joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408029
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push dword [ebp + 8]
call fcn.00404c69
lea ecx, [ebp - 4]
push ecx
push eax
call fcn.00404c76
add esp, 0xc
test eax, eax
je 0x408066
mov eax, dword [ebp - 4]
push 5
push 0x40de80
add eax, 0x305
push 0
push eax
push str.open
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
leave
ret

Function at 0x40809a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
push dword [ebp + 8]
call fcn.00404c69
lea ecx, [ebp - 4]
push ecx
push eax
call fcn.00404c76
add esp, 0xc
test eax, eax
je 0x408109
mov eax, dword [ebp - 4]
cmp dword [eax + 0xa18], 0
je 0x408109
push 0xc
call fcn.00404117
push eax
push dword [ebp + 8]
call fcn.004013c0
add esp, 0xc
cmp eax, 6
jne 0x408109
push 2
lea eax, [ebp - 0x314]
push 0
push eax
push dword [ebp - 4]
call fcn.004053fd
add esp, 0x10
test eax, eax
je 0x408109
lea eax, [ebp - 0x314]
push 5
push eax
call dword [sym.imp.KERNEL32.DLL_WinExec]
leave
ret

Function at 0x40810b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
push dword [ebp + 8]
call fcn.00404c69
cmp dword [eax + 0x254], 0
pop ecx
je 0x408135
push 0x9c45
push eax
call fcn.00406b6d
pop ecx
pop ecx
leave
ret
lea ecx, [ebp + 8]
push ecx
push eax
call fcn.00404c76
pop ecx
test eax, eax
pop ecx
je 0x408178
mov eax, dword [ebp + 8]
cmp dword [eax + 0xa10], 0
jne 0x408178
push 1
lea ecx, [ebp - 0x310]
push 0
push ecx
push eax
call fcn.004053fd
add esp, 0x10
test eax, eax
je 0x408178
lea eax, [ebp - 0x310]
push 5
push eax
call dword [sym.imp.KERNEL32.DLL_WinExec]
leave
ret

Function at 0x40846c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov al, byte [0x40de80]
push edi
push 0x41
mov byte [ebp - 0x108], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x108]
push eax
call fcn.00402ece
lea eax, [ebp - 0x108]
mov dword [esp], 0x40d94c
push eax
call fcn.0040337f
pop ecx
lea eax, [ebp - 0x108]
pop ecx
push 5
push 0x40de80
push 0
push eax
push str.open
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
leave
ret

Function at 0x4091b5
Capabilities:
Set registry value

Disassembly:
push dword [esp + 0xc]
call sub.MSVCRT.dll_strlen
pop ecx
inc eax
push eax
push dword [esp + 0x10]
push 1
push 0
push dword [esp + 0x18]
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret

Function at 0x4091d8
Capabilities:
Set registry value

Disassembly:
lea eax, [esp + 0xc]
push 4
push eax
push 4
push 0
push dword [esp + 0x18]
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret

Function at 0x40944a
Capabilities:
Create process on windows

Disassembly:
push 5
push str.regedit.exe
call dword [sym.imp.KERNEL32.DLL_WinExec]
push 0x1f
pop ecx
cmp ecx, eax
sbb eax, eax
neg eax
ret
Function at 0x409b05
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
push esi
call fcn.00409a34
cmp dword [0x40ef04], 0
mov esi, dword [ebp + 0xc]
je 0x409b47
call fcn.00402fee
test eax, eax
je 0x409b34
push esi
call fcn.00409a63
test eax, eax
pop ecx
jne 0x409b47
push 0
push esi
push dword [ebp + 8]
push 0
call dword [0x40ef04]
jmp 0x409bdc
mov al, byte [0x40de80]
push edi
push 0x40
mov byte [ebp - 0x124], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x123]
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00409a63
pop ecx
pop edi
test eax, eax
lea eax, [ebp + 0xc]
push 0x20019
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
je 0x409b84
push CreateStatusWindowA
jmp 0x409b89
push 0x80000001
call fcn.004090c4
add esp, 0x10
test eax, eax
jne 0x409bc3
lea eax, [ebp - 0x20]
push eax
push esi
call fcn.00409a7d
lea eax, [ebp - 0x124]
push 0x104
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0xc]
call fcn.0040912a
add esp, 0x18
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x124]
push eax
push esi
call sub.MSVCRT.dll_strcpy
xor eax, eax
pop ecx
cmp byte [esi], al
pop ecx
setne al
pop esi
leave
ret

Function at 0x409bdf
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push edi
push 0xe
pop ecx
xor eax, eax
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x24], 0
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x38], 0xc
mov dword [ebp - 0x30], str.properties
mov dword [ebp - 0x28], 0x40de80
mov dword [ebp - 0x20], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
pop edi
leave
ret
Function at 0x409ead
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push ebx
push esi
lea eax, [ebp - 0x20]
push edi
push eax
xor ebx, ebx
push dword [ebp + 8]
mov dword [ebp - 0x20], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
cmp eax, ebx
mov dword [ebp - 4], eax
jbe 0x40a062
mov esi, dword [ebp + 0xc]
push 0x810
push ebx
push esi
call sub.MSVCRT.dll_memset
push dword [ebp - 4]
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 0x10
mov edi, eax
push edi
push dword [ebp - 4]
push ebx
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0xc]
push eax
push 0x40d278
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x409f43
mov eax, dword [ebp + 0xc]
cmp dword [ebp + 0x10], ebx
mov ecx, dword [eax + 0x30]
mov dword [esi + 4], ecx
mov ecx, dword [eax + 8]
mov dword [esi], ecx
mov ecx, dword [eax + 0x14]
mov dword [esi + 0xc], ecx
mov eax, dword [eax + 0x10]
mov dword [esi + 8], eax
je 0x409f4b
push 1
push edi
call fcn.00409e80
pop ecx
pop ecx
jmp 0x40a064
cmp dword [ebp + 0x10], ebx
je 0x409f4b
push ebx
jmp 0x409f36
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x1c]
push eax
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x409f9a
mov eax, dword [ebp - 0x1c]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
push ecx
push eax
lea eax, [ebp - 0x18]
push str._4.4X_4.4X
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x18]
push 0x40de80
push eax
push edi
call fcn.00409dea
add esp, 0x20
test eax, eax
jne 0x409faa
lea eax, [ebp - 0x18]
push str.040904E4
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
lea eax, [esi + 0x10]
push eax
lea eax, [ebp - 0x18]
push str.ProductName
push eax
push edi
call fcn.00409dea
lea eax, [esi + 0x110]
push eax
lea eax, [ebp - 0x18]
push str.FileDescription
push eax
push edi
call fcn.00409dea
lea eax, [esi + 0x210]
push eax
lea eax, [ebp - 0x18]
push str.FileVersion
push eax
push edi
call fcn.00409dea
lea eax, [esi + 0x310]
push eax
lea eax, [ebp - 0x18]
push str.ProductVersion
push eax
push edi
call fcn.00409dea
add esp, 0x40
lea eax, [esi + 0x410]
push eax
lea eax, [ebp - 0x18]
push str.CompanyName
push eax
push edi
call fcn.00409dea
lea eax, [esi + 0x510]
push eax
lea eax, [ebp - 0x18]
push str.InternalName
push eax
push edi
call fcn.00409dea
lea eax, [esi + 0x610]
push eax
lea eax, [ebp - 0x18]
push str.LegalCopyright
push eax
push edi
call fcn.00409dea
add esi, 0x710
lea eax, [ebp - 0x18]
push esi
push str.OriginalFileName
push eax
push edi
call fcn.00409dea
add esp, 0x40
jmp 0x409f34
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x412806
Capabilities:
Encode data using xor

Disassembly:
fiadd dword [eax + eax]
fcomp st(2)
add al, 0
rcr dl, 4
add byte [edx], ch
fiadd word [eax + eax]
add byte [eax], al
add byte [eax], al
sbb al, 0xda
add al, 0
add bl, dl
add al, 0
add byte [eax], al
add byte [eax], al
pop ss
add byte [eax], al
adc byte [esi], 0
add byte [eax - 0x7fffffec], al
add byte [eax], al
add byte [eax], al
dec esp
fiadd dword [eax + eax]
lcall 0x4da, 0x8c0004da
add byte [esi - 0x26], dh
add al, 0
fiadd dword [eax + eax]
pop eax
fiadd dword [eax + eax]
add byte [eax], al
add byte [eax], al
and ah, dh
add al, 0
inc edx
out 4, al
add byte [edx - 0x1a], dl
add al, 0
push 0x780004e6
out 4, al
add byte [esi - 0x5ffffb1a], al
out 4, al
add byte [eax - 0x39fffb1a], bh
out 4, al
add dh, dl
out 4, al
add ah, ah
out 4, al
add byte [eax], dh
out 4, al
add byte [eax], cl
out 4, eax
add byte [edi], bl
add al, 0
xor bh, ah
add al, 0
inc esp
out 4, eax
add byte [edi + 4], dl
add byte [esi - 0x19], ah
add al, 0
jp 0x412882
add al, 0
mov bh, ah
add al, 0
lcall 0x4e7, 0xae0004e7
add byte [edx - 0x37fffb19], bh
out 4, eax
add dh, dl
out 4, eax
add ah, ah
out 4, eax
add ah, dh
out 4, eax
add byte [eax + ebp*8], cl
add al, 0
and al, 0xe8
add al, 0
aam 0xea
add al, 0
out 0xea, al
add al, 0
imul dl
add al, 0
or bl, ch
add al, 0
sbb bl, ch
add al, 0
sub bl, ch
add al, 0
notrack jmp 0x4128e4
add byte [eax], al
fadd dword [eax + eax]
dec esi
fiadd word [eax + eax]
pushal
fiadd word [eax + eax]
jle 0x4128d1
add al, 0
xchg edx, eax
fiadd word [eax + eax]
lcall 0x4de, 0xac0004de
add byte [edx - 0x39fffb22], bh
fiadd word [eax + eax]
salc
fiadd word [eax + eax]
in al, dx
fiadd word [eax + eax]
add bl, bh
add al, 0
sbb al, 0xdf
add al, 0
fild word ss:[eax + eax]
dec eax
fild word [eax + eax]
pop edx
fild word [eax + eax]
push 0x7a0004df
fild word [eax + eax]
xchg edx, eax
fild word [eax + eax]
mov al, byte [0xac0004df]
fild word [eax + eax]
mov edx, 0xc40004df
fild word [eax + eax]
invalid
Function at 0x41de03
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push edi
push dword [esi + 0x144]
lea ebx, [esi + 0x78]
push dword [esi + 0x20]
lea eax, [esi + 0x1f0]
push ebx
push eax
mov dword [ebp - 8], 1
call fcn.0042dadb
mov edi, eax
test edi, edi
jns 0x41de40
push 0x43bb08
jmp 0x41dfc0
lea eax, [esi + 0xe8]
push ebx
push eax
call fcn.00432bd5
mov edi, eax
test edi, edi
jns 0x41de5d
push 0x43bad4
jmp 0x41dfc0
cmp dword [esi + 0x268], 1
jne 0x41deb1
lea eax, [ebp - 4]
push eax
push 1
lea ebx, [esi + 0x274]
push ebx
call fcn.0041eea1
mov edi, eax
test edi, edi
jns 0x41de88
push 0x43ba96
jmp 0x41dfc0
push ebx
call fcn.0041f0bd
mov edi, eax
test edi, edi
jns 0x41de9e
push 0x43ba68
jmp 0x41dfc0
cmp dword [ebp - 4], 0
je 0x41deb1
push dword [ebp - 4]
call dword [fcn.00401270]
and dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
lea eax, [esi + 0xe4]
push eax
push dword [esi + 0x144]
lea eax, [esi + 0x9c]
push dword [esi + 0x20]
lea ebx, [esi + 0x78]
push eax
push ebx
call fcn.00431ea5
mov edi, eax
xor eax, eax
cmp edi, eax
jge 0x41dee7
push 0x43ba46
jmp 0x41dfc0
cmp dword [ebp - 8], eax
jne 0x41deff
push 0xe0000035
push 1
call fcn.0041daab
xor edi, edi
jmp 0x41dfc6
cmp dword [esi + 0xa8], eax
je 0x41df1a
cmp dword [esi + 0x20], 2
jle 0x41df1a
lea ecx, [esi + 0x34]
push ecx
push eax
push dword [ebp + 8]
call fcn.00430e8d
push esi
push dword [ebp + 8]
call fcn.0042d1eb
mov edi, eax
test edi, edi
jns 0x41df33
push 0x43b7c4
jmp 0x41dfc0
push esi
call fcn.00428843
mov edi, eax
test edi, edi
jns 0x41df46
push 0x43ba28
jmp 0x41dfc0
push ebx
push dword [esi + 0x1c]
call fcn.0042ed31
mov edi, eax
test edi, edi
jns 0x41df5c
push 0x43ba08
jmp 0x41dfc0
push ebx
lea eax, [esi + 0xe8]
push eax
call fcn.004234f5
mov edi, eax
test edi, edi
jns 0x41df76
push 0x43b9e2
jmp 0x41dfc0
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x41df9e
cmp word [eax], 0
je 0x41df9e
push 0
push eax
push 0x402658
push ebx
call fcn.0042717f
mov edi, eax
test edi, edi
jns 0x41df9e
push 0x43b994
jmp 0x41dfc0
and dword [ebp + 8], 0
lea eax, [ebp + 8]
push eax
mov eax, esi
call fcn.0041dcad
mov edi, eax
test edi, edi
js 0x41dfbb
cmp dword [ebp + 8], 0
jne 0x41df9e
jmp 0x41dfc8
push 0x43b97e
push edi
call fcn.00442c2b
pop ecx
pop ecx
push esi
call fcn.0042cf13
lea eax, [esi + 0x78]
push eax
call fcn.00427f87
cmp dword [esi + 0x284], 0xffffffff
je 0x41e003
cmp dword [esi + 0x268], 1
jne 0x41dfee
mov eax, dword [esi + 0x18]
jmp 0x41dff0
xor eax, eax
push eax
push dword [esi + 0xe4]
lea eax, [esi + 0x274]
push eax
call fcn.0041f3ab
push dword [esi + 0x34]
call dword [fcn.00401358]
test eax, eax
je 0x41e01f
push 0
push 0
push 0x10
push dword [esi + 0x34]
call dword [fcn.0040135c]
cmp dword [ebp - 4], 0
je 0x41e02e
push dword [ebp - 4]
call dword [fcn.00401270]
mov eax, edi
pop edi
pop ebx
leave
ret 4
Function at 0x401010
Capabilities:
Get geographical location

Disassembly:
push 0xffffffffffffffff
push 0x432de3
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4423f0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x24]
mov ecx, ebp
call fcn.00404991
mov dword [esp + 0x1c], 0
mov dword [ebp], vtable.CCustomEdit.0
lea esi, [ebp + 0x54]
call fcn.00409ab7
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40106b
push 0x80004005
call fcn.00401660
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi], eax
push 0
push 0
push 0xe
mov byte [esp + 0x28], 1
mov ebx, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x400
call ebx
mov edi, eax
mov eax, dword [esi]
mov edx, dword [eax - 8]
sub eax, 0x10
mov ecx, 1
sub ecx, dword [eax + 0xc]
sub edx, edi
or ecx, edx
jge 0x4010b1
push edi
mov ecx, esi
call fcn.00401740
mov eax, dword [esi]
push edi
push eax
push 0xe
push 0x400
call ebx
mov ecx, dword [esi]
test ecx, ecx
jne 0x4010c8
xor eax, eax
jmp 0x4010dd
mov eax, ecx
lea edi, [eax + 1]
lea ecx, [ecx]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x4010d0
sub eax, edi
js 0x401103
cmp eax, dword [ecx - 8]
jg 0x401103
mov dword [ecx - 0xc], eax
mov ecx, dword [esi]
mov byte [eax + ecx], 0
mov eax, ebp
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
push 0x80070057
call fcn.00401660
int3

Function at 0x4032e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4032f9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x403334
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x403330
lea ebx, [ebx]
cmp esi, eax
jae 0x403334
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x403320
cmp esi, eax
jb 0x40333a
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x406d1c
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x406d55
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00403594
push eax
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004016c0
pop esi
ret 4
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
pop esi
jmp dword [eax + 0x8c]
Function at 0x4088ca
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x40890d
call fcn.0040df55
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x40890d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x408928
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.00408481
test ebx, ebx
mov esi, eax
je 0x408926
test edi, edi
je 0x408926
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x40b2da
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x40b320
call fcn.0040df55
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x40b320
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x40b363
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
je 0x40b34c
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x40b34c
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x40b360
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x40f379
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x40f3a7
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x40f3c5
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0040f2e3
jmp 0x40f3c5
mov eax, dword [esi + 0x14]
test eax, eax
je 0x40f3c5
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.0040f2e3
test edi, edi
mov eax, edi
jne 0x40f3af
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x445474]
test ecx, ecx
je 0x40f488
jmp 0x40f378
ret 8

Function at 0x41e378
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4423f0]
jne 0x41e382
repz ret
jmp fcn.00422d4e
Function at 0x42be90
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00423ce7
xor ebx, ebx
cmp dword [0x44621c], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x42bf65
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x42bed0
xor eax, eax
jmp 0x42c029
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x438b80
push edi
call esi
cmp eax, ebx
je 0x42bec9
push eax
call fcn.00423c84
mov dword [esp], 0x438b70
push edi
mov dword [0x44621c], eax
call esi
push eax
call fcn.00423c84
mov dword [esp], 0x438b5c
push edi
mov dword [0x446220], eax
call esi
push eax
call fcn.00423c84
mov dword [0x446224], eax
lea eax, [ebp - 8]
push eax
call fcn.004217a5
test eax, eax
pop ecx
pop ecx
je 0x42bf33
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004231cf
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x42bf65
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00423c84
cmp eax, ebx
pop ecx
mov dword [0x44622c], eax
je 0x42bf65
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00423c84
pop ecx
mov dword [0x446228], eax
mov eax, dword [0x446228]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x42bfde
cmp dword [0x44622c], esi
je 0x42bfde
push eax
call fcn.00423cf0
pop ecx
call eax
cmp eax, ebx
je 0x42bfab
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x44622c]
call fcn.00423cf0
pop ecx
call eax
test eax, eax
je 0x42bfab
test byte [ebp - 0x18], 1
jne 0x42bfde
lea eax, [ebp - 0xc]
push eax
call fcn.004217dc
test eax, eax
pop ecx
je 0x42bfc6
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004231cf
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x42bfd5
or dword [ebp + 0x10], 0x200000
jmp 0x42c00f
or dword [ebp + 0x10], 0x40000
jmp 0x42c00f
mov eax, dword [0x446220]
cmp eax, esi
je 0x42c00f
push eax
call fcn.00423cf0
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x42c00f
mov eax, dword [0x446224]
cmp eax, esi
je 0x42c00f
push dword [ebp - 4]
push eax
call fcn.00423cf0
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x44621c]
call fcn.00423cf0
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x431990
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x4423f0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00431925
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0041f890
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x4319df
cmp dword [ebp - 0x1c], 5
jb 0x4319f7
jmp 0x4319f3
cmp dword [ebp - 0x10], 1
jne 0x4319f7
cmp dword [ebp - 0x1c], 4
ja 0x4319f3
jne 0x4319f7
cmp dword [ebp - 0x18], 0
jbe 0x4319f7
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x439414
call fcn.004317f9
test eax, eax
jge 0x431a18
mov byte [0x4462b1], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0041e378
add ebp, 0x78
leave
ret
Function at 0x401540
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push section..rdata
push 0x402d90
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x406148], eax
xor eax, eax
mov al, byte [0x406149]
mov dword [0x406154], eax
mov eax, dword [0x406148]
shr dword [0x406148], 0x10
and eax, 0xff
mov dword [0x406150], eax
shl eax, 8
add eax, dword [0x406154]
mov dword [0x40614c], eax
call fcn.00402d70
mov dword [ebp - 4], 0
call fcn.00402b90
call fcn.00402b80
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x407d50], eax
call fcn.00402720
mov dword [0x406128], eax
test eax, eax
je 0x4015d9
cmp dword [0x407d50], 0
jne 0x4015e3
push 0xffffffffffffffff
call fcn.00401fd0
add esp, 4
call fcn.004024a0
call fcn.004023c0
call fcn.00401fa0
mov esi, dword [0x407d50]
mov al, byte [esi]
cmp al, 0x22
je 0x40160a
cmp al, 0x20
jbe 0x401637
inc esi
cmp byte [esi], 0x20
ja 0x401602
jmp 0x401637
inc esi
cmp byte [esi], 0x22
je 0x401636
mov bl, byte [ebp - 0x28]
mov bl, byte [esi]
test bl, bl
je 0x401631
xor eax, eax
mov al, bl
push eax
call fcn.00402360
add esp, 4
test eax, eax
je 0x40162b
inc esi
inc esi
cmp byte [esi], 0x22
jne 0x401613
cmp byte [esi], 0x22
jne 0x401637
inc esi
cmp byte [esi], 0
je 0x401647
cmp byte [esi], 0x20
ja 0x401647
inc esi
cmp byte [esi], 0
jne 0x40163c
mov dword [ebp - 0x44], 0
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x44], 1
mov eax, 0xa
je 0x40166b
mov eax, dword [ebp - 0x40]
and eax, 0xffff
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call fcn.00401fd0
jmp 0x4016ac
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret