joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409570
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4177a1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esi + 4], ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
lea edi, [esi + 0x20]
mov ecx, edi
mov dword [esp + 0x18], ebx
call fcn.00408820
mov dword [edi + 4], eax
mov byte [eax + 0x45], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], ebx
mov dword [esi + 0x44], 0xf
mov dword [esi + 0x40], ebx
mov byte [esi + 0x30], bl
mov edi, dword [esp + 0x20]
cmp edi, ebx
mov byte [esp + 0x18], 2
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x48], ebx
je 0x409625
mov edx, dword [edi + 0x14]
cmp edx, ebx
lea ecx, [edi + 0x10]
je 0x40960d
mov eax, dword [ecx + 8]
sub eax, edx
sar eax, 2
cmp eax, ebx
jbe 0x40960d
mov eax, dword [edi + 0x18]
sub eax, 4
mov eax, dword [eax]
mov dword [eax + 8], esi
mov dword [esi + 0xc], eax
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x24], esi
call fcn.00409380
mov dword [esi + 4], edi
mov ecx, dword [edi]
inc ecx
mov dword [esi], ecx
jmp 0x409627
mov dword [esi], ebx
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x409970
Capabilities:
Connect socket
Resolve dns

Disassembly:
sub esp, 0x14
mov eax, dword [0x41c0f8]
push ebx
mov ebx, dword [esp + 0x1c]
test ebx, ebx
mov dword [esp + 0x14], eax
push esi
je 0x409a0a
mov esi, dword [esp + 0x24]
test esi, esi
je 0x409a0a
mov eax, dword [esp + 0x28]
test ax, ax
jbe 0x409a0a
push eax
mov word [esp + 0xc], 2
call dword [sym.imp.WS2_32.dll_htons]
push esi
mov word [esp + 0xe], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x4099e6
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x409a0a
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
mov esi, dword [eax]
mov edx, ecx
push edi
shr ecx, 2
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
push 0x10
lea eax, [esp + 0xc]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_connect]
neg eax
sbb eax, eax
pop esi
inc eax
pop ebx
mov ecx, dword [esp + 0x10]
call fcn.0040f5ac
add esp, 0x14
ret 0xc
mov ecx, dword [esp + 0x18]
pop esi
xor eax, eax
pop ebx
call fcn.0040f5ac
add esp, 0x14
ret 0xc
Function at 0x409a20
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 8]
test eax, eax
push ebx
je 0x409a86
mov eax, dword [esp + 8]
test eax, eax
jbe 0x409a86
mov ebx, dword [esp + 0x10]
test ebx, ebx
jle 0x409a86
push ebp
push esi
xor esi, esi
test ebx, ebx
push edi
jle 0x409a73
mov ebp, dword [sym.imp.WS2_32.dll_send]
mov ecx, dword [esp + 0x18]
push 0
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [esp + 0x1c]
lea edx, [esi + ecx]
push edx
push eax
call ebp
mov edi, eax
cmp edi, 0xffffffff
je 0x409a7c
push 0x1e
call dword [sym.imp.KERNEL32.dll_Sleep]
add esi, edi
cmp esi, ebx
jl 0x409a48
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0xc
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 0xc
or eax, 0xffffffff
pop ebx
ret 0xc

Function at 0x409b90
Capabilities:
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x800c
call fcn.00410820
mov eax, dword [0x41c0f8]
push ebx
push esi
push edi
push 6
mov dword [esp + 0x10], ecx
mov dword [esp + 0x8018], eax
push 1
xor eax, eax
mov ecx, 0x2000
lea edi, [esp + 0x18]
push 2
rep stosd dword es:[edi], eax
call dword [sym.imp.WS2_32.dll_socket]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x409caf
test ebx, ebx
jbe 0x409caf
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov ecx, dword [esp + 0xc]
push esi
push edi
push ebx
call fcn.00409970
test eax, eax
jne 0x409c28
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
push esi
push edi
push 0x418a0c
push str.LGLog.log
call fcn.00403740
add esp, 0x10
or eax, 0xffffffff
mov ecx, dword [esp + 0x8014]
call fcn.0040f5ac
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov esi, dword [ebp + 0x18]
mov eax, dword [ebp + 0x10]
push esi
push edi
push eax
lea ecx, [esp + 0x1c]
push str.POST__s_HTTP_1.1_r_nAccept:___r_nCache_Control:_no_cache_r_nConnection:_close_r_nHost:__s_r_nContent_Length:__d_r_n_r_n
push ecx
call fcn.0040f5ba
lea eax, [esp + 0x24]
add esp, 0x14
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409c50
sub eax, edx
mov ecx, esi
mov esi, dword [ebp + 0x14]
mov edx, ecx
shr ecx, 2
lea edi, [esp + eax + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 0x18]
add eax, ecx
mov ecx, dword [esp + 0xc]
push eax
lea edx, [esp + 0x14]
push edx
push ebx
call fcn.00409a20
test eax, eax
push ebx
jge 0x409cc7
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
lea eax, [esp + 0x10]
push eax
push ecx
push edx
push 0x4188ec
push str.LGLog.log
call fcn.00403740
add esp, 0x14
or eax, 0xffffffff
mov ecx, dword [esp + 0x8014]
call fcn.0040f5ac
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [esp + 0x8014]
xor eax, eax
call fcn.0040f5ac
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x40a6f0
Capabilities:
Initialize winsock library

Disassembly:
push 0xffffffffffffffff
push 0x4177fe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x198
mov eax, dword [0x41c0f8]
push esi
mov esi, ecx
mov dword [esp + 0x198], eax
push edi
lea ecx, [esi + 0x20]
mov dword [esp + 8], esi
call fcn.00404b80
xor edi, edi
lea ecx, [esi + 0x48]
mov dword [esp + 0x1a8], edi
call fcn.004026a0
mov al, 1
mov byte [esi + 0xa9], al
mov byte [esi + 0xa8], al
lea eax, [esp + 0xc]
push eax
push 0x202
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi], edi
mov dword [esi + 0x1c], 3
mov dword [esi + 0xa4], edi
mov dword [esi + 0xac], edi
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, dword [esp + 0x1a0]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x198]
mov eax, esi
pop esi
call fcn.0040f5ac
add esp, 0x1a4
ret

Function at 0x40abc0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
xor esi, esi
test ebx, ebx
mov dword [esp + 0xc], ecx
je 0x40ac70
mov eax, dword [esp + 0x14]
test eax, eax
jbe 0x40ac70
mov ebp, dword [esp + 0x1c]
test ebp, ebp
jle 0x40ac70
mov ecx, ebp
mov edx, ecx
shr ecx, 2
push edi
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
test ebp, ebp
rep stosb byte es:[edi], al
jle 0x40ac66
mov edx, dword [esp + 0x18]
push 0
mov eax, ebp
sub eax, esi
push eax
lea ecx, [esi + ebx]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x40ac66
mov ecx, dword [esp + 0x10]
add esi, eax
push esi
push str._r_n_r_n
push ebx
call fcn.004097f0
mov edi, eax
test edi, edi
je 0x40ac5a
mov eax, dword [esp + 0x24]
test eax, eax
je 0x40ac46
lea ecx, [edi + 4]
mov dword [eax], ecx
mov ecx, dword [esp + 0x10]
push ebx
call fcn.0040a2c0
test eax, eax
jbe 0x40ac66
sub eax, ebx
lea ebp, [eax + edi + 4]
push 0x1e
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, ebp
jl 0x40ac07
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0x10
Function at 0x40ac80
Capabilities:
Create tcp socket

Disassembly:
mov eax, 0x1210
call fcn.00410820
mov eax, dword [0x41c0f8]
push ebx
mov dword [esp + 0x1210], eax
mov ebx, ecx
lea eax, [esp + 0x10c]
push eax
mov eax, dword [esp + 0x121c]
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
push eax
mov ecx, ebx
call fcn.00409880
test eax, eax
jge 0x40acd7
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x120c]
call fcn.0040f5ac
add esp, 0x1210
ret 0x10
push esi
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x40ad0c
test esi, esi
jbe 0x40ad0c
mov ecx, dword [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
push esi
mov ecx, ebx
call fcn.00409970
test eax, eax
jne 0x40ad26
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x120c]
call fcn.0040f5ac
add esp, 0x1210
ret 0x10
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x114]
push ecx
lea edx, [esp + 0x21c]
push str.GET__s_HTTP_1.1_r_nAccept:___r_nCache_Control:_no_cache_r_nConnection:_close_r_nHost:__s_r_nRange:_bytes0__r_n_r_n
push edx
call fcn.0040f5ba
lea eax, [esp + 0x224]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40ad52
sub eax, edx
push eax
lea eax, [esp + 0x218]
push eax
push esi
mov ecx, ebx
call fcn.00409a20
test eax, eax
jl 0x40ad05
push edi
lea edx, [esp + 0xc]
push edx
lea ecx, [esp + 0x21c]
push 0x1000
mov eax, ecx
push eax
mov dword [esp + 0x18], ecx
push esi
mov ecx, ebx
call fcn.0040abc0
push esi
mov edi, eax
call dword [sym.imp.WS2_32.dll_closesocket]
test edi, edi
ja 0x40adb9
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x120c]
call fcn.0040f5ac
add esp, 0x1210
ret 0x10
push edi
lea ecx, [esp + 0x21c]
push ecx
mov ecx, ebx
call fcn.0040a040
cmp eax, 0xc8
jne 0x40ad9e
mov edx, dword [esp + 0x1224]
test edx, edx
jne 0x40adf5
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x120c]
call fcn.0040f5ac
add esp, 0x1210
ret 0x10
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x1228]
lea ecx, [esp + 0x218]
sub ecx, eax
add edi, ecx
cmp edi, ebx
jl 0x40ae43
mov ecx, ebx
mov esi, eax
mov eax, ecx
shr ecx, 2
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov byte [edx + ebx - 1], 0
lea eax, [ebx - 1]
pop ebx
mov ecx, dword [esp + 0x120c]
call fcn.0040f5ac
add esp, 0x1210
ret 0x10
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40ae45
mov ecx, dword [esp + 0x1218]
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.0040f5ac
add esp, 0x1210
ret 0x10
Function at 0x40b540
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x41783b
push eax
mov eax, dword [esp + 0x14]
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
cmp eax, ebx
push edi
mov edi, ecx
je 0x40b573
push eax
call fcn.0040a460
jmp 0x40b579
push esi
call fcn.0040a3a0
push esi
mov ecx, edi
call fcn.0040b2a0
test al, al
je 0x40b5a7
mov edx, dword [esp + 0x30]
mov eax, dword [edi + 0x38]
mov ecx, dword [edi + 0x3c]
push edx
mov edx, dword [esp + 0x30]
push edx
push eax
mov dword [esp + 0x1c], ecx
lea ecx, [edi + 0x48]
push esi
call fcn.00403460
test al, al
jne 0x40b5be
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 0x14
mov eax, dword [esp + 0x34]
cmp eax, ebx
jle 0x40b5c9
mov dword [edi + 0x1c], eax
mov eax, dword [edi + 0x54]
mov ecx, dword [edi + 0x1c]
cmp ecx, eax
jge 0x40b5d5
mov eax, ecx
xor esi, esi
cmp eax, ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [edi + 0x1c], eax
jle 0x40b650
push 0x58
call fcn.0040f510
add esp, 4
mov dword [esp + 0x34], eax
cmp eax, ebx
mov dword [esp + 0x20], ebx
je 0x40b605
push edi
mov ecx, eax
call fcn.004096f0
jmp 0x40b607
xor eax, eax
cmp eax, ebx
mov dword [esp + 0x20], 0xffffffff
je 0x40b63e
mov ecx, dword [edi + 0xa4]
cmp ecx, ebx
je 0x40b620
mov dword [eax + 0x14], ecx
mov ecx, eax
mov dword [edi + 0xa4], eax
call fcn.00405020
push 0x3e8
call ebp
mov eax, dword [edi + 0x1c]
inc esi
cmp esi, eax
jl 0x40b5e5
jmp 0x40b650
push 0xffffffffffffffff
call fcn.0040ffe3
push 0x3e8
call ebp
lea esp, [esp]
mov esi, dword [edi + 0xa4]
mov eax, esi
xor ecx, ecx
test eax, eax
je 0x40b66e
mov edi, edi
cmp dword [eax + 0x44], 0xffffffff
je 0x40b667
inc ecx
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x40b660
mov eax, dword [edi + 0x5c]
mov edx, dword [edi + 0x54]
cmp eax, edx
lea ebx, [edi + 0x48]
jae 0x40b704
mov edx, dword [edi + 0x5c]
mov eax, dword [edi + 0x54]
add edx, ecx
cmp eax, edx
jbe 0x40b645
test esi, esi
je 0x40b645
nop
mov eax, dword [esi + 0x50]
test eax, eax
je 0x40b6a0
mov esi, dword [esi + 0x14]
test esi, esi
jne 0x40b690
jmp 0x40b645
mov ecx, edi
call fcn.0040a690
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40b645
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x30]
push ecx
push ebx
lea ecx, [edi + 0x48]
call fcn.004029a0
test al, al
je 0x40b6ec
mov dword [esi + 0x44], ebx
mov edx, dword [esp + 0x2c]
mov dword [esi + 0x48], edx
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
lea edx, [ecx + eax - 1]
mov dword [esi + 0x4c], edx
mov dword [esi + 0x50], 1
push 0x64
jmp 0x40b64a
pop ebp
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 0x14
mov ecx, edi
call fcn.0040a650
mov ecx, ebx
call fcn.00403370
mov ecx, ebx
call fcn.004033a0
mov eax, dword [edi + 0x20]
lea ecx, [edi + 0x20]
call dword [eax + 0x2c]
mov ecx, dword [esp + 0x18]
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 0x14
Function at 0x40e1b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x417a39
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x23c
mov eax, dword [0x41c0f8]
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0xc]
mov dword [esp + 0x240], eax
call fcn.00405b30
mov cl, byte [esi + 0x30]
test cl, cl
lea eax, [esi + 0x30]
mov dword [esp + 0x248], 0
jne 0x40e211
mov eax, str.tttttttttttttttttttttttt
lea edx, [esp + 8]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40e205
jmp 0x40e22a
test eax, eax
je 0x40e22a
lea edx, [esp + 8]
sub edx, eax
jmp 0x40e220
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40e220
mov eax, dword [esp + 0x250]
push 0
push eax
lea ecx, [esp + 0x10]
call fcn.00405c00
test eax, eax
jl 0x40e2a2
push 0x108
call fcn.0040f510
add esp, 4
mov dword [esp + 4], eax
test eax, eax
mov byte [esp + 0x248], 1
je 0x40e269
mov ecx, eax
call fcn.0040c380
mov esi, eax
jmp 0x40e26b
xor esi, esi
test esi, esi
mov byte [esp + 0x248], 0
je 0x40e2a2
mov ecx, dword [esp + 0x230]
mov edx, dword [esp + 0x234]
push ecx
push edx
mov ecx, esi
call fcn.0040c260
test eax, eax
je 0x40e2ba
mov ecx, esi
call fcn.0040c3e0
push esi
call fcn.0040f50b
add esp, 4
lea ecx, [esp + 8]
mov dword [esp + 0x248], 0xffffffff
call fcn.00405bc0
xor eax, eax
jmp 0x40e2d0
lea ecx, [esp + 8]
mov dword [esp + 0x248], 0xffffffff
call fcn.00405bc0
mov eax, esi
mov ecx, dword [esp + 0x240]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x23c]
pop esi
call fcn.0040f5ac
add esp, 0x248
ret 4

Function at 0x40fc6c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40fc8c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004134fd
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x40fcad
test byte [esp + 8], 2
je 0x40fcad
mov dword [0x41cc28], 0xd
mov dword [0x41cc2c], 5
jmp 0x40fc88
xor eax, eax
ret

Function at 0x40fdb8
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40fde5
test byte [esp + 8], 0x80
je 0x40fdd3
and eax, 0xfffffffe
jmp 0x40fdd6
or eax, 1
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x40fdf6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004134fd
pop ecx
or eax, 0xffffffff
ret
xor eax, eax
ret
Function at 0x40ff22
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
inc esi
cmp dword [0x41cc74], esi
push edi
jne 0x40ff42
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x41cc70], esi
mov byte [0x41cc6c], al
jne 0x40ffa8
mov ecx, dword [0x41e330]
test ecx, ecx
je 0x40ff89
mov eax, dword [0x41e32c]
sub eax, 4
cmp eax, ecx
jmp 0x40ff82
mov eax, dword [eax]
test eax, eax
je 0x40ff74
call eax
mov eax, dword [0x41e32c]
sub eax, 4
cmp eax, dword [0x41e330]
mov dword [0x41e32c], eax
jae 0x40ff6c
mov eax, 0x41c024
mov esi, 0x41c02c
cmp eax, esi
mov edi, eax
jae 0x40ffa8
mov eax, dword [edi]
test eax, eax
je 0x40ffa1
call eax
add edi, 4
cmp edi, esi
jb 0x40ff99
mov eax, 0x41c030
mov esi, 0x41c038
cmp eax, esi
mov edi, eax
jae 0x40ffc7
mov eax, dword [edi]
test eax, eax
je 0x40ffc0
call eax
add edi, 4
cmp edi, esi
jb 0x40ffb8
cmp dword [ebp + 0x10], 0
pop edi
pop esi
jne 0x40ffe1
push dword [ebp + 8]
mov dword [0x41cc74], 1
call fcn.0040fe88
pop ebp
ret
Function at 0x410953
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x4190f8
call fcn.00410da4
mov edi, 0x94
mov eax, edi
call fcn.00410820
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x41cc34], ecx
mov eax, dword [esi + 4]
mov dword [0x41cc40], eax
mov edx, dword [esi + 8]
mov dword [0x41cc44], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x41cc38], esi
cmp ecx, 2
je 0x4109b3
or esi, 0x8000
mov dword [0x41cc38], esi
shl eax, 8
add eax, edx
mov dword [0x41cc3c], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x4109ee
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4109ee
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x410a06
cmp eax, 0x20b
je 0x4109f3
mov dword [ebp - 0x1c], esi
jmp 0x410a1a
cmp dword [ecx + 0x84], 0xe
jbe 0x4109ee
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x410a14
cmp dword [ecx + 0x74], 0xe
jbe 0x4109ee
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push esi
call fcn.0041263d
pop ecx
test eax, eax
jne 0x410a46
cmp dword [0x41cc80], 1
jne 0x410a33
call fcn.00414788
push 0x1c
call fcn.00414611
push 0xff
call fcn.0040fe88
pop ecx
pop ecx
call fcn.00413bc7
mov dword [ebp - 4], esi
call fcn.004140ba
test eax, eax
jge 0x410a5f
push 0x1b
call fcn.0041092e
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x41e324], eax
call fcn.00414c64
mov dword [0x41cc78], eax
call fcn.00414bc2
test eax, eax
jge 0x410a85
push 8
call fcn.0041092e
pop ecx
call fcn.0041498f
test eax, eax
jge 0x410a96
push 9
call fcn.0041092e
pop ecx
push 1
call fcn.0040feb8
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x410aac
push eax
call fcn.0041092e
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00414932
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x410acd
movzx eax, word [ebp - 0x40]
jmp 0x410ad0
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.0040be80
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x410aee
push edi
call fcn.0040ffe3
call fcn.00410005
jmp 0x410b20
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.00410ddf
ret
Function at 0x413d2d
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x39c]
sub esp, 0x41c
mov ecx, dword [ebp + 0x3a4]
cmp ecx, dword [0x41cf84]
mov eax, dword [0x41c0f8]
push ebx
push esi
mov dword [ebp + 0x398], eax
push edi
jae 0x413ef3
mov eax, ecx
sar eax, 5
lea ebx, [eax*4 + 0x41cfa0]
mov eax, dword [ebx]
mov esi, ecx
and esi, 0x1f
shl esi, 3
mov al, byte [eax + esi + 4]
test al, 1
mov dword [ebp - 0x80], ebx
je 0x413ef3
xor edi, edi
cmp dword [ebp + 0x3ac], edi
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x7c], edi
jne 0x413d97
xor eax, eax
jmp 0x413f07
test al, 0x20
je 0x413da8
push 2
push edi
push edi
push ecx
call fcn.00416270
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x413e7d
cmp dword [ebp + 0x3ac], edi
mov eax, dword [ebp + 0x3a8]
mov dword [ebp - 0x70], eax
mov dword [ebp + 0x3a4], edi
jbe 0x413ec4
mov ecx, dword [ebp - 0x70]
sub ecx, dword [ebp + 0x3a8]
lea eax, [ebp - 0x6c]
cmp ecx, dword [ebp + 0x3ac]
jae 0x413e0a
mov edx, dword [ebp - 0x70]
inc dword [ebp - 0x70]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x413dfb
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc edi
mov ebx, dword [ebp - 0x80]
mov byte [eax], dl
inc eax
inc edi
cmp edi, 0x400
jl 0x413ddd
mov edi, eax
lea eax, [ebp - 0x6c]
sub edi, eax
push 0
lea eax, [ebp - 0x78]
push eax
push edi
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x413e4a
mov eax, dword [ebp - 0x78]
add dword [ebp - 0x74], eax
cmp eax, edi
jl 0x413e56
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp + 0x3a8]
xor edi, edi
cmp eax, dword [ebp + 0x3ac]
jb 0x413dd1
jmp 0x413e58
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x3a4], eax
xor edi, edi
mov eax, dword [ebp - 0x74]
cmp eax, edi
jne 0x413eee
cmp dword [ebp + 0x3a4], edi
je 0x413ec4
push 5
pop eax
cmp dword [ebp + 0x3a4], eax
jne 0x413eb6
mov dword [0x41cc2c], eax
jmp 0x413efa
push edi
lea ecx, [ebp - 0x78]
push ecx
push dword [ebp + 0x3ac]
push dword [ebp + 0x3a8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x413ea8
mov eax, dword [ebp - 0x78]
mov dword [ebp + 0x3a4], edi
mov dword [ebp - 0x74], eax
jmp 0x413e58
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x3a4], eax
jmp 0x413e58
push dword [ebp + 0x3a4]
call fcn.004134fd
pop ecx
jmp 0x413f04
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x413edc
mov eax, dword [ebp + 0x3a8]
cmp byte [eax], 0x1a
je 0x413d90
mov dword [0x41cc28], 0x1c
mov dword [0x41cc2c], edi
jmp 0x413f04
sub eax, dword [ebp - 0x7c]
jmp 0x413f07
and dword [0x41cc2c], 0
mov dword [0x41cc28], 9
or eax, 0xffffffff
mov ecx, dword [ebp + 0x398]
pop edi
pop esi
pop ebx
call fcn.0040f5ac
add ebp, 0x39c
leave
ret
Function at 0x414611
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x41c0f8]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x41c6c8]
je 0x414646
inc eax
cmp eax, 0x13
jb 0x414637
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x41c6c8]
jne 0x41476c
mov eax, dword [0x41cc80]
cmp eax, 1
je 0x414744
cmp eax, edx
jne 0x414676
cmp dword [0x41c154], 1
je 0x414744
cmp ecx, 0xfc
je 0x41476c
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4146ac
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.004142e0
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.00413a80
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x4146e0
mov eax, edi
push eax
call fcn.00413a80
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x41913c
push edi
call fcn.00415040
add esp, 0x10
push edi
call fcn.00413a80
push dword [esi + 0x41c6cc]
mov ebx, eax
call fcn.00413a80
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.00410820
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.004142e0
push edi
push ebx
call fcn.004142f0
push 0x419138
push ebx
call fcn.004142f0
push dword [esi + 0x41c6cc]
push ebx
call fcn.004142f0
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.00414f40
add esp, 0x2c
jmp 0x41476c
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x41c6cc]
push dword [esi]
call fcn.00413a80
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.0040f5ac
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret