joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48cb70
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x10]
mov ecx, 6
add eax, 7
push ebx
cdq
and edx, 7
push ebp
add eax, edx
mov edx, dword [esp + 0xc]
sar eax, 3
sub ecx, eax
push esi
shl ecx, 2
xor esi, esi
push edi
lea ebx, [ecx + edx]
mov edx, dword [esp + 0x18]
lea ebp, [ecx + edx]
mov edx, dword [esp + 0x1c]
add ecx, edx
mov dword [esp + 0x20], ecx
mov edi, dword [ebx]
mov ecx, dword [ebp]
add esi, edi
lea edx, [ecx + esi + 0x66666666]
cmp edx, esi
sbb esi, esi
xor ecx, edi
neg esi
xor ecx, edx
mov edi, esi
not ecx
shr ecx, 3
xor edi, 1
and ecx, 0x2222222
shl edi, 0x1d
or ecx, edi
add ebx, 4
add ebp, 4
lea ecx, [ecx + ecx*2]
sub edx, ecx
mov ecx, dword [esp + 0x20]
mov dword [ecx], edx
add ecx, 4
dec eax
mov dword [esp + 0x20], ecx
jne 0x48cba8
test esi, esi
jne 0x48cbfb
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, dword [esp + 0x1c]
pop edi
mov ecx, dword [eax + 8]
mov esi, dword [eax + 4]
mov edx, ecx
shl edx, 0x1c
shr esi, 4
or edx, esi
mov dword [eax + 4], edx
mov edx, dword [eax + 0xc]
mov esi, edx
shl esi, 0x1c
shr ecx, 4
or esi, ecx
mov dword [eax + 8], esi
mov esi, dword [eax + 0x10]
mov ecx, esi
shl ecx, 0x1c
shr edx, 4
or ecx, edx
mov dword [eax + 0xc], ecx
mov ecx, dword [eax + 0x14]
mov edx, ecx
shl edx, 0x1c
shr esi, 4
shr ecx, 4
or edx, esi
or ecx, 0x10000000
pop esi
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], ecx
pop ebp
mov eax, 1
pop ebx
ret

Function at 0x48d600
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48eb18
push 0x48d7b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
push 1
call dword [sym.imp.MSVCRT.dll___set_app_type]
pop ecx
or dword [0x4b7964], 0xffffffff
or dword [0x4b7968], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x4b6ecc]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x4b6ec8]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x4b796c], eax
call fcn.0048d811
cmp dword [0x4a56a0], 0
jne 0x48d683
push 0x48d80e
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.0048d7fc
push 0x49100c
push 0x491008
call sub.MSVCRT.dll__initterm
mov eax, dword [0x4b6ec4]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x4b6ec0]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
push 0x491004
push section..data
call sub.MSVCRT.dll__initterm
call dword [sym.imp.MSVCRT.dll___p___initenv]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
push dword [ebp - 0x20]
push dword [ebp - 0x2c]
push dword [ebp - 0x1c]
call fcn.0048d820
add esp, 0x30
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x30], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret
Function at 0x40a940
Capabilities:
Execute shellcode via indirect call

Disassembly:
mov ecx, dword [0x4287d8]
test ecx, ecx
je 0x40a989
mov edx, dword [0x4287d4]
test edx, edx
jne 0x40a989
push ebx
mov ebx, eax
sub esp, 8
mov edx, dword [eax + 4]
cmp edx, 0x42605c
je 0x40a96f
mov ecx, dword [0x428a64]
test ecx, ecx
je 0x40a990
and ebx, 0xfffff000
cmp eax, 0x428280
je 0x40a985
mov eax, dword [0x428a64]
test eax, eax
je 0x40a9d0
add esp, 8
pop ebx
repz ret
mov eax, edx
xor ecx, ecx
mov edx, 1
and eax, 0xfffff000
call fcn.00413410
cmp ebx, 0x428280
je 0x40a985
mov edx, dword [0x4287d8]
test edx, edx
je 0x40a985
and ebx, 0xfffff000
cmp dword [0x4287d4], 0
jne 0x40a985
jmp 0x40a97c
add esp, 8
mov eax, ebx
xor ecx, ecx
pop ebx
mov edx, 1
jmp fcn.00413410
Function at 0x40dfe0
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
test eax, eax
mov dword [esp + 0x18], edx
je 0x40e0b0
mov esi, eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov ebx, dword [esp + 0x18]
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov byte [esp + 0x24], 0xa
test ebx, ebx
lea edi, [eax + 0x40]
jle 0x40e055
lea esi, [esi]
mov dword [esp + 8], ebx
mov dword [esp], esi
mov dword [esp + 0xc], edi
mov dword [esp + 4], 1
call sub.msvcrt.dll_fwrite
sub ebx, eax
add esi, eax
test ebx, ebx
jg 0x40e030
mov eax, dword [sym.imp.msvcrt.dll__iob]
lea edi, [eax + 0x40]
lea esi, [esp + 0x24]
mov ebx, 1
jmp 0x40e070
mov dword [esp + 8], ebx
mov dword [esp], esi
mov dword [esp + 0xc], edi
mov dword [esp + 4], 1
call sub.msvcrt.dll_fwrite
sub ebx, eax
add esi, eax
test ebx, ebx
jg 0x40e070
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fflush
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov eax, str.eprintln_NIL_
mov edx, 0xd
mov ecx, 1
mov dword [esp + 0x24], str.eprintln_NIL_
mov dword [esp + 0x28], 0xd
mov dword [esp + 0x2c], 1
call fcn.0040dfe0
add esp, 0x30
pop ebx
pop esi
pop edi
ret

Function at 0x40e2d0
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
mov esi, str.V_panic:
push ebx
mov ebx, 9
add esp, 0xffffff80
mov dword [esp + 0x14], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
add eax, 0x20
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov eax, dword [sym.imp.msvcrt.dll__iob]
lea edi, [eax + 0x40]
lea esi, [esi]
lea edi, [edi]
mov dword [esp + 8], ebx
mov dword [esp], esi
mov dword [esp + 0xc], edi
mov dword [esp + 4], 1
call sub.msvcrt.dll_fwrite
sub ebx, eax
add esi, eax
test ebx, ebx
jg 0x40e320
mov eax, dword [sym.imp.msvcrt.dll__iob]
lea edi, [esp + 0x40]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
call fcn.0040dfe0
xor eax, eax
mov ecx, 0x10
lea edx, [esp + 0x40]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x28]
mov dword [esp + 0x40], str.v_hash:
mov dword [esp + 0x44], 8
mov dword [esp + 0x48], 1
mov dword [esp + 0x4c], 0xfe10
mov dword [esp + 0x50], str.f33b712
mov dword [esp + 0x54], 7
mov dword [esp + 0x58], 1
mov dword [esp + 0x60], 0x422b25
mov dword [esp + 0x68], 1
call fcn.00419690
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
call fcn.0040dfe0
mov eax, str.print_backtrace_skipping_top_frames_is_not_implemented
mov edx, 0x36
mov ecx, 1
call fcn.0040dfe0
mov dword [esp], 1
call sub.msvcrt.dll_exit
lea esi, [esi]
lea edi, [edi]
Function at 0x40fdc0
Capabilities:
Query environment variable

Disassembly:
push ebx
sub esp, 0x148
lea ebx, [esp + 0x2c]
mov dword [esp + 8], 0x105
mov dword [esp], str.GC_LOG_FILE
mov dword [esp + 4], ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
sub eax, 1
sub esp, 0xc
cmp eax, 0x103
ja 0x40fe80
cmp dword [0x428a70], 2
mov edx, 0x80000080
mov eax, pe_nt_image_headers32
mov dword [esp], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x40000000
cmovne eax, edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
cmp eax, 0xffffffff
mov ebx, eax
je 0x40fe74
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0
mov dword [esp + 0xc], 2
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub esp, 0x10
add esp, 0x148
mov eax, ebx
pop ebx
ret
mov dword [esp + 8], 0x105
mov dword [esp + 4], ebx
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
sub esp, 0xc
cmp eax, 4
jg 0x40ff10
add eax, ebx
cmp dword [0x428a70], 2
mov dword [eax], 0x2e63672e
mov dword [eax + 4], 0x676f6c
jne 0x40ff1d
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp], ebx
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x40000000
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
mov ebx, eax
add esp, 0x148
mov eax, ebx
pop ebx
ret
cmp byte [esp + eax + 0x28], 0x2e
lea edx, [eax - 4]
cmove eax, edx
jmp 0x40fea1
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80000080
jmp 0x40fec9

Function at 0x40ff30
Capabilities:
Write file on windows

Disassembly:
test edx, edx
je 0x40ffa0
push esi
push ebx
mov esi, eax
mov ebx, edx
sub esp, 0x44
mov eax, dword [0x4287b4]
test eax, eax
jne 0x40ffe0
mov eax, dword [0x4281a4]
test eax, eax
je 0x410020
cmp eax, 0xffffffff
je 0x40ffb0
lea edx, [esp + 0x3c]
mov dword [esp + 0x10], 0
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], eax
mov dword [esp + 0xc], edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [0x4287b4]
sub esp, 0x14
test edx, edx
jne 0x410000
test eax, eax
je 0x40ffca
mov eax, dword [esp + 0x3c]
add esp, 0x44
pop ebx
pop esi
ret
xor eax, eax
ret
mov ecx, dword [0x4287b4]
test ecx, ecx
je 0x40ffca
mov dword [esp], 0x428224
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x44
mov eax, 0xffffffff
pop ebx
pop esi
ret
mov dword [esp], 0x428224
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub esp, 4
jmp 0x40ff4a
mov dword [esp + 0x2c], eax
mov dword [esp], 0x428224
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
mov eax, dword [esp + 0x2c]
jmp 0x40ff8a
call fcn.0040fdc0
mov dword [0x4281a4], eax
jmp 0x40ff57
Function at 0x410030
Capabilities:
Query environment variable

Disassembly:
push ebx
sub esp, 0x18
mov dword [0x4281a8], 1
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x41008e
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.Fatal_error_in_GC
mov dword [esp + 4], ebx
mov dword [esp], 0
call dword [sym.imp.USER32.dll_MessageBoxA]
sub esp, 0x10
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov edx, eax
mov eax, ebx
call fcn.0040ff30
test eax, eax
js 0x41008e
mov edx, 1
mov eax, 0x4231a2
call fcn.0040ff30
mov dword [esp], str.GC_LOOP_ON_ABORT
call sub.msvcrt.dll_getenv
test eax, eax
je 0x4100a0
jmp 0x41009e
add esp, 0x18
pop ebx
ret

Function at 0x4100b0
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [0x4281ac]
test eax, eax
je 0x4100c0
ret
push ebx
sub esp, 0x78
mov dword [esp], str.GC_USE_GETWRITEWATCH
call sub.msvcrt.dll_getenv
test eax, eax
je 0x4100dd
cmp byte [eax], 0x30
je 0x4101c0
mov dword [esp], 0x4231ca
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
sub esp, 4
test eax, eax
je 0x4101b0
mov dword [esp + 4], str.GetWriteWatch
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
sub esp, 8
test eax, eax
mov dword [0x428a64], eax
je 0x4101b0
mov eax, dword [0x4281e8]
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0x202000
mov dword [esp], 0
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
sub esp, 0x10
test eax, eax
mov ebx, eax
je 0x4101e0
lea eax, [esp + 0x2c]
mov dword [esp + 0x28], 0x10
mov dword [esp + 4], ebx
mov dword [esp], 1
mov dword [esp + 0x14], eax
lea eax, [esp + 0x28]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x30]
mov dword [esp + 0xc], eax
mov eax, dword [0x4281e8]
mov dword [esp + 8], eax
call dword [0x428a64]
sub esp, 0x18
test eax, eax
je 0x4101d0
mov dword [0x428a64], 0
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
sub esp, 0xc
mov dword [0x4281ac], 1
add esp, 0x78
pop ebx
ret
cmp byte [eax + 1], 0
jne 0x4100dd
jmp 0x4101b0
mov dword [0x428a68], 0x200000
jmp 0x410194
mov dword [0x428a64], 0
jmp 0x4101b0
Function at 0x413410
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
push edi
mov edi, eax
push esi
push ebx
shl edx, 0xc
sub esp, 0x2c
mov esi, dword [0x4281e8]
mov ebx, esi
neg ebx
and edi, ebx
mov ebp, edi
mov dword [esp + 0x1c], edi
lea edi, [eax + edx]
lea esi, [esi + edi - 1]
and esi, ebx
test ecx, ecx
sete byte [esp + 0x1b]
cmp ebp, esi
jae 0x41349d
mov edx, ebp
mov dword [esp + 0x14], eax
mov ebp, 1
jmp 0x413461
cmp byte [esp + 0x1b], 0
jne 0x413471
add edx, 0x1000
cmp edx, esi
jae 0x41349d
cmp dword [esp + 0x14], edx
seta bl
cmp edi, edx
setbe cl
or bl, cl
je 0x413450
mov ecx, edx
mov eax, ebp
shr ecx, 0xc
mov ebx, ecx
shl eax, cl
and ebx, 0x3ffff
shr ebx, 5
lea ebx, [ebx*4 + 0xc1f0]
lock or dword [ebx + 0x428a80], eax
add edx, 0x1000
cmp edx, esi
jb 0x413461
cmp dword [0x421828], 1
mov dword [esp + 0xc], 0x428264
sbb eax, eax
and eax, 0xffffffc4
add eax, 0x40
mov dword [esp + 8], eax
mov eax, dword [esp + 0x1c]
sub esi, eax
mov dword [esp], eax
mov dword [esp + 4], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x4134e0
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.un_VirtualProtect_failed:_errcode_0x_X_n
mov dword [esp + 4], eax
call fcn.004101f0
mov dword [esp], str.un_VirtualProtect_failed
call fcn.00410030
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_DebugBreak]
Function at 0x413520
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x428260]
test eax, eax
jne 0x4136c0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, eax
shr edx, 8
xor edx, eax
movzx edx, dl
mov edx, dword [edx*4 + 0x4282c0]
test edx, edx
je 0x41361a
cmp eax, dword [edx + 8]
jne 0x413610
mov edi, dword [edx + 4]
movzx ecx, byte [edi + 0x10]
test cl, cl
je 0x413585
movzx eax, word [edi + 0x12]
add eax, 1
mov word [edi + 0x12], ax
movzx eax, ax
shr eax, cl
test eax, eax
je 0x4136c0
xor eax, eax
mov word [edi + 0x12], ax
mov eax, dword [0x4287b4]
add ecx, 1
mov byte [edi + 0x10], cl
test eax, eax
jne 0x4136a0
xor esi, esi
xor ebx, ebx
jmp 0x4135eb
mov ebp, dword [0x428b30]
test ebx, ebx
cmove esi, dword [0x428ab0]
test ebp, ebp
je 0x413650
mov edx, dword [ebp + 4]
mov dword [0x428b30], edx
mov ecx, dword [0x4287b4]
test ecx, ecx
jne 0x413630
mov edx, dword [ebp + 0xc]
mov dword [ebp + 4], 0
add ebx, 1
mov dword [esp + 4], edx
mov edx, dword [ebp]
mov dword [esp], edx
call dword [ebp + 8]
mov dword [ebp + 0xc], 0
mov eax, dword [0x428b30]
test eax, eax
je 0x41366a
mov eax, dword [0x4287b4]
test eax, eax
je 0x4135a0
mov dword [esp], 0x42879c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub esp, 4
jmp 0x4135a0
mov edx, dword [edx]
test edx, edx
jne 0x413553
mov eax, dword [4]
ud2
mov dword [esp], 0x42879c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
jmp 0x4135ca
mov ebp, dword [0x4287b4]
test ebp, ebp
je 0x41366a
mov dword [esp], 0x42879c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
test ebx, ebx
je 0x413689
mov eax, dword [0x428ab0]
cmp eax, esi
je 0x413689
mov edx, dword [0x4287b4]
test edx, edx
jne 0x4136e0
sub eax, esi
add dword [0x428ab4], eax
mov byte [edi + 0x10], 0
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0x42879c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
jmp 0x413598
mov eax, dword [0x4287b4]
test eax, eax
je 0x41368d
mov dword [esp], 0x42879c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
jmp 0x41368d
mov dword [esp], 0x42879c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x428ab4]
sub esp, 4
sub eax, esi
add eax, dword [0x428ab0]
mov dword [0x428ab4], eax
mov eax, dword [0x4287b4]
test eax, eax
je 0x413689
mov dword [esp], 0x42879c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
jmp 0x413689
Function at 0x414450
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [0x428b30]
test eax, eax
je 0x4144cd
mov eax, dword [0x4287b4]
test eax, eax
jne 0x414470
mov eax, dword [0x428b30]
test eax, eax
je 0x4144a0
jmp fcn.00413520
sub esp, 0x1c
mov dword [esp], 0x42879c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x428b30]
sub esp, 4
test ecx, ecx
je 0x4144b0
add esp, 0x1c
jmp fcn.00413520
repz ret
mov edx, dword [0x4287b4]
test edx, edx
je 0x4144ca
mov dword [esp], 0x42879c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
repz ret

Function at 0x415260
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push esi
push ebx
sub esp, 0x14
cmp eax, 0xfffffff7
mov ebx, dword [0x428ac0]
ja 0x415410
lea esi, [eax + 7]
mov eax, dword [0x428ac8]
and esi, 0xfffffff8
sub eax, ebx
cmp eax, esi
jae 0x415345
cmp esi, 0xffff
ja 0x4153dd
mov ecx, dword [0x428a6c]
test ecx, ecx
jne 0x415360
cmp dword [0x421828], 1
mov eax, dword [0x428a68]
mov dword [esp], 0
sbb edx, edx
or ah, 0x30
and edx, 0xffffffc4
mov dword [esp + 8], eax
xor eax, eax
add edx, 0x40
mov dword [esp + 0xc], edx
mov edx, dword [0x428a64]
test edx, edx
sete al
add eax, 0x10000
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
sub esp, 0x10
test ebx, 0xfff
jne 0x415390
cmp dword [0x428b0c], 0x1ff
ja 0x4153b2
test ebx, ebx
je 0x4153cc
mov edx, dword [0x428b0c]
add dword [0x428aa0], 0x10000
cmp dword [0x428a70], 2
lea eax, [edx + 1]
mov dword [edx*4 + 0x43cc74], ebx
mov dword [0x428b0c], eax
je 0x4153f0
lea eax, [ebx + 0x10000]
mov dword [0x428ac8], eax
add esi, ebx
mov eax, ebx
mov dword [0x428ac0], esi
add esp, 0x14
pop ebx
pop esi
ret
mov dword [esp + 4], 0x11000
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea ebx, [eax + 0xfff]
sub esp, 8
and ebx, 0xfffff000
test ebx, 0xfff
je 0x4152f6
mov dword [esp], 0x423cbf
call fcn.00410030
call dword [sym.imp.KERNEL32.dll_DebugBreak]
cmp dword [0x428b0c], 0x1ff
jbe 0x415306
mov dword [esp], 0x423cd7
call fcn.00410030
call dword [sym.imp.KERNEL32.dll_DebugBreak]
test ebx, ebx
jne 0x41530e
mov dword [esp + 4], esi
mov dword [esp], 0x423d08
call dword [0x42182c]
add esp, 0x14
mov eax, esi
pop ebx
pop esi
jmp fcn.00413a00
mov dword [esp + 4], 0x10000
mov dword [esp], 0x423cee
call fcn.004101f0
jmp 0x41533a
mov eax, dword [0x428ac8]
mov esi, 0xfffffff8
sub eax, ebx
cmp eax, 0xfffffff7
ja 0x415345
jmp 0x4153dd
Function at 0x41a980
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
mov esi, str.double_string.free___detected_n
push ebx
mov ebx, 0x1e
sub esp, 0x10
mov eax, dword [sym.imp.msvcrt.dll__iob]
lea edi, [eax + 0x20]
nop
lea esi, [esi]
mov dword [esp + 8], ebx
mov dword [esp], esi
mov dword [esp + 0xc], edi
mov dword [esp + 4], 1
call sub.msvcrt.dll_fwrite
sub ebx, eax
add esi, eax
test ebx, ebx
jg 0x41a9a0
add esp, 0x10
pop ebx
pop esi
pop edi
ret

Function at 0x41a9d0
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
mov esi, str.println_NIL_
push ebx
mov ebx, 0xc
sub esp, 0x20
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov byte [esp + 0x1f], 0xa
lea edi, [eax + 0x20]
lea esi, [esi]
mov dword [esp + 8], ebx
mov dword [esp], esi
mov dword [esp + 0xc], edi
mov dword [esp + 4], 1
call sub.msvcrt.dll_fwrite
sub ebx, eax
add esi, eax
test ebx, ebx
jg 0x41a9f0
mov eax, dword [sym.imp.msvcrt.dll__iob]
lea esi, [esp + 0x1f]
mov ebx, 1
lea edi, [eax + 0x20]
jmp 0x41aa30
mov dword [esp + 8], ebx
mov dword [esp], esi
mov dword [esp + 0xc], edi
mov dword [esp + 4], 1
call sub.msvcrt.dll_fwrite
sub ebx, eax
add esi, eax
test ebx, ebx
jg 0x41aa30
add esp, 0x20
pop ebx
pop esi
pop edi
ret

Function at 0x41ac90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [0x428ac0]
mov eax, dword [0x428ac8]
sub eax, ebx
cmp eax, 0x7fff
ja 0x41ad39
mov ecx, dword [0x428a6c]
test ecx, ecx
je 0x41ad50
mov dword [esp + 4], 0x11000
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea ebx, [eax + 0xfff]
sub esp, 8
and ebx, 0xfffff000
test ebx, 0xfff
jne 0x41ada3
cmp dword [0x428b0c], 0x1ff
ja 0x41adc5
test ebx, ebx
je 0x41addf
mov eax, dword [0x428b0c]
add dword [0x428aa0], 0x10000
cmp dword [0x428a70], 2
lea edx, [eax + 1]
mov dword [eax*4 + 0x43cc74], ebx
mov dword [0x428b0c], edx
je 0x41ae10
lea eax, [ebx + 0x10000]
mov dword [0x428ac8], eax
lea eax, [ebx + 0x8000]
mov dword [0x428ac0], eax
add esp, 0x18
mov eax, ebx
pop ebx
ret
cmp dword [0x421828], 1
mov edx, dword [0x428a64]
mov dword [esp], 0
sbb eax, eax
and eax, 0xffffffc4
add eax, 0x40
mov dword [esp + 0xc], eax
mov eax, dword [0x428a68]
or ah, 0x30
mov dword [esp + 8], eax
xor eax, eax
test edx, edx
sete al
add eax, 0x10000
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
sub esp, 0x10
test ebx, 0xfff
je 0x41acea
mov dword [esp], str.Bad_VirtualAlloc_result
call fcn.00410030
call dword [sym.imp.KERNEL32.dll_DebugBreak]
cmp dword [0x428b0c], 0x1ff
jbe 0x41acfa
mov dword [esp], str.Too_many_heap_sections
call fcn.00410030
call dword [sym.imp.KERNEL32.dll_DebugBreak]
test ebx, ebx
jne 0x41ad02
mov dword [esp + 4], 0x8000
mov dword [esp], str.GC_Warning:_Out_of_memory___trying_to_allocate_requested_amount___lu_bytes_..._n
call dword [0x42182c]
add esp, 0x18
mov eax, 0x8000
pop ebx
jmp fcn.00413a00
mov dword [esp + 4], 0x10000
mov dword [esp], str.Got__lu_bytes_from_OS_n
call fcn.004101f0
jmp 0x41ad2e
Function at 0x41ae30
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [0x428ac0]
mov eax, dword [0x428ac8]
sub eax, ebx
cmp eax, 0x100f
ja 0x41aed9
mov ecx, dword [0x428a6c]
test ecx, ecx
je 0x41aef0
mov dword [esp + 4], 0x11000
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea ebx, [eax + 0xfff]
sub esp, 8
and ebx, 0xfffff000
test ebx, 0xfff
jne 0x41af43
cmp dword [0x428b0c], 0x1ff
ja 0x41af65
test ebx, ebx
je 0x41af7f
mov eax, dword [0x428b0c]
add dword [0x428aa0], 0x10000
cmp dword [0x428a70], 2
lea edx, [eax + 1]
mov dword [eax*4 + 0x43cc74], ebx
mov dword [0x428b0c], edx
je 0x41afb0
lea eax, [ebx + 0x10000]
mov dword [0x428ac8], eax
lea eax, [ebx + 0x1010]
mov dword [0x428ac0], eax
add esp, 0x18
mov eax, ebx
pop ebx
ret
cmp dword [0x421828], 1
mov edx, dword [0x428a64]
mov dword [esp], 0
sbb eax, eax
and eax, 0xffffffc4
add eax, 0x40
mov dword [esp + 0xc], eax
mov eax, dword [0x428a68]
or ah, 0x30
mov dword [esp + 8], eax
xor eax, eax
test edx, edx
sete al
add eax, 0x10000
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
sub esp, 0x10
test ebx, 0xfff
je 0x41ae8a
mov dword [esp], str.Bad_VirtualAlloc_result
call fcn.00410030
call dword [sym.imp.KERNEL32.dll_DebugBreak]
cmp dword [0x428b0c], 0x1ff
jbe 0x41ae9a
mov dword [esp], str.Too_many_heap_sections
call fcn.00410030
call dword [sym.imp.KERNEL32.dll_DebugBreak]
test ebx, ebx
jne 0x41aea2
mov dword [esp + 4], 0x1010
mov dword [esp], str.GC_Warning:_Out_of_memory___trying_to_allocate_requested_amount___lu_bytes_..._n
call dword [0x42182c]
add esp, 0x18
mov eax, 0x1010
pop ebx
jmp fcn.00413a00
mov dword [esp + 4], 0x10000
mov dword [esp], str.Got__lu_bytes_from_OS_n
call fcn.004101f0
jmp 0x41aece

Function at 0x41b8e0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.0041b940