn.0040a014
test eax, eax
pop ecx
pop ecx
je 0x40fb61
jmp 0x40fb5c
cmp dword [ebp - 4], 0
jne 0x40fbcf
test edi, edi
jge 0x40fb3b
neg edi
lea eax, [edi*4 + 8]
push eax
push ebx
call fcn.0040a014
test eax, eax
pop ecx
pop ecx
je 0x40fa93
lea ecx, [eax + edi*4]
and dword [ecx + 4], 0
mov dword [ecx], esi
mov dword [0x415f50], eax
cmp dword [ebp + 0xc], 0
je 0x40fbb8
push dword [ebp + 8]
call fcn.0040d7f0
inc eax
inc eax
push eax
call fcn.0040a268
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40fbb8
push dword [ebp + 8]
push esi
call fcn.0040ea20
mov eax, esi
sub eax, dword [ebp + 8]
pop ecx
add eax, dword [ebp - 0xc]
pop ecx
and byte [eax], 0
mov ecx, dword [ebp - 4]
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x40fbb1
or dword [ebp - 8], 0xffffffff
push esi
call fcn.00408b5e
pop ecx
cmp dword [ebp - 4], 0
je 0x40fbc7
push dword [ebp + 8]
call fcn.00408b5e
pop ecx
mov eax, dword [ebp - 8]
jmp 0x40fa96
push esi
call fcn.00408b5e
pop ecx
xor eax, eax
jmp 0x40fa96
Function at 0x40fff7
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 4
pop eax
call fcn.0040d720
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x41008c
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x44]
lea esi, [eax - 1]
not esi
and esi, ebx
sub esi, eax
mov dword [ebp - 4], eax
mov eax, dword [0x415f30]
mov ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0xffff1000
add ecx, 0x11000
add ecx, edi
cmp esi, ecx
jb 0x41008c
cmp eax, 1
je 0x4100a4
mov ebx, edi
mov edi, 0x1000
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x41008c
add ebx, dword [ebp - 0x18]
test dword [ebp - 0x14], edi
je 0x410061
test byte [ebp - 0xf], 1
mov ebx, dword [ebp - 0x24]
je 0x410088
xor eax, eax
inc eax
jmp 0x4100c0
cmp esi, ebx
jae 0x410090
xor eax, eax
jmp 0x4100c0
push 4
push edi
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x415f30]
jmp 0x4100a6
mov ebx, esi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 8]
push ecx
inc eax
push eax
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x54]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x409250
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
mov esi, 0x83fb8b57
leave
inc dword [ebx - 0x40]
mov esi, dword [ebp + 8]
repne scasb al, byte es:[edi]
not ecx
cmp ecx, 0xdea363
sub ch, byte [ebx + 0x56]
jbe 0x4092dd
mov dl, byte [ebx - 0x3e]
cmp dl, 0x3a
jne 0x40929f
mov al, byte [ebx + 2]
movsb byte es:[edi], byte [esi]
das
fild dword [esp + edi]
mov ebp, 0xe0681a75
add byte [ecx], al
push esi
call dword [0x9540c110]
mov eax, dword [ebp - 0x33]
add esp, 8
sub eax, 4
push ebp
invalid
mov eax, dword [ebx]
cmp al, 0x2f
in eax, 0xd2
cmp al, 0x5c
sysenter
movsd dword es:[edi], dword [esi]
cli
das
je 0x4092b3
cmp dl, 0x5c
jne 0x4092dd
cmp byte [ebx + 2], 0xbb
je 0x4092dd
sub ecx, 2
push 0x4113cc
add byte [ebx + 0x148902c3], al
adc bh, bh
adc eax, 0xebc110
mov eax, dword [ebp + 0xc]
or al, 0x83
les ecx, [eax]
lea eax, [ebp + 0xc]
jecxz 0x40932f
jne 0x40931a
Function at 0x401000
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 8], 1
jne 0x401014
mov eax, dword [0x4380cc]
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
jmp 0x401026
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [0x4380d0]
shr edx, 1
cmp dword [ebp - 4], edx
jae 0x4010ab
mov eax, dword [ebp - 4]
mov ecx, dword [0x4380b4]
movzx edx, word [ecx + eax*2]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
shr eax, 0xc
cmp eax, 3
jne 0x4010a6
mov ecx, dword [ebp - 0xc]
and ecx, 0xfff
add ecx, 0x1474
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
sub edx, 0x1474
mov dword [ebp - 8], edx
cmp dword [ebp - 4], 0
jne 0x401087
push 0x20e
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
je 0x401087
xor eax, eax
jmp 0x4010ab
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax]
mov edx, dword [ebp - 8]
mov eax, dword [ecx + edx]
add eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
add edx, dword [ecx]
mov ecx, dword [ebp - 8]
mov dword [edx + ecx], eax
jmp 0x40101d
mov esp, ebp
pop ebp
ret
Function at 0x401750
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov dword [ebp - 0x114], str.55222
mov eax, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x11c], eax
push 0x104
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, dword [ebp - 0x114]
push edx
lea eax, [ebp - 0x110]
push eax
call dword [ebp - 0x11c]
push 0
push 0x80
push 3
push 0
push 3
push 1
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xffffffff
je 0x4017ca
cmp dword [ebp - 0x118], 0
je 0x4017ca
jmp 0x40182c
mov edx, dword [ebp + 8]
cmp dword [edx + 4], 0
je 0x40182c
mov dword [ebp - 0x120], 0x3c41
mov eax, dword [ebp + 8]
add eax, 8
mov dword [0x4380b4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [0x4380d0], edx
mov dword [ebp - 0x120], 0x3c41
mov dword [ebp - 0x120], 0x3c41
call fcn.004011c0
mov eax, dword [ebp + 8]
mov dword [0x4380cc], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
call fcn.00401ad0
add esp, 0xc
mov dword [ebp + 8], eax
jmp 0x4017ca
mov esp, ebp
pop ebp
ret

Function at 0x401830
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
je 0x40184c
xor eax, eax
jmp 0x40192d
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
jne 0x401864
xor eax, eax
jmp 0x40192d
push ebp
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
add eax, 0x3c41
call fcn.00401300
mov esp, ebp
pop ebp
ret

Function at 0x401b10
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [0x4380c0], 0x24e1
mov eax, dword [0x4380c0]
sub eax, 0x24e1
mov dword [0x4380c0], eax
mov ecx, 1
test ecx, ecx
je 0x401bbb
mov edx, dword [0x4380c0]
cmp edx, dword [ebp + 0xc]
jb 0x401b47
jmp 0x401bbb
cmp dword [0x4380c0], 0
jne 0x401b65
push 0x263
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
je 0x401b65
xor eax, eax
jmp 0x401bbb
mov eax, dword [ebp + 8]
add eax, dword [0x4380c0]
mov ecx, dword [eax]
add ecx, dword [0x4380c0]
mov edx, dword [ebp + 8]
add edx, dword [0x4380c0]
mov dword [edx], ecx
mov dword [ebp - 4], 0xad9c
mov eax, dword [0x4380c0]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax + 2]
push edx
mov eax, dword [ebp + 8]
add eax, dword [0x4380c0]
push eax
call fcn.004011d0
add esp, 8
mov ecx, dword [0x4380c0]
add ecx, 4
mov dword [0x4380c0], ecx
jmp 0x401b2d
mov esp, ebp
pop ebp
ret
Function at 0x4c49e2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ebx, dword [ebp + 8]
cmp ebx, 0
je 0x4c4a27
mov eax, dword [ebx + 0x3c]
add eax, ebx
mov edx, dword [eax + 0x78]
add edx, ebx
mov ecx, dword [edx + 0x18]
mov eax, dword [edx + 0x20]
push ecx
push ecx
push eax
xor eax, eax
or ecx, 0xffffffff
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
repne scasb al, byte es:[edi]
not ecx
pop eax
push ecx
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
mov esi, dword [eax + ebx]
add esi, ebx
repe cmpsb byte [esi], byte es:[edi]
pop ecx
je 0x4c4a2d
add eax, 4
pop esi
dec esi
push esi
jne 0x4c4a0f
xor eax, eax
leave
ret 8
pop esi
pop ecx
sub ecx, esi
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx eax, word [eax + ebx]
mov ecx, dword [edx + 0x1c]
lea eax, [ecx + eax*4]
mov eax, dword [eax + ebx]
add eax, ebx
leave
ret 8

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x401000
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
xor esi, esi
push ebx
sub esp, 0x3c
mov dword [ebp - 0x24], eax
mov eax, dword [sym.imp.ucrtbase.dll_malloc]
mov dword [esp], 0x1000
mov dword [ebp - 0x28], eax
call eax
mov ebx, dword [0x406004]
mov dword [ebp - 0x1c], 0x1000
mov ecx, eax
jmp 0x40105a
mov eax, ebx
add ebx, 1
movzx edx, byte [eax + section..bss]
mov dword [0x406004], ebx
cmp dl, 0xa
je 0x401180
mov eax, dword [ebp - 0x1c]
lea edi, [esi + 1]
cmp edi, eax
jge 0x4010b0
mov byte [ecx + esi], dl
mov esi, edi
cmp ebx, dword [0x406000]
jb 0x401030
mov dword [ebp - 0x20], ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x406000
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 0x405000
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ReadFile]
mov ecx, dword [ebp - 0x20]
sub esp, 0x14
test eax, eax
je 0x4010d0
mov eax, dword [0x406000]
test eax, eax
je 0x4010d0
mov ebx, 1
xor eax, eax
jmp 0x401035
shl dword [ebp - 0x1c], 1
mov byte [ebp - 0x20], dl
mov eax, dword [ebp - 0x1c]
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll_realloc]
movzx edx, byte [ebp - 0x20]
mov ecx, eax
jmp 0x401055
mov edi, ecx
test esi, esi
je 0x401193
mov byte [ecx + esi], 0
lea eax, [edi + esi - 1]
cmp byte [eax], 0xd
jne 0x4010f0
mov byte [eax], 0
lea esi, [esi]
mov edx, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [ebp - 0x1c], edx
call edx
sub esp, 0x18
mov esi, eax
lea eax, [eax + eax]
mov dword [esp], eax
mov eax, dword [ebp - 0x28]
call eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
mov ebx, eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0
mov edx, dword [ebp - 0x1c]
call edx
sub esp, 0x18
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_free]
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, ecx
mov byte [ecx + esi], 0
test esi, esi
je 0x4010f0
jmp 0x4010de
xor ebx, ebx
jmp 0x40116c
Function at 0x4012b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov edx, eax
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
cmp word [eax], 0
je 0x4013f0
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x4012c8
sub eax, edx
sar eax, 1
mov ebx, eax
mov ecx, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [esp + 8], edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebx
mov dword [ebp - 0x30], edx
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [ebp - 0x2c], ecx
call ecx
sub esp, 0x20
mov esi, eax
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov edi, eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ebx
mov edx, dword [ebp - 0x30]
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], edx
mov ecx, dword [ebp - 0x2c]
call ecx
sub esp, 0x20
mov dword [esp], 0xfffffff5
call dword [sym.imp.kernel32.dll_GetStdHandle]
lea edx, [ebp - 0x1c]
sub esp, 4
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
cmp dword [ebp - 0x1c], esi
jae 0x4013a7
test byte [section..data], 2
jne 0x4013c0
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_free]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], str.Failed_to_write_output_n
mov dword [esp + 8], str.write_to_stdout
mov dword [esp + 4], 0x403000
mov dword [esp], 1
call fcn.00401260
jmp 0x4013a7
xor ebx, ebx
jmp 0x4012d7

Function at 0x402480
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call 0x4024f0
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.00401470
mov dword [esp], eax
call sub.ucrtbase.dll_exit
nop
nop
nop
jmp dword [sym.imp.ucrtbase.dll___p___argc]